Long Wu Yuan wrote:
So use Safari and maximize the risk of losing money/happiness/both. Or not use Safari I guess.
Sounds about right.
First I want to make it clear that I'm not defending Apple, just trying to present the facts that I've been able to keep track of. It's really up to the individual to be comfortable using any software they have based on the best information available. I would never take a position of trying to tell an individual what to do in cases like this. They need to make up their own minds.
What's a bit more of an issue is that there may be some financial institutions out there that will make the decision for you if they choose to block use of Safari in carrying out transactions. I suppose that's up to the institutions' IT departments to decide, but it would be nice if their industry was able to satisfy themselves through correspondence with Apple and their own testing what the correct policy should be.
There is a similar discussion going on in the forum concerning the NTP flaw that Apple claims to have patched. Just as Apple decided not to take the experts advise to disable SSLv3 in Safari, they decided not to adopt the patched version 4.2.8 of ntpd and came up with their own solution. I would guess that was probably because they started work on a fix before v4.2.8 was made available and rather than go through testing of 4.2.8 rolled out with their own fix. Now it seems the credit card POS industry has decided that any OS which does not have ntpd 4.2.8 is no longer in compliance of their PCI standards and therefore cannot accept credit card payments using OS X computers. I suppose that was the easiest way to test for compliance and based on what they were being told by the IT security community, rather than devise a test for the vulnerability itself.
They have a history of doing similar things. I recall may years ago when a major flaw was found in bzip2 which was patched by developers with a new version. Apple left the old version in place and patched something else to overcome the vulnerability, creating some concern among knowledgable users. Again, Apple Product Security responded to me that they were able to take a different route to blocking any exploit. There are similar examples involving Java updates prior to Oracle's finally stepping up with Java SE 7.
