Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Friday Security Fun

pudge posted more than 10 years ago | from the updating-as-soon-as-i-post-this-story-and-quit-my-browser dept.

OS X 52

rgraham writes "Apple has release a new security update for the Safari cookie bug. 'Security Update 2003-12-05 updates Safari to prevent unauthorized access to a user's cookies.' They also updated the article on how to 'Configure Directory Access to Protect Your Mac From a Malicious DHCP Server.'" We posted that the other day, but this time, pictures!

Sorry! There are no comments related to the filter you selected.

I hope Fr. O'Day (-1, Offtopic)

Anonymous Coward | more than 10 years ago | (#7642038)

has been careful online, lest he end up being promoted to bishop.

~~~

Re:I hope Fr. O'Day (-1, Flamebait)

Anonymous Coward | more than 10 years ago | (#7655657)

Come on, now. There's a REASON for questioning the sexuality of Macintosh users. The general population, contrary to the rantings of professional gay marrriage advocates, are about 0.5% to 1% homosexual. Bisexuals don't count, they're just orgasm-no-matter-how-I-get-it fiends; transgender isn't an orientation at all, it's just a slip of the scalpel. And lesbians aren't really homosexual, they just like making hetero men horny as hell.

ON THE OTHER HAND... fully 75% of the Macintosh-using population are provably doing the butt-hole surfing.

So, Steve "I only stole BSD twice" Job is selling a product that CAUSES homosexuality!

Now I hope this puts the matter to rest.

FIRST FUCKING POST (-1, Offtopic)

Anonymous Coward | more than 10 years ago | (#7642043)

or maybe not

Cookies (5, Funny)

Anonymous Coward | more than 10 years ago | (#7642072)

Never hand out cookies when on a Safari!

That's it! (3, Funny)

Anonymous Coward | more than 10 years ago | (#7642164)

I'm switching to Fig Newtons.

Re:That's it! (2, Funny)

daeley (126313) | more than 10 years ago | (#7642730)

I'm switching to Fig Newtons.

Don't bother. The handwriting recognition sucks. ;)

Or another fix (1, Interesting)

Doc Squidly (720087) | more than 10 years ago | (#7642196)

Just don't allow cookies. (Yes, it seems too simple)

Re:Or another fix (1)

the web (696015) | more than 10 years ago | (#7642506)

"Just don't allow cookies. (Yes, it seems too simple)"

I'll agree.

CIRCLE GETS THE SQUARE!!

Re:Or another fix (3, Funny)

Anonymous Coward | more than 10 years ago | (#7642783)

Dude, you're logged into slashdot, which means you're allowing cookies.

Re:Or another fix (0)

Anonymous Coward | more than 10 years ago | (#7648621)

He could just log on every time he adds a comment.

Re:Or another fix (0)

Anonymous Coward | more than 10 years ago | (#7649631)

How did this get a +1, insightful?

Re:Or another fix (5, Informative)

SillyWilly (692755) | more than 10 years ago | (#7642891)

It has been suggested that even disabling Cookies won't help: http://www.securityfocus.com/archive/1/344992 As I understand it, this is because in Safari disabling cookies merely prevents creation of new cookies and not access to old ones. Therefore you should delete all cookies first.

Re:Or another fix (2, Funny)

mgahs (686653) | more than 10 years ago | (#7646277)

So you should...toss your cookies? Oh, stop. It was funny. (in my head, at least.)

Re:Or another fix (4, Insightful)

prockcore (543967) | more than 10 years ago | (#7643749)

Just don't allow cookies. (Yes, it seems too simple)

If by "fix" you mean "break a lot of functionality on sites" then yes, that certainly is an option.

Re:Or another fix (4, Informative)

Graff (532189) | more than 10 years ago | (#7644732)

Just don't allow cookies.
If by "fix" you mean "break a lot of functionality on sites" then yes, that certainly is an option.

That's why I love OmniWeb. It allows you to accept cookies, but throw them out when you quit the browser. Sure I lose such nifty "features" as not having to log into some websites but I also cut ads and whatnot of the ability to track me across sites for long periods.

Honestly, there need to be much better built-in controls on all browsers for limiting a server's access to data on your computer.

Re:Or another fix (4, Informative)

valkraider (611225) | more than 10 years ago | (#7645514)

You can do this with Safari [macosxhints.com] as well.

Site by Site (3, Informative)

chigaze (98602) | more than 10 years ago | (#7646981)

OmniWeb allows this in a site by site basis rather than across the board. So I can tell it to treat Slashdot cookies normally but trash Amazon ones after every session.

It's the one thing that could drag me back to OW but I also like my Safari tabs.

Eerily reminiscent of my Windows days... (5, Funny)

cbiagini (728046) | more than 10 years ago | (#7642584)

Along with this update, Steve Jobs announced today that OS 10.3.2 will include a small globe icon that will appear next to your system clock, helpfully reminding you that you have an update to install. While Jobs did acknowledge the fact that this feature has been in another operating system for years, he did point out that Apple's implementation will harness the power of Quartz Extreme to render fully three-dimensional, alpha-blended "Security Gnomes" that run around and patch your system twice a week. I'll still never Switch back though ;)

Re:Eerily reminiscent of my Windows days... (1)

Lars T. (470328) | more than 10 years ago | (#7642736)

On Windows this feature is called the Start Menu.

Re:Eerily reminiscent of my Windows days... (1)

billbaird (166492) | more than 10 years ago | (#7643453)

Actually no. The update notification/reminder appears in the system tray on the bottom right of the screen(by default) in Windows XP, 2000, and ME. The start menu would be a totally different monster.

Re:Eerily reminiscent of my Windows days... (0)

Anonymous Coward | more than 10 years ago | (#7642983)

> will harness the power of Quartz Extreme

exactly, i get all confused about what happens to my windows and where they go unless i see them shrink down like a CPU-crunching genie to the dockbar. BUT SERIOUSLY, i want a way to completely disable animations that are not exactly "essential". it irritates me. for someone that prefers blackbox and enlightenment on the desktop, and uses a powerbook on the road. well. it gets on my nerves.

Re:Eerily reminiscent of my Windows days... (1)

Tengoo (446300) | more than 10 years ago | (#7643506)

Install Enlightenment or Blackbox, what is stopping you? I know Enlightenment runs fine under X11 (or used to, it's been a while), and there's always Linux.

Re:Eerily reminiscent of my Windows days... (2, Interesting)

transient (232842) | more than 10 years ago | (#7643541)

CPU-crunching

BZZZT. Try again. Unless that Powerbook of yours is dreadfully old, the UI is rendered by your graphics card.

Re:Eerily reminiscent of my Windows days... (3, Interesting)

tim1724 (28482) | more than 10 years ago | (#7643632)

The compositing is done by the video card (remember, Quartz Extreme only accelerates compositing!), but much of the drawing is done by the CPU. The Dock's genie effect, in particular, is drawn by software.

Even on my G5 the CPU does quite a bit of work to draw that effect. Not enough to slow anything down, but enough to be visible in the Activity Monitor.

The scale effect ought to be done all in the video card, although I'm not sure how it was implemented. In any case, it doesn't use much CPU at all, so if CPU usage is a concern, tell the Dock to use the scale effect instead of the genie effect.

Re:Eerily reminiscent of my Windows days... (4, Informative)

Graff (532189) | more than 10 years ago | (#7644787)

The compositing is done by the video card (remember, Quartz Extreme only accelerates compositing!), but much of the drawing is done by the CPU. The Dock's genie effect, in particular, is drawn by software.

Both of the Dock minimization effects are handled by the GPU. The window is drawn as normal by the application that owns it and is passed off to Quartz Extreme, which then hands it off to the GPU with the appropriate rendering commands. With the scale effect that is a simple scale command, with the genie effect there is stretching and scaling. All of this is done through Open GL commands.

Re:Eerily reminiscent of my Windows days... (2, Interesting)

tim1724 (28482) | more than 10 years ago | (#7644873)

Upon further experimentation, it looks like you're right. The CPU slowdown I was seeing appears to be from the Dock resizing icons (to make room for the new minimized window) rather than from the genie effect ... I only see CPU usage jump when the Dock needs to scale icons to make everything fit. (Unfortunately, the Dock appears to scale and draw its icons itself, rather than keeping the 128x128 icon in a buffer and allowing the GPU to scale it.)

Re: STOP THIS! (0, Troll)

bursch-X (458146) | more than 10 years ago | (#7657252)

Please stop being so damn reasonable and honest, after all this is Slashdot.

Re:Eerily reminiscent of my Windows days... (1)

Golias (176380) | more than 10 years ago | (#7659723)

Refreshing to see somebody admit when they were incorrect once in a while.

By the way, even if the Genie effect doesn't hog CPU cycles, if you find to "too girly" or whatever, you can get rid of it via the Preferences.

Needs a reboot... (3, Interesting)

Fulkkari (603331) | more than 10 years ago | (#7642947)

The update needs you to reboot the computer. *sigh* Why is that? This is a web browser we're talking about. Shouldn't it be enough quitting Safari + all applications that uses it's content rendering engine? As far as I know, Safari isn't integrated to the OS in any way like IE to Windows, so it shouldn't be neccesary to reboot the *whole* OS. On the other hand they effectively stop applications to interfere while updating and cause problems that way. Maybe it's some precautionary measure, but I don't think this should be neccesary...

BTW software updater was already automaticly fetching the update in the background while I read this. It's really nice when you don't have to wait while downloading them. I don't understand what's the big fuss of letting the OS fetch updates in the background, as long as it doesn't install them. I'm not sure but I think software update does only download the important updates...

Re:Needs a reboot... (5, Informative)

Rosyna (80334) | more than 10 years ago | (#7643039)

A lot of apps use WebKit (Help, Sherlock, Safari, Mail) so it's easier to tell users to restart than to tell them to log out or to quit all those applications. A person that knows what they are doing will just force quit the installer.

Re:Needs a reboot... (4, Informative)

justMichael (606509) | more than 10 years ago | (#7643499)

A person that knows what they are doing will just force quit the installer.

Or run the update from the CLI.

Re:Needs a reboot... (0)

Anonymous Coward | more than 10 years ago | (#7643685)

The problem is softwareupdate does not work from the command line.

killerbean:~ root# softwareupdate -d SecurityUpd2003-12-05-1.0
Software Update Tool
Copyright 2002-2003 Apple Computer, Inc.

Security Update 2003-12-05: 0...10...20...30...40...50Bus error

You must download the update using the GUI and then from the command line
install -verbose -target / -pkg /Library/Packages/SecurityUpd2003-12-05-1.0.pkg

Re:Needs a reboot... (4, Informative)

bat, blind as a (450375) | more than 10 years ago | (#7644769)

$ sudo softwareupdate -i -a
Password:
Software Update Tool
Copyright 2002-2003 Apple Computer, Inc.

Security Update 2003-12-05: 0...10...20...30...40...50...60...70...80...90...1 00
Optimizing system performance. This may take a while...
Done.

You have installed one or more updates that requires that you restart your
computer. Please restart immediately.

Re:Needs a reboot... (2, Insightful)

Graff (532189) | more than 10 years ago | (#7644830)

killerbean:~ root# softwareupdate -d SecurityUpd2003-12-05-1.0

Man, do yourself a favor and don't use the root account if you can at all help it. Use sudo instead, it's much safer.

Re:Needs a reboot... (1)

MachineShedFred (621896) | more than 10 years ago | (#7661238)

Especially when Apple disables the root user by default. This guy had to go in and turn it on!

Re:Needs a reboot... (1)

Durin_Deathless (668544) | more than 10 years ago | (#7643494)

As a side note, in Jaguar the update gives Safari v 1.0.1 not 1.1.1 as given in Panther.....annoys me a good bit.

Re:Needs a reboot... (3, Informative)

tim1724 (28482) | more than 10 years ago | (#7643592)

Safari 1.1 (and 1.1.1) uses some new features of Panther which aren't in Jaguar. Hence it is not compatible with Jaguar, and wouldn't work.

Re:Needs a reboot... (1)

billbaird (166492) | more than 10 years ago | (#7643513)

I'm not sure but I think software update does only download the important updates...

It appears as though you can not choose what software update downloads automatically. Once things are downloaded you can make them inactive(remove them from the list of available updates). You can read more here(apple.com) [apple.com] ...

Re:Needs a reboot... (4, Informative)

Hes Nikke (237581) | more than 10 years ago | (#7644132)

The update needs you to reboot the computer. *sigh* Why is that? This is a web browser we're talking about.

oddly, this update isn't an update to Safari, instead, it's an update to the CoreFoundation framework!

as the name implies, CoreFoundation is the core of all your aqua apps, or at the very least, all your cocoa apps. one of the things this framework can do is let any app that uses the framework to get data from a URL, so it would make sense that the cookie handling would be there too. yeah, in this case i'd say a reboot is absolutely called for.

Re:Needs a reboot... (1)

Alex Thorpe (575736) | more than 10 years ago | (#7648195)

Thanks for the info, I was wondering about that. I went ahead with the reboot, since I'd rebooted the day before and had no uptime to preserve. I'd discovered the hard way that Escape Velocity: Nova needs a Panther update..

Re:Needs a reboot... (3, Informative)

Graff (532189) | more than 10 years ago | (#7644820)

BTW software updater was already automaticly fetching the update in the background while I read this. It's really nice when you don't have to wait while downloading them. I don't understand what's the big fuss of letting the OS fetch updates in the background, as long as it doesn't install them. I'm not sure but I think software update does only download the important updates...

Yep, only critical updates are automatically downloaded and even that is optional. In fact the whole process is optional. You can tell the operating system to never check for updates on its own and you can choose to ignore updates.

Software Update is pretty flexible and non-obtrusive. The only thing that I wish is that it had an option to allow me to register and de-register other programs for it to check. That way if the author of a program allowed it I could have Software Update automatically check for updates from him in addition to those from Apple.

Re:Needs a reboot... (4, Informative)

Anonymous Coward | more than 10 years ago | (#7646021)

The only thing that I wish is that it had an option to allow me to register and de-register other programs for it to check. That way if the author of a program allowed it I could have Software Update automatically check for updates from him in addition to those from Apple.
According to ThinkSecret, Apple will provide this capability in a future version of Software Update. It will be limited to select developers, but surely the API will be reenigned in no time.

Re:Needs a reboot... (0)

Anonymous Coward | more than 10 years ago | (#7661971)

it's called VersionTracker

Re:Needs a reboot... (2, Informative)

Aqua OS X (458522) | more than 10 years ago | (#7651841)

To the user Safari doesn't appear to be integrated into the OS (like MSIE); however, its does access a lot global system resources that other applications frequently use.

Webkit is a fairly major one. Mail, Help, OmniWeb, etc all access this.

Re:Needs a reboot... (1, Funny)

Anonymous Coward | more than 10 years ago | (#7656136)

Just reboot. With the uptime I get from OS X Panther these days, it's probably not a bad idea to reboot every now and then. Everyone needs a good nose blow occasionally; picking alone just won't do it.

Some links (5, Informative)

blb (412923) | more than 10 years ago | (#7644289)

The knowledgebase article for 10.2.8 [apple.com] and for 10.3.1 [apple.com] .

Dear Apple (-1, Flamebait)

Anonymous Coward | more than 10 years ago | (#7645212)

Dear Apple,

I am a homosexual. I bought an Apple computer because of its well earned reputation for being "the" gay computer. Since I have become an Apple owner, I have been exposed to a whole new world of gay friends. It is really a pleasure to meet and compute with other homos such as myself. I plan on using my new Apple computer as a way to entice and recruit young schoolboys into the homosexual lifestyle; it would be so helpful if you could produce more software which would appeal to young boys. Thanks in advance.

with much gayness,

Father Randy "Pudge" O'Day, S.J.

Dear Father "Pudge" O'Day (-1, Troll)

Anonymous Coward | more than 10 years ago | (#7645226)

Dear Father O'Day,

Thanks for your letter. Being Catholic myself, I know exactly what you're talking about! It has always been our plan here at Apple Computer Inc to revolutionize personal computing with our high-quality and highly gay products.

I'm happy to answer your letter by letting you know that YES we will be releasing an entire hLife ("homo-life") software line. You'll be able to recognize it in stores by the small stylized logo depicting a large cock entering a tight anus with an Apple logo on it. ("Suddenly it all comes together" indeed!).

Anyway, I hope you and other members of our community will join us on our mission, and purchase the exciting new hLife boxed set. Only the boxed set comes with translucent cock rings!

Sincerely,

Harry Rodman
Vice-president
Homosexual Liaison Services
Apple Computer, Inc.

'Only from sites you navigate to' (5, Interesting)

rixstep (611236) | more than 10 years ago | (#7646321)

'For example, not from advertisers on those sites'

So reads the third cookie option in Safari, but it's not true. You'll find '.doubleclick.net' in there all the time, and I doubt any of you are wandering over to DoubleClick to check out the action.

And any domain for a cookie beginning with a '.' means 'any URL in that domain' - and that is NOT just 'from sites you navigate to'.

Re:'Only from sites you navigate to' (0)

Anonymous Coward | more than 10 years ago | (#7678070)

You might be without knowing it. Some sites will pass you through advertisers by using multiple redirects, and if you're not watching you can easily miss it (especially if you have a fast connection).

Replace Cookies.plist with a folder (5, Interesting)

Anonymous Coward | more than 10 years ago | (#7646427)

...and the cookies only last for the current session.

It seems to me that Safari is as buggy as IE (0)

Valleyman (731934) | more than 10 years ago | (#7712781)

Just count the sheer number of stories Slashdot has on "Safari cookie bugs", and on the log-in page of Thinkgeek.com it specifically says that Safari users might have problems with their cookies. When I get my Mac 'net connected I'm gonna stick with Opera.
Check for New Comments
Slashdot Login

Need an Account?

Forgot your password?