David Emery Online

Second Wave

22 February 2006

... And now there’s a nasty Safari exploit too. Check out this post on the Unsanity blog for more info and a fix – the fix uses APE however, which I think has much more chance of hosing your system then this exploit has (as no actual malware using this has been seen in the wild). APE has a very spotty reputation in some circles – I’ve never had a problem with it – so if you’re more paranoid about the exploit then APE then go right ahead, but I’m waiting for an Apple fix myself.

As mentioned in the article, this is no mere Safari bug. While Safari does the wrong thing in this case – which can easily be fixed – there’s still the wider issue of Launch Services weirdness. Launch Services is the part of Mac OS X that determines what app should launch a document when you open it, and seems to have all sorts of wonky thinking built into it (Launch Services was also behind the Earlier Mac OS X exploit which had a similar effect – letting malware run on your computer without you telling it to).

This exploit also shares some similarities with the previous recent malware in that it looks like a simple .jpg file – until you run it and it open the terminal (and potentially hoses your system). We need some way of differentiating documents from executable files (that includes .apps, shell scripts, apple scripts and anything else that executes on open).

One possible solution I’ve seen suggested is to put a badge on executables icons (like, for example, a small application icon in the bottom left of the icon), but I think this would look pretty ugly – especially when you get a whole application folder of them. Another option would be to bold the names of apps – but again this would be pretty ugly.

My proposed solution to the problem would be to add a small iTunes style arrow next to the name of an executable file. This would work nicely in all three finder view (icon, list and column), would look nice and for a good bit of extra functionality you could make a single click on the arrow launch the app. I’ve made a little mockup:

More functionality, good looking and fixes many possible exploits – what more could you want?