Exactly. Apple will fix it. Very few people will suffer from it. One person already has wiped out her desktop when they tried to save a web page with a huge long title, and didn't pay attention to the "Replace" warning But in the grand scheme of things it's not that big a deal - I'll bet this bug was in previous OS X versions, but it took until now to discover it.

Regardless, CNet will probably put it on the front page with "Extremely critical MacOS X bug unwittingly wiped out users' data!"

NObody is saying it is a bug - it's just not worth making a big deal out of it.

And to the genome guy, BS - I'm sure you all sit there trying to distinguish 1000 character filenames by eye. As if you don't use an index file to record which files your genome sequences are in. What if you had a 1025 character sequence? You're out of luck then, because no OS supports 1025 character path names.

For me, to save on the purchase of a word processor, I have been writing all of my docs as file titles. I find that it increases the speed of search without having to index the drive, which is butt slow in Panther.

I then copy the doc title and then write it down on paper, place it in an envelope and purchase a stamp at the local Check Casher, and then give it to my local letter carrier.

Apple's QA department is seriously lagging of late, but there is hope. MacOSRumors.org is reporting that the next 64-bit Finder will address this issue. If not, I'm gonna buy a Dell like all my neighbors, so they can help me with it.

So that is where all my p*** went? I want it all back.
:P

The genome filename example given above is rather silly.

These scientists used to use DOS 8 character filenames with 3 character filename extensions. Now they suddenly can not do research without 1000 character filenames?

Can you imagine a directory of only 20-30 files with 1000 character genome based filenames? Even with that few files, the extreme length of the filenames would be a hindrance to productivity.

Of course, if you only had 20-30 files in a given directory then there would be absolutely no reason to use 1000 character filenames.

With only 5 character filenames, you have over 60,000,000 valid permutations. It is a whole lot more likely that scientists studying genomes would use some efficient abbreviated naming convention rather than 1000 character filenames.

come on people... this is a serious problem. It opens the OS up to evil people. So I could copy a file over with a 1000+ character name and bring down an OS X server...

If you don't see how this could be serious, you obviously have your steve jobs glasses on.

The best thing Apple could do is say it's not a big deal (and release an update ASAP!!!)

- - - - - - - - - - - -

Do I need to worry about this: NO
Does Apple need to worry about this: YES

Nobody is going to name their file the 1000 characters. But it is still a security hole. Someone with certain group permissions can try to make a 1000 character file and destroy a user or incorrectly permissioned system folder.

It's not the file name ability, but it is another malicious capability.

>> It opens the OS up to evil people. So I could copy a file over with a 1000+ character name and bring down an OS X server...

This only affects Cocoa apps, so apparently a hacker would have to have physical access to your server and admin rights (or remote access to the GUI), and by the time they had that, they could do a million easier things to destroy your data.

"You couldn't hack an OS X box if you tried, and even if you could, you'd have to use some obscure method like activating the screensaver and typing the commands at light speed before the password dialogue pops up or trying to save a file with more than 1,000 characters in the name. Windows, on the other hand, can be exploited and compromised by an 11 year old using an old 75MHz Pentium and a dial-up connection."

Uh, let's not be zealot-like with the hyperbole, shall we? With this bug, and, yes, it is a bug, I can go to a "friend's" machine and seriously s**** him over by doing this. On the other hand, I see no evidence of an 11 year old hacker with 75 Mhz pentium.

In any case, if we want to pick on MS for all kinds of bugs - from the serious SoBig to stupid ones like "clicking on a malformed URL via Outlook and having IE set as so-and-so could allow a web site to take control of your machine blah blah blah" - we need to have the same standard for Apple as well.

Why, all of a sudden, has the press got so many reports of minor (essentially victimless) bugs?? It seems that there have been a series of stories suggesting how resistant Mac OSX is to problems, bugs and viruses, and that's been folowed by a series of reports about Mac OSX problems, bugs and security leaks. Is someone looking for trouble then exagerating what little they find?? Is the competition involved in creating this press?? Is there a problem with the concept of an MSNBC?

if you copy a significant amount (over 1000 ch) of text into clipboard and then accidently paste it into file name window, then you are in trouble...

Cheetah was 10.0

You people seem to be missing how it was determined/discovered is the real reason this is a real bug. Many web sites (esp those used with shopping or some nasty other ones on line) could have really long titles. Web sites don't care, because its not a file name, but a page title. But someone not paying attention, wants to save a copy of a web page, and without realizing it, just hosed their entire user directory (or worse).

But no, we get "This isn't a serious bug, why are people talking about it!" and "Won't affect me, I only use short file names" responses. Meanwhile, everytime someone finds some small buffer overflow in some MS product, no matter how inocuous or hard to near impossible to exploit, its all "OMG! MS is so full of security holes!" and "This is such a freaking problem I can't believe it!" c***.

If this was an MS problem, you'd be all over them. But its an Apple problem, so its 'no big deal'.

Hypocrites you are. (Oh, and I'm no PC-loving troll. I'm a Mac User since 84, never owned a PC and certainly won't until some time after Apple finally goes out of business - I read in Business Week that it could be any day now, although that was written in 1997).

That wouldn't work. You would likely simply get an error when copying the file, or wipe out only your own files on the server.

This is a serious problem. While it is true that there are few users that will be affected, this is more likely to affect corporate or research users and it is important that these people not have their hard drives erased.

Just because some of you have never named a file longer than 1000 characters does not mean it is a useful feature. And if it is a part of the OS and something that Apple has used to sell the OS to high end users, this cannot be something that not only does not work but erases drives. Many high end users who might be buying 2000 node super clusters would use this feature and be affected by this issue.

It is a GOOD THING that these bugs are in the open and public. They will get fixed sooner and give Apple the opportunity to publicly do the right thing by notifying users and fixing the bug promptly.

10.0 was Cheetah. 10.1 was Puma. 10.2 was Jaguar, and, well, you know the rest. ;)

And the next rev, 10.4, is going to be called p****.

Suppose you created a file with a 1024 character filename (which I suspect is the buffer for the filename), and put that in a Stuffit or Zip file. When you expanded the archive, would this cause the bug?

Also, I wonder if this includes the full path to the file as part of that filename. If you gave it a ridiculouos path to traverse, would that also trigger this bug?

There is a Windows vulnerability (still unpatched) that allows you to create very long paths, long enough to hide something from anti-viral software. You end up creating a set of nested subdirectories about 30 levels deep and placing files there. The OS can see them for execution, etc. but they cannot be deleted by the OS since it's too deep.

Well, if you're gonna market an Operating System as "rocksolid" and "foolproof" or even "Virus Free," don't expect the technology community (including reporters) to say "hey, that's neat" and just accept those notions without a challenge. People will investigate and substantiate those claims, and make sure that a company is held accountable for it's mistakes. Look at Microsoft for instance ... they have most of the technology press (and some "independant" researchers) in their pocket, and they push hard to suppress challenges to their system security and stability. With MS, however, they have so many holes that they can't possibly cover them all, and there are enough independant (and biased) parties out there who will make sure they are accountable.

Most of you MacNN readers couldn't string together 1000 characters in a row if you tried. Instead of being so concerned / unconcerned about this little bug, I suggest you sit down and reconsider dropping out of Grade 9.

Losers.

Send someone a Zip archive containing the 1,000+ character-name file. When the person unzips... *BAM* there goes the Desktop.

Suppose you created a file with a 1024 character filename (which I suspect is the buffer for the filename), and put that in a Stuffit or Zip file. When you expanded the archive, would this cause the bug?

Maybe you missed the memo, but you can't create a file with a 1024 character name. HFS+ only supports 255. Hence the problem (which should either be handled by not allowing entry past 255 characters, or pop up an error saying "File name too large" like OS 9 would yell at you in the Finder). The fact that (a) Apple doesn't handle it, and (b) then overwrites a directory due to (a), is the reason its a problem.

umm no, not "BAM"! Not only would MacNN readers have a hard time with typing 1000 characters in a row they also have difficulty reading 1000 characters in a row.

When you unstuffed the file, one of two things would happen. Either the finder would ask you if you wanted to rename or it would ask you if you wanted to rewrite. You would still have to read and make the correct decision so there is definitely the potential for trouble, but then again, I don't think you should be playing with a computer anyway. Grade-niners should still be learning with pencil crayons.

dickheads.

Maczealots are f***.

Last month, the developer stopped sales and downloads of Netflix Fanatic. "Due to a dispute with my employer, I will no longer be developing or distributing Netflix Fanatic," the developer said on his Web site. "If another company or individual takes up the reins or decides to develop a similar product, I will update this page with that information."

Most Netflix Fanatic users assumed that the developer had been strong-armed by some draconian corporate policy, but few knew who the employer actually was: Apple Computer. This information can be confirmed publicly: this resumé for the developer notes his employment by Apple.

Further, sources told Think Secret that Apple has claimed ownership over the application's name and source code. At the time we spoke with our source, the developer had not yet handed the source code over to Apple, but that may well have changed since that time.

One source makes the case that Apple is doing this illegally under California's labor laws, and, according to a quoted message sent to MacSlash, Netflix Fanatic's developer originally made the same argument before changing the message on his Web site. "Predictably, they will also not be developing or distributing it themselves, so the product is effectively at the end of its life. While I believe they are violating Section 2870 of the California Labor Code by doing this, I don't have the means to fight it," he reportedly said.

According to the section of the labor code he referenced, if a company has an employment agreement with provisions saying employees must assign the rights of their inventions to their employer, those sections do not apply if the employee developed it on his or her own time, without using the employer's equipment, supplies, facilities, or trade secret information. The exception to this law is an invention that relates to the employer's R&D or practice, or that results from work an employee did at the company. If Netflix Fanatic's developer showed that he developed the application independently from his work and resources at Apple, and that the application does not relate to Apple's R&D efforts, he may have a case under that section of the California Labor Code.

hi enter

grammar check...zzzzaaapp!>#*bbbbooooommmmmmm


PC zealots have no genitals

LOL.. I rest my case :)

Vastly superior GUI, security, apps, hardware, architecture, but there's a tiny bug with mentally long filenames; so it's c***!

Is it any wonder these f****** windows users can't see the wood for the trees and keep buying Dells.

This specific bug is not a buffer overrun nor a flaw in the file system. It is a bug in the way Cocoa apps determine the name of the file they are saving.

Basically, Cocoa apps use an append operation to add the chosen file name to the end of the directory path where the file is to saved.

Understandably, this append operation returns an error when the file name to appended is too long.

Unfortunately, the Cocoa file-saving code apparently doesn't check if the append was successful, and thinks that it has the full path to save the file, when all it has is the directory path.

When writing the file, it sees that the directory (say, "Desktop") already exists, and asks the user if it should be overwritten.

If the user says yes, it carefully deletes all the files contained in the directory, than replaces it with the new file.

This is clearly something that needs to be fixed, but is unlikely to occur... and is a reminder that the "Do you want to replace..." message should not be casually ignored... especially if you don't think you should be overwriting anything.

(Apple should be able to easily fix this, as it is part of the Cocoa Document-Based App code.)

Marcin

Now C-Net can jump on it ! I can see the title: "Dangerous Bug Discovered in Apples newest OS". Woo-hoo !!

With this bug, and, yes, it is a bug, I can go to a "friend's" machine and seriously s**** him over by doing this.

Why not just go to your "friend's" machine and reformat the hard drive or put a brick through the monitor.

Either method would be faster and cause more damage than the long filename bug.

"Lorem ipsum dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. Ut wisi enim ad minim veniam, quis nostrud exerci tation ullamcorper suscipit lobortis nisl ut aliquip ex ea commodo consequat. Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis at vero eros et accumsan et iusto odio dignissim qui blandit praesent luptatum zzril delenit augue duis dolore te feugait nulla facilisi. Ut wisi enim ad minim veniam, quis nostrud exerci tation ullamcorper suscipit lobortis nisl ut aliquip ex ea commodo consequat. Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis at vero eros et accumsan et iusto odio dignissim qui blandit praesent luptatum zzril delenit augue duis dolore te feugait nulla facilisi. Lorem ipsum dolor sit amet consectetuer adipiscing elit."

Since even 1,000-character web page titles are few and far between, there's a good passage to name files with.

BUT, if you are saving files with names this long, you are doing something wrong and you need to change your ways.

No OS reliably supports file names that long, 256 characters should be considered the safe maximum, for compatibility reasons if nothing else.

1000 characters could be a whole page of a document, you can't tell me you need that many characters for a 'file name'. Get real.

Some people like to organise their files using tags in the file names (Windows users and MP3s come to mind). Another stupid thing to do. Use folders for this.

So sarcastic. You know, there is a way you could get this bug. Sometimes I paste another filename or phrase from the document to use as a file naming starting point. Well, what if I forgot what I last copied to the Clipboard, and it was an entire long text story? Paste, and the bug is in effect.

Face it, somebody went through something like this or the bug would never have been found. You people who think "who would be stupid enough to do THAT?" forget how many ways things can happen on a computer. Remind me not to hire you for testing.

This "problem" has taken a lot of abuse from people who can't imagine a 1,000 character file name. When I catch myself saying "I can't imagine," I try to ask myself if perhaps I simply lack imagination? :-)

This can happen quite easily if you try to copy some text to use as a filename, but slip the mouse up or down and copy much more than you intended. Then you go paste it in as a file name, and BAM! Your entire disk disappears!

Here's another case: anyone have pets who like to walk on keyboards? I once ended up with a WordPerfect MeSs-DOS file named "GGGGGGGG.GGG" because my cat thoughtfully saved my file while walking on the keyboard.

It's a bug, folks, and a rather severe one, too! Severity trumps lack of likelyhood.

"ust because some of you have never named a file longer than 1000 characters does not mean it is a useful feature."

Nice try. Given that the most I've ever heard of an OS supporting 1024 characters for the whole path, not just the file - and most people don't store files at the root of their hard disk, I would say nobody has ever approached this limit unless they did so arbitrarily.

Yes, it's good to get these problems in the open. Though Apple typically fixes serious bugs immediately, it's not that same as if the bug was for another specific operating system.

It is extrange, because HFS+ has a 512 bytes, or 256 Unicode characters limit, so it is rare to find this condition... because Save boxes should be limited to no more than the allowed characters...

If you thought you had the filename in the paste buffer, but instead had a large document in there, and you pasted it into the file save dialog, you could end up with something like this. Any such easy-to-execute problem like this where massive data destruction is possible, is quite serious indeed.

why do people post uninformed opinions when they don't Read The Article?

Also, there's a phrase that comes to mind here:
backup your data!

That said, Apple should (and soon will) fix the bug.

The Genome example was a joke you humorless droids...

No s*** R2. You really got me with that one.

C3P0

Thanks for the tip. I was wondering why I kept losing my hard drive data... Now, I know!

Here's another tip I discovered: if you take a screwdriver to your OS X Panther disks and scrape them, it corrupts the data on the CD! This means you can't install Panther - a serious bug, for sure.

"The Genome example was a joke you humorless droids..."

It was absurd, but that does not make it funny.

Whoever posted it simply sounded like an idiot. If the intent was to be sarcastic or humorous, then it failed. Better luck next time.

The alleged ZIP exploit is bogus. Whoever came up with that idea apparently does not truly understand this bug.

If the OS is causing loss of data (regardless of a warning of an overwrite) then it IS A SERIOUS BUG. I don't care how unlikely it is to happen, it IS there and it needs a fix. Perhaps you don't seem to see the whole picture here, but bugs like these could very well be the tip of the iceberg. With the recent loss of data with Panther and FW and bugs like these, it makes me wonder what the h*** is Apple's QA team thinking about (if they even have one). Perhaps it is something you MacZealots should be thinking about before you wake up one day and find out someone exploited a security hole in your "unhaxored" OS X boxes.

Easy now, Windows man. Seems to me that the fox always checks his own hole first. What's that you say? Your Windows box has 72,000 holes, so how can you plug them all?

There ain't no one sticking anything in this tiny Mac hole, and if that is all there is, I can understand your jealousy and frustration.

Now back the f*** up, get the f*** out, and shut the f*** up.

I just got bitten by something very similar, maybe the same bug. I was using certain beta software (will not mention the manufacturer) and created an application that I ran. Didn't give me an error about long file names or bad file paths or anything... just deleted a chunk of the hard drive. Sounds like a related bug, if not the same thing. So it's not just random people naming their files way too long....