Apple’s Safari 1.1: Panther Only? has an entry up about Apple’s newly released OS X 10.3, “Panther”.  Specifically, it discusses how Safari 1.1 is only available for Panther users and that there’s no word yet on a version for Jaguar (10.2) or earlier users.

“So what?” you might say.  Normally, you might be right here that it isn’t a big deal; however, things are a little different here.  As pointed out by the WaSP author (and the thing I immediately thought of when I heard this news), we’ve heard something very similar to this recently.  When Microsoft revealed that the next version of :IE: would only be available with the forthcoming “Longhorn” OS (not due for years, mind you) there was a huge outcry from the web development community about tying the browser availability to the new OS.

Well, that’s exactly what Apple’s done here and yet no one’s crying foul over it.  I hear Panther is great and I’m sure lots of people will upgrade to it, but not everyone and certainly not just to get the new browser.  It’s also possible that Apple may release a 1.1 version for the previous OS versions, but nothing like that’s been announced yet.  So, what makes this action by Apple different from when Microsoft did the same thing?  Why is Apple “getting away with it”?

This is an older entry and as such, it may be by a guest author or contain formatting problems / extraneous code. If you notice something wrong with the entry, please use the Contact page to let me know the entry title and issue.


Short answer: track record.

Long answer: Safari’s not considered a broken browser.  And 10.2.8 isn’t considered a broken OS.  Apple also isn’t letting years and years pass between upgrades.  Whether or not Apple makes a Safari 1.1 that’s compatible with 10.2.x is immaterial.  No one’s harmed by it in any way.

Safari isn’t tied in with the operating system in any fashion, which is very significant in my mind, and to my knowledge, doesn’t even have the largest user base of Apple browsers.  If Apple users really really cared, then Apple will give them Safari 1.1 for 10.2.x.  Apple knows its customers and its customers know and trust Apple.  That goes back to the track record thing.

Oh, and Panther’s been out for a whole of two seconds, and Apple certainly hasn’t done anything like releasing a statement of “we’re not going to develop Safari further for 10.2.x”.  I think this particular author, and yourself included, are drawing parallels that simply aren’t there.


I think this particular author, and yourself included, are drawing parallels that simply arenít there.

I’m certainly not saying the situations of Apple and Microsoft here are exactly the same, but the basics are very similar: a new browser version only being available with a new OS version.

If Apple does release 1.1 outside of Panther then good for them, case closed.  Similarly, it’s not beyond possibility that Microsoft may decide to release the next :IE: apart from “Longhorn”.  Both of those things would be good.  However, right now neither of those things are true.

“Broken” browers or OSs, time between upgrades, etc. are, to quote you, “immaterial”.  I won’t argue that a new version of IE might be more useful for Windows users than a new Safari would be for OS X users, but I’m just trying to talk about the core issue itself.

The issue here is that both Microsoft and Apple are doing effectively the same thing: MS gets blasted and hardly anyone speaks out about Apple.

Heck, in this case (and believe me, I hate “defending” them) I think if anyone deserved slack it would be Microsoft:

1) If the browser is tied to the OS, then at least that’s a legitimate (though unfortunate) reason why the browser couldn’t be revised/released beforehand.

2) Seeing as how Longhorn isn’t anywhere close to out yet, then there does remain the possibility that a new version of IE could appear for general Windows users between now and then.  It seems unlikely to happen, but the point is that it could happen.

I wasn’t intending the post to be another Apple vs. Microsoft debate, though I suppose I can see how it might be interpreted that way.  Rather I’m genuinely curious about why the two companies in such similar circumstances are being treated differently.

Man, I’ve totally lost my train of thought…  Damn this freezing office!!

Ha, I wish my office were freezing.  I think I work with a building full of non-circulatory zombies.

Anyway, that’s fine with me—we can ignore all of those variables.  I still lead down to three main points that make this conversation worthless:

1) Track record.  Apple hasn’t burned their customers in the past, and doesn’t have a policy and philosophy of anti-consumerism.  If Apple had the security problems, instability, and spywareish tendencies, then peole would be more ready to jump at the chance to lash out at them.  Microsoft customers are always poised and ready to attack the behemoth for anything and everything unrelated to browser upgrades.  Apple customers are not.

2) The one point I will not concede: IE needs fixin’, Safari doesn’t.  Like all browsers, Safari does have some bugs—enough that I won’t use it over Mozilla.  But it’s not screwed up and doesn’t force you to design your web page with its inadequecies in mind.  Not to mention, Safari came out less than six months ago.  It doesn’t even have an attached base of users within the Apple platform that comes close to the percentage of customers affected by IE.  Apple users still happily use Netscape, Mozilla, Opera, and Omniweb.  I haven’t looked at a demographic in a while, but I’d wager that Safari is still pretty far down on that totem pole among Apple users.  IE 6 has been out for years, and will be years before we see any changes.  At least Apple’s working on their browser.

3) This point takes it and makes me even upset that the linked article author, and you, can even try to claim that it’s a similar situation.  Apple has not made a statement saying that Safari 1.1 will not be made available for 10.2.x.  Microsoft said publicly “no more updates!”  When Apple says that, then the other arguments and points are relevant, but until Apple actually says that Jaguar users will never get another Safari update, then this is an apples and oranges debate.

I can see where these seem to be related. If safari 1.x (where x is<1) is only coming out for panther, then that means that people who want the new Safari are going to have to buy the upgrade to get it, which sucks. Same deal with
  Now I know Derek is a Microsoft hater, but i think all the OSes are nice. I do not consider XP a “broken” OS. However i do agree that IE sucks, I use it here and there, but i perfer Mozilla, however, i do think that it is a crock to say that “no, you cant have any more updates until you get our next OS.” REGARDLESS of who says it.
  I think so many people who are so stuck on Apple being “the smart choice, for people who arent bafoons” that they wont complain against the company so readily. Much the same instance is where i could drop a message on a log much like this one that might say “linux is hard” NO ONE would say anything to me agreeing. The responses would be more like “yeah well your just used to your easy-does-it ‘windows’, this log is for PC users that are computer-literate”
  BTW Chris, i made a web banner for your site so i could link it with all the other pretty 468x60 pics, see if you like it. [url=][/url]

how in the hell do you get a “tab” to work on here? my paragraphs arent working….

I’ve looked through all of the Mac sites that I frequent, and their forums, trying to see if I am an isolated Mac user in my opinion on this issue.  I found a few posts on Apple’s website, but just some general banter—definitely no red flag, lots of people upset type of thing.  Perhaps more significantly, over at MacOSXHints, perhaps the greatest assemblange of Mac geeks who have converted from the tech-PC realm, have absolutely zero topics devoted to it throughout their forums.  And they get some wild ones.

I forgot to mention earlier on “dangling something in front of people” to encourage upgrades—if there’s a carrot in 10.3, it’s most definitely Expose.  OMG, this is quite possibly the single most useful interface idea in a looong time.  Once you use it, you’ll seriously wonder how you lived without it.  {some dude with 300 open windows showing off Expose}

LOL, bro—Chris’s :CSS: make the tabs for us.  We don’t do any formatting in our comments.

And Greg—you too are missing the point—Apple’s not made any statement at all like Microsoft did regarding updates to the browser.  It’s a correlatory leap that is pointless until Apple makes such a statement.

Then how do you tab to the next paragraph? Is it by making spaces?

LIke so?

Yes, it is a star background.. i was trying some new things. With images and backgrounds….. it was one i new someone couldnt readily say HEY THATS MY LITTLE GRAPHIC!! i got tired of plain jain grey…. doesnt seem to inviting to me… not that theres anything to see there hehe.

jain = Jane

Unfortunately, Safari 1.0.x *is* broken: it doesn’t support secure web proxies, and there is no workaround, which means that secure web sites from Apple to Paypal are off limits, and I have to load up butt-ugly Mozilla or IE to do my banking. This is a known bug, and it’s been three months now and there’s no sign of an upgrade.

This seems to combine the worst of Windows and Linux: inappropriately bundling the browser with the OS, and forcing you to “upgrade to unstable / switch to a new distro” to get a fundamental bug fixed…

And on top of this, a major hit to the Pocketbook because my Mac (which runs jaguar quite as crisply as my theoretically faster PC runs Windows) isn’t supported by Panther!

Safari bugs list (short)
# Supports HTTP 1.0, not HTTP 1.1 (demo)
# Doesn’t accept gzip encoding
# No javascript error reporting - doesn’t comply with 15.11 ECMAScript specification.
# No developer documentation.
# Doesn’t support application/xhtml+xml
# navigator.appVersion is incorrect
# Wrong support of css overflow: auto and overflow: scroll (demo | pic)
# Safari breaks Section 508, Subpart B, Technical Standards by not allowing fully functional keyboard navigation.
# Doesn’t support HTML Label element. (demo)
# Doesn’t support javascript select() method on textarea elements. (demo)
# Doesn’t allow browser-based directory browsing.
# CSS: hovered elements still retain their hovered state. (demo) Previously, it was easier to trigger this problem.
# HTML DOM EMCAScript Bindings: does not support getElementsByTagName(”*”) on Node or Document. (demo)
# CSS: nested Inline elements inherit properties of their nearest block level ancestor. (demo | pic1 | pic2)
# [removed] Does not support number.toString(radix);. (demo)
# CSS: Incorrect and incosistent handling of percentual heights. (absolute demo pic | relative demo pic | absolute demo2 pic)
# CSS: Clip values start from the top and left of the content edge, not the top and left of the border-edge. (demo | pic | pic of exepected behavior)
# DOM 2 Node constants are not supported (demo)
# toString method does not work properly on some native objects (demo)

I agree with Curtis on this one. I think there is just a general mindset going on here. Some people seem to think that mac anything is better, even their policies.

i agree

The only bug in that list I would consider critical is this one:

# Safari breaks Section 508, Subpart B, Technical Standards by not allowing fully functional keyboard navigation.

But then Apple has traditionally done poorly in this department.

Why doesn’t it include the lack of HTTPS proxy support? Or is that just a list of bugs in 1.1? The problem is there’s showstopping bugs in 1.0 and upgrading to 1.1 requires an unreasonable investment of time and money (particularly for users of older Macs).

That’s just a 1.1 list, and it’s a heck of a lot shorter than buglists in IE that’s for darn sure.  Unfortunately, 1.1 is tightly integrated with a few Panther only features, so they stopped their dev trail with 1.0, which they always claimed as beta software anyway.

And Peter, I refuse to believe that your Mac will run Jaguar and not Panther.  I’m running Panther on an old crappy G3 iMac.  Where I used to work, it was also running on even lesser Macs.

Panther is not supported on the Platinum Powermac G3. Don’t believe me, check Apple’s website.

And tightly integrating the browser and the OS is a really really bad idea. When Microsoft did that I banned the use of IE at work, and then we all laughed as all the inherent security flaws in the MS HTML control showed up. The majority of email viruses, for example, use the desktop/browser integration and the fact that Outlook Express uses the MS HTML control to infect machines.

We have had zero virus outbreaks originating at our division in 10 years, and the only antivirus software we used for most of that period was a patch to Office to block auto-executing macros… and that’s only because I couldn’t ban Office as easily as I could ban IE.

If Apple is going down the same path as Microsoft, god help us all.

PS: Yes, I know it’s a short list. That’s why I asked if it was a 1.1 list, because it *is* short. But the HTTPS problem in 1.0 is a simple one, it’s an easy one to fix (lord knows, I’ve written that code enough times in enough languages by now), and it’s a fatal bug if you’re behind any high security firewall.

I don’t want to use IE or Mozilla or some third party theme-happy browser, I want to use one that uses native controls, so I get the consistent and clean user interface that Apple’s known for. And that means Safari.

No no no, not *that* type of integration.  Safari’s 1.1’s rendering and functionality *relies* on the OS.  IE is the other way around—Windows *relies* on IE.  Completely different situation.  One is just a compatibility issue (ALL software has requirements, btw, why don’t you guys complain about these?), the other is part of the OS.

Thanks for the heads up, too, Peter, I wasn’t aware of the problem with the Platinums.  That said, you sound fairly successful—don’t you think it’s time to trash that old can and buy a new computer? wink

im running osx panther on my girlfreinds mac g3 350mhz… and it works fine.. regardless of the settlement, i think its a good upgrade.

Greg: it’s not the processor that’s the problem… I’ve got a G3/400 upgrade in one of mine and I could put a dual G4 or even a GHz processor in it, thanks to Sonnet. It’s that Panther will not boot on a Platinum, period.

Derek: Webcore is an OS Framework now, is it not? That’s the same kind of integration that Microsoft has done with MSHTML… in Microsoft’s case it’s an HTTP+HTML library built into the OS. The problems come when applications use that tool to fetch resources, and dont (or in the case of MSHTML, can’t) check whether the resource they fetched is owned by the user or is fetched from the public Internet.

The only way to design something like this safely is to make it *always* the application’s responsibility to fetch resources, and separate the HTML rendering and HTTP access into separate libraries that do not, ever, call each other directly.

Once you start passing URLs to applications and having them transparently access resources in untrusted domains as well as local resources… then you’ve gone too far. Apple seems to be heading down that road, and that worries me… you can feed Finder an FTP URL and it’ll “mount” it on the desktop, and now that resource looks like a local file to applications. That’s scary stuff.

As for trashing my G3s… dude, I’ve got teenagers. Any budget for computer upgrades, they get.

You can feed Finder an FTP URL and itíll ďmountĒ it on the desktop, and now that resource looks like a local file to applications. Thatís scary stuff.

Sounds handy to me.  As you state, any compitent server administrator will have things in place that would prevent anyone from successfully using this for a damaging purpose, though I can’t even imagine what one would be.

Here’s my point: you can delete Safari and your Mac still works.  Good luck doing that with Explorer.  Not the same path.

how would they change the boot sequence so it wouldnt boot on the platinums and it will on other systems? (honest question) To my understanding panther was only addional GUI speed and OS addins.

Good luck doing that with Explorer.

you can delete IE if you want. The only thing it hurts is how you do windows updates. you have to download them manually instead of through the browser and a little pop-up installer.

You can “uninstall” it, but that really doesn’t uninstall much of anything.  All of the underlying functionality is still present in the system and can (I’m pretty darned sure) still be used and accessed by other programs.

Back during the whole “MS antitrust trial” bit, one of the people testifying for the prosecution was a university professor from somewhere or other.  Don’t remember the details, but the relevant bit is that he’d created a utility that actually did go in and strip out all the real pieces of Internet Explorer.

The OS still worked without it (which was the point of it—to show that IE wasn’t required for Windows like MS claimed), but a lot of the fancy schmancy integration features didn’t work anymore.  Which, depending on your views, was a good thing…

You browse files with Explorer, even if you delete the “Internet” app, the API and core services are still the same, and still dependant for the OS to operate.

Derek: Oh, it’s handy. All the things in IE and Windows that produced the flood of viruses were handy as well.

How to exploit it? Well, let’s see. It’s fairly common for applications to have a way to open and run local files, right? And to have paths to files embedded in documents. All you need to do is to sneak a path that goes to “/volumes/” and then get them to run what’s at the end of that path after the user has opened “” on their desktop.

Is it easy? Well, right now I don’t know of any way to do it… but there’s new programs coming out all the time, and all it takes is one of them treating something that looks like a local file as a local file and launching it, and *bam*.

Is it unlikely? It’s a potential scenario. There’s hundreds of viruses out there that do analogous things with similar convenient “features” on Windows.

Greg: You can’t get rid of the MSHTML control. You can get rid of IE, but IE is just a front end for the MSHTML control… and it’s still there, and you can’t get rid of it or else things like “Add/Remove Programs” will stop working.

Greg: They don’t include things like ADB mouse and keyboard support, support for the built-in video, PCI chipsets, that sort of thing. And they just plain check the model, ROM release, etcetera.

And, no, Panther is a LOT more than just a tweak on Jaguar. They replaced some major subsystems with the newer versions from FreeBSD, for example…

No, that wouldn’t work with OS X.  At least it couldn’t do anything harmful.  Apps don’t have root priviledges on *nix based OS’s, hence why you don’t see viruses on Unix, Linux, or the new Mac OS.  They’d have to ask the user permission to screw up their system, and the OS’s messages about what an app is trying to do are pretty clear and explicit.

[quote[ Greg: You canít get rid of the MSHTML control. You can get rid of IE, but IE is just a front end for the MSHTML controlÖ and itís still there, and you canít get rid of it or else things like ďAdd/Remove ProgramsĒ will stop working.

...uhhh ok…. i dont recall saying anything about mshtml… i just said you can delete IE.. as in the folder that contains IE… and the abilty for it open.

Windwos explorer (not a part of IE but another program that uses many common elements) will still get on the net.

Now, if you delete your common files folder.. that WILL screw your computer up.

Derek: sure it can do something harmful. It can copy itself to other computers, it can install itself in *your* preferences so it’ll restart every time it logs in, it can wait until you do an OS upgrade and piggyback on the installer package (which *is* running as root), it can open up a listening port and forward spam through your computer (which you get blamed for), and on and on and on.

After all, Windows NT has multiuser protection as well… unless you run with admin privileges to can’t write to system files, but you can still get infected.

Non-windows systems get fewer viruses because they have fewer avenues of infection. The Windows browser-desktop integration just opens up so many of these.

Greg: it doesn’t matter if you remove the ability for IE to open: the problem isn’t just the IE front end, it’s all the programs like Outlook and Windows Media Player that share the MSHTML control.

again… i said nothing about mshtml…. ever i JUST said you can delete ie… and thats all i said…. nothing.. ever… about mshtml…..ever….

Naw, you don’t need explorer running for the OS to work, at least not on XP. When explorer is shut off in a windows session, internet explorer can continue to run by itself. But for sake of argument you can shut them both off. I can still browse files on my drive using Microsoft Outlook or any third party file manager. Also those windows 3.1 style dialog boxes can still be accessed through any running app that saves, prints, etc. With IE off I can still surf to any website using Microsoft Outlook, Money, Encarta, Frontpage, MSN browser, Netscape, etc.
As a matter of fact, you can remove explorer.exe from ever booting up in your sys and try using your own shell/file manager. I do it all the time to shake things up. Program defaults and access remain the same.

I think those other shell and file mangers are still making calls to Explorer’s APIs, though.  It’s the only way into the Windows filesystem, IIRC.

Well you know those services are a part of Windows and still run, but explorer doesn’t need to be on for those services to work anyway. Oh and there is always DOS.

caesar: The file “explorer.exe” is not “Internet Explorer”. It’s just a front end program that starts up the Microsoft HTML control. The Microsoft HTML control is what used to be called “Internet Explorer” before Microsoft decided to try and pull a fast one on the Department of Justice.

You just made my point exactly.

And returning to the topic: has absolutely no similarities with Safari, or their decision for the dev path to change to Panther only.

Derek, I think you are confusing the idea of a similar situation with similar motives. I am sure that Mac is doing what there doing for a reason, and MS is doing what they are doing for a totally unrelated different reason. But they both are saying the same thing about their respective newer browsers which is, “you aint gettin it till you upgrade to the new OS”. That is a similar situation. Which means these incidents have the same or SOME of the same characteristics. So all your points about broken browsers and broken OS’s have nothing to do with the fact that these incidents are similar. And the only reason it is such a fractured topic is due to the general MS hatred out there. Mac gets away with it, MS cannot.

uh… looks like they are both getting away with it cheif….

And one more point. Safari already exists in its new form, denied only to those not using Panther. Windows users have not been denied anything cuz the new IE isn’t already floating around somewhere on a new ready to purchase OS. Longhorn is a good year away if we are lucky. When it comes out and something like IE 7.0 is in there, then we should turn to see if Microsoft is gonna deny owners of previous versions of windows that new browser upgrade. So Mac has really set the precedent.

windows allready said that they wont offer anymore upgrades for IE6 as in 7 wont work in xp either. ... thats the whole reason this is being compared to MSco.

I don’t buy it. The same thing was said about IE 6(outlook xpress6), WMP 7 & 8. Just ask any up to date user of a previous windows what IE and WMP they have installed on their puter. It’s 6 & 9. Though they’re not XP clones cuz they run in a diff environment, they still got a useable upgrade. So I am sure IE 7.0 will port in some way to XP.

caesar, no.  It’s not the same thing.  IE is not only saying that they won’t fix their current one, but they are also forcing you to wait for their next dev cycle in 2005 for an alternative.

Apple killed the Safari 1.0’s beta development chain, ending Jaguar user’s options with that browser.  But they have a current alternative that Apple is offering.

I don’t think anyone would complain that MS wasn’t going to update IE 6 if IE 7 were already available, Longhorn or not.  Again, we’re talking about new products.  Software has basic system requirements.  To me, complaining about that basic premise is like complaining that Diablo II won’t run on the same hardware that Diablo did.  Diablo owners are screwed!  They’ll never have a “run” key unless they upgrade their RAM and video card!

Remember, IE6 came out after Windows Xp released. And there have already been two service packs (fixes) for IE6 since IE6 was released. Also MS is planning to add some more features like a pop up blocker, which by the way is already available in the IE clone MSN browser. To say that we as MS IE users are waiting for the next dev cyc is a little ridiculous. We’ve been getting fixes and updates and added features all along. That is going to continue Through IE6’s life cyc on into IE7. As far as your “hardware” simile, I am sure that any porting of newer software is going to be limited by the older operating systems own services limitations. Which is exactly the way it is now with IE6 and say Windows ME. I am in no fear that MS will do the right thing when it comes to updating the browser, which is their “track record”. The only limitations will of course be the newer technology vs. the older ones. And that is understandable. Which is why I will definetly buy Longhorn when it is released.

Getting back to the topic:

1. there is an obvious and easily fixed security bug in Safari 1.0, and there is no supported fix for a lot of users who bought the *latest* version of Mac OS only a year ago.

2. Apple is following Microsoft’s lead in moving the core browser components (MSHTML, Webcore) into the OS.

3. in Microsoft’s case has lead to the biggest network security disaster of the past 30 years… and since computer networks have only been in use about 30 years that’s pretty damn impressive.

4. In Apple’s case, this has prevented them from fixing the security problem in Safari 1.0 because they’ve abandoned the standalone browser.

Here there be tigers.

uh…. no IE 6 came with windows xp…. In fact you could get a beta Ie6 BEFORE XP came out…

i also will mention that IE6 has not had ANY new features, nore does it plan to have any more… there arent any MS announcments to add any… the ONLY additions to IE6 have been security updates….  With the exception of some component integration as the windows components have changed.

Exactly, which was the whole point of Chris’s thread.  MS made a public announcement of making no updates or enhancements to IE 6.  Only system critical security flaws would be on the table for fixing.

And yeah, I remember having IE 6 before XP came out.  In fact, I’ve never had a computer that ran XP.  The last computer I had switched to Linux when I began using my Mac as my primary computer at home.

Peter, I’ll concede points 1, 2, and 4 to you, just because talking about them has grown tiresome.  But number 3 is completely irrelevant.  Why?  Like I said before, OS X, like any *nix based system is not subject to the flaws that make Windows such a healthy target for hackers and virii.

“IE6 came out after Windows Xp released” was not meant to say IE was released *after* XP was released, but came out *when* XP was released, both with XP and as a seperate download for all previous versions of windows except win 95 I think.
As far as fixes and features go read this

as i said.. thats alllll secuirty issues.. minus the pop-up and script blocking…. which should have been there in IE5

Man somebody start a new thread, this one is about beaten dead I think. smile

Derek: There is no “magic” in UNIX that makes it immune to viruses.

Look, I was at Berkeley in 1980, I worked on 4BSD, I was one of the original developers for the modifications to Jolitz’ code that became FreeBSD, I’ve written firewall software, found and fixed security bugs in major Open Source applications and I’ve been responsible for changes in the security model for Java when I found a problem there.

When I say Microsoft’s experience with the email virus plague is relevant, then, I’m not playing debating tricks… I’m 100% serious. Moving things like Internet access into the core and making it transparently accessible to applications is very dangerous, because it makes it impossible for an application to tell if it can trust the instructions found in a document.

The first time I had this discussion on comp.sys.amiga about 15-16 years ago, I posted an article describing a “UNIX virus” I had discovered, ending with “this is a hoax, but the techniques this virus used would work”.

A week later the “Internet Worm” hit. This was the first big worm on the Arpanet, and spread through an application-level security hole that had been left in “sendmail” as a convenience feature. My first reaction when the reports came in was “oh shit, someone’s actually done it, I’m doomed”.

Dodged the bullet, that time.

Windows NT is an interesting operating system with a ot of sophisticated security features at the OS (NT Kernel) level. They are rendered more or less irrelevant by flaws at the application level, flaws like the browser-desktop integration, and the low default security configuration required by applications like Microsoft Office.

There’s no reason that, with a better designed API and more attention paid to security, Windows NT couldn’t be just as “virus-proof” as UNIX.

And there’s no reason to expect that the UNIX underpinnings of Mac OS X render it inherently any more virus-proof than Windows, if the applications open it up to attack. There are very few vectors or reservoirs that don’t exist in OS X. The big difference is that there isn’t this dangerous blending of the untrusted Internet and the trusted local system in the same APIs that Windows has.

If Apple changes that, the UNIX underpinnings of Mac OS X won’t add up to a hill of beans.

no reason to expect that the UNIX underpinnings of Mac OS X render it inherently any more virus-proof than Windows, if the applications open it up to attack

Come on, Peter.  You’re a smart guy with a Unix background.  Unless the app has root priviledges, which user apps do NOT have, there is zero danger.  That by itself renders it “more virus proof than Windows.”

do not also forget that most people that took all the time to learn how to program linux use there skills to make money… not break things…

making viruses for windows is easy… and most jerks that want to fuck something up find out how to do it.

There ARE mac viruses…. just not a whole lot because who the hell wants to get pissed off and “hurt all those damned mac users”. then they would have to learn to use a mac themselves….. Until mac becomes even more mainstream… and cheap enough that any old jackass can get one and still run quake on it… i dont see a lot a viruses coming its way….

not to mention, in my experiance with osx… you had to have root permesions to do a TON of stuff…. and i had to type the password in manually each and every time…. no password saving there… i think thats a good feature and reather preventitive measure as well… i dont think mac will sacrifice that.

Then again…. if any old program can have access to the net through built in browser components… that at least means if you can geta program started without root permissions, then you could use that program to do other things that didn’t require permissions…. albiet with little effect other than silly things like pop-up messages… no real hdd treat i dont think.

uh, top paragraph hwere i said linux, that should have read “Unix”

damn you no edit button.

And a program such as that (hereto forthwith known as annoyance-apps) would show itself in the process viewer, and would be killed by a simple click.

Let’s not forget the hidiously long chain of unlikely events that it would take to even get to that point.  First, FTP isn’t used much anymore as a file distribution method, and second, how many Mac users would even know or want to mount an FTP link to their desktop?  How successful would the distribution of a script or application that would do that without the user’s intervention be?  Not bloodly likely, even if they tried to do it sneakily.  Mac users, similar in culture to the *nix geeks, are eager to assist one another, instead of screw one another.  The moment such an application or series of events was known to cause an annoyance-app or even something damaging, it would be known on every Mac related site out there, with detailed instructions on how to avoid or how to alleviate.  Mac users stick together, and that in itself is a defense mechanism that the Windows culture doesn’t have.

Maybe it’s because 13 and 14 year old Mac geeks are too busy with Garageband making music or doing other creative things when the 13 and 14 year old Windows geeks are trying to be l33t.

Maybe itís because 13 and 14 year old Mac geeks are too busy with Garageband making music or doing other creative things when the 13 and 14 year old Windows geeks are trying to be l33t. 

CHaaaa—CHING! My point exaclty.

Derek: you write “Unless the app has root priviledges, which user apps do NOT have, there is zero danger”

Um, no, that’s not in fact the case. First, you don’t need to be root to infect a user’s computer. Second, it’s not that hard to become root.

Let’s see. If I was a virus on a Mac OS X system, where could I hide? Well, let’s see… first place I’d try would be ~/Library… if there’s any “bundles” in there, their Resource subdirectory will be a great place to stick my executable content… and I don’t need to be root to do it. If there isn’t one, I can create one… I can pretend to be a buggy iTunes visualiser. If someone notices me, they’ll try running me, nothing will happen, they may not even bother to delete me. I can be a screen saver. Or I can just create ~/Library/Preferences/ and stick myself in there. Nobody’s going to screw with that.

Next, how do I get myself started automatically. Well, the obvious thing to do would be to go into ~/Library/Preferences/ and make myself the handler for .dmg files, or audio disks, or something like that. Then I’d run and run the original handler which I’d stashed somewhere… and I’d be live after reboot and nobody would ever know.

So, I can run code and have it rerun after login. Now, what can I do that’s dangerous? I can trash any of the user’s files, or corrupt them. I can send spam as that user. I can redirect the user’s browser to my websites. I can cause no end of trouble… without once becoming root.

But let’s say I want to become root?

Well, on Mac OS X the user is accustomed to switching into superuser routinely, through the Preferences panel and in installers.

So I hide until it saw an installer package in the user’s download folder that needed to run as root, then copy myself into the reources folder and hook myself into the installer configuration. I can use file events so I’ll know the package is there before Finder! And that’s just one way…

Sure, it takes time. What do I care? What’s time to a Virus?

As to “how do you map a file link to a user’s desktop”?

Try having a link on a web page pointing to ... in a “Location:” header on a link anywhere that it’ll get fed to Safari. Safari will feed that to Finder, and Finder will create a link on the desktop. All without the user’s intervention.

Right now, that’s as far as you get… but all it takes is one application running webcore that’ll load applescripts from a local file referenced from a document… and you feed that app the ftp: URL followed by the page with the local file link… and you’re in. Applescripts can do anything.

And that’s not unlikely at all. There’s been innumerable attacks on Windows that do exactly that.

And, finally, people have *already* written custom vireses targeted to a specific company to “get” them: that’s how the Halflife 2 source code was stolen. And since everyone “knows” macs are safe it’s even more likely you’ll catch someone offguard.

And antivirus software won’t protect against targeted viruses, because nobody’s going to have a signature for it until the virus gets discovered… and by that time you’ve already got your swag.

Nearly every one of the things your imaginary nasty-program would do would either alert the user, ask for permission, or the system would simply not allow the program to carry it out.  Not to mention that anytime the user ran the programs that have legitimate ownership of dmg, audio discs, etc., they would prompt you to switch them back to default.

Good luck tagging yourself inside a installer package, too.  And there’s still no hiding from the process monitor.

Your scenario is about as viable and likely as the movie Hackers.

And what’s the danger in a targeted virus to the public?  Zero.  No more than they should be worried about someone breaking into their house and using their computer.  Sure it can happen, but will it?

Derek: I’m sorry, but you’re wrong on every point.

Starting from the last: Windows has a process monitor too, it’s called “Task Manager”, and there’s a button for it right on the window that pops up when you hit Ctrl-Alt-Delete. The fact that you can easily see what’s running on your machine and kill things has done absolutely nothing to protect the average user from viruses.

Next… on my Mac, right now, as I type, I have .dmg files redirected to an alternate Mount program, and none of the standard disk tools have raised a peep.

Third, you don’t need to ask for permission to break root, you just need to wait until some other program you have attached yourself to does.

Fourth, an installer package is just a directory containing an archive, a bunch of plist files, and some resources. Modifying one on the fly is almost trivial compared to patching a Windows executable… and the beauty of this technique is that if you’re detected the program you just downloaded that now has the virus embedded into it will get the blame.

And finally, none of these techniques I’ve described are new. Every single one is already in use, on Windows, in malware that’s in the wild right now. Some of those program use far more involved paths to activate and hide themselves.

The current design is a fairly small hole, as I said already… there’s no way to use the existing Safari-Finder integration to break in without significant “social engineering”... tricking people into doing things. But the precedent is worrisome: it’s only a small opening, but it’s only a small convenience. It’s not something to make anyone rational say “stop using Safari”... but it’s something to watch. The next convenient internet integration tool may be one feature too many.

Hypercard Mac Attack!

Derek: I have had to clean up more than one infected UNIX box. System and network security is what I do for a living, and I have seen every trick viruses use to hide on Windows pulled on UNIX, up to and including replacing the kernel with one that didn’t show up the virus processes even with other ‘hacker’ tools applied.

There’s no “magic” to it: Windows has a decent OS under the hood, the problem is that the applications and libraries on top of it have been developed for features rather than security for the past two decades.

What I’m trying to get across is that merging the browser and the desktop is *dangerous*. As I have pointed out (not “admitted”, I brought it up in the first place) Apple has only *begun* to go down that road, but they need to be watched, because if they put too much effort into convenience features that reduce security the only reason you might be able to get away with not worrying about viruses is because of Apple’s poor market share. And that is hardly any reason to celebrate.

Wow Derek, you should go into advertising. You make Macs sound like the best thing since sliced Atkin’s 5net carbs bread. Seriously, I think we can all tell how much you love your Mac, which is quite touching really. Just remember there my man, that those of us who use Windows are not all ready to jump all over the behemoth as you suggest. In my mind Windows will someday prove to be the greatest of OS’es. It will come from the constant neccessity to refine in the face of unrelenting challenge. The things you say make Windows weak are the things that are gonna make it tougher in the end. Better in the end, more “Experienced”.

Apple has only *begun* to go down that road

I’ll make sure and keep my eye on that path.  If that’s all we’re arguing here, then both of our points are moot.  It takes at least two points to define a vector, and I’ll wait for the second step before the hair on the back of my neck stands up.

Well, caesar, if you spent less time pulling stuff out of your yang and actually spent some time with alternatives to your Windows box, you might appreciate the things I like about it a bit more.  And I’d not say that I’m a Windows-slanderer, more of an Anti-Mac-slanderer.  There are few things that irritate me more than people dogmatically citing uninformed opinions.

I certainly hope you’re right about the future of Windows.  I hope Longhorn is good enough to have a positive effect on computing as a whole.  If it’s not, it could be detrimental to the whole computing world, simply from the fact that its effects will be of broader scope by sheer numbers alone, good or bad.

Just remember that the man behind Microsoft is not a great thinker, nor is he an innovator.  He’s a very very sharp businessman, who has made every dollar he has by recognizing something that someone else did and called “good”, taking it for his own, and making it “great”.  It’s not likely that MS will cause innovation, but they are our best chance for adopting innovation and making it common.

I have redhat and mandrake and dislike them both. Sorry!

I’m not a big fan of Linux either.  It’s neat to tool around and pretend to be different, but it’s not a useful method of computing.

I am however a big fan of Mozilla; Mozilla firebird; Ghostzilla (my Favorite!); Netscape 7. The prob with *nux anything is that there is just too much going on in too many directions. There are endless releases and one package often dies off when something newer comes along (although some have stuck it out). Also the idea of subscribing to the software on your computer bothers me. Even the best Gui’s are asanine at best. The other is that until recently, no one workin *nix really cared about the *home* user all that much. The computing experience reminds me of Win95 at best (OMG!).Maybe in the future, once they catch a vision, it’ll all be alittle bit more user friendly and fun. But, if your running a server/network, it is a no frills, dependable, cheaper alternative for sure.Believe it or not I have high hopes for *nix, but for now I’m stickin with Windows. Besides I think in the future everything from refrigerators, stoves, garage door openers, home security, stereos, clocks etc are going to have some kind of OS in them. A Basic Input Output System. I think *nix is a better alternative to Windows or even Mac environments for these kinds of devices (excluding PDAs, phones, beepers, smart watches and maybe even MP3 players). Just a thought though.

Seriously, I think we can all tell how much you love your Mac, which is quite touching really.

well, they obviously must be lovers…

Leave Your Comment

Commenting is not available in this weblog entry.