Tiger update to patch Dashboard vulnerability

2

Comments

  • Reply 21 of 46
    This is my first post although I've started to frequent the forums for awhile now. My iTunes widget barely works as well and upon opening the dashboard I get a weather widget crash window but it stills runs.



    I haven't had most of the problems every one else has had with the new OS. One or two things have been buggy like my version of illustrator 10 upon closing but that's about it other than the weather widget.



    That being said I downloaded the new iTunes 4.8 and long story short between that, Tiger, and the fact I use it on my work computer still running Jaguar...it crashed. I lost everything on the drive but it was all backed up.



    It took about 2 mins to copy over one song and then just locked everything up. The only thing I could do was pull it out of the dock and shut down my iMac with the button in the back. I even restored the Pod twice and in the process it locked up as well. I've contacted MacInTouch to find out if anyone else was experiencing this but so far no response.



    I'll move the topic out of the thread if anyone has any information on this because as of now the only thing we could do was restore it on my fiance's mac still runing Panther and have her upload songs to it. A few years ago there was some firmware issues on Jaguar so I think that might have been the case but iTunes and TIger didn't help.
  • Reply 22 of 46
    schmidm77schmidm77 Posts: 223member
    Quote:

    Now, the one that bothers me is the clock. I know that the city is representative of the time zone, but I do not particularly care to see "Chicago" at the bottom of my clock. [/B]



    You can edit the cities that are displayed by the worldclock. The file in the widget package is worldclock.js.
  • Reply 23 of 46
    gongon Posts: 2,437member
    Quote:

    Originally posted by rtamesis

    I just want Apple to fix iChat AV on Tiger so that it is actually usable.



    So how is it broken?



    I have personally thought it to be the most stable, well-behaved IM app I have used.



    Voice chat works well too.
  • Reply 24 of 46
    jeffdmjeffdm Posts: 12,951member
    My own issue with Dashboard is that sometimes it seems to use CPU when it's not in use. Not all the time, but enough that I've noticed that there is an errant process. I'm pretty new to MacOS so I don't know what some of the processes do save for some of the process it has in common with other UNIX systems.



    I have since turned Dashboard off as much as I could. There doesn't seem to be a way to kill Dashboard short of never allowing it to turn on, and the only way to prevent it from accidentally turning on is to remove dock icon and disable the hot key.



    The fact that Activity Monitor claims these dashboard clients claim to take 200MB of virtual memory each is disturbing too, I'd like to know why a widget is doing that.



    To me, the Dashboard / Safary vulnerability seems to be an egg in Apple's face because no downloaded program should be allowed to automatically execute. Whether they can cause damage, and how much damage isn't the issue. The fact that Apple didn't ship with an easy means to manage installed widgets seems to show that first, they didn't think it through very well, and second, they should have allowed a wider beta testing for comments. IMO, concern over leaks be damned, it needed some public comment.



    That said, Tiger does seem pretty nice, although the value of many of the improvements are at least somewhat overstated.
  • Reply 25 of 46
    kwsanderskwsanders Posts: 327member
    Quote:

    Originally posted by schmidm77

    You can edit the cities that are displayed by the worldclock. The file in the widget package is worldclock.js.



    I looked for worldclock.js on my system, but Spotlight did not find it anywhere.
  • Reply 26 of 46
    jeffdmjeffdm Posts: 12,951member
    Quote:

    Originally posted by kwsanders

    I looked for worldclock.js on my system, but Spotlight did not find it anywhere.



    I don't think it is safe for Spotlight to help users find system files. Spotlight was only meant for user documents.



    It is in the system hard drive at: /Library/Widgets
  • Reply 27 of 46
    rayz66rayz66 Posts: 5member
    Quote:

    Originally posted by JeffDM



    To me, the Dashboard / Safary vulnerability seems to be an egg in Apple's face because no downloaded program should be allowed to automatically execute.




    Do they automatically execute though?



    My understanding is that they 'auto-install', but you have to manually execute them.
  • Reply 28 of 46
    maccrazymaccrazy Posts: 2,658member
    Quote:

    Originally posted by Rayz66

    Do they automatically execute though?



    My understanding is that they 'auto-install', but you have to manually execute them.




    But if Safari auto-downloads a widget called Stickies - first you wouldn't notice - then it would go to your widget folder making it more difficult to realise it has downloaded. Because it has the same name as an Apple widget it takes precedent over the Apple widget. Launching the Stickies which you think is safe would result in the new widget being opened inadvertently so you would have launched a potentially harmful application. I hope this is succinct enough!
  • Reply 29 of 46
    I've never once had a problem with the widgets. I know exactly what I'm downloading every time and I know that it goes on my desktop. It doesn't install unless I want it to and I made it a point to find out where they go. I think apple is partially to blame but I also think the uninformed user is as well.



    Do download a widget from a third party site. It's exactly like not opening an attachment in a spam mail. You just DON'T DO IT.



    Any widget I download is on the apple site. Even then it's not perfectly safe but I've read people going nuts and downloading every widget they can find. The question is...WHY? I download what I use. I understand the issue and the fact Apple really is at fault here but I can't understand why people can't take two seconds and think about what they download and or where it goes.



    If you just look around you'll find what you're looking for far easier than on a windows machine (I'm a windows user of some 8+ years since Win3.1 I believe it was called), and not with Spotlight it's even less of an excuse. I'm sorry Apple is wrong but so is the random user who just clicks buttons like a zombie.
  • Reply 30 of 46
    maccrazymaccrazy Posts: 2,658member
    Quote:

    Originally posted by BlindingForce

    I've never once had a problem with the widgets. I know exactly what I'm downloading every time and I know that it goes on my desktop. It doesn't install unless I want it to and I made it a point to find out where they go. I think apple is partially to blame but I also think the uninformed user is as well.



    Do download a widget from a third party site. It's exactly like not opening an attachment in a spam mail. You just DON'T DO IT.



    Any widget I download is on the apple site. Even then it's not perfectly safe but I've read people going nuts and downloading every widget they can find. The question is...WHY? I download what I use. I understand the issue and the fact Apple really is at fault here but I can't understand why people can't take two seconds and think about what they download and or where it goes.



    If you just look around you'll find what you're looking for far easier than on a windows machine (I'm a windows user of some 8+ years since Win3.1 I believe it was called), and not with Spotlight it's even less of an excuse. I'm sorry Apple is wrong but so is the random user who just clicks buttons like a zombie.




    BUT these can auto-donload without you selecting a link or anything - the user may not notice this or will be too late as these are small files. These then go to the widgets folder. It is auto downloading widgets that I have the problem with.
  • Reply 31 of 46
    But can't this be fixed by turning off the open safe files after download within the Safari prefs? I'm not one to visit backwater sites so while I understand the problem and agree Apple is at fault I can't see this happening to most people, and even less had they not actually said anything. I mean yeah I'm all for keeping the public in the know but now you have a bunch of people who are going to do it for the sake of pretty much ruining things for everyone else because they needed to get their jollies. This really is a big issue but what I'm asking is if there are certain steps that can be taken even now prior to the OS updated?
  • Reply 32 of 46
    kwsanderskwsanders Posts: 327member
    Quote:

    Originally posted by JeffDM

    It is in the system hard drive at: /Library/Widgets



    Nope... I don't have it. This is a pre-installed copy of Tiger, by the way. I just got the Power Mac.



    No biggie. I was not really interested in changing the city name. Your post was just a nice aside to the thread.
  • Reply 33 of 46
    jeffdmjeffdm Posts: 12,951member
    Quote:

    Originally posted by BlindingForce

    But can't this be fixed by turning off the open safe files after download within the Safari prefs?



    Yes, but this shouldn't be necessary, and it isn't a good fix. For any program, the default should generally be the safest option. The user shouldn't have to deal with it. Any kind of file type with scripting or execution capabilities shouldn't be automatically opened. New software shouldn't be allowed to automatically download or automatically execute unless the user specifically requested it. I think that's three bad things going on, simultaneously.



    I know that one shouldn't go to seedy sites, but what if an otherwise good site got hacked so it served this stuff up? Even server software with the latest patches may have vulnerabilities that haven't been addressed yet.
  • Reply 34 of 46
    Like I said I agree that this is an Apple problem and should have been handled before launch but I know I go into every program's prefs that I use and look around. I understand most people don't but I've had the download options in Safari set since day one. It still doesn't excuse the user to play ignorance to anything because they don't know computers (I see this too much and too often) especially in the past year or so with what's been going on virus wise and etc. You don't have to be a computer geek and know every crevice but you, as in general not specific, should have some idea what's going on.



    I'm glad in a way this has been made public (although in alot of ways it shouldn't have been) because maybe people will wake up and actual think before they do anything.
  • Reply 35 of 46
    maccrazymaccrazy Posts: 2,658member
    Quote:

    Originally posted by kwsanders

    Nope... I don't have it. This is a pre-installed copy of Tiger, by the way. I just got the Power Mac.



    No biggie. I was not really interested in changing the city name. Your post was just a nice aside to the thread.




    Go to Macintosh HD>Library>Widgets>



    then find the world clock - right click (control-click/contextual menu button) and select show package contents.
  • Reply 36 of 46
    shetlineshetline Posts: 4,695member
    Quote:

    Originally posted by AppleInsider

    Meanwhile, previously published tidbits suggest the update will also pack improvements to DHCP over wireless networks, file sharing over AFP and SMB/CIFS network file services...



    You know, it just wouldn't be a proper System Update without even more improvements to file sharing. File sharing has been improved so many times now, why, I'll bet that after this next update all I'll have to do is think about a file I want that's on another computer, Mac or PC, and it will just appear on my desktop!
  • Reply 37 of 46
    Which would solve the problem of people letting widgets download automatically! The new Spotlight Mindreader plugin because they forgot about the new Spotlight feature and it's too much to type in Widgets to find the folder!



    GENIUS!
  • Reply 38 of 46
    freestatefreestate Posts: 123member
    Quote:

    Originally posted by JeffDM

    My own issue with Dashboard is that sometimes it seems to use CPU when it's not in use. Not all the time, but enough that I've noticed that there is an errant process. I'm pretty new to MacOS so I don't know what some of the processes do save for some of the process it has in common with other UNIX systems..



    The problem here is not with Dashboard but with someone making a widget that did not know what they are doing. Apple even tells developers how to turn off the functions that are using system resources when a widget is idle and/or dashboard is hidden.



    If you want to see poor programing just open up any one of the 3rd party widgets listed on apples site and look at the code. The Amazon search widget looks like it was written by someone who never once read the Apple documentation on how to do it properly.
  • Reply 39 of 46
    gongon Posts: 2,437member
    Quote:

    Originally posted by shetline

    You know, it just wouldn't be a proper System Update without even more improvements to file sharing. File sharing has been improved so many times now, why, I'll bet that after this next update all I'll have to do is think about a file I want that's on another computer, Mac or PC, and it will just appear on my desktop!



    I'd be content if they'd fix the HORRIBLE lag that comes after disconnecting a SMB share, about half of the time. I'm talking 100% unresponsive UI and choppy mouse pointer for about 30 seconds.



    I'm still on Panther. This issue has survived through nine updates up to 10.3.9. Please someone tell me that they fixed this in Tiger
  • Reply 40 of 46
    rayz66rayz66 Posts: 5member
    Quote:

    Originally posted by MacCrazy

    But if Safari auto-downloads a widget called Stickies - first you wouldn't notice - then it would go to your widget folder making it more difficult to realise it has downloaded. Because it has the same name as an Apple widget it takes precedent over the Apple widget. Launching the Stickies which you think is safe would result in the new widget being opened inadvertently so you would have launched a potentially harmful application. I hope this is succinct enough!



    Okay, I was actually asking about the auto-running, which would have been really dumb.



    Does it actually overwrite the Apple widget, or does it go in a separate folder, which takes precedent over the Apple widget?



    I'm curious to see exactly what the problem is here. Auto-running doesn't appear to be one of them, but it looks like spoofing widgets is.



    I think that the downloaded widget taking precendent over the system widget is OK, but it certainly sounds as if Apple hasn't given enough warning to tell users what is going on.
Sign In or Register to comment.