Safari Beta Security Slammed; 8 Vulnerabilities Found

[Chaszmyr]

firefox beta did not have any problems like this.

Firefox has certainly had its share of vulnerabilities too. And I think if you'd investigate, you'd find that IE has had just about one security vulnerability for every line of code.

 

[Kenn Marks]

Like the Spaghetti Sauce, it's in there!!!

Security issues or not, I'm using it. . .

I think my days of being a Firefox user have just come to an abrupt halt. If only Apple would incorporate the feature from FF where it clears your passwords, cache and history when you quit, it would be perfect.

If you check out the Private Browsing tab of the Safari download page you will notice that all those things you mentioned in FF can be done automatically by turning on private browsing or manually by using the Reset Safari item in the Safari menu list. Hope this makes your new experience exceptional.

 

[dscottbuch]

While some may not agree with it, Denial of Service vulnerabilities (aka "crashers") is broadly considered a security vulnerability, although it is typically ranked lower than privilege escalation, arbitrary code execution, and remote vulnerabilities. Here's what Secunia gives advisories for, for instance:

http://secunia.com/about_secunia_advisories/

Its not a matter of not agreeing with it, its just wrong because it associates something which is not generally dangerous or disruptive - a bug which crashes a program - with something that is - a real DoS where your computer is not usable or a real virus, which deletes your files. This was done, IMO, not for sane logical reasons but just to extend the reach of the security companies and organizations. As I said previous I crash programs every day. Almost every program will crash. This is not, in and of itself, a security issue.

 

[Mainyehc]

It would have made MUCH more sense for Apple to just install an additional Safari application so you could switch back to the old Safari easily if you wanted. As it is, it looks like you first have to un-install the beta (using the included uninstaller), and then re-install Safari from your installation CD. That is NOT how a public beta is supposed to be handled, in my opinion.

Not true. The uninstaller either includes the latest version of Safari 2, or backs it up to an unspecified location. I know this because I encountered an overly annoyng bug - both the close ("X") button and Cmd+W just wouldn't do their task 😱 - and had to uninstalled... As mentioned earlier, my favicons were also zapped, but Safari 2 runs as it should...

 

[surferfromuk]

D

Would you ever install ANY software that could or could not have security holes?

Yes to both counts.

All software that communicates or transfers data over the public internet has the capacity for security holes.

 

[longofest]

Still far more secure than the 115 Secunia advisories on IE:

http://secunia.com/product/11/

I can't believe I'm about to do this, but you're actually being a little unfair to Microsoft/IE. That was IE 6.x, which is no longer the latest version, AND that count was the total number of vulnerabilities found. 20 remain unpatched (17%). IE 7 on the other hand has 12 advisories, 7 of which remain unpatched.

Safari 1.x on the other hand has 15 vulnerabilities, 1 unpatched.
Safari 2.x has 6 advisories, 4 unpatched.
Secunia hasn't updated their page for the latest round of exploits.

All said and done, IE definitely has more vulnerabilities, no doubt about it, but its a bit unfair to still quote them at 115.

 

[JPark]

I found a bug already running under windows with multiple screens. But I wasn't surprised, instead, I went to menu "Help" > "Report bugs to apple", and told them about it along with my system setup.

It's Beta software, if you use it, expect bugs, and when you find htem, report them like a good kid.

You pepole aren't downloading the beta expecting to use some free piece of software, expecting perfection and never having to actually beta test, are you? 🙄

That's one of tens of posts all saying the same thing: This is Beta, so bugs are to be expected.

Well, yes, bugs are to be expected. But you don't understand the difference between a bug and a remotely exploitable security hole (forgivable since you're probably a mac user and don't generally have to worry much about those). How are people supposed to test software/report bugs if by using the software they are opening up their computer to a remote exploit? 🙄

Security issues should have been dealt with in alpha, especially in this day and age. I imagine it's not a happy day at Cupertino today.

 

[eenu]

bludy windoze! haha thats really quite funy, you can take the safari out the os, but you cant take the flaws out the os

err there are flas in the OSX version so whats your point?

 

[JD92]

In my world a "beta" should at least "work" on 90+% of all machines where it could be installed. This isn't even good enough to be considered an "alpha" IMO

Alpha is usually the first release so yeah alphas are definitely likely to have pretty big problems, such as the ones seen here. Beta *usually* is when the feature set is frozen and the rest of the time is spent fixing bugs/UI stuff.

So yeah I would say this is beta, assuming all the features have been implemented.

 

[Earendil]

Does beta mean it's allowed to have security holes?

Would you ever install ANY software that could or could not have security holes?

Yes.

Ask any software developer. As any IV&V team. Read the EULA or other warnings before installing. That is the entire point of beta software. It's not so you get your freeby before the real deal is released. It's not that volunteer workers make take a risk helping a developer make software the best it can be, before it is released to the general public. When you use beta software you run the very serious risk of losing everything.

Is this really as much of a foreign concept to most pepole as it seems? I (honestly, without sarcsm) didn't relize it was this far spread a problem in misinformation...

 

[mags631]

And?

1. Thank you for finding the bugs. Please report them to Apple to fix.
2. IT'S BETA -- STOP HAVING A HISSY FIT OVER IT.

 

[MRU]

I think the point most have missed with the how high you can pee fighting contest going on is this.

Apple have created software for windows - to potentially increase it's market share and usher in future switchers.

If these future switchers experience, buggy, ineffective software from apple regardless if its the nature of the beast on windows, it will undoubtedly still put a few of those potential switchers off.

So regardless of how high you all can pee 😉 (mac/windows) this is still sad news.

 

[longofest]

I don't understand why Apple didn't do this. They should have released the beta separate from the GM.

I think it has to do with WebKit, which is updated in Beta3. Since WebKit is in the OS, only one version of Safari can operate at a time.

 

[inkswamp]

It is called private browsing...

EDIT: I do believe you are experiencing the "placebo effect." The time it takes to load a html page from Safari to Firefox is insignificant.

Selecting private browsing from the file menu in Safari doesn't stick. If you close the window, it reverts to non-private. In Firefox's preferences, you can specify that Firefox wipes cache, cookies, passwords, history, etc. every time you quit the app and that stays and happens every time. Also, you have a great deal of granularity with it (i.e., I can keep my cookies but dump the cache and history) whereas Safari's private browsing is all or nothing.

Secondly, the slow down Safari experiences is actually from the AJAX Digg uses on its forums so it's not totally HTML-related. Safari beta 3's handling of AJAX is greatly improved--better than Firefox now, I would say.

 

[BuzWeaver]

Vulnerabilities are a concern, however I can't figure out why with all the innovation that Apple Offers they couldn't have made a Sorting System for Bookmarks. How can you contend in the browser market if your users can't sort their favorites. I simply don't get it. 😕

 

[tutubibi]

2. IT'S BETA -- STOP HAVING A HISSY FIT OVER IT.

Well said!

Sad truth is that due to this obsession with security, those "exports" are not doing this to improve security but to gain publicity and increase their consulting fees 😀

 

[DTphonehome]

I don't understand why Apple didn't finish this product before releasing it...what was the big rush getting Safari onto Windows? They knew it would be torn apart immediately, so why not wait until it's totally ready and secure?

 

[shigzeo]

yup

never used safari much outside of the time i did not know that camino existed... isn't it beta since its release? i find so many websites that do not work with it as well as my all important yahoo.co.uk mail beta.

ill stay away. looks like others might too

 

[Earendil]

In my world a "beta" should at least "work" on 90+% of all machines where it could be installed. This isn't even good enough to be considered an "alpha" IMO

Maybe apple should at least RUN it on a Windows machine (even though it surely hurts and the guy with the windows machine isn't allowed to sit at the same table in the cafeteria?) at least once before releasing it to the world instead of just making sure it compiles and releasing it?

...
I'm honestly speechless. Do you know a thing about software development? I don't actually expect you to, that' sokay, as long as you don't pretend to.

Take it from a guy who spends 40+ hours a week testing software and qualifying it for release.
What you just said means that the group developing the software has 90% of the hardware that this could run on, and has had as much time to spend on each indavidual setup as all of us do with our own personal machines.

It also means that the software team has to THINK like every possible person could think about a problem, and an approach, and prepare for it. This last point being the hardest for a software engineer to anticipate.

They try hard, but there is no way a software team and backup IV&V or QA team can possible test and prepare for all the things a couple thousand/million users will throw at it over the course of a day, a week, or a month.

 

[irishgrizzly]

I love that, so far, ten people have posted this positive. The headline could be "Apple to join Microsoft" and people would still vote + 🙄

 

[tutubibi]

Selecting private browsing from the file menu is Safari doesn't stick. If you close the window, it revert to non-private. In Firefox's preferences, you can specify that Firefox wipes cache, cookies, passwords, history, etc. every time you quit the app and that stays and happens every time. Also, you have a great deal of granularity with it (i.e., I can keep my cookies but dump the cache and history) whereas Safari's private browsing is all or nothing.

Secondly, the slow down Safari experiences is actually from the AJAX Digg uses on its forums so it's not totally HTML-related. Safari beta 3's handling of AJAX is greatly improved--better than Firefox now, I would say.

I actually find Safari's private browsing to be a great feature. I often just want to switch to private mode to visit some sites and than revert back to normal mode.

 

[strangelogic]

Messenger Problems

I use Windows live messenger to chat to all my friends almost everyday so I can't be without it. Unfortunatly the Safari 3 Beta caused Messenger to crash everytime I closed a conversation window so I am back with version 2 - its still great though! I do have the latest version of Messenger btw. Just wondering if anyone else noticed the same problem.

It caused problems with the conversation windows in Yahoo messenger - would constantly scroll to the top when the new text was at the bottom. No crashes - and uninstalling it of course cleared up the problem.

 

[dscottbuch]

That's one of tens of posts all saying the same thing: This is Beta, so bugs are to be expected.

Well, yes, bugs are to be expected. But you don't understand the difference between a bug and a remotely exploitable security hole (forgivable since you're probably a mac user and don't generally have to worry much about those). How are people supposed to test software/report bugs if by using the software they are opening up their computer to a remote exploit? 🙄

Security issues should have been dealt with in alpha, especially in this day and age. I imagine it's not a happy day at Cupertino today.

But apparently neither do the Security experts. Almost all of the 'vulnerabilities' are really just Bugs - they crash the application!!!!! no more. They DO NOT open your computer to a remote exploit (except for 1). This is FUD, no more.

 

[Infrared]

Absolutely, this is a public beta, and this is the time to find these vulnerabilities. But in the case of the Mac OS X, the beta overtakes the old Safari.app.

It would have made MUCH more sense for Apple to just install an additional Safari application so you could switch back to the old Safari easily if you wanted.

The Safari installer package seems to contain a new Dock. If it does
install a new Dock, switching between the beta and the old version
will probably be a bit more involved than simply closing one and
opening the other.

Cheers.

 

[Stridder44]

1. Thank you for finding the bugs. Please report them to Apple to fix.
2. IT'S BETA -- STOP HAVING A HISSY FIT OVER IT.

x2. Lather, rinse, repeat.