Safari 4's Messy Trail

Signum Ignitum writes "Safari 4 comes with a slew of cool new features, but extensive data generation combined with poor cleanup make for a data trail that's a privacy nightmare. Hidden files with screenshots of your history, files that point back to Web pages you've visited and cleared from your history, and thousands of XML files that track the changes in the pages in your Top Sites can add up to gigabytes of information you didn't know was kept about you." Some of Safari's bloat is kept in quite obscure locations; it takes a fairly knowledgeable user to find it and clean it up. You can avoid some of the worst of it by disabling Top Sites.

Comments

Advert co-incidence

[ZERO1ZERO]

Is it only I that see ths advert for 'Clean you Mac' in the panel beside the summary?

(frosty piss)

Re:Advert co-incidence

[Silas is back]

Keywords:
Did, not, get, joke

Re:Advert co-incidence

[icannotthinkofaname]

The Internet looks like shit with Adblock disabled

FTFY

Re:Advert co-incidence

[BrokenHalo]

man, Slashdot looks like shit with Adblock disabled

Not any more. If you're a good boy, you get to disable ads on /. while you're logged in. I now just get a little box saying "Ads disabled [tick] Thanks again for helping make Slashdot great!".

Re:Advert co-incidence

[centuren]

Not any more. If you're a good boy, you get to disable ads on /. while you're logged in. I now just get a little box saying "Ads disabled [tick] Thanks again for helping make Slashdot great!".

Dear Slashdot policy makers,

The feature introduced to allow active participants the option of disabling advertisements on the site has to be one of the most awesome things I've seen implemented re: ads on community driven sites.

Keep the great ideas coming.

Oh that Apple

[wampus]

I for one like it because it is so innovative and it fits in well with my hip, young lifestyle.

Safari does clean up after itself.

[ozzmosis]

There is a "Empty Cache" button under the "Safari" menu.

Before "Empty Cache"
ahze:/private/var/folders/zz/zzzivhrRnAmviuee++31gU+-Ev6/-Caches-/com.apple.Safari ahze$ du -sh
  129M .

After "Empty Cache"
ahze:/private/var/folders/zz/zzzivhrRnAmviuee++31gU+-Ev6/-Caches-/com.apple.Safari ahze$ du -sh
  32K .

Re:Safari does clean up after itself.

[Anonymous Coward]

Yes but that last 32k is the EVIL 32k

Re:Safari does clean up after itself.

[mallumax]

"Empty cache", doesn't delete everything.
before: 737M -Caches-
after: 571M -Caches-
This is seriously fucked up.

Re:Safari does clean up after itself.

[mallumax]

Anyway, chrome beta is coming on nicely and hopefully I will be able to ditch safari for good. [Firefox is my main browser but I do need a second browser].
I have been keeping track of mac chrome and in the last two months it has become quite stable and only thing missing is flash. Some here would even consider that a feature.

Re:Safari does clean up after itself.

[moon3]

Safari does clean up after itself

That is a bit of contradiction there, you say that and in the next sentence you claim you need to press the "Empty Cache" button. That means unless somebody figures out how to flush the stuff Safari is happily recording you.

I can't see that option in the Windows version (beta), there is a preference to limit the size of the database, but not a clean up link in the menu.

Re:Safari does clean up after itself.

[Ilgaz]

/var/folders is generally folder for storing possibly sensitive data of ANY application. I don't know the exact reason of why some files are cached there and some in ordinary caches folder but I mean it is NOT just Safari cache. There could be caches of anything, any program.

It could be decided like ''If a program binary is signed and it connects to net'' by core OS itself. Again, it is just a very rough guess.

Did you really expect 700+ MB of Cache from a browser? It indeed cleaned its Cache and didn't touch other applications files. /var/folders is just randomized (sandboxed in future?) temp dir. Nothing exclusive to Safari or any other program.

Re:Safari does clean up after itself.

[monktus]

32k of evil ought to be good enough for anybody.

Re:Safari does clean up after itself.

[Anonymous Coward]

I'm sure you had something interesting to say, but it seems you don't know how to coherently convert thoughts into English.

Re:Safari does clean up after itself.

[Anonymous Coward]

Seriously messed up. On my machine:

before: 737M -Caches- after: 815M -Caches-

Re:Safari does clean up after itself.

[belrick]

Yes but that last 32k is the EVIL 32k

You mean each of the evil bits left over from the 129 MB of data?

Re:Safari does clean up after itself.

[Anonymous Coward]

You're not seriously considering Chrome over Safari for privacy reasons?

Re:Safari does clean up after itself.

[CarpetShark]

32k of evil ought to be good enough for anybody.

Unless you're called Bill, in which case you'll want around 640k of evil.

Re:Safari does clean up after itself.

[dangitman]

Jeeze, seriously, I didn't even RTFA but I noticed TFS said Safari 4 was generating potentially gigabytes of cached info, which it did -not- delete when you "cleaned" the cache.

Yeah, slashdot summaries are known for being highly accurate and reliable, and not at all sensationalistic. Of course, anything could potentially generate gigabytes of data. My text editor could do it if I had enough monkeys. But is the average Safari user's cache weighing in at several gigabytes? I don't think so. That was just put there to cause alarm for attention-getting reasons.

Re:Safari does clean up after itself.

[Ilgaz]

I would do it in single user mode (Apple key+S on boot). What people (and that blog) doesn't understand is, that structure doesn't only carry Safari caches. There are some system caches, font caches and caches of OTHER users there.

Also they didn't even bother to check the new method of Safari (and other webkit) cache creation. They now create the file in a reasonable (64MB here) size and fill it with zeros.It is a flat file, I guess one of the reasons is to prevent fragmentation.

Safari does a good job cleaning it. The reason is ''force quit'' and similar. If it loses track of its own file, it (in fact, OS) re-creates in another random dir and they all add up.

At least it is not windows temp

[linzeal]

Windows temp (/username/appdata/local/temp) which if not cleaned can hold every single unzipped file/torrent/etc since you installed the operating system. Just cleaned up a computer at a friend's house that was nearing 200 gigs in temp from mostly anime porn avi he downloaded and unzipped. I showed his gf some of the stuff thinking it was funny and was told to leave the house, he was not very happy either. Damn kids, lol.

Re:At least it is not windows temp

[Bigjeff5]

For internet settings (for IE at least), it's Options > delete offline content (exact location varies based on version). You get a warning about cache and cookies, you hit OK and it is gone. Deleted. ALL of the internet temp files.

To get of -all- temp files, just run disk cleanup. It will empty all standard temp directories. A program uses windows temp, disk cleanup removes it. None of this hiding BS, at least not in XP.

Dunno about Vista personally.

Re:At least it is not windows temp

[Runaway1956]

Am I the only one who changes the temp directories immediately after installation? C:\tmp for both user and windows temporary folder. I clear it frequently. Sometimes, stuff just doesn't WANT to delete, so I start in safe mode, and delete it anyway. No computer has the right to store data that I consider "sensitive". Anime porn, government subversion, or funding for the most outstanding charity in the world, it is MY business, and no one else's. People should learn what the environment variables are for, and use them intelligently - whether they use Mac, Windows, or *nix

Re:At least it is not windows temp

[wipeMyButt]

And this has what to do with Safari's shockingly poor behavior?

Why is it that everyone's response to any sort of problem is "Windows is worse"? If someone described a serious flaw in say, a Prius, would your response be, "Yeah, but Honda sucks."

I'm not trying to excuse crappy design problems in Windows, but when is Apple going to lose this untouchable luster and take it's lumps along with everyone else?

Re:At least it is not windows temp

[ya really]

Probably one of the best ways I've found to deal with temp stuff (if you have enough ram) is to create a ram drive and throw your web cache, page file, and all temp files on there. At least that way when you reboot, they're all gone.

This method works great with Opera or Firefox, but as far as I know, Safari does not let you change the location of it's cache. In Opera, just type opera:config and then search for cache, in firefox, just type about:config and then it's a matter of adding a string to the config (google if you would like to know more).

Aside from keeping pesky temp files from building up, this also helps to cut down on disk fragmentation because many of your most modified files will now be isolated on a ram disk and ram doesn't really have any loss compared to a hard disk for fragmentation.

Re:At least it is not windows temp

[thePowerOfGrayskull]

Why change it? %TEMP% in the address bar will take you there every time, straightaway... doing that ensures you can find all of your temp files (including those from apps that make assumptions about the location of the temp folder, instead of obtaining it properly.)

Mac abstraction affects the non-savvy...

[ruphus13]

The big value-proposition of the Mac has been that it is easy for the non-geeky user to use. Unfortunately, things like these make those very users vulnerable. Without exposing easy ways to flush potentially sensitive and private information, it is the same users Apple attempts to serve that will be exposed. And, this will probably be the default browser for most new systems, so unless this is patched, expect the problem to proliferate...

Re:Mac abstraction affects the non-savvy...

[Ilgaz]

But is there really anything to fix besides the files getting into the /var/folders on secure home dir scenarios?

Browsers cache/store history since they were invented and that click happy site found there is a treasure there. Well, that is why Apple spits files to the randomized and soon to be more secure caches dir. The breach (!) requires someone sitting on your chair and browsing your Caches. It is the same formula for getting Mac fanatics attention and unfortunately every time, it works.

What will they do? 128 bit encrypt general public jpegs? Not that it can't be done, just enable filevault or whatever equivalent on Windows.
time.

Re:Mac abstraction affects the non-savvy...

[AnalPerfume]

A basic level of user knowledge must also be to blame too. Browsers cache web sites, there's a limit to how much cache is used, perhaps it's set to a maximum by the application unless you set it otherwise. All browsers do that, it saves bandwidth, time and cycles to download each page every time you visit it.

We know this but this is one of the basics of "using a PC" that ALL users should be taught; every so often you empty your cache. How often varies on what you do with your PC. There's a difference between power users / admins and normal users as we all know. Normal users shouldn't need to learn lots of geeky stuff just to use their PC daily, but there's a basic skill set that they should be expected to know. This is one of them, along with defragging and anti-malware scans (if you're on Windows) updates etc. It's not much, just regular maintenance.

Of course, if that were to start happening PC stores would see a drop in frequency of repairs, the amount they could con out of customers for simple work or new PC sales because their 1 yr old PC is slow as hell and they think it's out-dated. Some companies like to charge for basic training too, so I'd guess there'd be plenty of people who would like to see that idea shot down in flames. Nothing like screwing the people for maintaining your ticket on the gravy train huh?

Seriously though, a PC is a versatile tool, used in most places of work now. This means that most people will have to use PCs as part of their work, so basic PC maintenance should be part of the school curriculum. Note I said "PC" not "Microsoft Windows". We're talking platform agnostic here, giving the kids generic PC knowledge which they can apply to any platform, not indoctrination camps to create the next wave of Microsoft monkeys. In other words EDGI not wanted.

Re:Mac abstraction affects the non-savvy...

[Bigjeff5]

Right, because clicking "Safari -> Empty Cache..." is amazingly complicated...

Er, did you RTFA? Or even TFS? Or even a few of the comments?

That's the PROBLEM! "Safari -> Empty Cache" doesn't empty potentialy hundreds of megs of data that Safari 4 generates. A normal user can handle an "Empty Cache" function, they can't handle digging through the browser's cache locations to manually delete the gigs of data built up because the "Empty Cache" function didn't do what it was supposed to do.

Re:Mac abstraction affects the non-savvy...

[RiotingPacifist]

erm putting all of a users private into ~ is pretty key, why safari is even allowed to write to files outside ~/ or /tmp/ is beyond me

Re:Mac abstraction affects the non-savvy...

[node 3]

Sorry, the menu item is "Safari -> Reset Safari..." where the option is to "Remove all webpage preview images".

Re:Mac abstraction affects the non-savvy...

[Anonymous Coward]

There are conflicting design considerations: Cached information in a user folder "unnecessarily" inflates the user folder, which is typically subject to frequent backups, often over the network. That's a lot of overhead for temp files. Shared caches can also improve the cache hit ratio. The obviously conflicting (and IMHO more important) goal is privacy, but it's not a simple "doh, how could they?" situation.

Re:Mac abstraction affects the non-savvy...

[Mista2]

What about the porn mode, I mean the private browsing option?

Re:Mac abstraction affects the non-savvy...

[Ilgaz]

It is not Safari writing the files there, it is the OS which redirects the files. Safari doesn't say ''let me create a weird dir to write my files'', it is OS which says ''Let me put Safari's caches to a weird place so it won't be easy to hack it and steal its caches''

beta software

[commodoresloat]

Keep in mind this is a beta, folks; if you're using it, you're presumably volunteering to help inform Apple about stuff like this. So in addition to letting everyone else know safari is doing this, it might be a good idea to let Apple know that it is unacceptable in a web browser. Presumably the company released the beta in order to solicit just this kind of information from its users; hopefully enough concern from users will lead them to take these "features" out of the final release candidate.

Re:beta software

[node 3]

Please don't do this. This "unacceptable in a web browser" feature is fantastic, and if you still find it unacceptable, you can turn it off. I, personally, find it a very nice touch.

Re:beta software

[falcon5768]

um yes, they should. Thats the WHOLE POINT of a beta, that you are testing it in a real world, uncontrolled environment with all the risks it entails.

Re:beta software

[node 3]

putting screenshots of websites you visit outside your home directory is a fantastic feature?

You're referring to an implementation detail, not a feature. The feature is the web page previews. Whether they are stored in /var or in ~/Library has no effect on the feature, but does affect the underlying implementation of it.

By all means, put the previews in the ~/Library folder. By all means, file a bug report about this detail, but don't request the removal the feature.

wow i sense the RDF is strong in this one

Correct, because as we all know, nothing bolsters a straw man like ad hominem.

Re:beta software

[alanQuatermain]

Would anyone care to look at the permissions on the -Caches- folder in question? I know, it'll make it harder to spout hyperbole about security, but it could be instructional I think:

MacBook-Pro:1tUM+kJcGEqwqSH2bBdLR++++TI jim$ pwd
/var/folders/1t/1tUM+kJcGEqwqSH2bBdLR++++TI
MacBook-Pro:1tUM+kJcGEqwqSH2bBdLR++++TI jim$ ls -l
total 0
drwx------ 92 jim staff 3128 12 May 20:53 -Caches-
drwx------ 13 jim staff 442 23 May 20:12 -Tmp-

As you can see, the permissions on the -Caches- folder mean it's only readable by the owner, namely the current user. So it has the same protections as something inside the user's home folder. Also, by benefit of being in /var/folders/xxxx/-Caches- the operating system can clean this out more or less upon a whim-- this is, after all, the purpose of temporary folders and caches.

Oh expoitable

[johncandale]

The real scary part of this for me is not the government, more on that in a sec, but your girlfriend/boyfriend/housemate. Anyone who feels like he/she wants to do some snooping now has a treasure chest of stuff to take out of context.

I hope no one here is naive enough to use the "if you have nothing to hide..." line.

Getting back to the government, most cases are not high profile law&order style procedural deals. I could easily see local lawyers taking porn sites as evidence you killed her, technology sites as evidence you were researching bombs, map sites that you were researching crimes, and I can see local judges allowing it, and local jury's believing it.

Of course they could get most of this from ISP logs, but that would be just that much harder to get, and wouldn't come with screen shots.

Re:Oh expoitable

[EvilIdler]

Wow, that's the most paranoid thing I've read all day, and I've read at least two Slashdot articles!

Re:Oh expoitable

[node 3]

The real scary part of this for me is not the government, more on that in a sec, but your girlfriend/boyfriend/housemate. Anyone who feels like he/she wants to do some snooping now has a treasure chest of stuff to take out of context.

They've always had this. It's called "History" and "Temporary Internet Files". The only difference here is Safari has added screenshots.

If you're that worried, you can enter Private Browsing mode, you can selectively clear out parts of your history (and cache and screenshots), entirely clear out all of the above (including cookies), or just turn the feature off in the first place.

Re:Oh expoitable

[phantomfive]

The real scary part of this for me is not the government, more on that in a sec, but your girlfriend/boyfriend/housemate. Anyone who feels like he/she wants to do some snooping now has a treasure chest of stuff to take out of context.

If you are seriously worried about those people snooping around in your computer like that, you have serious problems. You're supposed to be able to trust your girlfriend. If you can't, you may consider getting a new one, because she's going to cheat/breakup before long.

Can't always do as much for your housemate, but if you are seriously worried about them snooping around in your computer, you ought to password protect your computer. And get a lock for your bedroom.

Getting back to the government, most cases are not high profile law&order style procedural deals. I could easily see local lawyers taking porn sites as evidence you killed her, technology sites as evidence you were researching bombs, map sites that you were researching crimes, and I can see local judges allowing it, and local jury's believing it.

What exactly are you planning on doing that you will end up in such a situation? Judges typically don't allow evidence that is not directly related to the case, so if you're worried about being framed for killing your girlfriend with a pipebomb at a popular geocaching site I can see why you're worried, but most people don't have that problem. Oh, maybe this goes back to your weird housemate thing again?

Re:Oh expoitable

[Anonymous Coward]

I'm not sure even Private Browsing works fully. Adobe stores a cache of all flash ads and components that are seen on sites that you visit.

So if you are browsing porn, (possibly even on Private Browsing mode... I'm not sure), even with resetting and clearing your history and cache, you can still get some idea of the websites visited by looking in the user's Library/Preferences/Macromedia/Flash Player/ folder and looking in the subfolders there (eg. follow through the #SharedObjects folder, and the macromedia.com folder and they have folders naming the sites visited in each).

Even when most people think they've cleaned up traces of where they've been, it's trivial on a Mac to get a list of sites that they've visited.

Re:Oh expoitable

[gyrogeerloose]

I just checked that out on my Mac. While there certainly is a long list of sites (longer than I'd like to see, for sure) listed there, it includes any site that happened to have a Flash ad on a page that I've loaded so it's not really an accurate record of where I've been.

Still, I agree that it's a bothersome thing

Reset Safari

[aftk2]

This is a bit sketchy, I will agree. However, it does appear like you can remove most of this. In the menu bar, click "Safari > Reset Safari." Make sure that reset top sites and "Remove all webpage preview images" is selected.

Oh well...

[PopeRatzo]

...a data trail that's a privacy nightmare...gigabytes of information you didn't know was kept about you.

Remember those famous Apple "1984" advertisements where they're the young, free person breaking out of the crushing tyranny of Big Brother?

Bullshit scaremongering.

[Anonymous Coward]

Use "Private Browsing" mode and this junk won't get in your history in the first place for you to need to delete it. The end. Meanwhile, fulltext searching of your history is hella convenient.

Re:just poke around in ~/.mozilla/*

[Ilgaz]

Ever wonder why Apple, who offers one of the best organized file system to users since 1980s decided to put temp files to ''non obvious'' places, scattering them?

Think a bit. I was a Mozilla user when they made the great choice of randomizing cache/temp folder name, Apple (and some vendors) just extended it to operating system for exact same reasons. Temp folder and caches folder security is one of weak points of operating systems and by putting files to weird, impossible to guess places, they are preventing some targeted attacks in future.

Re:Why would you use Safari anyway?

[UnConeD]

Here's why I use and love Safari 4 on OS X. And yes, I am a huge geek who hacks code for a living.

• It's bloody fast, in every way. From loading speed, to rendering speed, to JavaScript execution to Canvas rendering. Firefox does not compare, and Chrome still isn't available for Mac.
• Full-text indexing of your history + thumbnails are a life saver for finding that one blog post or article that you read 3 days ago but can't remember the URL to or find on Google (because the site's SEO sucks). Coverflowing through a set of thumbnails lets you identify specific pages really quickly if you've seen them before. It really is waaay more than just a cool effect.
• Safari has the best web standards support and includes a bunch of awesome proposed features on top of that. Web fonts, box/text shadows (+ rounded corners), css transforms, border image, etc. It's awesome fun to develop on.
• It is the most polished browser on OS X, by far. The scrolling is butter-smooth and feels analog (multitouch trackpad++), the form widgets feel like real Aqua, the textareas are resizable, the font rendering is the most consistent.

For me, Safari provides the best web experience. For you, Firefox 3 is the sweet spot. Why can't you just accept that people have differing priorities and requirements, instead of smugly deriding others for using a "miserable little browser"? If you want to hate on a browser, hate on IE. At least there's demonstrable evidence of how IE has damaged the web. Us Safari users are doing just fine.

That's What Passwords Are For

[reallocate]

Fretting about Safari 4 privacy issues seems a bit pointless because if someone can see all that data they can see anything on your Mac.

If your Mac -- or any other PC -- is available to others, well... that's what a password is for.

Okay, this is ridiculous.

[geekboy642]

Everybody on here needs to grow up. You're whining and crying about your browser keeping a history of your browsing. That's been an accepted feature for over a decade. Only now, you've got a porn mode so it doesn't keep a history. That's new. Why are you wanking fools whining about a browser cache now? Are you seriously crying that a file on your computer might have a screenshot of where you've been on the web? Really? I've got a hint for you: NOBODY CARES ABOUT YOUR DONKEY PORN.

Don't bother responding, I've already answered your objections:
"Oh, but Geekboy, I live in a totalitarian regime, and I'm a freedom activist! They monitor everything I do!" Your browser history is the absolute last place the KGB is gonna look for information. They'll talk to your neighbors, your boss, your parents, and probably drag you in for interrogation before they even consider looking in your history.
"Oh, but Geekboy, I just love looking at little kids! It's not sexual at all, it just makes me happy!" Do like pedophiles have done since the middle ages: become a priest. Get it off the internet, those parents' groups and TV shows are really annoying. Also, same thing as in the KGB. Even if they don't catch you in an actual sting, they'll grab your stacks of CDs and piles of imported manga way before they give a rats ass about your browser.

Now mod me down, and prove you're all pathologically paranoid morons.

It's Beta Software!

[skribble]

First of all this is a beta product that isn't shipping on anything and while it's trendy to think beta software is fully functional (Thanks Google) with Apple, beta generally means, "really this isn't finished, there's still stuff that's messed up here." (In fact this would apply to most Apple .00 products as well, which is fine since historically .1 or .01 is rolls a few weeks after the initial release.) In other words, stuff like this is to be expected.

Second, Safari has for the longest time provided this very nifty "Private Browsing" which will eliminate all of these issues.

Finally, if you dig in the preferences you can turn a bunch of this stuff off if it bothers you so much. Still feed the fire of Mac hate... whatever.

let me get this straight

[mzs]

The whole commotion is that temporary files are stored under per user only readable subdirs of /var instead of under ~/Library? I don't know about you but my home dir is mounted from a server. That seems a whole lot more secure (and efficient) to put that in a place more or less guaranteed to be local and not exported. It seems to me some people just have to learn about another place temporary data can appear. Also where it is makes it really easy to just rm -rf all of it when they want to.

/var

[jbolden]

Call me a crotchity old unix head but I'm very happy that Apple is using /var for cache information and not /Users/username/Library/Caches.... in fact i think that whole directory should point to /var.

I'd love to be able to partition my /var stuff off like I do in Linux. So if Apple is moving in this direction and keeps it up, good.

Re:Ads Disabled box?

[TaoPhoenix]

Hi.

Where is this box? I'm fairly active, but I don't have it/can't find it.