Stephan “stephan.com” Nosurname has opened a can of worms with his post detailing the potential security hazards of automatically-installed Dashboard widgets.

When the first announcements were made about widgets some months ago, warning bells should have gone off in our collective heads. Applications made like web pages? Aren’t web pages sometimes a bit … dodgy? How come we didn’t see this coming a long way off?

(Perhaps some of us did; if you made a fuss about this at the time, I’d love to hear about it.)

Several people have contacted Stephan to point out that by disabling auto-install, people can avoid this kind of problem. Others have reminded him that it is possible to remove widgets, just with a simple Terminal command or a root around in the Finder.

But those people are missing an important point, I think.

One of the main reasons that everyone is getting so excited about Tiger is that it is better than Windows. Even some Windows supporters are saying so. Microsoft’s Longhorn development is delayed and even the work that’s been done doesn’t compare to the attractive ease-of-use offered by Mac OS X.

This is Apple’s chance to grab some market share, people are saying. It has the advantage, it has the momentum; go, Apple, go!

So imagine if you, or perhaps a member of your family, is one of this new generation of switchers. People pulled in first by the iPod, sold on the gorgeous user interface of Tiger; wooed by the eye-candy of Dashboard.

Imagine if your loved one starts using Tiger on their shiny new Mac, and is seriously impressed. And then hits a web page like Stephan’s, only this time with something far more malicious and unpleasant buried within it.

This imaginary newbie won’t know about killing widgets via the Terminal, won’t realise that changing a preference in Safari could make all the difference. They’ll just suddenly see Dashboard go crazy, and they’ll wonder what on earth is going on.

I’ve been spending much of my free time in the last couple of years telling Windows users I know to switch from Internet Explorer to Firefox.

“IE has too many potential security holes,” I tell them. “Firefox is much safer.”

I don’t want to have to start doing that for people who use Safari.

This sort of security hole is precisely the kind of thing that people have been criticising Microsoft for. Just as it is on Windows, if you’re geeky enough, you can avoid problems. But for most users, it’s a potential cause of serious trouble.

Let’s hope a fix — one for ordinary users, not power users — appears in Software Update soon. Otherwise Apple can kiss a decent chunk of that momentum for change goodbye.

Shocked? Horrified? Bemused?