Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Safari Bug Allows Websites to Track Your Recent Browsing Activity in Real Time [Updated]
- Thread starter MacRumors
- Start date
- Sort by reaction score
I don't get the impression that Monterey has a "huge bug list". Catalina seemed to be a low point in quality, perhaps because they changed a lot of internals.
It's a bug, and 50 days and counting is a bit slow for Apple to react, but still well below Google's 90-day responsible disclosure deadline. They shouldn't have disclosed it yet.
It does not hurt to look into what others do and to learn from it for your own platform / favourite gadgets. Both if they do better or worse.
With regards to software feature releases, it is good that Apple introduces things once or twice per year, because the constant changes that other companies do to their UI/UX can be frustrating. I know that Apple can also miss the mark entirely - so let's not get into the tab-design discussion or the Podcast App.
But, if you have bugs you need to be faster. Every programmer can overlook something. And in the same way that you can be clever to solve a problem, somebody can be equally clever and open a new door. That is the nature of things. But here Apple's slowness of upgrades is bad and Microsoft is usually much more reactive.
And although people like to bash Microsoft, but the company has actually some good sides as well. As a developer I really appreciate their structured approach to language design and most of the JavaScript community will agree that they have made two important and valued contributions: TypeScript and Visual Studio Code (though I feel that the latter one gets overly complicated ... as is the nature with many successful products and platforms).
Safari shouldn’t be on a yearly release schedule. As much as it is my favorite browser and I use it daily for a decade, this old yearly release approach from Apple is clearly hurting them in the long run. While they push some critical bugfixes fast, others like rendering issue or format support takes until the next big release to come out. In this world where the web is evolving so fast, and so are its threats, it’s just unnaceptable to see a modern browser lag behind so badly.
The same argument should be made to separate security fixes from iOS regular releases. Pegasus should have been able to be patched earlier, and no doubt bundling it with a dot release took unnecessary time.
Also, pay your bounties Apple and stop ignoring threats when people disclose them to you! You’re a 3 trillion dollar company, start acting like it.
The same argument should be made to separate security fixes from iOS regular releases. Pegasus should have been able to be patched earlier, and no doubt bundling it with a dot release took unnecessary time.
Also, pay your bounties Apple and stop ignoring threats when people disclose them to you! You’re a 3 trillion dollar company, start acting like it.
I've been using the public beta of Monterey on my M1 Air since it launched, and I have not had any issues...I use it daily for work, leisure and study. The one thing that worried me was the SSD cycle issue right at the start but that seems to have been resolved.
The mountains are closer to the spy satellites... there's less clouds to see you thru.
They can still track your heat signature via satellite unless you cover your entire body with cold mud like Arnold (Dutch) did to hide from Predator.
I tried it in Safari Technology Preview and it still happens there. WTF is wrong with Apple, do they not care about privacy or security, this should have been fixed over the weekend already. It's not like they have any shortage of engineers or money. At least provide a setting to turn off the db or clear them. They should stop bloviating about user privacy if they can't manage to do proper security audits of WebKit.
I live in the mountains. Everyone in Denver did that in 2020 and now no one can afford to live in the mountains...without their gadgets to work remote.
Man, I wish I could disagree with this. So Apple's "we are the most secure" marketing is just marketing. Yep, should have known that.
Apple is the major contributor of Webkit. The third party commits are relatively insignificant compared to the commits of Apple employees. Just because Apple has open sourced this technology doesn't take anything away from their responsibility in fixing this.
Last edited:
This isn't limited to iframes, but any tabs that you open during the browsing session. So, any website could be a bad actor and doesn't necessarily have to be an ad network. They could link your Google profile (if logged in) with the tabs that you have open.
Staying calm means Apple will never fix it. Remember they are nothing but a marketing company these days and one penny spent that is not needed (using image as the base requirement) is anti-Cook philosophy.
In my experience, it is not "engineering competence" but rather management direction. There are no or not enough engineers assigned to do WebKit security code and testing. Why? Because it adds nothing to the Keynote each year, unless there is a big media hoopla.
Anyway, security is so 90s. Apple's national security letters have to be implemented somehow.
Yes, and perfectly normal to anyone BUT a security researcher that hasn’t seen their twitter account retweeted in a few months.
They always put all the SCARY stuff right up front and then it’s like pulling teeth to get to “But how’s this an exploit, buddy?” Because they know this isn’t a serious exploit. My guess is that this does do what they say it does, but there are SO many other more effective ways of doing that thing, there’s no malicious actor that would use this vector which can be defeated just by a user closing a window/tab.I wish that, just like I can enable Reader View automatically on a per site basis, I could also disable Javascript on a per site basis.
Still doesn’t change the fact that it’s open source, though. And, that this will be fixed as soon as the WebKit open source community deems it necessary to be fixed.