News, info, and opinion by Mac users, for Mac users.

May 16, 2008

security

Maybe this CBS buyout thing will be a good thing

Posted May. 16, ’08, 7:26 AM PT by Derik DeLong
Category | Security

Safari Carpet bomb Hold on to your seat because CNet has gotten all self righteous on Apple’s Safari developing behind. They’re very concerned that Apple is dismissing a “Safari vulnerability”. Sounds bad right? Sure it does. I allowed myself to get sucked in and read the piece.

The problem is referred to as a “Carpet Bomb”. Basically the “vulnerability” is that Apple downloads things without reflexively asking for permission. Firefox and Internet Explorer both have download confirmation dialogs that users either disable or reflexively accept every time it comes up. Users like being prompted with dialogs constantly. Vista certainly proved that.

Even better, in the example given when a site tries to do it many times over, you’ll get asked over and over again. The big problem with this is that malicious files could be downloaded to your computer without your consent. That’d be a problem except those files aren’t executed. You’ll have to go to your download directory and then click on it. The assumption is that a user inept enough to open an unknown file locally wouldn’t just trust a random download. Right.

This is an annoyance at best. Let’s hope CBS brings some standards to CNet, or you know, common sense, that’ll work too.


6 Comments

Dave-O said:

Did they forget that Mac OS X will warn them if they try to launch the downloaded executables, or was it about the Windows version?

May 16, 2008 7:45 AM
Inkling Author Profile Page said:

The CBS of Rathergate won't bring any "standards" to CNET. In the former, CBS didn't listen to their own document consultants, and in a 2004 Sixty Minutes segment claimed as a 1970s typed document some faxed memos that are indistinguishable (kerning, centering, font and line breaks) from the same text typed in the latest version of Microsoft Word with the defaults unchanged.

So no. The CNET acquisition by CBS is not good. If the CBS mindset takes over, look for some computer companies to be targeted with faked documents (the corporate equivalent of Republicans) while others get away with almost anything (the Democrats). And look for more audience-grabbing sensationalism in general.

And yes, when the facts came out, Dan Rather was forced to retire a year early. But embarrassment was the reason rather than professional integrity. The culture that manufactures 'facts' and spins stories in the interest of ideology remains. Obama isn't getting the same scrutiny that'll soon be turned on McCain.

May 16, 2008 8:34 AM
NONfinis Author Profile Page said:

... well that was an interesting, rambling tangent.

I've always found the security measures on OS X to be of the right balance... asking if I want to do something when it's necessary to ask, and staying out of my way when it's not.

CNET just seems (to me) to be less and less relevant with each passing day.

May 16, 2008 9:18 AM
Scissor Author Profile Page said:

CNET & CBS: Unk. if it's good or bad.

CBS & GW's National Guard Service: A Lt. Colonel Killian offered the docs as true. When challenged, CBS fired several folks, incl. Rather. As to whether the facts were correct, the original military files at DOD were 'accidentally' destroyed. http://en.wikipedia.org/wiki/Killian_documents

May 16, 2008 9:28 AM
Scissor Author Profile Page said:

Forgot to add:

CNET might have been better off merging with the Murdock-Machine (FOX).

In that way, prevarication, sublimation, and exaggeration would be the norm.

May 16, 2008 9:35 AM
Noah said:

"The assumption is that a user inept enough to open an unknown file locally wouldn’t just trust a random download. Right."

I could see it happening actually. An un-educated user might stop the download when they see it (because of warning from their virus laden Windows expert friends). However, an innocently named file that sits on their desktop? If they didn't even know it was downloaded (if the download window is already open, it doesn't pop to the front with new downloads - I'll assume it's the same on Windows), they might think it's something they'd just downloaded forgotten about...

I know when my desktop gets dirty, I'll end up with a couple .dmg files that I'll open just to see what the programs in them do.

May 16, 2008 12:17 PM

Leave a comment

 



Visit other IDG sites: