Neowin.net

If Apple's response is authentic... well what more can be said.

Good on Microsoft to be honest. How Apple can not see that this is a security flaw I don't know. All it would take is an inadvertent double-click on the wrong executable , or hitting return instead of delete with them all selected to induce chaos on your system. If everyone else can fix flaws like this, why does Apple think that they don't have to.

If they don't want to maintain Safari for Windows, they shouldn't have made it in the first place.

Great move Microsoft.

Who choose this when IE is such a good browser ?

It's basically the Safari "carpet bomb" flaw (which isn't really a flaw), in combination with the IE habit of executing any code handed to it on Windows.

Safari automatically downloads stuff to the desktop from a site without asking your permission, because Apple feels that if you went to that site on purpose then the download is what you want. The stuff downloaded can't affect a mac computer anyway so all it can ever be for a mac user is a minor annoyance that can be stopped by going to a different site or turning off the browser. Also on a Mac, any code or files downloaded form a website have to be authorised before they will run, whereas on Windows, they just run.

On Windows this can be used to execute random code due to the IE flaws. So it's really a MS, Windows-based problem in the long run.

Is this talking about how Safari just starts downloading things and then once its done asks you if you wanted it? :\ Always thought that was abit weird.

Gotta love how much Apple cares about customers who use its products on Windows.

/Uninstalls Safari

Its more like Apple are thinking 'if we let this flaw go unpatched for a while, people will blame Windows instead!'

Safari makes IE7 look completely secure.

Last edited by bbfc_uk on 01 Jun 2008 - 15:21

I am very glad that I use either Firefox or IE (mainly Firefox ) as my browsers!

As for Safari, Apple is still stuck in the old ways of "Security by Obscurity".
Apple takes this critical security matter so lightly.

I just hope that websites will take advantage of this flaw
and fill up the desktop with 1000 GigaBytes of useless files on MacOSX and Windows,
let's see how Apple would change their mind
about the urgency of the Carpet Bomb Safari Security flaw!

Microsoft should warn Safari users with an update to the Malicious Software Removal tool.

Apple certainly seems to be a malicious software vendor on the Windows platform -- I think it fits.


"Hi. I'm a Mac."
"And I'm a PC."
"And I'm an Apple Developer" *pulls out a gun and shoots PC in the leg.*


Last edited by MioTheGreat on 01 Jun 2008 - 16:44

For years (and years and years and years), MS has been responsible for so much lost data that it has become the stuff of legend.

MS shipped Windows XP in 2001 with five open ports. A security nightmare, even though we were well into the internet age.A Swiss cheese OS, really.

They've finally cleaned up their act - although it took XP years to get to SP3 where it's finally mature enough. And to their credit MS is in very recent memory being extremely open about flaws and careful to fix mistakes.

On the other side of the fence, to their credit, Apple adopted a Unix/BSD foundation for their OS, and there has not been one single virus for OS X documented in the wild. They've created the most stable, reliable, usable consumer OS on the planet.

But unfortunately, and perhaps to their chagrin in the near (or not so near) future, they have a rather cavalier attitude about security.

Let's keep things in perspective, shall we? It seems neither organization is either 100% successful or 100% honest when it comes to security.

And when it comes to dishonesty, underhanded tactics, Apple can (and perhaps has) learned plenty from Microsoft.

Perspective, people.

My take:

I'm surprised at Apple's statement. I find it inappropriate. Although the Windows architecture might present some challenges, Apple needs to step up its efforts to treat Windows users as well as it treats Mac users. If Apple's tactic is to encourage use of its software on OS X by serving up incomplete (and flawed) versions of it on Windows, then at least in part, it will result in a good chunk of users who are not only angry, but simply can't move to OS X wholesale for whatever reason.

Apple doesn't have security issues.... woops I mean Macs don't have viruses... whoops that is also infact a lie.... Apple do have security issues. Maybe people will have to rely on Microsoft being the one to fix the security issue via windows update... any file not downloaded from IE or another approved browser by microsoft could have the file marked and then has a security check pop-up dialog box - oh wait then Apple will probably argue that this is deliberately causing a nuisance to users to try and stop people using safari.

This is unacceptable. Is their response is correct, why the heck they think this is not a security issue?

I think this approach will change as soon as malicious websites implement this and stat bogging mac and windows users with tons of downloads.

This kind of companies must be trusted about their security policies. Microsoft has always been informative (i don't think they are 100% though because info about some issues are best to be hide until they are solved) but Apple, as far as its Windows software concerns, always take a long time to fix their flaws.

I hope this doesn't get spread to users of safari but Apple has to fix this behavior in their browser.

Way I see things, Apple will address this issue, bury it in a "Security Update", never acknowledge that it was a problem to begin with, and conclude by remarking that OS X is the most secure operating system ever.

Here's my take: If Safari and Quicktime are supposed to represent the Mac experience on a Windows platform, then I now know exactly what it's going to be like if Apple becomes as widely used as Windows.

Microsoft should treat it as a virus and remove the Safari browser on the next update

Or at least pop-up a security window informing the user of the issue and giving them the choice whether to use Safari or not but we all know what would happen if they did... lawsuit anybody?

FUD

why (or how) Microsoft have the right to talk about THIRD PARTIES SOFTWARE?. And, do you known the goodness about Internet Explorer browser?

Soon Microsoft will blame WOW, Counter Strike and BF. And, do you known about the goodness of xbox360 and Falo3 ?

"Dhanjani said Apple indicated it wasn't in a hurry to fix the Windows vulnerability, if it ever got around to it."

Is anyone at all shocked by this attitude? Really? Maybe if I type it in giant letters I can draw more attention to my comment! You know, because it's more important than the other ones

I'm surprised people are fighting about IE vs Safari, when everyone knows you should be using Firefox...


And Microsoft is about to release IE 8 Beta, so they don't want Safari to steal more market like they did with itunes...