Apple's Safari problem

You�ve probably heard of the current problem with Safari running under Windows. It�s basically a trivial method to �carpet bomb� a users desktop (or other folder) with files.

Now, as far as I can tell, it�s not a way to actually execute code on a user�s system. It merely provides the ability to put tons of files on a system, which could then be executed.

However, according to the Nitesh Dhanjani, who discovered the exploit, Apple believes this is not an issue and won�t be fixing it.

�...the ability to have a preference to "Ask me before downloading anything" is a good suggestion. We can file that as an enhancement request for the Safari team. Please note that we are not treating this as a security issue, but a further measure to raise the bar against unwanted downloads. This will require a review with the Human Interface team. We want to set your expectations that this could take quite a while, if it ever gets incorporated.� [Emphasis mine]

Nitesh goes to great pains to emphasize that Apple has been extremely responsive and a great pleasure to do deal with. And I have no doubt that they have been � Apple is comprised of a great deal of very nice, very smart people.

But maybe they don�t understand the Windows environment, in the broadest sense. They�ve shown they don�t understand the mores of Windows users, by forcing out security updates that include an unrelated application. And maybe they don�t understand our security environment. Perhaps life has been so pleasant in Apple Land that it�s like taking someone from the back-country and throwing them into the hardest areas of New York.

Anyone who has ever seen an infected spyware system knows what the desktop looks like: It�s a sea of icons providing shortcuts to various dubious sites. This method provides exactly that type of capability � a malware author can push all kinds of junk onto a desktop, saying �Click me for special savings!� and it could very well be malware.

But you�d have to have gone through that to understand how bad a �carpet bomb� can actually be. Perhaps Apple folks have been living in a bubble and simply haven�t seen this thing.

I hope this is fixed soon. Thankfully, Safari�s usage is still under 3%.


Alex Eckelberry