Deja-Doom (aka, Do not read this post with Safari)

Chances are if you're loading this page in Safari (tested on multiple variants of 10.4 up to 10.4.5, on PPC and Intel boxen) you aren't reading this unless it's been fixed in a security update, as the image below crashes anything webkit-based in a very hardcore way. Actually, it crashes anything using ImageIO in a hardcore way, which includes the Finder and Preview.app and apps based on Webkit and WebCore...

It's remarkably similar to the Safari Image of Doom™ from awhile ago, although this time ImageIO seems to be choking during an EXIF routine, so I won't rehash what I said there. However, a few thoughts...

  • This particular image (and ones like it) are already floating around on the web. It wasn't "created" to show off a flaw.

  • It's not as though Apple is the only one to ever have problems properly dealing with images without creating security holes and other general wonkiness. Belay the hysterics, but do take it seriously. I wouldn't be the least bit offended if you wet yourself after realizing what someone seriously capable could be poking around in if I'm able to blindly stumble into this stuff again and again.

  • While it's hard not to notice that an image is once again taking out Safari (and it isn't as though the Finder needs much of an excuse to trip over itself) and there is inconvenience there, it should be thought of as a security issue first and foremost.

  • It's really nice to have one Gigantor API that many different things call upon for functionality as opposed to having them all spread out. The other side of the coin is that if there's a flaw, now everything interacting with it carries the same flaw.

  • If anything touching the network isn't properly sandboxed from the rest of the System, the above is mightily exacerbated -- as in even more dangerous than it otherwise might be. If you aren't going to sandbox them, they need to be as safe as possible, or you're engendering a world of hurt.

  • If you don't have the will or the manpower to keep your core routines safe -- especially ones used by apps sucking data over a network -- you need to look at having them in a language that is more forgiving: Managed code. Programmers are going to make mistakes, and there are going to be strange interactions, but sometimes it's worth giving up a little bit of speed on high-value targets so you don't have to worry about a whole slew of the most common ones Joe Programmer might make. I've talked about this before, and it's a can of worms.

  • Applications out there which aren't hitting the crashiness have all basically rolled their own support instead of using what Apple provides. You are able to open the image with Photoshop, and Graphic Convertor, and of course things like Camino and Firefox will view this page just fine. If a developer can't trust Apple's included solution to be robust, there's little point in throwing it in aside from bullet points.

  • Don't underestimate the above, nor how widespread the problem is throughout OS X. As an example, I have yet to encounter a developer needing to use SOAP services in a serious way on OS X that hasn't given up on what Apple's provided to the point where they just write their own stack. If you encounter someone that hasn't, ask them if they wish they had. We won't even go into things like Bluetooth, as I've stopped talking to anyone having to deal with Bluetooth on the Mac -- it's just too damn depressing.

    It's not popular, but it doesn't change the fact that it's how it is. It isn't everything, and something like Core Data is a highly-positive exception: I believe one could learn a lot by deconstructing what allowed that to ship at the level of solidity (even just documentation) it did compared to the other chunks of wonkiness that are getting out the door at Cupertino.

  • The problem with stuffing one's pants is that, given enough time, you might actually believe the sock is you. I really, really wish Mac users would stop walking around like they want to slap it on the table and measure when it comes to security. A virgin saying you're the biggest they ever had is, well, a virgin saying you're the biggest they ever had.

    I haven't met anyone within Apple that's been around awhile who wouldn't admit over beers that they'd be mighty nervous dropping OS X as it currently stands into the orgy Windows swims in, so I'm always amused at what shows up around the web, and less amused by the pundits feeding it to them.

  • I haven't dropped a lot of time into this since I came across it, but did ask around and was told it'd been reported as bug #4485821 in Apple's system. No clue as to the status/resolution.

Dude, what the hell?

I'm aware many people who have the site in their feeds will be trying to access it via something based on WebKit/WebCore. Safari may have crashed, and you lost all your open tabs. You may have had your RSS reader up, and opened up some links in tabs, and down it all went. Read whatever you will into the fact that while these things did occur to me, I'm attaching it inline instead of linking to it separately anyways.

yummy alcohol posted button Posted by drunkenbatman
    March 28, 2006, at 04:02 PM


Comments (241)