The Problem with Widgets
I'm not going to make an active link to this site, but I am going to tell you about it and then list the link, and if you really want to check it out, then you can copy and paste the address in your address bar. Here's the address: http://stephan.com/widgets/zaptastic/
Now, if you jump over to that site, it automatically downloads a widget and it also automatically installs it if you are on Tiger, using Safari, and you haven't bothered to disable the "Open 'safe' files after downloading" feature.
So what? How's that a risk? Read more after the jump.
First things first: Before we do this go to Safari—>Preferences and under General uncheck the "Open 'safe' files after downloading" feature.

Now, go to zaptastic: a blueprint for a widget of mass destruction, notice that something suddenly downloads without you asking for it, and read the long horrible story of how widgets could all go horribly wrong and problematic for the Mac community, becoming, essentially spyware and annoyware for Macs. Doom and gloom. Doom and gloom!
Eh, just don't ever recheck that check box. And whatever you do, do not look at the goatse.cx widget. Do not look at the goatse; if you do not know what the goatse is and you are curious, then read up on it at Wikipedia. Never look at the goatse!
Thanks, Cap'n Hector for the tip!
Share
Categories
I'm not going to make an active link to this site, but I am going to tell you about it and then list the link, and if you really want to...
Add a Comment
This posting is extremely helpful to the environment in which I work. When supporting 3000 macs which half are now converted to Tiger, with students using the computers....you can probably figure where I am going with this. It is one thing to hit a link one time that can take you to a porn site, it is another thing to face one everytime you launch Dashboard. As for the resource issue, some users might use smart computing, but many don't realize that installing several widgets might not be good, they just think it's neat. So, thank you for the posting.
July 14 2005 at 3:42 AM Report abuse Permalink rate up rate down Replyjust activating my comments
June 15 2005 at 4:09 AM Report abuse Permalink rate up rate down ReplyI am new to Mac and have puchased an Emac with Tiger software installed. I am wanting to learn best practice in using my new computer
June 15 2005 at 3:36 AM Report abuse Permalink rate up rate down ReplySome people are missing the point... Gee, great for you if you are a power user, or just an informed user - but after recently dealing with a client who did not even know how to get to his files using a simple OPEN window, I find this very scary. A LOT of people buy a Mac BECAUSE they are both computer illiterate and uninterested in leaning. The want to do their little things - browse, email, maybe use a few dedicated applications - but outside of that little garden, they have no clue whatsoever. With recent switchers and first time computer buyers getting Macs, I would call those a substantial % of the user base. Now - this widget was not malicious, by design. But the simple fact that the security hole exists means Apple should have a serious look at the technology's implementation. There are just too many journalists and tech reviewers who would love yet another reason to present Apple in a bad light - all you need is a single unfortunate incident.
May 27 2005 at 2:36 PM Report abuse Permalink rate up rate down ReplyThe problem is that Safari spontaneously downloads something when the page loads because the http-headers on the page tell it to do so. I'm languishing on 10.3.9, but the widget still downloaded itself! I don't want my browser to do that, thanks very much. SM
May 08 2005 at 12:47 PM Report abuse Permalink rate up rate down ReplyI agree with those who say this is not a major security concern, however it is something that needs to be fixed by Apple. All good modern browsers allow you to manage your start page, bookmarks and block popups. Dashboard is a web based technology, I am disappointed in Apple for not thinking this out better. I would not recommend anyone use Dashboard until Apple provides two enhancements: Allow users to uninstall Widgets and Implement a Pop-up Blocker. This is just the opening some WinDoze users have been looking for to show OS X has the same problems as XP and is no better.
May 08 2005 at 11:13 AM Report abuse Permalink rate up rate down ReplyI've downloaded a number of Widgets, tried them out and then trashed them if I did not like them. I've also moved Widgets that came with the system out of their folder. I just went to Spotlight and typed in the word Widget and the two folders showed up. I created a Disabled Widgets Folder and the ones that I did not want to use, I put in there and placed that disabled folder anywhere I wanted to on my hard drive. I really don't see the big deal in removing Widgets.
May 08 2005 at 11:08 AM Report abuse Permalink rate up rate down Reply200MB... 20MB... 2MB.... It doesn't matter to me because I ("Joe Average User") still can't get rid of it. I don't know about the ~/Library/Widgets folder because Apple doesn't tell me about it. And I certainly don't know about /Library/Widgets. In fact, I'll say it again, Apple even tells me that I _can't_ get rid of it. (See my previous post, #8.) So now that I have that porn-site-widget-masquerading-as-a-world-time-clock installed, it's permanent. Guess I'll just have to reinstall the OS. And that sounds like a Windoze solution if ever there were one. Why there's not a contextual menu for the Dashboard items I don't know. That seems like a "Duh!" to me. Heck, even the Dock items (and now the sidebar items in Finder windows) now have contextual menus. Apple, this needs to be fixed. Now. (And I've entered Feedback, although the webpage for MacOS X feedback doesn't know about 10.4 or its 10.4-specific features. See http://www.apple.com/macosx/feedback/.)
May 08 2005 at 7:02 AM Report abuse Permalink rate up rate down ReplyInteresting stuff, I recently downloaded the "Hula Girl" widget for fun, while reading this blog I opened activity monitor and noticed that even though the hula widget was not active (not seen) it was consuming 9% of the cpu! Well I don't need to be wasting cpu for a Hula girl widget just for fun (even when its not visable), so Off to the library and into the trash it went. There should be a right click to delete option wouldn't you think? Anyways I'll not be downloading anymore widgets just for fun! I do like useful widgets, stock ticker, weather, phonebook (with link changed to google maps). Rbren
May 08 2005 at 6:59 AM Report abuse Permalink rate up rate down ReplyHot Apps on TUAW
Deals of the Day
more deals- JVC Motion Sensing Clock Radio with Dual iPod Docks for $55 + free shipping
- Apple iPhone Headset with Mic for $4 + $2 s&h
- miFrame Picture Frame Dock for iPad for $64 + $8 s&h
- Refurb Apple iPod nano 8GB MP3 Player for $99 + free shipping, 16GB for $119
- Hannspree Apple-Shaped 28" 1080p LCD HDTV for $270 + free shipping
- Philips wOOx Alarm Clock Radio for Apple iPod / iPhone for $60 + free shipping
Software Updates
more updates- EFI Firmware Update brings Lion Internet Recovery to 2010-model Macs
- OS X Lion 10.7.3 released with Safari 5.1.3, Wi-Fi bug fix
- Aperture updated to 3.2.2, addresses Photo Stream issue
- Apple updates Keynote to address Lion issues
- Google Search app gets new look on iPad
- Apple releases Apple TV Software Update 4.4.3



34 Comments