Slashdot Mirror
Safari 3.1 For Windows Violates Its Own EULA, Vulnerable To Hacks
recoiledsnake writes "The new Safari 3.1 for Windows has been hit with two 'highly critical'(as rated by Secunia) vulnerabilities that can result in execution of arbitrary code. The first is due to an improper handling of the buffer for long filenames of files being downloaded, and the second can result in successful spoofing of websites and phishing. This comes close on the heels of criticism of Apple for offering Safari as a update for approximately 500 million users of iTunes on Windows by default, and reports of crashes. There are currently no patches or workarounds available except the advice to stay clear of 'untrusted' sites." Further, Wormfan writes "The latest version of Safari for Windows makes a mockery of end user licensing agreements by only allowing the installation of Safari for Windows on Apple labeled hardware, thereby excluding most Windows PCs." Update: 03/27 17:23 GMT by Z : Dave Schroeder writes with the note that the license has been updated to correct this mistake.
Guess this article was right!
So Acid 4 will include security tests too now, right?
Sometimes it's just really not a good idea to push a piece of software out to hundreds of millions of people on its first release just because they use/update your other products. This is the real way that it could come back and bite them, and it certainly seems to have.
...if Apple can sue itself for proposing illegal installs of safari on windows?
EULA's have gotten to the point that they conflict with themselves. One can then assume that Safari is intended for the Windows install on Mac machines, *or* on machines to which someone has applied an Apple brand sticker.
I am waiting for the EULA that requires all users to declare the programmer their god and send off their first born child to him in sacrifice.
Karma Whoring for Fun and Profit.
Can someone please explain to me how software could possible "violate its own EULA" (even theoretically, not necessarily restricted to this case)?
;)
I agree that the EULA makes no sense, assuming that Apple wants as many Windows users as possible to use Safari. But that's an entirely different matter.
In fact, the EULA can be adhered to without any problem: afterall, you can install Windows just fine on Mac hardware these days. So you can actually run Safari for Windows on "Apple labeled hardware".
I seriously doubt the way it is stated in the EULA is really Apples intention though
Every expression is true, for a given value of 'true'
How can you violate an agreement that you never agreed to? Does Microsoft have a copy of a contract with my signature on it saying I'll accept its terms of use for XP? If I had Safari would Apple have a signed contract?
When I go to best buy I don't "license" an OS or piece of software; I pick a box up off the shelf, pay money for it and am delivered a purchase reciept. I then own the goods that I just BOUGHT. I am under no statutory obligation to read anything or sign anything. I tear open the box and do what I want with it, short of violating copyright law.
Your EULA is fiction, and until I see one stand up in court I'm going to ignore it.
-mcgrew
mcgrew's razor: Never attribute to stupidity that which can be explained by greedy self-interest
I got Safari as part of the iTunes update. I have a non-Apple Windows machine, running Safari. They basically forced the software on me, and the EULA says I can't use it.
Does that answer your question?
My iPod came with a big Apple sticker which for some reason I did stick on my PC. Guess I'm OK to use Safari then.
http://en.wikipedia.org/wiki/ProCD%2C_Inc._v._Zeidenberg
"ProCD, Inc. v. Zeidenberg, 86 F.3d 1447 (7th Cir., 1996), is a United States contract case involving a "shrink wrap license". The issue presented to the court was whether a shrink wrap license was valid and enforceable. Judge Easterbrook wrote the opinion for the court and found such a license was valid and enforceable."
They've been held up in court. The issue isn't totally decided, with other cases dealing with more specific issues, but your "nah nah nah MARY HAD A LITTLE LAMB nah nah nah" fingers in the ears stance may not be legally prudent.
A naturalist is -
"A scholar or student of natural history, the science of the natural world; see also natural science. It may also refer to a Wildlife enthusiast or a Conservationist"
Not a naturist or nudist.
Yeah, and they found that it's based on Konqueror, not Firefox. Something that Apple widely acknowledges, too.
Error: password can't contain reverse spelling of ancient Chinese emperor
Apple, these sort of tactics really are not necessary. Don't take the low road please...you can win it by going on the high way.
Step 1: Install Safari on millions of unsuspecting Windows PCs
Step 2: Sue non-Mac owning PC users for violating EULA
Step 3: ???
...I can install one copy of Safari on an Apple-branded computer
It doesn't say how many I can install on non Apple-branded machines...
"We live in a global world" - Harvey Pitt, former Securities and Exchange Commission Chairman
weirdest thing I ever saw: scientology advertising on slashdot.
And the heavy-handed tactics they use to push said software is truly amazing. If MS did half of the underhanded stuff Apple does, they would be dragged back into court in a heartbeat. Why Apple continues to get a free pass on such crap is beyond me.
I will NOT install Quicktime, iTunes, Safari or any other Apple software on my computer. And I always advise others not too as well. It's just not worth the hassle (if Apple really wanted your business, and not just to sleaze their way onto your computer, they would sell iTunes songs through their website and not require a software download).
SJW: Someone who has run out of real oppression, and has to fake it.
I think you should seriously consider Ubuntu: for all those things that people usually use a Mac Mini for (music, video, photos, web browsing, text processing, Skype, etc.), it's actually probably a better choice. Ubuntu supports more audio, video, and file formats, it's easier to keep updated, and all the applications are preinstalled. Oh, and Ubuntu will talk just fine to your iPod, and unlike iTunes, will let you copy both to and from the iPod.
(I have a Mac Mini, an iMac, and several iPods, but I now mostly use my Ubuntu systems for everything)
You're free to do one yourself if you want, since Safari's engine, WebKit, is open-source. It's kind of odd though that a "rip off" of Firefox would be scoring so much higher than it on the Acid3 (100/100 now as of the latest nightly), and (compared to FF2) on Acid2.
You must not come here much, do you?
Proof that nobody reads EULA, not even the people that write them?
More likely, some tired programmer just copied the string resource across from another project without checking it.
IANAL but....
The offending section seems to have an even bigger issue in it.
It reads:
B. Certain components of the Apple Software, and third party open source programs included with the Apple Software, have been or may be made available by Apple on its Open Source web site
(http://www.opensource.apple.com/) (collectively the "OpenSourced Components"). You may modify or replace only these OpenSourced Components; provided that: (i) the resultant modified Apple
Software is used, in place of the unmodified Apple Software, on a single Applelabeled computer; and (ii) you otherwise comply with the terms of this License and any applicable licensing terms
governing use of the OpenSourced Components. Apple is not obligated to provide any updates, maintenance, warranty, technical or other support, or services for the resultant modified Apple
Software.
You expressly acknowledge that if failure or damage to Apple hardware results from modification of the OpenSourced Components of the Apple Software, such failure or damage is excluded from
the terms of the Apple hardware warranty.
---
Now, one of the open source components used in Safari was/is Khtml which is licensed under the GNU LGPL. Now this clause allows you to modify & use the open source components ONLY if you use them on a single system (assuming the apple-labeled part has been fixed as i've heard).
You mean, like.... Ummm.... I'm thinking here.... Windows Media Player for mac? That would be the sort of vindictive thing that would be awesome for MS to do in my not so humble opinion. Bonus points if they "forget" to fix their licence, and say that it has to be run under windows.
That which is done from love exists beyond good and evil
They're all over the place:
- Stuck to the back glass of pickups
- Stuck to the back glass of poorly maintained econo-cars
- Stuck to teenage girls' bedroom/dorm doors
- Stuck to teenage girls' binders and backpacks
Good luck getting them back...
"When information is power, privacy is freedom" - Jah-Wren Ryel
To be more precise, the html rendering engine (webkit) is based on khtml, which is the konqueror (default) built-in rendering engine.
And whatever we can say about konqueror/safari, this branch of engines is generally considered to be well designed and standards compilant (khtml passed acid2 tests before gecko).
Man, they're not even trying are they? This day an age, not only is there no excuse to ship with such a basic flaw, there's really no excuse to be programming in a fashion that would allow it. It's so easy to audit for basic overflows (at least on Windows) that it's silly. Even just compiling /GS with VC++ should protect you against a lot. Seriously, people give MS a bad rap these days, but any exploit you're going to see in their software these days usually takes advantage of complex system interactions or odd exception throwing.
Apple should take a serious look at their coding practices and consider banning the use of unsafe CRT functions and using _s versions of any C functions their using (Visual C++ has them and they're part of the next standard) or at a minimum requiring audits of all raw pointers. Static analysis tools should also be mandatory and should catch most issues.(http://www.spinroot.com/static/)
500 million users of iTunes, really? 12% of the world population that has access to electricity, are you sure?? How many computer users are there even really out there anyways? And how the hell would you know how many single users for a program you have out there any bloody way? And why on Earth am I seemingly the only one out here this figure made cringe?
You just got troll'd!
All I want to do is update QuickTime on my XP box. I need it because of the .mov and .qt files it won't play otherwise. QT tells me there's a new update I must install, but the ONLY WAY Apple will provide me this update with bundled with iTunes which I DON'T HAVE and DON'T WANT!
It's never a good idea to install software you have no need for (I'm one of the remaining 27 people in the world without an iPod), don't want (the software, or the iPod), and don't know how avoid without just not updating in the first place.
Why the hell does Apple think I need an iTunes update just to update their buggy QT?
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
Considering ... the aggressive way their software "takes over" your computer...
Good Lord! Apple has hacked Windows' security so it lets Apple software mod the Registry to determine which app starts when you double-click a URL?
They're more malicious than I could ever have imagined!!! Soon, all these machines will be filled with all the spyware, viruses, trojans and etc that Apple is notorious for hosting!
"Inquiring Minds Want to Know!"
Seriously, people give MS a bad rap these days, but any exploit you're going to see in their software these days usually takes advantage of complex system interactions or odd exception throwing.
That's because Microsoft's "Active Content" security model, introduced in 1997, pretty much created the 'complex system interactions' vulnerability ecosystem. Before then the whole idea that an application that displayed untrusted content would provide a path for that content to execute code with full local user privileges was inconceivable. It was a joke, literally, the basis for the joke "Good Times" virus hoax was the idea that there would EVER be a way for an embedded virus to be launched automatically by email software.
Microsoft has its own problems with buffer overflows, for example this recent one, but if they only had buffer overflow issues there wouldn't be the kind of virus problem there is now. Because when you fix a buffer overflow you're fixing a bug. When you fix a 'complex system interaction' problem, you can't usually fix the underlying cause because there's other legitimate software that depends on that cause... so all you can do is add new checks. Which means that variants of the original exploit, possibly using a different avenue of approach to the underlying vulnerability, still remain.
So Microsoft is between a rock and a hard place. Every check they add has the possibility of breaking legitimate content. So instead of preventing the dangerous interaction, they pop up a dialog and ask the user if they really meant to do whatever caused the dangerous interaction to happen. Which pisses users off, and trains them to answer "yes" to "I'm about to do something stupid and dangerous" dialogs.
When web comics about fuzzy animals are making fun of this problem, you know things are getting bad.
CATS wants to execute 'setupbomb42.dll'. As a result you may have no chance to survive make your time. Allow (yes) (no)?
And the really annoying thing is that Firefox (with XPI install through the browser) and Safari (with 'open "safe" files after downloading') have started to follow Microsoft's path of setting users up the bomb and then popping up a dialog asking if they want to detonate. Luckily Apple finally turned 'open "safe" files' off by default, but they've kept the 'set us up the bomb?' dialogs anyway.