Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Safari Privacy Bug May Be Leaking Your Data

timothy posted more than 4 years ago | from the problem-with-software-is-that-it-sucks dept.

Security 152

richi writes "If you use Safari, your browser may be leaking your private information to any website you visit. Jeremiah Grossman, the CTO of WhiteHat Security, has discovered some Very Bad News. I have some analysis and other reactions over at my Computerworld blog. The potential for spam and phishing is huge. A determined attacker might even be able to steal previously-entered customer data." In short, autofill for Web forms is enabled by default in Safari 4 / 5 (and remotely exploitable), and the data that this feature has access to includes the user's local address book — even if the information has never been entered into a Web form.

Sorry! There are no comments related to the filter you selected.

But not Firefox... (5, Insightful)

alain94040 (785132) | more than 4 years ago | (#32996220)

It seems that the bug is due to Safari allowing keyboard events to be generated from Javascript, so a malicious script can pretend to interact as if it were the user, whereas Firefox doesn't get fooled.

--
The Founder Conference [thefounderconference.com] is coming August 17

what the user sees should be hidden from programs (2, Insightful)

improfane (855034) | more than 4 years ago | (#32996310)

This reminds me of Windows. It's impossible to override certain key combinations like CTRL+ALT+DELETE.

It's kind of obvious: you don't let a program ever, imitate the user in the same context. Web browsers should never have been able to create windows 'outside' of the rendering area to boot (unless full screen)... browsers should never have been able to 'see' what the user sees in regard to links...Internet explorer showing contents of C:\...and so on...

Re:what the user sees should be hidden from progra (1)

telchine (719345) | more than 4 years ago | (#32996732)

This reminds me of Windows. It's impossible to override certain key combinations like CTRL+ALT+DELETE.

Is this true?

Odd coincidence, but last nioght I got a Windows

Re:what the user sees should be hidden from progra (1)

nickspoon (1070240) | more than 4 years ago | (#32997988)

Odd coincidence, but last nioght I got a Windows

Did it hurt?

Re:what the user sees should be hidden from progra (1)

SanityInAnarchy (655584) | more than 4 years ago | (#32998862)

And why should fullscreen get a pass?

Re:what the user sees should be hidden from progra (1)

improfane (855034) | more than 4 years ago | (#32999870)

Only if the user invoked the fullscreenedness should it be permitted. I think in that way it would very difficult for software to 'fake' your desktop.

Re:what the user sees should be hidden from progra (1)

Cankersore (946935) | more than 4 years ago | (#32999270)

Its not impossible. Its just the default

Bad Headline (3, Insightful)

dch24 (904899) | more than 4 years ago | (#32996392)

Jeremiah Grossman says in the comments:

@Anonymous, Tom: I believe this may be a WebKit issue and not just Safari. While it is difficult to confirm now, I suspect this technique did in fact affect Chrome. Had some discussions with Google a while back surrounding this topic and recall them finding/fixing something, but I don't really get all the details straight. Will have to find an older Chrome version somewhere to confirm...

@Harryf: good find, that is vaguely similar and potentially offers a way to make this more efficient.

@klkl: it does, sorta, but getting it to work is more difficult than it should be. At least for me. :)

Would that have been before or after Eric Schmidt resigned Apple's board and they became sworn enemies? He didn't get mad because Steve started stalking him, did he?

Oh well, I'll hit submit in Safari now...

Re:Bad Headline (2, Funny)

Anonymous Coward | more than 4 years ago | (#32999614)

No need to hit Submit-- I've already got it.

Re:But not Firefox... (-1, Offtopic)

Anonymous Coward | more than 4 years ago | (#32999494)

Newsflash: Safari isn't the only thing from Cupertino that leaks information. I'm talking about fags' asses leaking DNA in the form of semen.

Maybe I'm misremembering Owebama's lofty campaign speeches, but weren't we promised that lobbyists would have no place in his administration? So how is it that Google's chief lobbyist would up as ol' Barry Soetoro's WH Deputy Chief Technology Officer?

http://nlpc.org/cached/white-house-emails-show-more-extensive-improper-contact-google.html?q=stories/2010/07/22/white-house-emails-show-more-extensive-improper-contact-google [nlpc.org]

So..'many eyes make bugs shallow'? (1, Interesting)

RLiegh (247921) | more than 4 years ago | (#32996258)

If that old canard is so true, than I have to wonder why it is that their are so many security-related issues with F/OSS browsers that go unchecked for so long? While IE was justifibly a laughing stock nowadays webkit and firefox are barely much better -despite the 'many eyes' theory.

Could it be that the job is simply to complex for most non-professionals and that the open source model has reached the end of it's useful life?

Re:So..'many eyes make bugs shallow'? (-1, Offtopic)

Anonymous Coward | more than 4 years ago | (#32996346)

Can someone say "Strawman"?

Thanks...

Re:So..'many eyes make bugs shallow'? (5, Insightful)

bunratty (545641) | more than 4 years ago | (#32996364)

It could be that more of the vulnerabilities are being found in open source browsers than in closed source browsers. In other words, closed source browsers may have many more undiscovered security problems. IE still has security vulnerabilities they're not fixing, both ones that are publicly known and ones that only Microsoft and a few others know about. Chrome and Firefox have no publicly known security vulnerabilities today.

Re:So..'many eyes make bugs shallow'? (4, Insightful)

natehoy (1608657) | more than 4 years ago | (#32996660)

Actually, this is a perfect example of it.

The vulnerability is in closed-source software, because Safari is closed-source. The vulnerability does not exist in Webkit (the open source component of Safari), so no one but Apple can fix this issue.

The issue was discovered almost by accident. Safari allows Javascript to emulate keypresses (which is almost inconceivably stupid).

If any respectable open source team member had seen Javascript events being passed to the keyboard buffer, he or she would have screamed blue bloody murder and it would have become a priority one bug faster than you can say "the developer who wrote that shit has just lost code submission privileges on this project".

Re:So..'many eyes make bugs shallow'? (4, Insightful)

ToasterMonkey (467067) | more than 4 years ago | (#32997224)

If any respectable open source team member had seen Javascript events being passed to the keyboard buffer, he or she would have screamed blue bloody murder and it would have become a priority one bug faster than you can say "the developer who wrote that shit has just lost code submission privileges on this project".

I'm not buying your assertion that open source developers are more attentive or more dedicated than non-open source developers. What is the rationale for that?
Other than defining the QA process to be whatever you want and being your own QA team, what advantages does a project being open source confer in this regard? Some outsider can swoop in and patch your critical security vulnerabilities for you, with tests, and no new bugs? Your users can fix bugs on their own, maintaining private one-off branches?

Not to dig on open source or anything, but I think it's usefulness is being pushed a BIT too far sometimes. There are certainly places it shines, but this is not one of them.

Re:So..'many eyes make bugs shallow'? (2, Insightful)

ewanm89 (1052822) | more than 4 years ago | (#32997436)

the Q/A being in the open anyone can go file and read through the bug reports, and if anyone actually didn't assign such a bug as priority one, then the whole project would be ridiculed, probably here and in many other places.

Re:So..'many eyes make bugs shallow'? (3, Insightful)

amicusNYCL (1538833) | more than 4 years ago | (#32997664)

I'm not buying your assertion that open source developers are more attentive or more dedicated than non-open source developers.

It may even go the other way, it may foster complacency. A programmer working on an open source project may be more likely to assume that someone else has already looked at the code and therefore that they don't need to do it themselves. In an organization there would be someone who's specific job is to audit everything, but if that's left as a community task with no one person taking responsibility for it then it might breed complacent developers.

Obviously this is pure speculation.

Re:So..'many eyes make bugs shallow'? (2, Interesting)

PopeRatzo (965947) | more than 4 years ago | (#32998054)

I'm not buying your assertion that open source developers are more attentive or more dedicated than non-open source developers. What is the rationale for that?

It could be because between open source and non-open source developers, only one group has a boss to hate.

Freedom to do the best job you can and the sheer desire to create a product that's good enough that you would use is a very strong motivating factor.

I'm not saying this is necessarily the "rationale" you asked for, but maybe. Maybe the open source developers didn't have to waste their time going to "team building" workshops, or Monday breakfast meetings or have to keep their mouth shut while their boss screws something up or takes credit for the developers' work.

Not that open source shops are utopias, but I think it's possible that they are more dedicated than their colleagues at Microsoft or Apple.

There are certainly places it shines, but this is not one of them.

Wait a minute now. We're talking about four browsers. The ones from Apple and Microsoft have security vulnerabilities and the ones from Google and Mozilla do not. Is it just coincidence?

Re:So..'many eyes make bugs shallow'? (3, Insightful)

BitZtream (692029) | more than 4 years ago | (#32999668)

Freedom to do the best job you can and the sheer desire to create a product that's good enough that you would use is a very strong motivating factor.

I'm sorry, have you actually USED any OSS software?

Yes, thats true for a few things, but the 'quality' and 'movtivation' of OSS devs is just as shitty as closed source devs. For ever good OSS project there are roughly 1000 shitty ones, and the same is true for closed source software.

The people who write open source software are VERY OFTEN the EXACT SAME ONES writing closed source software. Most of the time its because one is so they can eat and the other is so they can relax and enjoy themselves.

I'm not saying this is necessarily the "rationale" you asked for, but maybe. Maybe the open source developers didn't have to waste their time going to "team building" workshops, or Monday breakfast meetings or have to keep their mouth shut while their boss screws something up or takes credit for the developers' work.

So instead of having real motivation like 'fix the fucking bugs or your fired and don't get paid' or we have OSS motivation 'I'll feel special if I fix a bug!' ... And you think thats going to make OSS safer? Let me tell you how developers work. They write some code that they are proud off and think is bug free, and then ... someone finds and exploits thier pretty code because only about 1 out of 10,000 even care about finding bugs rather than pushing out new features, and only one in 10k of those actually have the skills to examine code and applications to find bugs, even fewer still have the ability to figure out ways around security mechanisms.

Wait a minute now. We're talking about four browsers. The ones from Apple and Microsoft have security vulnerabilities and the ones from Google and Mozilla do not. Is it just coincidence?

Wait, what? Are you blind or just born yesterday and don't have any clue wtf you're talking about? Let me quote what the person who found the bug said on the page linked since no one bothers to read it ...

@Anonymous, Tom: I believe this may be a WebKit issue and not just Safari. While it is difficult to confirm now, I suspect this technique did in fact affect Chrome. Had some discussions with Google a while back surrounding this topic and recall them finding/fixing something, but I don't really get all the details straight. Will have to find an older Chrome version somewhere to confirm...

DOM event model (3, Insightful)

bussdriver (620565) | more than 4 years ago | (#32997596)

The standard event model allows javascript to trigger events such as keystrokes.

Its easy to see why a browser obsessed with speed would just forward the API call to the internal event model. I can totally see the appeal and instinctive reaction to a situation like this; its clean, fast and simple coding - security is not often a big goal when you are initially just trying to get something working; even so, this could get missed by multiple eyes... Plus this is not part of webkit - its bridging the engine to the GUI; which is an unusual situation compared to the bulk of code - all the hard work is in the engine this just ties that to a GUI, quite likely there is a separation between working groups - obviously there is one since the engine is open source and the GUI is not. Their job is to bridge and probably do not get the level of attention as other aspects of the program.

I'm not letting them off the hook, this should have be caught within 1 version or during a security audit if there was one... and if there was:
1) was the attention given to the engine only?
2) do these people work on the code so they get tied up fixing bugs instead of just logging all the ones they uncover? (a lack of specialization)

Re:So..'many eyes make bugs shallow'? (3, Informative)

Smurf (7981) | more than 4 years ago | (#32998254)

If any respectable open source team member had seen Javascript events being passed to the keyboard buffer, he or she would have screamed blue bloody murder and it would have become a priority one bug faster than you can say "the developer who wrote that shit has just lost code submission privileges on this project".

Given that most Safari developers working for Apple are very respectable Open Source team members that contribute heavily to WebKit, I will have to say that your assertion is simply not true.

Re:So..'many eyes make bugs shallow'? (2, Informative)

BitZtream (692029) | more than 4 years ago | (#32998976)

The vulnerability does not exist in Webkit (the open source component of Safari), so no one but Apple can fix this issue.

Really? Because there is discussion between developers (not just fanboys like yourself) about it existing and being fixed in chome because its likely a webkit issue, not Safari.

Of course, I don't know that for a fact because its too soon to tell, but that didn't stop you from spouting some ignorant bullshit so why should it stop me?

Its a bug in the javascript and dom code ... which ... guess where that code comes from ... Its not like Safari does it different than every other WebKit based browser.

Re:So..'many eyes make bugs shallow'? (1, Interesting)

Anonymous Coward | more than 4 years ago | (#32996518)

Isn't this a bug in Safari, not Webkit? As such, it's Apple's responsibility, not the F/OSS community's.

Re:So..'many eyes make bugs shallow'? (1)

maxume (22995) | more than 4 years ago | (#32996530)

Your post would make sense if the majority of the work done on Webkit and Firefox was not done by professionals.

Re:So..'many eyes make bugs shallow'? (2, Insightful)

jc42 (318812) | more than 4 years ago | (#32997496)

Your post [about F/OSS software being safer due to the "many eyes" phenomenon] would make sense if the majority of the work done on Webkit and Firefox was not done by professionals.

I don't think any definition I've seen of Free/Open Software includes anything at all about the professional status of the programmers.

In fact, much of the work on the most popular F/OSS packages is done by "professional" programmers. This is widely understood as a way to improve your public image and résumé, since it allows you to get involved with new things that an employer wouldn't permit. Most employers don't like people working on something that they've never done before, so if you want experience with something new, you usually have to work on it in your copious spare time, i.e., as a Free Software project. And, of course, you want it to also be Open Source, so that people can read your good work and be impressed.

It's also common for the more enlightened managers to approve of employees getting involved in F/OSS work, for the same reasons, and to give the company more credibility among software developers.

But it's common for the corporate world to disparage Free/Open software developers as unpaid professionals. It's pure ideological PR, though, with little basis in reality. (Reality is always a lot messier than anyone's ideology. ;-)

Re:So..'many eyes make bugs shallow'? (2, Informative)

maxume (22995) | more than 4 years ago | (#32997768)

If you are going to shove words into my post, shove the words I was replying to into my post:

Could it be that the job is simply to complex for most non-professionals and that the open source model has reached the end of it's useful life?

Re:So..'many eyes make bugs shallow'? (1)

phopon (977751) | more than 4 years ago | (#32997774)

While it is true that most(all?) developers on things like the Linux kernel are professional, it isn't true that they are usually acting on their own. In fact from the looks of it, only between 15-25% of the code is from unpaid work. The majority is by people who are paid by one company or another to work on it.

Re:So..'many eyes make bugs shallow'? (0)

Anonymous Coward | more than 4 years ago | (#32999506)

And Safari wasn't?

Re:So..'many eyes make bugs shallow'? (2, Insightful)

phantomfive (622387) | more than 4 years ago | (#32996578)

Browsers are about the most complex piece of software you will find anywhere. Think about all they can do. They have a not just one page rendering algorithm, several different types. Different modes mean different things, and W3 lists over 20 different modes. [w3.org]

Then they have the networking part, that communicates to servers, opening several sockets at a time and coordinating their retrieval. And they have to be able to do it with HTTP1.0 or HTTP2.0. And they have to be able to handle weird HTTP things, like password authentication.

After that, they have to be able to parse at least three different image types (and image parsing libraries are a great place to look for vulnerabilities because they are complex and the data is hard to validate). And they have to be able to interact with the OS in some way to allow movie and audio playing. And flash. And Java Applets. And any other weird plugin.

Then add to it a complex, object oriented, interpreted language (as if the several versions of HTML weren't bad enough), and the fact that the entire page has to be dynamic. Quickly dynamic: people want to do animations with this stuff, it has to happen in milliseconds.

And a spell checker. Oh, and it has to be able to interact with and recognize tons of different character encodings. In short, if I had a choice between writing a kernel and guaranteeing that it was vulnerability-free, and writing a browser and guaranteeing it was vulnerability-free, I would take the kernel any day. It's a significantly easier piece of software.

So there are still bugs in IE too, don't worry.

Re:So..'many eyes make bugs shallow'? (2, Insightful)

pclminion (145572) | more than 4 years ago | (#32996690)

In short, if I had a choice between writing a kernel and guaranteeing that it was vulnerability-free, and writing a browser and guaranteeing it was vulnerability-free, I would take the kernel any day. It's a significantly easier piece of software.

The kernel (let's use Linux as an example) is significantly higher quality, not because it is a simpler piece of code but because it is written by people who aren't morons and actually care about robustness. A web browser has a lot of spec cruft to contend with, but that's peanuts -- a kernel has to contend with anything that could possibly occur on the machine, in any order, simultaneously or not, by any user, using any device, with any amount of memory, any number of CPUs, and any unknown modifications, modules, or other tweaks that might be in place. Comparing the two types of software is insane.

Re:So..'many eyes make bugs shallow'? (1)

phantomfive (622387) | more than 4 years ago | (#32997014)

The thing is, we have decades of experience knowing how to deal with all that; not only that, there have been books written, classes taught, and academic discussions about the best way to do it, and the best way to organize it, and the basic structure isn't going to change much. All those problems you mentioned are serious problems, it's true, but they've been solved, and you can learn about the various solutions in an undergraduate class and choose the one you want. A single person can write a basic kernel in a few months (although you'll have a lot of work adding drivers, but it's typically easier to avoid a security flaw in a driver than in a network-facing piece of code).

But you can't take a class about browser construction. The theory isn't really settled. It's entering uncharted territory. The problems may not be as complex, but you have to solve them yourself (and some of the problems are quite complex: the parser for a page of HTML must be a beast). It's harder to know what potential problems you may face in the future.

That's why I say I'd rather guarantee the security level of a kernel, because I know how to do it, and I know what problems I may face. Who would have thought of a cross-site-scripting bug? Are there other similar classes of bugs that haven't been discovered yet, that all browsers are vulnerable to? It's a lot less likely that you'd find a class of bug that hasn't been discovered yet for a kernel.

Re:So..'many eyes make bugs shallow'? (2, Insightful)

BitZtream (692029) | more than 4 years ago | (#32999002)

I've written my own kernels for microcontrollers and I've done a fair amount of embedding Gecko and now Webkit.

Embedding Gecko pretty much means you have to become a browser dev because mozilla is full of idiots but I digress.

I would, without any doubt in my mind, write kernel code over browser code.

Kernel code is freaking EASY compared to a browser. I'm more confident in fake 'memory protection' I can create without an MMU than I am of anything in a browser, and I know the fake memory protection is trivial to blow right past.

Hardware is really easy to deal with because there aren't 300 layers inbetween you and the real hardware. Way too much redirection and other code in a browser, not only do you have the browser code but you also have all the code under it that makes it useful, including the kernel.

Give me a SGI onyx with 64 processors and tell me to make a kernel and I'll do it.

Tell me to write a rendering engine for a markup language and my first question will be 'whats the pay rate and whats the signing bonus for even considering taking the project'.

Browser programming fucking sucks.

Re:So..'many eyes make bugs shallow'? (0)

Anonymous Coward | more than 4 years ago | (#32996740)

HTTP2.0 uhhh WAT?

Re:So..'many eyes make bugs shallow'? (0)

Anonymous Coward | more than 4 years ago | (#32997134)

That's nothing. Safari is the leading browser for support of HTTP 5.0.

Re:So..'many eyes make bugs shallow'? (1)

think_nix (1467471) | more than 4 years ago | (#32996966)

After that, they have to be able to parse at least three different image types (and image parsing libraries are a great place to look for vulnerabilities because they are complex and the data is hard to validate). And they have to be able to interact with the OS in some way to allow movie and audio playing. And flash. And Java Applets. And any other weird plugin.

says who ? why does this level of interaction have to deal with the os level ? WTF ? Why do application layer programs have to crash the whole box . please tell me why ?

Re:So..'many eyes make bugs shallow'? (1)

phantomfive (622387) | more than 4 years ago | (#32997052)

You sir, are dumb. Please go educate yourself. And at least try to understand what you read before responding.

Re:So..'many eyes make bugs shallow'? (1)

amicusNYCL (1538833) | more than 4 years ago | (#32997710)

why does this level of interaction have to deal with the os level ?

How exactly does the browser play video and audio without the OS? Should browsers come with their own audio and video drivers now?

Re:So..'many eyes make bugs shallow'? (1)

Kagetsuki (1620613) | more than 4 years ago | (#32999128)

Embedded browsers do.

Re:So..'many eyes make bugs shallow'? (2, Insightful)

bit9 (1702770) | more than 4 years ago | (#32997384)

Browsers are about the most complex piece of software you will find anywhere.

I don't disagree with your main point that web browsers are very complex. However, the above quote is pure hyperbole. There are many types of software that make web browsers look like child's play. Among them, I would say, are avionics software, flight software for satellites, etc. Those are just a couple examples - I'm sure there are quite a few others.

Re:So..'many eyes make bugs shallow'? (0)

Anonymous Coward | more than 4 years ago | (#32999374)

Embedded systems that require mission critical certification are always simpler than consumer apps. Go read about the NASA code certification process. Anything clever is removed by huge buildings full of auditors reading code on dot matrix printouts while wielding red markers.

If the auditor doesn't understand a piece of code, then the code is reviewed for refactoring. The fact that they use less common languages should not be mistaken for difficulty or complexity of coding. They use less common languages because most people do not require absolute reliability, therefore there is a huge market for less precise (more versatile) programming languages.

Re:So..'many eyes make bugs shallow'? (3, Insightful)

lennier (44736) | more than 4 years ago | (#32997812)

After that, they have to be able to parse at least three different image types (and image parsing libraries are a great place to look for vulnerabilities because they are complex and the data is hard to validate). And they have to be able to interact with the OS in some way to allow movie and audio playing. And flash. And Java Applets. And any other weird plugin.

All of these are certainly complex requirements which could understandably lead to bugs.

What it is not acceptable is for bugs in a data processing algorithm - say, image rendering - to even be able to lead to vulnerabilities.

There is no logical need, for example, for a JPEG parser to even conceivably trigger arbitrary code execution if the programmer makes an off-by-one error in an array subscript. It's simply irrelevant to the task of that code. It should be literally impossible to make a mistake in such code in such a way as to trigger code execution.

Because Internet programming is so complex that if vulnerabilities are not made impossible, they are a certainty, and a certain vulnerability times the size of the Internet mean even the smallest mistake is no longer tolerable. Humans simply can't work with that degree of precision, nor should they ever need to. This is exactly what we built computers for: to take over the repetitive drudge work which we can't do without error. So while a programmer can be assured to make errors, it's the job of the language to make it impossible for errors in data manipulation to lead to logically-unrelated weirdnesses like code execution.

Surely this isn't rocket Turing Machine science. We don't have to solve the halting problem to get rid of buffer overflows, do we?

Re:So..'many eyes make bugs shallow'? (1)

DragonWriter (970822) | more than 4 years ago | (#32997914)

Then they have the networking part, that communicates to servers, opening several sockets at a time and coordinating their retrieval. And they have to be able to do it with HTTP1.0 or HTTP2.0.

Can you point me to some resources (like, say, the RFC) for HTTP 2.0? I'm having trouble finding any evidence that it exists...

Re:So..'many eyes make bugs shallow'? (0, Flamebait)

DaveV1.0 (203135) | more than 4 years ago | (#32998100)

No, a web browser doesn't need to do most of what you have listed. In fact, it probably shouldn't be doing most of what you listed.

Web browsers need to display text, and maybe pictures. None of the rest of that stuff is needed. JavaScript, Flash, playing video and audio, plug-ins, spellchecker, etc. just aren't necessary and just leads to people use the browser to do things is just isn't suited to do. Even Java is iffy when it is used to run applications in the browser.

People treat the browser as their best, if not only, tool and use it even when it is not appropriate, much like using a hammer to drive screws.

Re:So..'many eyes make bugs shallow'? (1)

phantomfive (622387) | more than 4 years ago | (#32998638)

lol sure, go back to your world of using Lynx. Great browser. Meanwhile, back here in the modern world, a lot of people like Javascript, and in the future (with HTML 5) we are only going to see expanded use. You're fighting a losing battle man, you might as while give it up and put your energy into something where it can be useful. Or keep fighting windmills. If that's what you like.

Re:So..'many eyes make bugs shallow'? (0)

DaveV1.0 (203135) | more than 4 years ago | (#32998948)

Yes, tell me how much you like JavaScript when it locks up your browser. Remember this as you and your ilk continue to use the browser for more and more and basically turn it into an OS that runs on top of another OS. And, as more and more browsers are using the same innards (WebKit anyone), it is going to become a mono-culture. And, we know what happens with mono-cultures, don't we?

Meanwhile, you are using appeal to popularity to justify stupidity and laziness.

Re:So..'many eyes make bugs shallow'? (1)

phantomfive (622387) | more than 4 years ago | (#32999032)

lolol you are fun. There is more diversity in browsers now than there has been in a decade. Of course monoculture is bad, but you don't need Javascript for a monoculture.

Meanwhile, you are using appeal to popularity to justify stupidity and laziness.

No, I'm saying form follows function, not the other way around. If you learn what that means, you will be a better programmer (assuming you are a programmer).

Re:So..'many eyes make bugs shallow'? (1)

PeanutButterBreath (1224570) | more than 4 years ago | (#32998256)

Browsers are about the most complex piece of software you will find anywhere

So much the better then to keep them simple by omitting useless features like autofill. I don't need my browser to remember my personal information for me. (Seriously, who needs help typing in their own name!?) This is is a gimmicky feature thrown in to impress rubes. It is near worthless for legitimate use and and a crack waiting to happen.

Re:So..'many eyes make bugs shallow'? (4, Insightful)

natehoy (1608657) | more than 4 years ago | (#32996618)

Umm... WHAT? Sorry to burst your conceit bubble there, Sparky, but... "Many eyes make bugs shallow" does not apply to Safari, because Safari is not open source software.

Webkit (the open source rendering engine that Safari uses) is not vulnerable. Chrome and Chromium (also built on Webkit) are also not vulnerable. Webkit is fine, at least in regards to this vulnerability.

Safari (the closed-source browser built on Webkit) is vulnerable.

This is a closed-source software bug that has been reported to the vendor.

I don't disagree that all software has bugs. That's going to be true. But this is an example of the opposite.

Re:So..'many eyes make bugs shallow'? (0)

Anonymous Coward | more than 4 years ago | (#32996716)

I can see your upset, but I have to ask... [bit.ly]

Re:So..'many eyes make bugs shallow'? (1)

natehoy (1608657) | more than 4 years ago | (#32996872)

Not mad, just making a point. ;)

Re:So..'many eyes make bugs shallow'? (2, Informative)

Lars T. (470328) | more than 4 years ago | (#32997634)

Umm... WHAT? Sorry to burst your conceit bubble there, Sparky, but... "Many eyes make bugs shallow" does not apply to Safari, because Safari is not open source software.

Webkit (the open source rendering engine that Safari uses) is not vulnerable. Chrome and Chromium (also built on Webkit) are also not vulnerable.

Well, yes and no.

Jeremiah Grossman said...

@Anonymous, Tom: I believe this may be a WebKit issue and not just Safari. While it is difficult to confirm now, I suspect this technique did in fact affect Chrome. Had some discussions with Google a while back surrounding this topic and recall them finding/fixing something, but I don't really get all the details straight. Will have to find an older Chrome version somewhere to confirm...

@anonymous: this hack may have worked on Chrome at one time, but no longer. Trying to confirm, but difficult to get old OS X copies. :)

It is the free rider problem (1)

leereyno (32197) | more than 4 years ago | (#32997286)

The problem is that the people who use firefox are not cut from the same cloth as the people who develop it.

GCC is a robust and powerful compiler because the people who use it can fix it when it is broken and improve it.

The vast majority of those who use firefox and other such products are utterly incapable of fixing problems, or even of identifying when there is a problem.

Re:It is the free rider problem (1)

ewanm89 (1052822) | more than 4 years ago | (#32997794)

GCC is a lot more complicated than a browser, compilers are very tricky tools to make. A lot of users that can code C certainly wouldn't be able to make a compiler without training in that area (the difference between a CS degree and a software engineering degree). On top of that GCC is a whole load of compilers, assemblers and processors not to mention the optimizers. Add the question of how does one compile a compiler without the compiler, then one realises that just the build process is nastily complicated. Last I heard from GCC developers was that the code is quite a mess.

Yeah, I think I prefer firefox source code.

Re:It is the free rider problem (1)

ewanm89 (1052822) | more than 4 years ago | (#32997818)

Oh, and developers use browsers as well as compilers.

Re:It is the free rider problem (0)

Anonymous Coward | more than 4 years ago | (#32999890)

A browser is a compiler with a funky filesystem layer.

Re:So..'many eyes make bugs shallow'? (1)

lennier (44736) | more than 4 years ago | (#32997584)

Could it be that the job is simply to complex for most non-professionals

s/non//

I think reality is showing us that programming in the modern Internet's always-on, concurrent environment in non-thread-and-memory-safe languages is not merely difficult for amateurs, but impossible for even professionals to do safely.

I also think the answer will have to involving throwing out the von Neumann model, since we're manifestly living in a very non-von Neumann environment. Stuff happens all at once in a single giant massively-connected network of communicating processors (ie, the Internet) and we don't have any mainstream languages which even attempt to accurately model this. (Maybe Erlang?) We have Algol-descended languages based on the control-flow idea of 'do this thing, then that thing, in my private resource space', which is really efficient on one CPU, but into which we keep trying to shoehorn safety and concurrency and message-passing, and it's really not working, because you have to keep doing manually what the language is not designed to do and doesn't lend itself to doing. It sorta-works, but it creates huge potential for mistakes.

I think we need to start with replacing control-flow with data-flow completely and really pay attention to what the message-passing theorists in the 1970s were trying to say, and which OOP only partly implemented. The Internet is a message-passing network, but the software connected to it only half does message passing. We should go all the way.

Re:So..'many eyes make bugs shallow'? (1)

SanityInAnarchy (655584) | more than 4 years ago | (#32999020)

s/non//

So, most -profesionals? How... -professional of you.

Sorry, I couldn't resist when there's a bug in your joke regex about software development being hard...

(Maybe Erlang?)

Not till it has better Unicode support, at the very least.

We have Algol-descended languages based on the control-flow idea of 'do this thing, then that thing, in my private resource space',

JavaScript still functions more or less like this. Try developing a Chrome extension -- if you want to communicate between tabs, you're going to end up sending messages. Granted, it's not going to be nearly as efficient as Erlang if you're handling large data structures...

Me, I'm waiting for something like Reia, or maybe io, to get usable. Until then, I work with the tools I'm given -- Java at work and in school, Ruby and JavaScript at home.

Re:So..'many eyes make bugs shallow'? (1)

mjwx (966435) | more than 4 years ago | (#32998384)

If that old canard is so true, than I have to wonder why it is that their are so many security-related issues with F/OSS browsers that go unchecked for so long?

Because Safari is not an Open Source browser. No one but Apple can look at all of Safari's source code let alone submit a fix. Thus the old canard remains unchallenged, this is not endemic to WebKit or KHTML as it's affecting Safari only so I'd say the issue is in Apple's code, not the Open Source code.

In Soviet Apple (0)

Anonymous Coward | more than 4 years ago | (#32996336)

    Safari leaks ON you !

Yours In Cupertino,
Kilgore Trout

Only if you put the data there to begin with... (1)

DavidR1991 (1047748) | more than 4 years ago | (#32996370)

Who fills out all their personal information into OS X's address/contact listing? I certainly don't

Re:Only if you put the data there to begin with... (2, Informative)

Spy Hunter (317220) | more than 4 years ago | (#32996546)

Even if you've never used the Address Book app this information could be in there. In the OS X first-launch setup dialog it asks for your real name, and that gets automatically inserted into the address book. I'd wager that most people who use Macs have done this, so their real names are accessible to any website using this technique.

Additionally, though this is less likely, if you fill out the registration form during setup I believe that information also goes into the address book, so there's your home address and email too.

Re:Only if you put the data there to begin with... (1)

natehoy (1608657) | more than 4 years ago | (#32996710)

OK, fair enough, but (assuming you use Safari), this issue goes a little deeper...

What information have you filled into web forms? Is Safari set up so it remembers that information?

Sure, your name and address may be safe from the address book, but have you ever entered your name and address on a site and had it remembered?

If you use Safari and you wish to continue using it, it's a very, very good idea to read the first article and turn off the "remember stuff in web forms" immediately, and keep it off until a fix is available.

Re:Only if you put the data there to begin with... (1)

MoeDumb (1108389) | more than 3 years ago | (#33000414)

Auto-fill is enabled by default? OK, disable it by default and enable only when needed. Seems that would solve this problem until a fix is released.

Re:Only if you put the data there to begin with... (1)

theurge14 (820596) | more than 4 years ago | (#32997032)

I do. It's a rather useful feature.

That I will be using again once this bug is fixed. :P

Re:Only if you put the data there to begin with... (1)

vlueboy (1799360) | more than 4 years ago | (#32999284)

Who fills out all their personal information into OS X's address/contact listing? I certainly don't

The "computer literacy" which we have, and "cooperation with what the computer would like to have you do " sometimes go at odds with each other. Therefore, you probably can't fathom why I've seen plenty of managers and their staff in the financial sector, who want their data to be well known / available with little fuss for business' sake OR the higher education sector, where managers, faculty and staffers sit at their desks with lots of "free time" to gain arcane knowledge of address-book features without much practical security to keep them safe from data breaches. We think different, but they do not, and they do fill out this data or it is filled out in a centralized way for them.

Ironically, these businesses are largely big in nature, and hold much bigger stakes when the data is compromised than when it's nothing more than a breach due to Joe average's online naivete pushing "web 2.0 babbling" to his offline life and OS. We can blame our increasing pressure to "fill out every [pointless] textbox to collect a reward."

In my last couple jobs, Windows address books were filled out automatically, sometimes with very detailed information on locations, phones, titles, webpages and even detail boxes (sometimes including home #'s) I'm not sure if the MacOS Server version has this same kind of Windows Server integration, but it is reasonable to suspect that your internal information might have been stored there when you arrived at the company, and try to erase it locally if you find that to be "informally" OK.

I know all about you if you're a Safari user. (-1, Troll)

Anonymous Coward | more than 4 years ago | (#32996376)

When a Safari user comes to my site, I automatically know:

1) They make poor purchasing decisions. They'll waste many thousands of dollars on hardware that's four or five years out of date, but sports the "correct" logo.
2) They are homosexuals, or have strong homosexual tendencies. They are Apple users, after all.
3) They don't have a real job, but rather a sugardaddy or a trust fund.
4) They like fancy coffee blends.
5) They're likely hipsters (or rarely, an old fat neckbeard who's trying to relive his NeXT glory days).

Re:I know all about you if you're a Safari user. (0)

Anonymous Coward | more than 4 years ago | (#32996432)

Do detect this and charge them extra for your products accordingly?

proud to be! (0, Offtopic)

Infonaut (96956) | more than 4 years ago | (#32996516)

  1. Rainbow apple stickers are no longer "hip" or "in"?
  2. What are you doing after?
  3. You're just jealous. Maybe you'd like a job as my cabana boy. Did I already ask you what you're doing after? I forget. So many drugs, so little time.
  4. Listen, in Paraguay this blend of bat guano, fern leaves, and cave-grown coffee is common. Want a taste? Hey, what are you doing later?
  5. I'm proud to be a fat neckbeard who wears skinny black jeans, Chuck Tailors, ironic t-shirts, and ugly black glasses. You should be so lucky.

But seriously, what are you doing after?

Re:I know all about you if you're a Safari user. (-1, Troll)

Anonymous Coward | more than 4 years ago | (#32996534)

When a Linux user comes to my site, I automatically know:

1) They have no money because their mom cut back their allowance.
2) Their sexual orientation is indeterminate because they never had nor will ever have sex.
3) They don't have a job.
4) They don't like anything including themselves.
5) They are loser and likely smell bad.

Re:I know all about you if you're a Safari user. (-1, Troll)

pandrijeczko (588093) | more than 4 years ago | (#32997258)

In response:

1) Please refer to my response in 3) for full details as to why I have no need of an allowance from my mother. However, since I am not compelled to queue outside of electronics stores overnight on a twice-yearly basis in order to buy little white boxes with pictures of fruit on them, I do not spend the money I have on said boxes, thermal underwear (if queuing outside during the Winter period), or overpriced mocha-frappa-choca-rama-langa-ding-dong-chinos while posing with said white boxes in fashionable coffee houses.

2) Hmmm, interesting. I will have to ask my wife of 17 years if she is sexually frustrated through lack of attention from me.

3) Hmmm, interesting. I will have to ask my boss why he has been approving my project time bookings for the past five years which causes money that I never use to buy little white boxes with pictures of fruit on them (see 1) above) to mysteriously appear in my bank account at the end of every month.

4) The lack of a compulsion to buy little white boxes with pictures of fruit on them (see 1) above) stems from not having a requirement that everything I possess looks like a fashion accessory. From this it might be construed that not having a need to hide a personality disorder behind a corporate logo means that I probably do not have a personality disorder in the first place - in other words, I am a happy, well-adjusted Linux-using individual.

5) You are clearly telepathic, well done. Not only was I a temporary "loser" of my car keys today for about 20 minutes (until I found them in my trouser pocket in the washing basket) but I also have a particularly nasty cold at the moment which impairs the functionality my olefactory senses currently - indeed, my smelling capability is really bad at the moment. You really must tell me how you managed to work this out - was it with the assistance of an app from the store of the manufacturer of the little white boxes with pictures of fruit on them? (See 1) above.)

"If you use Safari, (4, Funny)

mark72005 (1233572) | more than 4 years ago | (#32996424)

"If you use Safari,..."

Phew. That takes care of everyone.

Re:"If you use Safari, (2, Funny)

Monkeedude1212 (1560403) | more than 4 years ago | (#32996542)

Well, everyone worth taking care of, at least.

Re:"If you use Safari, (0)

Anonymous Coward | more than 4 years ago | (#32996684)

Yeah, because no one has an iPhone or iPad.

Re:"If you use Safari, (3, Informative)

Lars T. (470328) | more than 4 years ago | (#32997652)

Yeah, because no one has an iPhone or iPad.

Naccio said...

@ Jeremiah Grossman: Does it work with iPad, iPhone or iPod browser?

July 22, 2010 11:56 AM Jeremiah Grossman said...

@naccio: no, it does not. Mobile Safari's behavior is different.

Bug? (3, Funny)

Anonymous Coward | more than 4 years ago | (#32996770)

Just don't hold it like that.

Re:"If you use Safari, (1)

lwsimon (724555) | more than 4 years ago | (#32996782)

I use Safari in Windows, and I'm taken care of too - I read the article (gasp!), turned off Autofill, and went about my day.

Re:"If you use Safari, (1, Funny)

SchroedingersCat (583063) | more than 4 years ago | (#32996904)

I use Safari in Windows (gasp!)

There, fixed it for you

Re:"If you use Safari, (1)

Monkeedude1212 (1560403) | more than 4 years ago | (#32996930)

How do you know you haven't already had the information taken from you?

Re:"If you use Safari, (1)

MobileTatsu-NJG (946591) | more than 4 years ago | (#32998030)

How do you know you haven't already had the information taken from you?

You don't know if you've had info taken from you, either. What do you do about it?

My guess is... (0)

Anonymous Coward | more than 4 years ago | (#32996744)

So basically, make a website with properly-named (and hidden) form elements, and have a form.submit on something that will likely be clicked? Or even a javascript on.change on the fields themselves?

Re:My guess is... (1)

Qzukk (229616) | more than 4 years ago | (#32997048)

It goes a little bit beyond that. Entirely automatic autofill is usually tied to a specific site, everything else is autocomplete. In this case, the attack is to create an input named "name" and insert the letter A in there. If the victim's name starts A, Safari goes beyond the usual dropdown of options that other browsers use for autocomplete and inserts the whole name directly in the field. If it doesn't, then the attack javascript erases the A and writes B, and so on.

It's not a webkit bug. Chrome will show the autocomplete dropdown (the "name" box will show everything you ever put into an input named "name") but won't fill in the input field so the javascript can't see anything (but if you click on an option in the dropdown fast enough, the script will see that)

While doing this, I discovered that Chrome's autocomplete dropdown has an interesting glitch: if you switch tabs away from the script while it's running, the dropdown will appear on top of everything else in some random location (in my case, chrome runs on display 2, and the dropdown appeared on display 1). I guess they didn't expect that an input field could open a dropdown while that tab is not visible.

Not a bug... (-1, Troll)

AnonGCB (1398517) | more than 4 years ago | (#32996746)

It's not a bug, it's a feature!

Not the whole address book (2, Informative)

Mojo66 (1131579) | more than 4 years ago | (#32996818)

and the data that this feature has access to includes the user's local address book

The only card that can be read is the "Me" card, not the whole address book.

Re:Not the whole address book (1)

pandrijeczko (588093) | more than 4 years ago | (#32998182)

...and having the "Me" card may allow me, as a wiley hacker, to work out if your account password is based on any information held in that card.

Or maybe it gives me your phone number so I can call you & do a bit of social engineering to make you install an application I want on your machine, or even get you to reveal your password to me...

Please do not underestimate the value of information to any hacker - even the "Me" card means someone can ending up knowing more about you then when they didn't have it.

I'm mad as hell... (1)

bennomatic (691188) | more than 4 years ago | (#32996826)

...unless, of course, they give me a free bumper for my MacBook.

Re:I'm mad as hell... (0)

Anonymous Coward | more than 4 years ago | (#32996948)

Just don't browse that way.

Problem solved.

Ohh my goood a Safari bug... (0)

Anonymous Coward | more than 4 years ago | (#32996946)

It is just amazing that Jeremiah Grossman and his friends always come up with little shitty bugs and get hyped by media.

OMG... Safari has a P*R*I*V*A*C*Y bug.

Seriously guys. With every new Safari patch-day there are tons of REMOTE CODE EXECUTION holes fixed that not only endager your privacy but all of your data. I never see media praising the finders of these vulnerabilities. Or maybe they are just not advertise themself enough like Grossman and Friends.

Data (-1)

Anonymous Coward | more than 4 years ago | (#32997008)

may be leaking your Safari privacy bug?

Update: Statement from Steve Jobs... (1, Redundant)

pandrijeczko (588093) | more than 4 years ago | (#32997278)

... you are holding your Safari browsers the wrong way.

Apple has fumbled the ball (-1, Flamebait)

Anonymous Coward | more than 4 years ago | (#32997390)

I'm sure this will lead to a exodus to Linux!!!!oneoneone!!!

Sorry... but every now-and-again I got to make fun of those dumb Linux faggots.

Re:Apple has fumbled the ball (0, Flamebait)

pandrijeczko (588093) | more than 4 years ago | (#32997804)

Apologies but could you repeat your message as I missed it the first time?

I was out with friends spending lots of money on a social life & beer since I don't spend it on overpriced designer hardware that makes me feel part of an elitist little club with permission to sneer derisively at anyone outside that club.

Re:Apple has fumbled the ball (0)

Anonymous Coward | more than 4 years ago | (#32999414)

I make enough money that I can do both because I have a real job because I know how to use a real computer. Now go back to your buddy's mothers basement and keep sucking down that Hamm's 30 pack you bought with tips from delivering pizza.

Re:Apple has fumbled the ball (1)

pandrijeczko (588093) | more than 3 years ago | (#33000498)

Like I said - great well-paid job, lots of disposable income with no need to spend any of it on little white boxes with pictures of fruit on them, great long-term relationship & about to spend this coming weekend at a classic rock festival in London seeing some of my all time favourite musicians play.

I'm in a great mood & immune from the goading of trolls - have a GREAT day yourself!

Only a few users' privacy was violated (2, Funny)

aapold (753705) | more than 4 years ago | (#32998062)

and they are: Alan Jones, 9112 Tarquin Drive Luton New Hampshire, Bday Nov 3, 1970, SSN# 867-53-0909...
Arthur J. Smith, 30612 Jethro Lane, Biscuitbarrelville Connecticut,
James Walker, 26318 Adrian Telescope Road, Harpenden Maine

Why would anyone use autofill? (1)

snowwrestler (896305) | more than 4 years ago | (#32998450)

Seems to me that autofill creates a database of personal information that is accessible by the Internet and dependent on a browser's security model. Does any kind of software have a worse record for security than Web browsers? (Maybe e-mail clients?)

The first thing I do in any browser is turn off autofill for all fields. Anything I need to type into a form is either already in my head or I can look it up easily (credit card number for instance). Either way, it's personal info that IMO does not need to be attached permanently to the Internet.

Overblown? (1, Redundant)

nilbog (732352) | more than 4 years ago | (#32999182)

The only time the data is given to the browser is when you've already started typing it. Iirc you have to enter one field and then tab to the next. So if you're giving this data anyway it's not really a vulnerability. The only potential victims are people who start entering data and then decide not to. Worth paying attention to, but not exactly a huge problem.

Re:Overblown? (0)

Anonymous Coward | more than 4 years ago | (#33000020)

BZZZZZT! YOU ARE WRONG. You are an idiot. Did you READ the ARTICLE? You are very very wrong. I think, sadly, you are suffering from AIDS-RELATED DEMENTIA. Many Apple users suffer from that. I feel sorry for you.

You are WRONG.

What is the appeal of Safari in the first place? (1)

Kagetsuki (1620613) | more than 4 years ago | (#32999226)

I use it once in a while to test compatibility with web applications I'm developing, but even then I find it frustrating to use. Perhaps it is just the windows version, but buttons never respond quickly, in general the browser just feels slow and heavy, and the fact that F5 doesn't refresh a page annoys the hell out of me (as I use it constantly in every other browser). On top of that Safari renders everything in tables, and if you save a rendered snapshot of the page you get this one line table vomit which makes it impossible to figure out what exactly is going wrong. Chrome of course gives the same output, but at least the default developer tools in Chromium are decent. My last WTF point about Safari is something that Apple is obviously handling differently for their own products: JavaScript mouse events, including drags - Safari will immediately reclaim the mouse and not let you implement a JavaScript drag easily unless you use their 800 line device detection library script and then set up a CSS3 framework of all sorts of bizzare obviously not standard garbage. This is what you see if you are able to view the HTML5+CSS3 demos on the Apple web page. Sure it looks good and perhaps even makes sense on an Apple device - but the whole thing could be done in JavaScript even without HTML5 (we're doing it!) and 3D stuff should be handled in Canvas; NOT Apple brand "it's a standard because we say it is" CSS3. Just look at the source to those demos, we achieved similar functionality in less than a quarter of the code using only actual standards and it even works on IE7+ (but the drag does not work on Apple devices, and we have no intention of adding hundreds of lines of code to allow it to).

Wonder when the video is released (1, Funny)

Anonymous Coward | more than 3 years ago | (#33000272)

Wonder when they will release a video of showing that all other browsers are also vulnerable (although different vulnerabilities).

Load More Comments
Slashdot Login

Need an Account?

Forgot your password?