It didn’t start as a security story in the strictest sense, but Apple’s release this week of the Safari web browser for Windows sent researchers scurrying.

Within a few hours, claims of as many as six flaws in the beta were revealed.

Apple has promoted Safari’s browsing speed on its website, but its widely thought that the release has more to do with users of the soon-to-be-released iPhone having the opportunity to use the same browser on PCs and mobile devices.

“Now, why do I think Jobs introduced Safari for Windows. Let’s look at the satiation here. Let’s say Windows people are afraid to switch to a Mac because they don’t know how to operate the interface. Okay. Safari and iTunes are the Mac apps on Windows. Both are different in their own special way, each having a nice interface. The new Finder is just like iTunes. Compare ‘em, go ahead. Safari is exactly the same on both platforms. IMHO – I think Apple is making a play here for switchers. Don’t be afraid to switch to OS X, have you used iTunes before? Then you know OS X. Done. Everything in OS X will look like an app you are already familiar with, okay?”
- Joel Esler, OS X and Other Stuff

And on those newly discovered flaws…

“Safari for Windows is all about the iPhone. Apple is not going to let people develop third-party apps for the phone. However, the phone will run Safari. So if you develop Safari-specific web applications, you can get them on the iPhone, assuming they lend themselves to a mobile platform. You may have to configure, install, download, etc. from your regular computer and sync with your iPhone. Safari will be the iTunes to the iPhone’s iPod. This has nothing to do with Apple trying to take market share from IE or starting a new browser war…Now whether it is secure is another question. Another question is what has Apple done that so many security researchers will not share disclosure information with them. I think they need to reassess their relationship with the security industry.”
- Alan Shimel, Still Secure, After All These Years

“The guys over at Errata Security found a memory corruption error in the new Windows beta of Safari before (to quote a friend) ‘the ink was even cold on the press release.” And all using publicly available tools. Ouch.”
- Martin McKeay, Network Security Blog