Dashboard from Tiger may bring the first real OS X Virus...

Welcome to zaptastic.

If you are using Safari on Tiger, thanks to the magic of widget autoinstall, combined with the <meta> tag, a slightly evil widget has been installed in your dashboard. It could be a lot worse. There's a slightly more evil widget linked lower in this page, and I think it would be possible to make a much more destructive widget. I gave you something fairly tame.

You're welcome.

Other browser users will probably find it on their desktop.
In case the autoload doesn't work, here's a link: zaptastic

I picked up Safari at launch time from my local Apple store, brought it home, and got inspired to start in on a widget the next day. My flores and coras widgets are taking off like crazy. Over the last few days I've figured out quite a lot, including the fact that there are some potentially very annoying things one can do with a widget.

Let's start with autoinstall. I happen to like it, actually, I think it's a great thing. But, as I have demonstrated here, it has the side effect of setting up a situation where a user can be given an application without their knowledge.

That's not such a big deal; by default, widgets can't do much damage, and they can't run unless you drop them into your dashboard. The funny thing is that once that widget is there, according to Apple, you CANNOT remove it. Type "remove widget" into Apple Help, and you find out:

You cannot remove widgets from the Widget Bar or change their order.

Most of those reading this are probably aware of the workaround - just remove the offending widget from ~/Library/Widgets/. The Dashboard bar is not very good about updating when a widget is removed, but eventually it figures things out.

The average user, who can't find their Library folder with two mice and a spotlight, is stuck. It would take all of thirty seconds for me to pick out a nice porn image, make it the icon of a widget, drop it in your dashboard, and you're stuck with it. It doesn't even need any Javascript. Oh, hell, why not? (warning: oh me oh my, this is SO VERY NSFW) Click on this: ******.cx

Aren't you glad I didn't autoload THAT one?

Annoying, but not actually deadly. Unless, of course, some porn site installs 'chickswithdicks.wdgt' and your heavily armed and unstable spouse sees it. Actually, now that I look at that on my Dashboard, I'm kinda proud of it. Mr. ******, wherever you are, I tip my hat. And I hope you can sit down now.

Next, let's talk about zaptastic. I went to the trouble of making it ostensibly useful: it is a countdown timer for the launch of alleged PayPal competitor GreenZap. GreenZap is probably a Ponzi scheme, but do remember that PayPal gave away money when they were new, and it really would be a good idea on general principle if they had competition. Decide for yourself if this is of any utility. That really wouldn't be necessary, though, because the real point of the widget is that when it initializes or you click on it, it takes you to the GreenZap site, with my affiliate code, to try to get you to sign up. GreenZap is a pretty benign place to send you; I'm sure you can think of some less friendly destinations. Otherwise, it's rather well behaved, at least until June 1, after which it will take you there on every refresh.

This is annoying.

With one more line of code, the more evil version that I promised earlier takes you to GreenZap every time the widget is shown. This means that once you install zaptastic_evil, every time you launch Dashboard, your web browser goes to the GreenZap site. Which has the side effect of immediately dropping you out of Dashboard, preventing you from closing the offending widget.

You cannot get rid of zaptastic_evil without deleting it from ~/Library/Widgets/ and rebooting your computer. You cannot use your Dashboard until you delete it from ~/Library/Widgets/ and reboot your computer. Write that down if you're not clear on the concept, on a piece of paper, not a Dashboard sticky, because you won't be able to read it once you've installed this. Because Apple didn't actually give you a way to relaunch Dashboard without a reboot, though I suppose you could just kill the process. Certainly there is no user documentation for that.
This is very annoying.

I am SO not kidding! Do not install zaptastic_evil unless you actually know how to delete it and reboot your computer. zaptastic_evil shouldn't do any real damage, it's not that smart, but I take no responsibility if it does.

This said, here it is: zaptastic_evil.

Click to expand...