News for Wednesday, 22 February 2006

Heise.de has reported what can be definitely called a critical security flaw.
The default setting for Safari is to open "safe" files at the end of download, unzipping them if needed. And here is the trick: if some nasty coder zips a malicious shell script, it will be ran without request for confirmation. Under normal circumstances, shell scripts begin with a "shebang line" such as "#!/bin/bash" to indicate which interpreter should handle its execution. However, Mac OS X will load scripts without a shebang line into the Terminal where it will be executed by a shell even if the file's extension is something unrelated like ".jpg". Of course, there's some social engineering involved given that the file has to be downloaded firsthand.
To prevent this from happening, uncheck "open 'safe' files after downloading" and move Terminal out of the Applications folder to keep it from running automatically.
As a demonstration of this flaw, Heise prepared the following download. Impressive but harmless, it opens a shell window and displays the content of a folder:
http://www.heise.de/security/dienste/browsercheck/demos/safari/Heise.jpg.zip
This flaw is actuallly much more worrying than the so-called "virus" everybody talks about now.

OWC has opened an MacBook Pro and put the pictures online. Sure, it's not completely dissected, but the taking apart of the top panel lets us have more than a glimpse on the computer's guts.

The main board is very small and if the CPU and GPU are nowhere to be seen on that picture, it's because they're on the other side. As you can see, the place is packed and nothing more would fit in. Even the Bluetooth module had to be squeezed in the only vacant space besides the hard-disk, on the right.
Craig Wood performed on the 1.83GHz version tests which are more user-oriented than those we have seen so far. Powerwise, they tend to position the MacBook Pro closer to the G5 Dua 2GHz than to the Powerbook G4.
Remarkably, it is the first laptop that plays 1080p videos without droping frames. Moreover, it does so using a lower CPU ressource percentage than the PowerMac G5 2GHz...

You can find new photos of the unpacking of a MacBook Pro purchased in the United States on the ZDNet blog. Even though there still are no tests of the machine, this one shows it turned on.
It is also compared in many physical aspects to the PowerBook G4.

We have reported to you several times about the apparent incompatibility between certain Western Digital hard drives and G5s (both PowerMacs and iMacs).
The hard drive manufacturer has published a note in regards to this in their FAQ.
They have learned that the affected models are 400 GB drives and the Raptor 150. The only solution they offer (which is not always possible) is to connect the drives to an additional SATA card.
The problem seems to be related to an incomplete implementation of the SATA standard in Apple's products.
We know, however, that the Raptor 150 works fine in a G5 Quad, which leads us to believe that Apple has solved this issue on these machines.