Safari 3.1 For Windows Violates Its Own EULA, Vulnerable To Hacks 368
recoiledsnake writes "The new Safari 3.1 for Windows has been hit with two 'highly critical'(as rated by Secunia) vulnerabilities that can result in execution of arbitrary code. The first is due to an improper handling of the buffer for long filenames of files being downloaded, and the second can result in successful spoofing of websites and phishing. This comes close on the heels of criticism of Apple for offering Safari as a update for approximately 500 million users of iTunes on Windows by default, and reports of crashes. There are currently no patches or workarounds available except the advice to stay clear of 'untrusted' sites." Further, Wormfan writes "The latest version of Safari for Windows makes a mockery of end user licensing agreements by only allowing the installation of Safari for Windows on Apple labeled hardware, thereby excluding most Windows PCs." Update: 03/27 17:23 GMT by Z : Dave Schroeder writes with the note that the license has been updated to correct this mistake.
It has begun... (Score:4, Funny)
Re:It has begun... (Score:5, Funny)
Re: (Score:2)
He eventually moved on, but the person who inherited the laptop still has that sticker on there!
Re:It has begun... (Score:4, Funny)
Since my job was prepping the machines for install in the studio, I decided to pimp the studio people by putting an "Intel Inside" logo over the Apple logo; of course the machine was for the Mac zealot in the group who was super pissed that the logo was there and that he couldn't figure out how to remove it.
I caught hell for doing it, primarily because it took major surgery and a ton of time to put the stupid thing in there and I didn't get some other tasks accomplished.
Re:It has begun... (Score:5, Funny)
I went down to engineering and got one of the old metal Sun logos, the ones that used to be on the front of Sun-2 boxes, and put it over the logo of the laptop, fired it up in my office, and waited for the first victim to wander by. A while later, one of the senior software developers walked into my office to ask me something, and spied the laptop with the Sun logo and the screensaver running with the Sun logo on it. "How'd you get a Sparc laptop? I didn't think they were in production yet!" I have lots of friends
It didn't take long for the prank to be found out, but it sure was fun for a while...
Reminds me of the time that I got Wine running under A/UX (Apple's version of UNIX, SVR4 flavor) - I was working for Apple at the time, and it was fun to see people's faces when they'd come by and see the Windows logo on the screen on what was obviously a Mac, but that's a story for another time. Sure was a fair bit of work, but it worth the prank value...
Re: (Score:3, Funny)
Found 'em (Score:3, Funny)
- Stuck to the back glass of pickups
- Stuck to the back glass of poorly maintained econo-cars
- Stuck to teenage girls' bedroom/dorm doors
- Stuck to teenage girls' binders and backpacks
Good luck getting them back...
Re: (Score:3, Funny)
Re:It has begun... (Score:5, Funny)
Re: (Score:3, Insightful)
If you want to continue that logic, you don't have to buy a computer at all, or any electronics for that matter. In fact, you could be a naturalist and live without even clothes.
Not that I dislike apple more now then I did before I RTFA, which is to say I have a fairly neutral view on them, but if you look at a lot of articles lately I do believe that in gen
You keep saying that word.... (Score:4, Informative)
"A scholar or student of natural history, the science of the natural world; see also natural science. It may also refer to a Wildlife enthusiast or a Conservationist"
Not a naturist or nudist.
Re: (Score:2)
Sorry, the funny part is I translated it from Swedish to English without really reflecting over it, and had to check the dictionary (in Swedish) and realized I was wrong even there. :)
Oh well, hope you still got the point
Re: (Score:3, Funny)
Re:You keep saying that word.... (Score:5, Funny)
Re: (Score:3, Funny)
Re:You keep saying that word.... (Score:4, Funny)
Chill, don't get your knickers in a twist.
Err
Cheers
Re:It has begun... (Score:5, Funny)
Any EULA is basically saying:
Re: (Score:2, Insightful)
If Safari becomes the default browser on these systems, you end up with critical vulnerabilities in a browser installed on non-tech-savvy individuals' computers.
Re:It has begun... (Score:5, Interesting)
People are having software that they have no license to use being automatically installed on their systems. I would think a term like that is not valid (non-obvious terms may not be valid in the US), but if it does hold, they will have millions of people in the US infringing on their IP. If they decide they are desperate and start suing (not likely any time soon) there are a lot of potential targets.
This is like the RIAA giving away MP3s on their website, saying "you agree to listen to this on only RIAA approved devices". When you suddenly have millions of people acting innocently illegally using your product it is not good for them.
Re: (Score:3, Informative)
Oh, come on. That's not just farfetched, it's ridiculous. First of all, the scenario you describe is impossible just because of the issue that they pushed this update out themselves. Even if they did become this "desperate" (because of people illegitimately using their free web browser? Well, whatever), no judge in the world would listen to a suit like that. Bu
Re:It has begun... (Score:4, Informative)
Re: (Score:2, Funny)
So, I think we can safely assume that they just forgot to change the same clause in the EULA for OS X also.
Re: (Score:3, Funny)
Re: (Score:3)
There is no "just an oversight" when it comes to legal documents, as a good lawyer once drummed into my skull. The stupid, obvious thing you don't correct before you sign a legal document is the stupid, obvious thing you're legally liable for afterward. IANAL, but I'd bet that the fact that Apple installed it on one's system might be a defense for the violation, but in and of itself wouldn't really seem to nullify the EULA. Who is to say which the oversight is... one of not changing the EULA to include PCs,
Re:It has begun... (Score:5, Insightful)
Oh blow me. Can you imagine the shitstorm of a comment thread that would result from this exact same thing being the result of MS's doing? The massive gaping security hole *is* a big deal, it is not made less so just because Apple did it and not MS.
And what the hell are you talking about with MS giving guidelines? You mean like, MS should give you guidelines on what you should and should not do with your PC? Dude, seriously, where the hell did you come up with your ideas?
Re:It has begun... (Score:5, Funny)
Good god, man! We've got to get them back on Internet Explorer!
Re:It has begun... (Score:5, Insightful)
Re:It has begun... (Score:4, Insightful)
So first we have to have a user who is unaware of what Safari is or careless enough to not uncheck the box in Apple Software Update. It seems highly unlikely to me that many of the users who download Safari without thinking about it are going to go looking for it in the Programs menu and launch it. And it's not vulnerable if it's not running.
It was silly and wrong for Apple to leave the box checked by default, but this is not a big problem, and it's not going to become one.
Re:It has begun... (Score:5, Insightful)
The issue is in part that Safari is not related to iTunes or Quicktime. There's no reason to believe that by installing music software, the manufacturer will also push a browser to you.
All this will do is piss people off and make them turn off automatic update options, which will eventually result in some flaw in iTunes or Quicktime being less widely patched. It was not a capital crime, but it was dumb and irresponsible of Apple.
And the EULA thing is just funny. What with the ample fleet of lawyers they have in Cupertino, I'm surprised ANYTHING gets out without a full legal vetting. Software gets out with bugs, but EULAs don't typically get out without great scrutiny.
Re:It has begun... (Score:5, Insightful)
You don't even have to use apple-firmware in your ipod. There's an upgrade-firmware [rockbox.org] that makes itunes totally obsolete.
It's not available for all ipod-models yet though...
All in all, though, an installer that offers the option of installing irrelevant software (like installers that offer "google toolbar" or "Safari" or "superduper spywareinstaller") should have that option unselected as default.
Re: (Score:2)
Re:It has begun... (Score:5, Informative)
Mind you, I last installed it about 4 months ago. I'll try again if people say it's much better now.
Re:It has begun... (Score:4, Insightful)
Anyone who installs Apple software had better be prepared to join the cult, otherwise stay the hell clear of it.
Re:It has begun... (Score:5, Informative)
Anyone who installs Apple software had better be prepared to join the cult, otherwise stay the hell clear of it.
Download the installer. Run cabextract on it. You'll get the following files:
AppleSoftwareUpdate.msi
QuickTime.msi
QuickTimeInstallerAdmin.exe
Only install Qucktime.msi. Delete the others. Just do msiexec
Then run this registry file:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"=-
Make sure to delete the shortcuts so users can't bring it up. Doing it this way will let the browser plugins work, and also enable software that uses quicktime to work (lots of educational software uses it) without being hostile to your system. It will only take the quicktime file extensions this way.
Re:It has begun... (Score:5, Informative)
"msiexec
Acidity (Score:5, Funny)
Re:Acidity (Score:5, Funny)
Yet more proof (Score:5, Funny)
Re: (Score:2)
Some ideas are not so good (Score:5, Insightful)
I wonder... (Score:5, Funny)
Thre real question is, who would win? (Score:2)
It was bound to happen (Score:5, Insightful)
I am waiting for the EULA that requires all users to declare the programmer their god and send off their first born child to him in sacrifice.
Re:It was bound to happen (Score:4, Funny)
Re: (Score:3, Funny)
Re:It was bound to happen (Score:5, Interesting)
See paragraphs 2 and 3 in the LIMITATION OF LIABILITY section.
Nonsensical headline (Score:4, Insightful)
I agree that the EULA makes no sense, assuming that Apple wants as many Windows users as possible to use Safari. But that's an entirely different matter.
In fact, the EULA can be adhered to without any problem: afterall, you can install Windows just fine on Mac hardware these days. So you can actually run Safari for Windows on "Apple labeled hardware".
I seriously doubt the way it is stated in the EULA is really Apples intention though
I think you're not reading closely enough (Score:5, Informative)
I got Safari as part of the iTunes update. I have a non-Apple Windows machine, running Safari. They basically forced the software on me, and the EULA says I can't use it.
Does that answer your question?
Re: (Score:2)
How are they to know the difference between Windows on a Mac and Windows on any other PC to determine whether to disable the 'bonus feature' or not?
Re: (Score:2, Interesting)
http://www.apple.com/legal/sla/ [apple.com]
At which point you as the user have to pick through a list of different licenses to get to what you may want.
Re: (Score:2)
Re: (Score:2)
The only other way is that the updater maintains a list of what hardware configs Apple has, and then they'll need to keep updating that list and potentially get in to the situation
Re: (Score:3, Informative)
Quite easily. Ask WMI. It knows a lot of stuff going on and under your Windows setup.
Re:Nonsensical headline (Score:4, Insightful)
As someone who regularly uses the functions "copy" and "paste", I can tell you that there are many times where I c/p a blob of text and forgot to change something crucial in it. This happens to many people. Apparently, the folks at Apple are not immune to human flaws.
It's probably just an oversight. A HUGE oversight. But there's really no need to make a circus out of it. Then again, this is Slashdot, right?
Violating the EULA (Score:5, Interesting)
When I go to best buy I don't "license" an OS or piece of software; I pick a box up off the shelf, pay money for it and am delivered a purchase reciept. I then own the goods that I just BOUGHT. I am under no statutory obligation to read anything or sign anything. I tear open the box and do what I want with it, short of violating copyright law.
Your EULA is fiction, and until I see one stand up in court I'm going to ignore it.
-mcgrew
Re:Violating the EULA (Score:5, Insightful)
Re: (Score:2)
Re: (Score:3, Informative)
Re: (Score:2)
Re: (Score:2)
Re:Violating the EULA (Score:4, Interesting)
Yes, it sucks, but that's what free software is for.
Re:Violating the EULA (Score:4, Informative)
Sorry, but 17 USC 117 says that owning the binary copy already grants me the right to install and use the software.
You can stop ignoring them (Score:5, Interesting)
"ProCD, Inc. v. Zeidenberg, 86 F.3d 1447 (7th Cir., 1996), is a United States contract case involving a "shrink wrap license". The issue presented to the court was whether a shrink wrap license was valid and enforceable. Judge Easterbrook wrote the opinion for the court and found such a license was valid and enforceable."
They've been held up in court. The issue isn't totally decided, with other cases dealing with more specific issues, but your "nah nah nah MARY HAD A LITTLE LAMB nah nah nah" fingers in the ears stance may not be legally prudent.
Re: (Score:2)
Re: (Score:2)
So an automatic update with no interaction is very invalid ?
Re: (Score:3, Interesting)
Well, I bet that the iTunes EULA includes somewhere in it the rights to expand the scope, yada, yada.
I imagine that there is an anti-trust suit waiting to happen, since Apple has a near-monopoly on music downloads, which requires the iTunes player, which pushes Safari... If it's good enough for MS, it's good for Apple.
Re:Violating the EULA (Score:5, Informative)
The whole section on enforcability starts with "The enforceability of an EULA depends on several factors, one of them being the court in which the case is heard. Some courts that have addressed the validity of the shrinkwrap license agreements have found some EULAs to be invalid, characterizing them as contracts of adhesion, unconscionable, and/or unacceptable pursuant to the U.C.C." If you read between the lines, it says "No court has rejected EULAs outright". If you're outside the US, it seems to be much the same. Yes, Germany declared the bundling with Windows to be unenforcable, but the EULA as such still remains. In short, you're talking about the way you want it to be not legal reality except possibly in Kansas where there was a ruling agreeing with you.
Re: (Score:2)
Re: (Score:3, Insightful)
If you do not agree to the license, you do not have a right to use said software.
Especially in the case of boxed, purchased software, I gained the right when I gave the store clerk money in exchange for that software. In fact, since up until the point that I click "I Agree" to some ignorable EULA I haven't even given the illusion of agreeing to anything, it's my right to hack out any objectionable code (such as that EULA dialog). That's because I own that copy of the software.
Fine by me (Score:5, Funny)
Re: (Score:2, Funny)
Switch? (Score:3, Funny)
Apple, these sort of tactics really are not necessary. Don't take the low road please...you can win it by going on the high way.
Re:Switch? (Score:4, Insightful)
some comments (Score:4, Informative)
(I have a Mac Mini, an iMac, and several iPods, but I now mostly use my Ubuntu systems for everything)
so confused (Score:2)
Re: (Score:2)
1) Apple fanbois who can't afford an Apple, or don't know about Boot Camp, or don't want to keep jumping between two different OSes, or just want a browser that looks like their iTunes.
2) Web devs who want their sites to look reasonable for any Mac visitors.
There's probably also a small number of people who might see it and be tempted to check out a full Apple computer because of it, but given that it'll stick out like a sore thumb in Windows then I doubt it.
Re: (Score:2)
Re: (Score:2)
A) Web developers.
B) Steve Jobs worshippers.
B is a freagin huge group of people.
Profit? (Score:5, Funny)
Step 2: Sue non-Mac owning PC users for violating EULA
Step 3: ???
The EULA says... (Score:2, Interesting)
It doesn't say how many I can install on non Apple-branded machines...
Why is this bad? (Score:2)
I am trying to figure out why this is a bad thing, and I'm coming up dry. Help me here.
Not the first impossible EULA (Score:2)
Everyone knows EULAs are a joke, and this certainly isn't the only one that's impossible to comply with [honeypot.net]. Are they legally binding anywhere?
Hardly surprising (Score:4, Interesting)
And the heavy-handed tactics they use to push said software is truly amazing. If MS did half of the underhanded stuff Apple does, they would be dragged back into court in a heartbeat. Why Apple continues to get a free pass on such crap is beyond me.
I will NOT install Quicktime, iTunes, Safari or any other Apple software on my computer. And I always advise others not too as well. It's just not worth the hassle (if Apple really wanted your business, and not just to sleaze their way onto your computer, they would sell iTunes songs through their website and not require a software download).
Re:Hardly surprising (Score:5, Interesting)
Seriously though, Apple is allowed legaly for said reason, but I never understood why people accept it... I mean, last I checked, when Microsoft -started- doing that crap, they weren't a monopoly either...and look where it got us.
That being said...watching a media player (iTune)conflict with a RAID (I swear Ive seen that happen) is quite amusing... Just exactly WHAT is that stupid thing doing anyway?
Re:Hardly surprising (Score:5, Informative)
That "spyware" service you refer to is just a notifier to open iTunes when an iPod is connected. That's all it does. It's hardly malicious, and it doesn't report to Apple what you do with your computer.
Re: (Score:2)
The tricks would be different, but similar things can be done on OSX too. You just need different tactics, and (almost) no one
Re:Hardly surprising (Score:4, Insightful)
Safari is marketed as the perfect browser for Windows, without flaw, without question. They have the gall to assume that everyone who uses iTunes would prefer Safari simply because it has an Apple logo on it.
And when Safari falls victim to Security vulnerabilities just like every program out there, those of us who know what we're talking about don't blame Apple for their complete incompetence as programmers. Security vulnerabilities happen. It's the way of programming. It's virtually unavoidable. Yet fanboys turn around and say Apple isn't obligated as a company to produce secure software and back up their own marketing hype simply because Windows is a crap platform. It sickens me. And they get away with it.
in related news... (Score:2)
Nobody reads them (Score:4, Funny)
More likely, some tired programmer just copied the string resource across from another project without checking it.
GPL Violation? (Score:3, Interesting)
The offending section seems to have an even bigger issue in it.
It reads:
B. Certain components of the Apple Software, and third party open source programs included with the Apple Software, have been or may be made available by Apple on its Open Source web site
(http://www.opensource.apple.com/) (collectively the "OpenSourced Components"). You may modify or replace only these OpenSourced Components; provided that: (i) the resultant modified Apple
Software is used, in place of the unmodified Apple Software, on a single Applelabeled computer; and (ii) you otherwise comply with the terms of this License and any applicable licensing terms
governing use of the OpenSourced Components. Apple is not obligated to provide any updates, maintenance, warranty, technical or other support, or services for the resultant modified Apple
Software.
You expressly acknowledge that if failure or damage to Apple hardware results from modification of the OpenSourced Components of the Apple Software, such failure or damage is excluded from
the terms of the Apple hardware warranty.
---
Now, one of the open source components used in Safari was/is Khtml which is licensed under the GNU LGPL. Now this clause allows you to modify & use the open source components ONLY if you use them on a single system (assuming the apple-labeled part has been fixed as i've heard).
A buffer overflow? In 2008? Seriously? (Score:5, Interesting)
Man, they're not even trying are they? This day an age, not only is there no excuse to ship with such a basic flaw, there's really no excuse to be programming in a fashion that would allow it. It's so easy to audit for basic overflows (at least on Windows) that it's silly. Even just compiling /GS with VC++ should protect you against a lot. Seriously, people give MS a bad rap these days, but any exploit you're going to see in their software these days usually takes advantage of complex system interactions or odd exception throwing.
Apple should take a serious look at their coding practices and consider banning the use of unsafe CRT functions and using _s versions of any C functions their using (Visual C++ has them and they're part of the next standard) or at a minimum requiring audits of all raw pointers. Static analysis tools should also be mandatory and should catch most issues.(http://www.spinroot.com/static/)
A buffer overflow? In 2007? Seriously? (Score:3, Insightful)
That's because Microsoft's "Active Content" security model, introduced in 1997, pretty much created the 'complex system interactions' vulnerability ecosystem. Before then the whole idea that an application that displayed untrusted content would provide a path for that content to execute code with full local user priv
0.5 billion users??? (Score:3, Interesting)
Apple Update Sucks! (Score:3, Insightful)
All I want to do is update QuickTime on my XP box. I need it because of the .mov and .qt files it won't play otherwise. QT tells me there's a new update I must install, but the ONLY WAY Apple will provide me this update with bundled with iTunes which I DON'T HAVE and DON'T WANT!
It's never a good idea to install software you have no need for (I'm one of the remaining 27 people in the world without an iPod), don't want (the software, or the iPod), and don't know how avoid without just not updating in the first place.
Why the hell does Apple think I need an iTunes update just to update their buggy QT?
Re: (Score:3, Informative)
Yeah, and they found that it's based on Konqueror, not Firefox. Something that Apple widely acknowledges, too.
Re: (Score:2)
Re: (Score:3, Informative)
You're free to do one yourself if you want, since Safari's engine, WebKit, is open-source. It's kind of odd though that a "rip off" of Firefox would be scoring so much higher than it on the Acid3 (100/100 now as of the latest nightly), and (compared to FF2) on Acid2.
You must not come here much, do you?
Re: (Score:2)
hehe
Re: (Score:3, Funny)
Re: (Score:2)
worst of both worlds. good luck with that.