Apple Updates Safari for Improved SSL Authentication

An anonymous reader writes "Safari upate is available from Apple on Software Update. This updates to Safari 1.0 Beta 2 (v74)." Says Apple, "This update is recommended for all Safari users and improves how Safari validates the authenticity of websites that use SSL certificates."

Re:In Other News...

[manual_overide]

Oh... I saw it because I was logged in and my prefs say to show me everything. Now I feel like a tard. :(

~lart me

No problem

[0x0d0a]

That's okay. It's still pretty trivial, unworthy-of-Slashdot news.

Thanks /.!

[MikeXpop]

There's nothing like seeing "2 minutes remaining" turning into "20 minutes remaining" that brings a smile to my face.

Re:Thanks /.!

[DarKnyht]

And by the time I tried to get it (a few seconds ago), Software Update was no longer mentioning that the update was available.

Had to go to their site and manually start the download.

At least Apple is up on these things...

[MrTangent]

Microsoft seems to twiddle their thumbs when security issues are found. Apple has been pretty good with security issues, even in their beta software like Safari.

Re:At least Apple is up on these things...

[MikeXpop]

You obviously don't use XP. There are system updates every week, and a good chunk of them include security updates.

Re:At least Apple is up on these things...

[Anonymous Coward]

Wow. I almost got whiplash from that little turnabout. "It's good that Apple releases more security updates than Microsoft." Woosh! "It's good that Apple doesn't have to release as many security updates as Microsoft."

Amazing. I salute you, sir.

Re:At least Apple is up on these things...

[MrTangent]

*curtseys* What I meant is that generally speaking there are a lot less security issues (and patches) for Apple software, but when a security issue does rear its ugly, misshapen head Apple is quick to squash it and issue a fix. Microsoft has been known to repeatedly ignore problems (for months) until many a customer's computer is compromised. Make any sense?

Re:At least Apple is up on these things...

[Smurf]

Let's see. The original post from MrTangent says:

Microsoft seems to twiddle their thumbs when security issues are found. Apple has been pretty good with security issues, even in their beta software like Safari.

His second post says:

However, it's refreshing that Apple doesn't release security updates every week like Microsoft. That shows that their products are generally more secure.

I don't see why you imply that he said:

"It's good that Apple releases more security updates than Microsoft."

Therefore I don't see the "whoosh". The first post says that Apple's security bug fixes are fast. The second one, that they are not needed as frequently as for Windows. Those are two separate but non-exclusive ideas. You may not agree with him, but he doesn't contradict himself.

Re:At least Apple is up on these things...

[Anonymous Coward]

Jesus Christ, dude. First you fail to spot a joke when one hits you square in the forehead, and then you get moderated UP for it!

Slashdot is dead already. These are just random twitches.

Re:At least Apple is up on these things...

[HiredMan]

There are system updates every week, and a good chunk of them include security updates.

Whether the need for near-weekly security updates is a good or bad thing is left up the reader as an exercise.

=tkk

Re:At least Apple is up on these things...

[sabNetwork]

Exactly. I use WinXP Pro, and these security updates are SCARY. The security holes which Apple patches are usually innocuous, minor bugs which would require significant effort to exploit. On the other hand, 75% of Microsoft's WinXP patches are described as "... allows attacker to gain control of computer, access to an administration account..."

Re:At least Apple is up on these things...

[kalidasa]

I don't ever remember seeing the phrase " access to an administration account..." in an MS update. I could be wrong, but I'd be surprised.

Re:At least Apple is up on these things...

[heXXXen]

You people are funny, because Apple doesn't even have to do the codework to fix these bugs. They're just patches and updates to the open source software bundled in (sendmail, etc.) Furthermore, usually those fixes are for problems where the server could be rooted, whether you think so or not.

Re:At least Apple is up on these things...

[sg3000]

> There are system updates every week

Yeah, if those updates don't come fast enough, Microsoft is planning on including a sledgehammer [yahoo.com] with every copy of their next version of Windows [microsoft.com]. :-)

That was quick!

[Whatchamacallit]

Nice to know they fix stuff very fast when it occurs. This was only announced a couple of days ago.

Microsoft is a whole lot slower to release stuff even when they are caught with their pants down which is usually what happens.

Faster than you know.

[RalphBNumbers]

Check the creation date on the updated app. It was built a couple of days ago.

I'm guessing they just had to run it thru QA since then to make sure they didn't break something else by fixing this.

Re:Faster than you know.

[Phroggy]

I'm guessing they just had to run it thru QA since then to make sure they didn't break something else by fixing this.

Another difference between Apple and Microsoft... ;-)

Re:Whoo hoo indeed!

[HiredMan]

But because we're a superior 5% [macworld.com] it apparently matters more.

Come on - it was a joke. The real reason is to pad out the distance between dupes and M$ bashing articles.

;)

=tkk

Re:Whoo hoo indeed!

[Duck_Taffy]

And would you like to tell me what percent of computer users use Linux?

Re:Whoo hoo indeed!

[DarKnyht]

Or more importantly, of those Linux users are not IT People or Computer Geeks like us?

Re:Whoo hoo indeed!

[davesag]

5% of computer users maybe, but 95% of apple.slashdot.org [slashdot.org] readers surely.

a thought - by computer users do you also include computers that use computers, or do you only mean people who use computers?

Re:Whoo hoo!

[Virus1984]

Actually for the fraction of users who load apple.slashdot.org this is "stuff that matters". It's a section meant to be read by Mac users (read: potential Safari users)...see ?

OT-INIT 1984?

[wirelessbuzzers]

Does your name have anything to do with the INIT 1984 virus?

Just wondering

Re:OT-INIT 1984?

[SeanAhern]

Know someone with . in their path?
echo "#!/bin/rm -f" > cat; chmod a+x cat

I've had . in my path for many years, and wouldn't do without it. It's at the end of my path, so there's no way you're going to spoof my "cat". It's only those who have . at the beginning of their path that get screwed.

Re:OT-INIT 1984?

[FunkyMarcus]

I've had . in my path for many years, and wouldn't do without it. It's at the end of my path, so there's no way you're going to spoof my "cat". It's only those who have . at the beginning of their path that get screwed.

Oh, you've never accidentally run a chomd, or maybe l s-l?

(Ouch, those hurt to type.)

Mark

Re:OT-INIT 1984?

[SeanAhern]

Well, "l" is an alias/function in my shell. And chomd...hm. Don't know. I do type "wc-l" more often than I'd like to admit. :-)

I get your point. I'll have to think about that some more - see if I spend time in publically-writable directories. Not sure I do...

It's an interesting thing to think about, though. Thanks.

Re:OT-INIT 1984?

[wirelessbuzzers]

Heh. Amusing joke. Problem with your first idea though. Part of the point of my stupid joke was that you have no idea what's going on afterwards, as it removes itself. Yours doesn't, and they check the username, and...

Another amusing joke is to
perl -e "open FOO, '> foo'; seek FOO, 2009743546,0; print FOO 1;"
DO NOT TRY THIS ON AN HFS/HFS+ VOLUME, it only works on a UNIX volume. It makes a file which appears to be huge, but isn't (it takes up a dozen k or so on disk, due to UNIX sparse-file support).

Re:OT-INIT 1984?

[Virus1984]

Nope, it's the nickname I've carried for seven years now (Virus) with my birth year appended to make it unique and longer than 6 characters so I can use it as a login ;-)

Re:Whoo hoo!

[kalidasa]

n-baxley just posted a troll that less than 5% of apple.slashdot.org readers, themselves less than 5% of Apple users, themselves a mere 5% of computer users, would ever consider reading. Woot!

What this update fixes

[aberkvam]

One May 9, Secunia [secunia.com] released an advisory entitled Apple Safari and Konqueror Embedded Common Name Verification Vulnerability [secunia.com]. The summary is, "Apple Safari and Konqueror Embedded fails to validate the Common Name of a SSL certificate. This makes it possible to spoof SSL sites, so that users can't trust the authenticity of a SSL website." They also add, "NOTE: This does not affect the ordinary version of Konqueror."

Re:What this update fixes

[unixbob]

What I find interesting on this is that Apple have taken Konqueror embedded and wrapped a Cocoa interface around it. According to the news story you link to, this is a bug not just in Safari but in Konqueror which Safari is based on.

So I've just been to [kde.org] to have a look at the recent news. No mention at all of an SSL bug in konqueror which requires immiediate patching. This makes me wonder - what is the KDE policy on releasing bug fixes like this to their codebase? And it also makes me wonder what

Re:What this update fixes

[Phroggy]

Is Safari a codefork or an interrelated project?

Apple does contribute patches to KDE, but it's a fork. Apple's version (which does not use Qt) is called WebCore [apple.com].

Re:Broke their own BugReporter

[gerardrj]

I DLed the new Safari a few hours a go and just tried sending a bug report.

It worked flawlessly, just as it did the last time I used it.

Perhaps there was a transitory problem on the network when you tried?

Now if I could just stop my manager...

[rubicon7]

...from using the term authentification.

Re:Now if I could just stop my manager...

[Migrant Programmer]

Amerificans have a habit of doing that, I'm afraid.

Just Installed lt. . .

[Farley Mullet]

And I'm glad that the ssl fix came in. But does anyone know if that nasty memory leak is fixed too?

Faster?

[sld126]

Maybe it's just me, but it does seem a bit snappier, both in page display and page downloading. Opening tabs behind the displayed tab seems faster too. Just my $0.02

Security-shmecurity--still needs this feature...

[nystagman]

As much as I like Safari (and I do!), I can really only use it at work, not at home, because of how it handles (or refuses to handle) individual loading of images.

At home I do NOT have high-speed access, just dial-up over crappy 80 year-old lines (parts of the path from wall jack to telco interface are the original wires from when the building was first wired).

I prefer NOT automatically loading images, instead individually selecting the ones I actually need to see, or in the extreme case, selecting the me

Perhaps there's something you're missing indeed...

[RalphBNumbers]

In the appearance pane in prefrences uncheck "Display images when the page opens".
Volia, images will not loaded automatically, as you prefer. This has been there since before beta2 iirc.

I can't see how you're supposed to load them manually though...

Re:Perhaps there's something you're missing indeed

[gerardrj]

The user notes that he knows about that preference of not loading images.

What is missing in Safari is the ability to manually load individual images when you have images set to not load.

Apparenlty MSIE has this feature, I know iCab has it (along with a lot of other's I'd like to see in Safari).

When images aren't loaded, you can right-click (cmd-click) on the image placeholder and choose something like "load image", and only that image will be loaded. In iCab this is especially useful, as sometimes your i

Re:Perhaps there's something you're missing indeed

[nystagman]

If you read my post carefully, you'd see that I do know about the preference to load all the images on a page. This however is a task that is anything but simple and immediate, requiring quite a bit of mousing and clicking to accomplish.

What I would like to see is the ability to 1) choose "Load Images" from a main menu (having a command key equivalent) and a button in the toolbar; and 2) context-click an image placeholder and select "Load Image" to see that particular image.

These are things I can current

Re:Security-shmecurity--still needs this feature..

[Phroggy]

As much as I'd like to say 'buh-bye' to Internet Exploiter I simply can't, at least not at home.

Um, Safari is hardly the only non-MSIE browser available for Mac OS X. Try Camino, or Mozilla, or OmniWeb, or iCab.

Safari https via squid proxy

[FrankRoscher]

Does any body know a solution howto use https via squid proxy (beta2/v74)? This is the only reason to sometimes use Explorer on my macs here ...

Re:Safari https via squid proxy

[sandoz]

It seems to be a problem with WebCore Framework.(I think it's a framework.) iTunes 4 uses the same resources and you cannot purchase music behind a proxy server. It also breaks the music sharing feature of iTunes 4.

Re:Safari https via squid proxy

[FrankRoscher]

Hope this will be fixed in near future because I like safari and I'm always frustrated to use Explorer to buy something on Amazon ...