Like many Macworld readers I couldn't wait to install Tiger... OK, that's not strictly true - I did wait a bit. I went to the Tiger launch at London's Apple Store at 6pm on Friday April 29. I did wait long enough to pass pleasantries with various Apple bigwigs, decamp to a local pub for several pints, get peckish and try to find my favourite Soho pizzeria, discover that said historic institution is now a bloody Starbucks, get so hungry that even the dodgy Thai restaurant opposite seemed a good idea even though it was closing in 20 minutes, think about waiting for a night bus, immediately hail a taxi, and finally fall asleep oblivious to the slightly squashed Tiger box flung to the floor on arriving home.

I wasn't even up at the crack of dawn to upgrade from long-in-the-fang Panther. Eventually, I opened the box to find the Mac OS X 10.4 Tiger DVD. That's right; goodbye to those two or three OS X Install CDs - which is tough luck to those people without a DVD-ROM drive, as getting it on CDs is an awful struggle:

First, purchase a copy of Tiger; then download and post an order form with proof of purchase and the Tiger DVD plus your cheque for £11.99; wait; receive CDs; start thinking what else you could use a DVD drive for; go back to Apple Store; end up spending hundreds of pounds on a new Mac... that has Tiger pre-installed on it anyway.
I won't bore you with the usual installation tips. You can get them from here: The whole process takes less time than it took to type that URL into your old non-RSS Safari.

The first thing you notice about Tiger is that it's much more responsive than before, and startup time is incredible. This may just be because my home Mac previously took so long to start-up that I was close to shooting it or at least dragging it to the repair shop after numerous Panther
re-installs failed to get it to boot-up faster. It's a dual-G5 Power Mac, but my kettle could be fully filled with ice and boiled dry before the top menubar, Dock or desktop icons bothered to show up. Installing Tiger appears to have fixed my Mac - that's worth £89 for starters.

Every new version of the Mac OS has its ta-da feature - something to show-off to Windows users that almost always raises a "whoa!" or at least a gentle hum of appreciation, and much shameful, envious shuffling of feet behind you.

OS X's original ta-da was the Dock's rolling Magnification and Genie effects. Tiger's biggest breakthrough is Spotlight, Apple's Windows-beating desktop search engine that instantly flicks through all your files, emails, contacts, images, movies, calendars and applications for whatever you want, saving results as Smart Folders that update automatically. It's clever, cool and incredibly useful. But it isn't Tiger's ta-da.

Like most show-off fancies Tiger's ta-da is kinda frivolous, Indeed, I'm almost ashamed to be singing its praises here rather than gushing about Automator or going all mushy about QuickTime 7's H.264 video codec. Yes, as handy as the tools are in Tiger's Dashboard feature, they are all quite superfluous.

Worse, Dashboard's mini apps are embarrassingly called "widgets", like the plastic pressure-release thing at the bottom of a can of ice-cold Guinness. Because widgets are small, cute and friendly I've got a nasty feeling that Apple is confusing them with midgets - bang goes the company's political-correctness points (although, of course, the company has never been too PC-friendly).

But widgets are the quiet fireworks of Tiger - summoning collective 'oohs' and aahs' whenever and wherever they're called upon. It's pathetic really, and I'm sure I'll soon grow weary of their glossy niceness and shimmering ripple effects.

Dashboard's little widgets appear to be handy little critters, but a security-conscious developer has alerted us to a potential security threat. Because Dashboard automatically downloads and installs Widgets, it opens up the possibility of malicious widgets - the movie Gremlins springs to mind.

Theoretically these warrior widgets could be unleashed to collect people's user names, destroy data held on hard drives, spit porn all over your screen, or simply endlessly open windows, the developer notes. A widget could use time when it is hidden to add <meta> tags to every .html page stored in the users home directory. If the user happens to be running a Web server - or even uploading files to one - this could propagate a widget to other machines.

Dashboard widgets are constrained to run in a safe Javascript sandbox by default. However, a widget creator can make plug-ins for a widget that can do anything an app can do or run any command-line process. Evil third-party sites could distribute auto-install Widgets. To prove this the developer has set-up his Web site ( so that if someone running Tiger visits it, they automatically download a wicked widget called Zaptastic.

Like all widgets, it is automatically downloaded and installed and can't be removed without manually removing the file from the Library folder and rebooting the computer.

Removing offending widgets is easy enough. Go to
~/Library/Widgets/. Trash the wonky widget. And restart (alternatively, kill the process in Activity Monitor). It's simple, but how many people do you know who casually delete items from their Home's Library folder, or even know it's there?

The problem is that Apple has made it impossible to delete widgets from within Dashboard (you can't even change their order), yet allows auto-installation as a default. Autoinstall has the side effect of setting up a situation where a user can be given an application without their knowledge.

Although you're warned when installing new applications directly from the Web, Mac users are conditioned to think of widgets as harmless little toys, and therefore believe that Apple's nannyish warning can be safely ignored. Wrong.

Terrified that the Mac could become a battleground for viruses and Trojans just like Windows? Don't be. The easiest way to turn off auto-installing of widgets is to disable the automatically "open safe files after downloading" preference in Safari. (It's daft of Apple to set this as a default in the first place.) Downloaded widgets then simply end up as a zip file on your desktop.

I hope I haven't scared you off Tiger. The security issue is easily fixed: disable the Auto-install in Safari's Preferences, and be careful to download only recommended widgets. After all, as I discovered with my copy of Tiger, waiting a while before you install software is more sensible than doing it blind. MW