digg

Facebook Connect Join Digg About

'Day One' for Safari for Windows Becomes Zero-Day Nightmare

betanews.com — It took security engineers perhaps less than two hours yesterday to introduce Apple's surprise entry in the field of Windows browsers to the big, cruel world of exploits and vulnerabilities, following its introduction yesterday morning at WWDC. As a result, much of the clout Safari had received as the secure browsing alternative is lost

Who dugg this? Made popular Jun 13, 2007

Digg DudeWhat is Digg?

Digg is a place for people to discover and share content from anywhere on the web. Digg surfaces the best stuff as submitted and voted on by the community. Take the Tour to learn more.

399 Comments

show profanity settings
expand all
  • Ryosen, on 10/11/2007, -19/+353PC: "Hi, I'm a PC"

    Mac: "And I'm a Mac"

    PC: "Welcome to the big, bad world of the Windows platform"

    Mac: "Mommy!"
  • Cwo655321, on 10/11/2007, -46/+376mac software finally has a user base larger than the margin of error.
  • Omicron, on 10/11/2007, -39/+317I predict in the comments, that somehow this is going to be Microsoft's fault
  • estvir, on 10/11/2007, -27/+256> Well it is just a Beta.

    That line [on Digg] doesn't work for Microsoft products so it sure as hell doesn't work for others.
  • maxlew, on 10/11/2007, -23/+233I dunno about that i love macs, but safari 3.0 is pretty crap.
    also the beta tag is losing its charm as an excuse now that everything seems to come out in beta. People seem to expect that beta means pretty much finished
  • Scopitone, on 10/11/2007, -12/+173This was like releasing an adorable yet unequipped baby panda into lion choked jungle.
  • rderveloy, on 10/11/2007, -12/+157@maxlew
    "Also, the beta tag is losing its charm as an excuse now that everything seems to come out in beta. People seem to expect that beta means pretty much finished."

    I blame Google's abuse of beta. Don’t get me wrong, I love Google. However, the search giant has routinely come out with excellent and extremely polished software and slapped the beta tag on it. And, since millions of people use new Google software, your average computer users all think that beta means to expect a nearly fully functional bug-free piece of software. In the same manner that Google has changed search, Google will change beta, but not in a good way.
  • Ryosen, on 10/11/2007, -8/+149This reminds me of that old John Travolta movie, "The Boy in the Plastic Bubble", (http://imdb.com/title/tt0074236/) where he is nestled inside a protective, virus/germ-free environment his entire life. Then, at the end of the movie, he tries to step outside of the bubble.

    And promptly dies.
  • kheldorin, on 10/11/2007, -6/+136The problem is besides the 'beta' tag, it's not treated as one. You have a link on Apple's main page with caption that reads "The World's Best Browser. Now, for Windows too". And in the next page, they advertise the 12 reasons why I would love Safari and provide the performance charts. Who the hell does that for a beta? Where are the warning signs?
  • Kazbaeden, on 10/11/2007, -11/+137It's not /just/ a Beta; it's a Beta which recieved a keynote fanfare from Steve Jobs as well as a prominent link on the Apple home page. With that kind of exposure, you'd think that what they would release to the public would be something more than abhorrent pre-alpha code.
  • inactive, on 10/11/2007, -17/+126Oh sure. Let's announce and release a browser at a huge fanboy conference, claiming it's better and faster than all competitors already. When it breaks and screws your system, hey.. /It's just a beta!/
  • inactive, on 10/11/2007, -9/+98Firefox/Opera FTW
  • inactive, on 10/11/2007, -12/+86"You know, developers. People who are smart enough to make software"

    Perhaps Apple should hire a few of them.
  • pigg123, on 10/11/2007, -15/+87"The World's Best Browser." --> Own3d

  • inactive, on 10/11/2007, -12/+77Good for a laugh :)
    www.apple.com/safari
    http://i35.photobucket.com/albums/d165/zybch/hahaha.jpg
  • saralk, on 10/11/2007, -19/+83The shoe is on the other foot now.
  • thealliedhacker, on 10/11/2007, -25/+88No, you see, the point is that Apple makes just as many holes as anyone else. No-one cares to exploit them if it's only going to be on a Mac.
  • Cyber_Akuma, on 10/11/2007, -17/+80So hows that security through obscurity working out for ya now that you are in the real world Apple?
  • ThinkFr33ly, on 10/11/2007, -11/+71That might be a good point if it actually *was* the operating system.

    But it's not. It's a very poorly written browser.
  • KibibyteBrain, on 10/11/2007, -13/+73It uses lots of ram, has a billion bugs, has some bad installs that just don't work, and is a security nightmare. But if there is one thing it has going for it, it loads your pages fast. Sorry.
  • cheesegrits, on 10/11/2007, -18/+76""Huge fanboy conference?" It's the Developer's conference, ass. You know, developers. People who are smart enough to make software."
    But not secure software?
  • byronm, on 10/11/2007, -42/+99@ maxlew

    Beta does mean "pretty much finished" - aka "we're about to ship a final product, hammer away and notify us of any bugs"

    What Apple shipped is "Alpha" - we're not done developing it, try and your own risk - may not work. HUGE difference. When i beta test Windows Software, Xbox 360 Games, MMO's, RPG's and other goodies i get my hand on we're working on a polished product - trying to polish it off more. Why would Apple get to be respected any differently? Not like the wintel platform is anything NEW to them (or anyone for that matter)
  • ThinkFr33ly, on 10/11/2007, -4/+45"So are you saying Apple "engineers" do not know what they are doing? Or that they forgot some code while writing the Windows version/? Or that they did not give a crap?"

    It's not necessarily a question of whether Apple's engineers "know what they are doing". Unlike Microsoft, which has been under siege for years by people trying to hack Windows and their various other productions, Apple has enjoyed virtually no serious examination of their software's security.

    Microsoft had their ass handed to them and they had invent a brand new way of developing software (the Secure Development Lifecycle) to deal with it. It cost Microsoft billions, but their recent product versions (Vista, IE 7+, IIS 6, IIS 7, .NET 1.x, 2.x, 3.x, etc.) have shown to be extremely secure by any body's standards.

    Apple hasn't had to endure this kind of onslaught yet. The fact that Safari was compromised in a matter of hours shows that Apple's inexperience in dealing with security will come back to bite them if they venture into more "popular" feeding grounds for hackers.
  • Stoical, on 10/11/2007, -9/+48Looks like the exploit isnt just limited to Windows:

    "...the bugs found in the beta copy of Safari on Windows work on the production copy on OSX as well (same code base for alot of stuff). The exploit is robust mostly thanks to the lack of any kind of ad[v]anced security features in OSX..."

    Quote from linked article from the main article: http://erratasec.blogspot.com/2007/06/niiiice.html

  • zimsters, on 10/11/2007, -8/+47perfect evidence of how the all-secure apple would not pass the scrutiny of the user base that windows has.

    apple is "secure" because nobody has bothered to hack it. offer up a prize or hold a tournament and its hacked in hours.

    windows has been under the microscope and has been battered for a decade now from millions upon millions of users. it survives. apple won't survive that.
  • Scyth3, on 10/11/2007, -28/+65As it hits 51+ diggs...?
  • pauleric, on 10/11/2007, -6/+40@rderveloy, I agree, google's beta is not what beta has traditionally meant. But it also doesn't fit into any other category. Google constantly adds new features, so they really should say 'alpha'. Except it's pretty stable so it should be a release candidate. It's closer to the open source development model. Anyway, a buggy (but feature complete) Safari is just what 'beta' means.
  • aaronm67, on 10/11/2007, -9/+41From www.apple.com/safari (under security)

    "Now you can enjoy worry-free web browsing on any computer. Apple engineers designed Safari to be secure from day one."
  • wageslaven, on 10/11/2007, -6/+37"That's because mac users never install any windows products"

    Ever heard of IE for Mac? MS Office? MSN Messenger? Windows Media Player is presently listed as the 3rd highest download on apple.com

    Shut up fanboy.
  • inactive, on 10/11/2007, -7/+37@daiperedhusky "On the worlds worst OS."

    OMG - OS9?!
  • meshman, on 10/11/2007, -11/+40"Seems that people have forgetten what beta might mean."

    It seems Apple has forgotten what Beta means; NOT for open public distribution.
  • Topher06, on 10/11/2007, -9/+35@ byronm

    http://www.apple.com/safari/ "read the title"

    Also, this is a beta of an existing product. I mean, why should it be less secure then Safari 2.0? I mean, what did Apple do, strip out all the security features and call it 3.0?

    I agree, Beta does not mean ready to release (release candidate does), so the negative feedback is a little pre-mature, but still, if this was Microsoft they would be lambasted, but people seem to feel they need to defend Apple for putting out something that should never have hit the public yet.

    However, I do have to say that Apple's reputation for developing Windows software is a little weak. I know they can do a better job, its almost like they purposely make their Windows software buggy and less efficient just to say "See, get a Mac and these issues go away". iTunes on Vista is still crap, and every now and then if I click on a quicktime link in IE, it takes out IE. Apple has to do better if they want to convince PC users they can actually make better products by making their Windows software actually better on Windows.
  • DollaDollaBill, on 10/11/2007, -13/+38I don't think the beta tag is to blame. I blame another unneeded poorly made browser. Seriously, what do we need it for? Other than testing on a PC if you don't have a mac, it serves no purpose other than making one more thing devs and designers have to test for.

    What we all really need is a universal rendering engine, required to be used by all browsers, some please think of the developers!
  • MikeonTV, on 10/11/2007, -8/+33This is a clear example that Mac users can't touch a Win customer. There was never a discussion about Microsoft products being Beta tested on a Mac, like this is. 24 hours and already 3 articles saying the exact same stats have hit the front page at Digg. Clearly you million dollar celebrity advertisements can't help ya.
  • djtrypt, on 10/11/2007, -4/+26well i went to try it out on vista business and it didn't work at all, none of the text or fonrts showed up in any of the menus or input boxes on the app, quite disappointed
  • shakdang, on 10/11/2007, -19/+41am an Apple fan but, hahaha touche!
  • ThinkFr33ly, on 10/11/2007, -3/+24So Apple has crappy coding practices and makes up for it using calls to security APIs in an effort to put a band aid on it?

    Using security APIs is great, as long as it goes hand in hand with having a secure development lifecycle to begin with.
  • Septimus, on 10/11/2007, -6/+27The comment to show how stupid fanboys really are.

    Yes its the OS's fault that Apple won't code to Windows guidelines.
  • SenorPez, on 10/11/2007, -5/+26If it's a beta, it should have been released to a limited scope of customers, with incident tracking, rolling builds, and planned tests.

    Or, you can just roll it out to the whole world and use "beta" as an excuse. It's not just Apple that's playing stupid with the "beta" tag. But you don't get to fall back on "beta" as soon as security bugs, that would have been found by any reasonably-written test plan, start cropping up. You're either fit for public consumption, or you're not.

    It's clear right now that SafariWin is in the latter category.
  • bowe, on 10/11/2007, -6/+27http://projects.info-pull.com/moab/

    Found an exploit every single day for a whole month in OSX.
  • btipling, on 10/11/2007, -10/+30Yeah light years, what with bad windows management (green button), a ridiculous way of finding apps, an inconsistent UI (you have to hit the keyboard button to eject an empty disk tray to put a disk in but you can drag a disk to the trash can to eject), a stupid mouse, a dock with a mind of it own, ETC ETC


    Pfffft. I'll take my Windows start menu or xfce application menu and toolbars and fully maximizable windows over a stupid os x anyday.
  • inactive, on 10/11/2007, -4/+24"For the PC users....sucks for you..."

    Not really. Most of us Windows users didn't ask for Safari nor would we ever use it. Windows browsers are streets ahead so there is no reason to install it.

    We don't do form over function this side of the fence, okay?
  • ZergyPoo, on 10/11/2007, -5/+25No, you misinterpreted, you have no basis to claim that OSX is the "safest OS."

    The article doesn't say "OSX is safest" it says "They're most used to OSX than windows."

    Intimate operating system knowledge does not equal "Macs are better." So stop spinning the words around to make baseless fanboyish claims.
  • underrun, on 10/11/2007, -6/+25The BETA tag is ***** now.

    It's an easier for a company to say "oops...it's only in beta" rather than "oops...we ***** up". They want you to install it and use it but they don't want to be held responsible for the inadequacies of the product (mainly the FREE ones). In fact, most of the "BETA" classifications should be replaced with the "FREE" classification. This way you already know the response if something ***** happens and why.
  • akatherder, on 10/11/2007, -11/+29Fantasy: As a Windows user, this experience with Safari has introduced me to the speed, security, and snazziness of Apple. I can't wait to drop a million dollars on an iPhone and my next computer will be a Mac!

    Reality: WTF? Safari sucks and Macs are a bunch of overrated *****.
  • Epyn, on 10/11/2007, -2/+19At least PC guy's article wasn't three years old. I stopped reading yours when the guy complained that someone got popups when he installed Kazaa.
  • NSMike, on 10/11/2007, -3/+20Do you like movies about gladiators?

    /airplane
  • cheesegrits, on 10/11/2007, -12/+29Apple has avoided most exploits by being little used by the computing public. After a cracker has exploited Windows numerous times, Apple is like a dewey eyed maiden waiting to be raped (please forgive the preceeding phrase, I've been reading some books about barbarians).
    Hopefully, linux developers will learn from this and avoid some of the more common mistakes when they write their code.
  • NSMike, on 10/11/2007, -3/+20@diaperedhusky -

    Well it must have some clout, since, you know, it not only has the market share of the world, but was good enough for Safari.
  • cheesegrits, on 10/11/2007, -11/+27B-U-G-G-Y
    B-A-D
    B-U-M-M-E-R
  • Fetching more discussions...
    Show 51 - 100 of 399 discussions

  • Add a Comment

    Login or register to comment!
    Or, sign-in super fast with your Facebook account ...


© Digg Inc. 2009 — Content created and posted by Digg users is dedicated to the public domain | Terms of Use Updated | Privacy Policy
DIGG, DIGG IT, DUGG, DIGG THIS, Digg graphics, logos, designs, page headers, button icons, scripts, and other service names are the trademarks of Digg Inc.