[Redo]

Microsoft urges Windows users to shun 'carpet bombing' Safari | The Register

Microsoft's security team is advising users to stop using Apple's Safari browser pending investigation into a quirk that allows miscreants to litter their desktop with hundreds of executable files.

Windows users who visit a booby-trapped site with Safari could be forced to download and execute malicious files with no prompting, Microsoft says. The "blended threat" is a result of the default download location in Safari and the way the Windows desktop handles executable files.

This Microsoft advisory suggests users "restrict use of Safari as a web browser until an appropriate update is available from Microsoft and/or Apple."

The recommendation comes a week after researcher Nitesh Dhanjani reported that Apple's browser doesn't seek user permission before downloading certain types of files. Even when encountering malicious iframes - a common occurrence these days even on the most trustworthy of sites - Safari obediently does what it's told to do, including downloading a file hundreds of times.

Apple's security pros, upon learning of the so-called carpet bombing vulnerability, said they didn't see it as a significant threat. A researcher in Cupertino wrote to Dhanjani that it may get fixed at some point down the road as "a further measure to raise the bar against unwanted downloads," but said it could take a quite a while, if ever, for that to happen.

Apple's unfortunate refusal probably explains why Microsoft's security arm has resorted to the unusual recommendation. We can't remember the last time Redmond counseled users to avoid installing a mainstream product for security reasons. Apple representatives didn't respond to a request to comment for this story.

And before any Mac users decide this is an issue they can safely ignore, remember this: While Microsoft's recommendation obviously is limited to Windows users, Dhanjani says the carpet bombing scenario can play out on OS X, too. ®

Yay for Firefox

 

[Kilane]

Number 1 offender of security risks advises not using software on grounds of insecurity.

It's not quite as good as when MS claimed that IE was more secure than Firefox because Firefox had more bug fixes, but I'll take it.

Either way, it's another reason to hate apple and THAT makes me a happy panda.

 

[terrymx]

Here comes the flamewar.

Ever since I use Opera, my antispyware softwares never detects spyware anymore, and it's been good, so i don't even care about IE or Safari anymore.

 

[Kilane]

Quote:

Originally Posted by terrymx /img/forum/go_quote.gif Here comes the flamewar.

If there's one thing I'm not out to do it's start a flamewar, although I realize I've probably stepped on some toes

.

I don't mind Opera, I use IE at work and a I work IT at a predominantly Microsoft shop. That said, my big pet peeve is companies with arcane proprietary everything, Apple fits the bill pretty strongly and MS isn't terribly far behind either.

Given my personal choice I'd much rather run Linux and open source everything, but most of what I want doesn't come in that paticular flavor.

 

[krmathis]

Another reason to stay clear of Safari. I don't use it on any platform.
Mac OS X -> Camino
MS Windows -> Firefox

 

[scompton]

I use Firefox most of the time. Unfortunately, some sites don't work well, or at all with Firefox. allmusic.com sometimes causes Firefox to suck up resource and make everything crawl on one of my old computers. Another example is the VPN for my wife's work. It requires IE. I really haven't used Safari that much.

 

[Febs]

Quote:

Originally Posted by scompton /img/forum/go_quote.gif Another example is the VPN for my wife's work. It requires IE.

Our VPN does as well, but I use IE Tab to run it from within Firefox. Works great.

 

[Uncle Erik]

Another reason to run Firefox. IE is a gaping security hole and Firefox has very useful extensions.

 

[TSi]

xp sp3 and vista vulnerable, that just proves how ****ty their upgrades were.

I mean, if apple discovered something that bombs microsoft's os because their security isn't tight enough, it isnt the fault of apple

 

[Kilane]

Quote:

Originally Posted by scompton /img/forum/go_quote.gif I use Firefox most of the time. Unfortunately, some sites don't work well, or at all with Firefox. allmusic.com sometimes causes Firefox to suck up resource and make everything crawl on one of my old computers. Another example is the VPN for my wife's work. It requires IE. I really haven't used Safari that much.

You might try the latest release candidate of Firefox 3. I've enjoyed it immensely and it's memory management is zounds better.

 

[Al4x]

ff and tbird ftw

waiting for ff3 to be out properly, its just really nice to use will all the dblockers, sidebar, extra toolbars etc

edt and most importantly, looks ace

 

[milkpowder]

I've been using FF3 since the betas and haven't really noticed any instability. The only thing that has changed is the improved 3rd party add-on support. Almost all the add-ons I used in FF2 work in FF3 RC1.

 

[no1likesme]

Quote:

Originally Posted by Kilane /img/forum/go_quote.gif Given my personal choice I'd much rather run Linux and open source everything, but most of what I want doesn't come in that paticular flavor.

x2 While linux does everything I want it to do very well while at school, My parents have netzero dial up and I cannot seem to get it running in ubuntu.

 

[grawk]

Quote:

Originally Posted by Kilane /img/forum/go_quote.gif I don't mind Opera, I use IE at work and a I work IT at a predominantly Microsoft shop. That said, my big pet peeve is companies with arcane proprietary everything, Apple fits the bill pretty strongly and MS isn't terribly far behind either. Given my personal choice I'd much rather run Linux and open source everything, but most of what I want doesn't come in that paticular flavor.

Apple opensources nearly everything about both their operating system and browser. Webkit and darwin are both released under a real open source license (bsd). Where's the source to internet explorer and vista kernel?

 

[krmathis]

Quote:

Originally Posted by milkpowder /img/forum/go_quote.gif I've been using FF3 since the betas and haven't really noticed any instability

Same here!
Been using Firefox 3.0 beta and now RC1 (work computer, running MS Windows XP), and have not really ran into any problems.