Apple’s newly released Safari Browser for Windows is coming under fire for all the wrong reasons today with separate reports indicating that the browser presents a security risk to Windows users.
Thor Larholm has published a 0day exploit that causes Safari to shut down when visiting a site with malicious code.
David Maynor at Errata Security claims to have found 6 bugs, 4 Denial of Service and 2 remote code execution bugs.
The browser has met with mixed reviews; the ability to quickly render sites being countered by visually foreign (to Windows users) font rendering and a failure to support the Vista Aero interface.
More news at CrunchGear.





Thank you for this post. Your blog is the first one my colleagues and I read every morning. It makes our jobs easier and keeps us well informed. We recommend it to everyone. Keep up the great work!
Duh. It’s in Beta…
It’s in Beta sure, but it seems clear to me that they rushed this out the door just so Steve could do the “One More Thing” line. Seriously, if it disables aero than this is a pre-alpha not a beta.
I thought Apple was known for their amazing software. I guess they got a few things to learn when it comes to creating a secure browser on windows.
That aside I’m still glad to see safari on windows. As a web developer in a windows environment, it was annoying to not be able to fully test my sites compliance.
I look forward to a more stable version before I go install it though.
It looks alien on Windows. Not that this is necessarily a bad thing; the font rendering isn’t any uglier than IE7’s, and the only real interface niggle I had was that the status bar is turned off by default.
Presumably these security issues don’t exist in the Mac version, and I’m sure they’ll sort them out here. In some ways, Apple are shooting themselves in the foot: I was considering buying a cheap Mac for testing purposes, but now I don’t have to. Thanks!
In all seriousness, I think this should be thought of as a developer’s release, and in those situations these omissions matter less. I don’t think they seriously intend to take market share from Firefox and IE, but with the iPhone coming, not to mention the AppleTV … it makes sense.
I agree with you Ben @4. They didn’t rush it for the “One More Thing” line. It’s so that Windows users who will purchase an iPhone get used to Safari. I don’t think Apple’s interested in entering the browser war.
It is ugly as sin, I don’t even care about Aero, it sucks totally independently of not supporting the standard.
Still will use it for testing, but it’s awful to look at and those gel scrollbars are like the brightest thing on the page. Terrible.
…And the font rendering is fuzzy and horrible. They should have just stuck with ClearType (which Vista’s DWM is optimized for anyway).
Its kind of amusing to see everyone saying “duh. its beta.” If a Microsoft beta release was this shoddy, everyone would be screaming that they can’t do security. Double standards are great.
On a side note, this will finally have people test against Safari, which is good for Mac and iPhone, but bad for developers. Kind of sad they didn’t just stick with the Mozilla rendering engine for Safari.
Safari on Windows : A solution searching for a problem!!!
‘Apple’s newly released Safari Browser for Windows is coming under fire for all the wrong reasons’
That quote suggests that it is a full, tested release product, it is not. With TechCrunch being quite a well read site, you should state it is Beta.
@Andre: Ding ding ding ding! You hit it on the head! Double standards are great!
We all know it’s a sin to criticize Apple since they are the savior for all things Microsoft. That’s why we’re automatically required to forgive them for anything the bandwagon crowd would jump on MS in an instant for. Security? Who cares it’s a beta! Poor rendering/Aero problems? Who cares, it’s a beta! Common sense and quality? Who cares, it’s a beta!
Perhaps we have Google to blame for how shoddy beta programs have turned out to be… their projects stay in beta for years.
If it’s a zero day on a beta does that make it a negative number of days?
I think it’s a sign of Apple’s increasing popularity on the desktop that everyone’s jumping on the FUD wagon as soon as they put out a beta. A few years ago there would have been a resounding shrug of the shoulders at the news.
Why don’t you use Opera (www.opera.com) instead of Safari or FF? It’s worth to try
I’ll throw everything else overboard, and focus on the two reasons (in the end) why for Macintosh users, Safari For Windows is A Good Thing:
1) At last, Windows-based web developers have no real excuse for not certifying their work is compatible with Safari.
2) Macintosh users can finally browse the web on their Windows machines in a way that makes them smile.
I am a mac user as well as a PC user (sometimes the fat and sometimes the young guy from the commercial).
1. I was disappointed not to have better news than a browser after such a big expectation.
2. I installed the new Safari for my mac. Faster than the previous. No reason to change my PC Vista browser.
3. IE for Vista has a book capability to visualized all the open windows. It has better toolbars especially for SEO. I cannot be able to see the favicon logos.
Mario Ruiz
http://www.oursheet.com
Hi Duncan,
“Thor Larholm has published a 0day exploit that causes Safari to shut down when visiting a site with malicious code.”
The above statement is only partially true. The exploit doesn’t just cause Safari to “shut down”, but much more importantly, it enables an attacker to run arbitrary code on the victim’s computer just by making him view a web page in Safari. This is an extremely critical vulnerability.
I tried the windows version, thought it looked a bit, ugly?, dunno, odd at least with the different font rendering, but I was looking for the speed pick-up advertised over IE7 and FF. Very odd thing happened, though, I happened to be ripping a CD in iTunes while I had Safari open and the ripping slowed right down to a crawl - doesn’t happen without Safari. I’ll be uninstalling Safari asap, wish I could do the same with iTunes.
It’s bad form but thank God it doesn’t look like other Windows apps.. The Windows interface is not known for it’s beauty.
“It’s in Beta sure, but it seems clear to me that they rushed this out the door just so Steve could do the “One More Thing” line.”
Please tell me you’re joking.
Anyways, the browser has bugs. It’s beta. Every browser has bugs in beta. Hence the big BUG button next to the URL field. They want you to report them.
Apple is releasing their browser to a foreign OS, which is FASTER than all of the other browsers for that OS, but they need to fix some bugs (ie: BETA).
GET OVER IT.
I downloaded this, thinking it’d be cool to try out, at least. Man, does it look awful on Vista. The way that iTunes doesn’t integrate at ALL with Aero has bugged me since I moved to Vista, and Safari is worse. It doesn’t even have the updated Vista-style minimize/restore/close buttons that were added in iTunes 7.1. Hopefully those are coming in an upcoming version, at the VERY least.
If they don’t want to add the glass window borders to their Windows apps, could they not at least add the shadows and animation effects on minimize/restore, so that their apps don’t look so second-rate on Vista??
Oh, and it crashed within the first 2 minutes of using it. I know. It’s beta.
The fact that’s in beta, we should give them the opportunity to work the kinks out
Mike
What’s Hot Today.com
As a former Mac user who nows uses a tablet PC, Safari has a lot of potential. It’s way faster than Opera or IE, but it is frustratingly uncustomizable. There’s no way to install YubNub, no way to configure keyboard or mouse gestures, and a lack of support for standard browsing techniques, like Ctrl-Return for Add-.com-and-Go or middle-mouse for scrolling and closing tabs. Also, try to use the find feature on a page with embedded scrollboxes or while using the mousewheel. Bad things happen.
Oh, and Yahoo! Mail crashes, but with all the ads I’ll probably drop it anyway.
“[countered by] a failure to support the Vista Aero interface”
Hahahaha! This is a problem? Apple programs are much better looking than standard Microsoft programs. Why would you want iTunes or Safari to look like IE7?
The whole point of this is to entice people to Apple. They don’t want to make it look or act like a Windows application.
Btw, you have to restart your computer after installing Safari on Windows. That’s Microsoft’s problem, not Apple, though. I’ve done that and Safari hasn’t crashed yet.
I use most browsers for testing for development purposes and most are buggy, and I don’t need to pick one browser, they’re all pretty much always in beta and ironing out problems, ALL of them.
Its more likely here that Window’s users feel they finally have a play at bashing Apple for a change since Windows always gets so much grief.
I was brought up on PC’s I know how shoddy the code under the bonnet is, and for me Apple was a breath of fresh air. Windows and Microsoft get bashed for good reason, their just nasty at coding, and second hand code at that.
Apple needed to get this out so that Windows users can report bugs, they did nearly the same thing when OSX first came out and that was full release. At some point you need to get it out there to the masses and let Jo Public do the final testing for you. There’s no way round it. You can only test for so many things in a closed environment.
Safari IS native to Macs after all, but all that said, and to be honest as a Mac user its never my default browser I prefer FF and even that’s still buggy and glitchy.
I love Apple, but have never got on with Safari.
@asjdflkasjdf
“Btw, you have to restart your computer after installing Safari on Windows. That’s Microsoft’s problem, not Apple, though. I’ve done that and Safari hasn’t crashed yet.”
I find it interesting that so many non-developers on this board think they know best when it comes to things like this. If you require a reboot after installing Safari, that means Safari changed a file that is in use (it couldn’t overwrite it). Windows installer will tell you to reboot. This isn’t Microsofts problem — Apple didn’t prepare their setup right — thats Apples problem.
And as far as not making something “look or act” like a Windows application — keep in mind that a user on Windows expects a program to act a certain way and expects certain key commands to work, etc. Not doing this is just a lack of fit and finish. An application should “fit” the platform that it is deployed on. It should look like, feel like, and act like that platform so the user feels familiar and comfortable with the application. Apple has never been good at making their UI’s consistent with Windows, and thats why iTunes (and now Safari) are uncomfortable to use to a Windows user.
Tried to install this piece of sh_t on my XP machine last night, wasting my 1 hour of sleep. Doesn’t work and looks totally out of place on Windows.
So much for the “downtrodden” on the Windows platform, from Apple. Please test your product even when you give it away as alms.
The discovery of security issues is another reason to get rid of this stuff from my laptop asap.
IE and Safari have miles to go to catch up with FF.
Well.. it does say its a beta, what do you expect?
I try and keep up with the latest developments and love new things, but I am a user and in no way a programmer, coder, designer, IT guru or savant.
I have always been a PC user with a curiosity about Mac’s. I have Vista, so Safari for Windows seemed a great idea… and so far I like it, its got quirks and oddities but no deal breakers so.
I have one question for all of you out there please: The lead to this thread states that “Safari on Windows is a security risk,” but only one response addressed this. How is Safari a security risk? So far all I have heard is that it crashes, it doesnt look nice, its not what peopel expected, basically nit-picking.
So, please, specifically, is using Safari a security risk for my PC?
Someone said: “Still will use it for testing….”
EXACTLY. The all-windows shops developing HTML can now test the main browser for Mac OS X and the iPhone, without buying any Apple hardware.
That’s all Safari on Windows is meant to be.
I think the real question to ask here is “Why does Apple feel the need to get into the Browser war?”.
I mean Firefox is way better than what Apple is offering. Especially with all the extensions available.
My take is that this has to do more with their iPhone app strategy. Especially the fact that developers can get apps to the iPhone using Safari. Maybe they are introducing the version for windows to make it easy for everyone to start writing much more compatible apps.
Mike, what do you think?
Abhishek
Andre, I’m no sure why you think Apple should have gone with Gecko. No OS company in the world is going to hand over their rendering engine to an external open source project.
Granted that while WebKit is also open source, Apple really gets to decide what happens with it as they add more features to their OS. Plus, it supports the W3C standards nicely, so developing for Safari is a breeze. 99% of the time, all you need to do is run your work through the W3C validators and that’s usually all there is to it.
But it’s important to understand that WebKit powers more than just Safari on OS X. It’s baked into Mac OS X, and provides rendering for any app that talks to the internet, including iTunes, OS X Mail, the Dashboard Widgets, and any third party apps that wish to harness its rendering engine. (That’s why OS X Mail is able to display Flash and HTML in email so well).
I think you’ll find that with the new WebKit port for Windows you’ll actually be able to build new Windows apps with it really easily. Believe me, it’s a lot easier to develop with than you might think.
KindAndThoughtful *is* tech crunch. The lamers are self promoting themselves with supposed comments from others. This has to be one of the lamest things Bloggers do. Just like authors who buy their own books….. sad
I feel sorry for Apple employees. I doubt there are many people who go to work at Apple to create programs for windows!
Ralph,
I understand that they would want to have their own rendering engine, it just seems like they have neglected it and it has a good number of bugs in its own right.
I am happy I can test sites I make without a Mac nearby now (I used to use BrowserCam), so that is a good thing, and I welcome that. I don’t think Safari is a horrible browser, but building some sites, I’ve certainly found inconsistencies which are irritating.
On the API note, I was looking into embedding a browser into an application I’m going to start on OSX soon, so its refereshing to hear that OSX has the ability to embed Safari. As far as having this functionality on Windows, Internet Explorer has always been able to do this, so I don’t think you’ll see Safari embedded anywhere in Windows anytime soon.
I admire some things about the Mac (I wish they’d make a two-button MacBook Pro so I could install Windows on it), I just don’t like when Apple makes strange moves like this that will make my life that much harder in the QA cycle.
Oh, and one other think I forgot to mention.
Since the iPhone runs OS X, and since WebKit is a major component of OS X, it’s pretty easy to see why Apple needed WebKit to make the iPhone work with the internet and the OS so seamlessly.
Choosing Gecko for OS X would have made it slow and difficult to bake into the widgets, E-Mail application and other apps. But having WebKit as a core component in the OS allows it to share resources and have it co-exist with Core Animation and other OS X technologies with ease and speed.
Incidentally, how come Outlook on a PC doesn’t use IE to render HTML E-Mails?
(Pardon me if it does already, but I could have sworn that Outlook has more trouble rendering HTML than even IE does.)
Seems like if IE was so easy to embed in other apps, they should be able to make Outlook display HTML and Flash with ease. Just curious.
The readers of these pages are techies, but visitors to apple.com are joe and jane public. Yes it says “beta” but that doesn’t necessarily mean much to ordinary users, especially ones who have been using gmail beta for however many years, and the very prominent (ie front page) positioning of the download safari (”the world’s best browser”) option means it is not unreasonable to think it would work pretty well out of the box.
@8
- solution searching for a problem …
- the problem was developers / on windows - couldnt test without a mac
@Ralph
Outlook 2003 uses HTML. In 2007, they “reverted” sadly to Word. As to why, they did this, I don’t know. It seemed to be a head-up-the-ass decision.
I can think of two reasons they may have:
1) Outlook suffers from a really old codebase which in my opinion, needs a desperate rewrite. But it causes it to be somewhat single-threaded (therefore sluggish). Perhaps they can do a better job merging word in there than IE
2) I don’t think the Office and IE teams are allowed to talk (antitrust), so they may have not known what to expect with IE 7 when both were being developed in parallel.
3) Perhaps they were looking to reduce exploits by taking a dumbed-down renderer. This way people can’t embed ActiveX or JavaScript that may affect the system. You can turn off these features when you embed IE in an app, but maybe they thought this was the safest bet. Again, the Outlook team doesn’t own the IE code and probably doesn’t want to get blamed with a security hole. Go figure.
@Ralph
Just to mention, embedding IE in a Windows app (especially in a .NET app) is as easy as dropping a control on the designer. From there you get things like “.Navigate(url)”, “.Document”, etc.
Are you an Apple developer, I’d be interested in speaking with you regarding some work I’m doing. http://www.linkedin.com/in/andredecav or send an email to me @ my website.
It is amazing… WHY another browser ?? What is Apple thinking? Apple should stay in his niche, just shooting a new browser (very limited IMHO) to Windows just because, will not make it. Also it will open (as you see on this post) more headaches in terms of security.
And hey… web designers will have more compatibility headaches anyway.
Come one guys! The line has been drawn. There is only room for IE and FF
Isn’t amazing that the same journalists who so loudly trumpeted Safari for Windows yesterday have been completely silent on these issues? AP, Reuters, NY Times, not a PEEP about these problems. Safari has crashed five times for me when adding a bookmark, the Apple boards are filled with similar comments/posts.
Thank you Techcrunch for doing the follow up.
0 day?
Duncan did you used to BBS?
Andre,
Sorry, I’m not an Apple Developer. (I just read about Apple products a lot).
They have a pretty extensive developer network. It’s free to register for access to the online resources:
http://developer.apple.com/
But if you need more “under the hood access,” you’ll need to lay down a little cash:
http://developer.apple.com/products/
I know that Apple is reaching out to Windows Developers with this WebKit release, so there’s a big educational push going on at the WWDC conference this week with a lot of hands-on help. Apparently a lot of new converts are attending this year, and they’re catering more to them.
But, I’m sorry I can’t be of more help.
Hmm, so far so good. I like it. It seems fast. I haven’t had a crash yet. It’s funky looking, though - amateurish visually. But, I’m liking it so far.
They make so many things that look so nice, and then the release a vist app with solid chrome/silver and blue gel scroll bars? This is an embarrassingly ugly app, and that has nothing to do with it being beta.
They are getting so many customer due solely to the fact that there stuff looks “cool”, and then they release a product meant to give PC users a Mac experience, and its the ugliest app I’ve seen since the last download.com mp3-conversion shareware I downloaded.
More Safari 3 beta security issues here..
http://www.urlpire.com/?KEMSC
I really wish I could use my mouse buttons to navigate.
I’m an Apple user who works at IBM as a Tech Analyst, I absolutely despise Windows for reasons that only those who spend alot of time experiencing the Mac user-interface regularly will understand.
I am heavily dependant on my web-browser as a core tool using it constantly throughout the day. Indeed Safari looks out of place on Windows (I’m using XP), the menu bar (File,Edit,..) looks pretty horrible because the Windows window doesn’t allow it to put it at the top and thereby make good use of space (leaves a stupid grey gap). The browser is full of bugs, when I maximize to full-screen, then minimize to the taskbar, then restore, it doesn’t restore full-screen but half-sized - this pisses me off all day. Also, restoring by clicking on the button on the taskbar doesn’t even work. I’ve also had it a few times where I can’t get the window to restore when it’s displaying an error dialogue generated by the webpage I’m visiting. Other than that I’ve had pretty much no trouble at all.
Cool features include:
>> The newly added ability to consolidate all browser windows into tabs (Window>’Merge All Windows’) - I’ve wanted this feature for so long on my Mac, clears up the clutter of windows (an especially positive thing on Windows as you can’t ‘hide’ apps).
>> I can resize the text-box I’m writing in right now by grabbing the bottom right-hand corner, I think this is a really cool feature, cause sometimes form designers only give you a tiny box.
>> The new Find feature is much-improved.
Despite any bugs I am experiencing, and some terrible frustrations, now that Apple software is arriving on Windows am determined to use nothing else. I’m sure that this will seem idiotic to some, but I’m prepared to wait for Apple to fix these problems as I know they will eventually get their browser in tip-top shape, have some patience folks, and please submit bug reports.
As for people complaining that it looks crappy on Vista, I had to laugh.. I went into a store the other day and was fiddling with Vista, horrified to see that they’d tried to copy the window transparency from OSX (select applications) which looks pretty good, except on Windows they got it horribly wrong, for it’s not a transparency at all, it’s a blur, and the tops of all the windows look like they’ve got poo smeared on them - an absolutely ghastly interface. Windows needs to start thinking for themselves, they copy the Aqua GUI and call it Aero, and get it wrong, they copy Widgets and call them Gadgets, and get them wrong.. blah blah.. From the beginning Microsoft has been stumbling around in the wake of Apple’s intuition, they should break free and do something original and cool.
Unfortunately Windows is the business of making shoddy garbage, cheap imitations of Macintosh, and selling it in bulk.. Apple on the other hand has a keen eye for detail, they are perfectionists, and because of that I’m confident that Safari will become very good once it takes on full-release.
I use Windows XP. I have used Macintosh OSX before, and I found it quite irritatingly unintuitive (Errrrr, I want my two buttons! and I hate having pop-ups at the bottom of the screen, and a stationary bar at the top). Anyway, Safari on Windows…
I want to give this a chance. I really like GarageBand (I hope Apple ports that soon). Anyway, I tried out Safari. Safari does look different than all the other windows apps, but I think it still looks nice. (I do think they should change the title bar, however. Maybe they should add a line or something in between that and the menu bar. Or maybe for Vista users they should add the vista title bar.) I used Safari for a bit, and I was impressed at first. Then it crashed. It crashes much more often than IE7, actually. That disappointed me. I hope Apple improves their software. They almost impressed me.
So, Microsoft does have their problems, but overall they have produced reliable software (at least in my experience). Apple, too, has it’s problems. I think that if Apple is going to claim they are so much better than Microsoft, they are going to have to prove it. So far, I don’t believe they have.