Typing “old” (space) into iOS Safari crashes the app
twitter.com
twitter.com
Edit: stopped reproducing here as of 19:11 UTC.
Edit: some people digged into it[2][3], [2] includes partial endpoint URLs. Apparently this was happening for 7+^H^H 10+ hour.
1: https://www.macrumors.com/2022/11/14/safari-search-crash-bug...
Installing 15.7.1 now to check that version (and because I might as well install it anyway...) Edit: doesn’t crash on 15.7.1 either (though my first test on 15.7.1 was at 17:28 UTC.)
I have no idea what this means
people forget that many acronyms are context sensitive and/or audience sensitive. they just assume everyone across the world has the same shared life experience that they do.
Target is a supermarket chain in USA. I assume Bestbuy is also something like that.
In my browser (Firefox on Android) if I type "tar" it auto-suggests completing the url to "target.com". Useless to me because I'm nowhere close to USA and there's no Target in my country.
Speaking of which, maybe they should have a separate list of autocompletable sites based on the user's location. However, I'm not sure of the privacy implications of that.
Would be quite the story if shitty adware causes crashes.
1. apple shipped a feature for walmart causing their browser to crash
2. apple shipped walmart code in their browser which crashed
3. apple shipped walmart plugin in their browser and then apple made a breaking change which crashed
3rd one is my favorite because it's the most dysfunctional
Probably I should upgrade even more slowly in the future…
Doesn't reproduce for me btw. I also have the setting disabled that adds a period when typing a space twice, if that matters.
I wasn't able to reproduce the bug.
Turning off “Safari Suggestions” in settings fixes it.
They've actually apparently introduced a few new operators since the old days, which I found surprising. For example, $ for prices, # for hashtags, and .. for ranges of numbers. https://support.google.com/websearch/answer/2466433?hl=en
edit: Also, I'm on the iPhone 11 or 12 I think? So maybe model has something to do with it?
Turned it back on... still no crash. Search engine makes no difference.
Wonder if it's a cache thing and disabling Suggestions cleared that, removing whatever bad data was hanging around, or if it was a purely server-side bug and they've already fixed it.
[EDIT] Some others saying it stopped happening, so may have been fixed.
Also, I'm on the iPhone 11 or 12 I think? So maybe model has something to do with it?
Wholesome hacking
So be careful.
Old Spice, Old Navy...
They are desperate about getting you to download their app.
“bedt “
“old “
“wel “
“dta “
All of these crash safari in iOS for me.
What’s strange about this bug is that it happened overnight for multiple iOS version.
It seems to be a server bug that happens with the requests that populate the suggestions.
Turning off safari suggestions fixes it.
Wait, you don't want them to fix the client crashing on malformed data?
Doesn't need to be. Some software nowadays can toggle feature flags clientside behind your back. I know Firefox does (or did?) this. Creepy as all fuck.
Really? No - there is no privacy threat surface with suggestions, unless you assume that Apple and everyone who works there is lying about it?
ref: "any information sent to Apple does not identify you, and is associated with a 15-minute random, rotating device-generated identifier"
[0]https://www.apple.com/legal/privacy/data/en/siri-suggestions...
“We do not provide any government agency with direct access to our servers, and any government agency requesting customer content must get a court order.”
Either Snowden is lying, or Apple is.
There are lots of potential explanations here. It’s possible and even likely that in an org as large as Apple, the people writing press copy simply are not exposed to all of the details of all of the moving parts that enable realtime surveillance of their userbase. They can also use a different definition of “direct access” (while providing realtime unsupervised access via API, but not via physical (“direct”) entry to a datacenter building).
Apple also claims (in HT202303) that iMessage is end to end encrypted, when for the vast majority of the userbase of iMessage, Apple has copies (readable to Apple) of the endpoint private keys and can, if they wish, decrypt and read and store anyone’s iMessages in realtime as if they were not encrypted at all. It’s still “end to end encrypted” if there is a key escrow backdoor in the system that defeats the end to end encryption. It’s like putting a $5 gym lock on a cardboard box. It’s not lying to say that you locked it up.
You can make factually accurate statements about certain specific things that paint a picture or strongly imply a state of affairs that is diametrically opposed to the truth. Apple is, as far as I can tell, the best in the world at this type of misdirection. It even fools professional journalists.
For example: if they log the client IP of all requests to the API, the statement you quoted holds true - and yet it is still trivial to make a single query to a) relate all of your API requests together, and b) relate them to your identity via Apple’s many other APIs. The “rotating” implies that it is unlinked, but does not guarantee that it is unlinkable (eg from having client IP and timestamp columns in the data).
Apple is skilled at lying by saying only very specific, true things, as confusing as that may sound.
It is also a mistake to assume there is no importance because there is no threat model. Even if the data is never linked to you, it is a privacy violation for the keystrokes to leave your device if you don’t want them to. For a contrived example, you don’t need a threat model or ID linkage to not want your neck-down nudes leaked. A non-identifiable privacy violation is still a privacy violation.
Can someone clarify why that's done or how it could even be useful? It just seems (to me, naïvely) like if you're going to rotate the identifier every fifteen minutes, why even bother?
Perhaps we should ask people that bought iTruth for $299. But seriously, you are way too trusting of corporations and their public statements.
Now your browser can crash because of a bug on a server, somewhere, which you weren't planning on browsing to, let alone even knew existed.
The future truly is here.
“Fail gracefully” for malformed responses. If a JSON API all of a sudden starts returning a cloudflare html error response, you shouldn’t crash your iPhone app.
-- Leslie Lamport
Asking for a friend who has Safari search suggestions disabled (so Safari does not crash) but encounters Firefox crashes regularly.
doesn't crash in private mode
Edit: best guess so far: something regional or language dependent? Looks like US-specific search suggestions?
My non-crashing circumstances:
(iPhone11, iOS 15.6.1, Swedish language, in Sweden)
But it clearly doesn’t reproduce across all devices/versions/settings with iOS Safari. Better repro steps needed.
* edit crazy typo
Is the person who wrote the tweet trolling? Probably not either.
But what type of iOS device do they have? Which version of iOS are they running? Which language and locale?
Those things matter. Other things that apparently shouldn't matter might matter as well: other apps installed or running, notification configuration, how many tabs they have open, whether they're connected via WiFi or 4G, etc.
We don't know any of that stuff. As GP said: better reproduction steps needed.
As it is this bug report is barely above the kind of "hurr durr it dern't work" support ticket that really pisses off everyone in my team, and indeed every support engineer, and software engineer I've ever worked with.
2) The very first thing any actual engineer on Apple's payroll ought to try to reproduce it will work (most recent official iOS, "happy path" settings that have Safari Suggestions turned on)
2) Yes, they will, but that won't necessarily repro the bug without knowing which type of device it's running on, so at the very least they might need to check several different devices, and even then other factors can come into play that go beyond basic device configuration.
I'm sure, given that this appears to affect at least a significant minority of users, that Apple will be all over it and will find a way to repro it in relatively short order. Yet, at the same time, it's obscure enough to have escaped their no doubt reasonably robust QA processes before release, so it may well be there are some wrinkles to reproduction that aren't immediately apparent.
People might. This one didn't even @ Apple. Jesus, HN (a sentiment the Tweet author has also expressed by now on the tweet thread, as they're apparently reading this and seeing y'all acting like this in public)
> 2) Yes, they will, but that won't necessarily repro the bug without knowing which type of device it's running on, so at the very least they might need to check several different devices, and even then other factors can come into play that go beyond basic device configuration.
Twitter figured this out in like 30 minutes. It's Safari Suggestions on any recent iOS. This may not be the platonic ideal of a bug report but it's not a bug report and also it happens, by chance, to be entirely fine even if it were, because this is super-easy to figure out.
... and what more? in US? On en-US language? Because it doesn't seem to be that universal.
no, it really didn’t.
i’m on 16.1.1 with suggestions on and it does not crash.
Launch Safari
Tap address bar
Type "old"
Launch Safari
Tap address bar
Type "old "
Boom!
I'm sorry to to be the one to break this to you -- you have only worked with bad engineers.
If you get a bug report like this, where some simple user action like typing three characters is causing client devices to crash, you better be more mad at your busted ass system than a sparse bug report.
I don’t think it’s unreasonable to try to narrow it down here simply because the story sort of hinges on the magnitude here.
Apple developers should look at the stack trace that should either be sent automatically when it crashes (if privacy settings allow), or with a problem report sent from the device.
If this is a widespread issue, devs should have already gotten an automated alert.
Crashes on my phone running 16.1.1.
People are suggesting it might be en-US only.
Must be something else more complicated.