Why so glum, chum? 'Cause that look of dejection sails far beyond the city limits of Monday Bluesville and nestles somewhere east of the Thursday Dumps. We're going to hazard a guess and assume that this has something to do with the Help Viewer security hole-- specifically, the fact that Apple patched it Friday night. You installed the update and verified that Help Viewer no longer launches local scripts when pages containing demo exploits are loaded, so you figure that Apple has indeed plugged what is arguably Mac OS X's first ever Gaping Chasm o' Vulnerability-- and its departure has, understandably, left some viewers like yourself feeling vaguely regretful and empty.

While literally no one reported any damage resulting from the flaw and its negative impact on the world at large paled in comparison to even the mildest Windows worm, for a brief, shining moment, we Mac users stood shoulder to shoulder with the Wintel crowd as we contended with a security flaw of practically Microsoftian proportions... and now that moment has seemingly passed. Of course you're grieving a little. Well, cheer up, Bucko; we aren't out of the woods yet. Unsanity, the maker of the freeware Paranoid Android software that was written to protect against the Help Viewer exploit, has posted a white paper explaining that clever malware authors can avoid using the "help:" protocol entirely by registering their own custom protocols. There's a linked demo exploit which still managed to write a file into our home directory even after we'd applied the Security Update and unchecked "open 'safe' files after downloading." So Apple's got a little more work to do, apparently.

Or possibly even a lot-- because meanwhile, faithful viewer Larry Vinson points out another glaring vulnerability in Mac OS X described over at Daring Fireball-- and Security Update 2004-05-24 reportedly does nothing to fix it, either. Buckle up for another URI-related vulnerability, just like the "help:" one, although with rather less potential for creative evil. This time the problem rests with the "telnet:" scheme, which, by default, is mapped to Mac OS X's Terminal application. It turns out that Mac OS X will pass along anything after the standard two slashes as a command line argument to the UNIX "telnet" command, which sounds relatively harmless until you hear that one possible argument is the "-n" flag, which specifies that telnet should log all activity for the session into the filename specified. That wouldn't be a problem, except that if a file with the same name already exists in the given location, telnet will overwrite said file with its log. Without even saying "please." Which is, we're sure you'll agree, pretty rude.

The upshot is that anyone can slap together a web page that automatically launches Terminal and overwrites data that happens to sit in a known location. Sure, it won't nuke any files for which the current user lacks write permissions, so it's unlikely that this hole could be exploited in such a way as to hose your entire Mac OS X system, and we didn't have much luck specifying filenames with spaces in them (though we were probably just doing it wrong)-- but we were able to create a web page that completely annihilated all of our Stickies. Before visiting the page, we had a rainbow of about thirty happy little notes, crammed full of random info-snippets like driving directions, bank transaction numbers, and a recipe for pie crust so flaky you'd think it believed in astrology; after visiting the page, we relaunched Stickies and found ourselves staring into a single lonely yellow rectangle with a cursor blinking forlornly within. Yikes. Just yikes.

No, it's not quite as sexy as the Help Viewer exploit, which could execute arbitrary chunks of code and theoretically even be used to spread a self-propagating worm, but any security hole that allows a web page to wipe quantities of data from your hard drive still qualifies as pretty effin' nasty in our book. So as we all sit around waiting for the next Security Update, we definitely recommend that you at least disable the telnet: URI protocol until Apple issues a real fix. There are plenty of ways to go about it; we used the freeware More Internet preference pane (which everyone should have installed-- it's Internet Config for Mac OS X, dontchaknow) to map telnet: to Image Capture instead of Terminal. After all, when was the last time you came across a legitimate telnet: link, anyway?

Of course, that doesn't fix the "arbitrary custom protocol" problem illustrated in Unsanity's white paper, so maybe the best course of action is to install Paranoid Android. We haven't had a chance to put it through its paces yet, but given that its author was able to blow through Apple's Security Update like so much wet Kleenex, we have to assume he knows what he's doing. Meanwhile, smile! We're still dealing with security issues of arguably Wintellian proportions; it's almost like we're using what the IT guys refer to as "real computers"! Can newfound respect for our chosen platform be far behind?