Slashdot Mirror

Gentoo has significantly more vulnerabilites than Fedora, even if you add up all the vulnerabilities for all 4 cores (not that those raw numbers really matter in the end as long as they all get patched)

Well, first I'd like to irraterate what you already pointed out, that neither has unpatched vulnerabilities.

Second, you're comparing EVERY release of Gentoo ever to Fedora Core 4.0. Notice how Fedora Core 4.0 doesn't have any vulnerabilities before Feb 2005? That's because it didn't exist much before then.

You forgot the 186 patched vulerabilities in FC 3, the 132 patched vulnerabilities in FC 2, and the 74 patched vulnerabilities in FC 1.

No, that 448 patched vulerabilities is much less than the 746 vulnerabilities for Gentoo, but that's a stupid rubrik anyway. 746 vulerabilities covers the entire portage tree, where as 448 vulnerabilities only covers those packages distributed on the RedHat installation media.

Keep your meta distribution, it's no skin off my nose. But at least attempt to make like comparisons in your arguments.

Thank you for passing this information along to the community.

For what it is worth, the MacroMedia Flash Player has a security hole that has been fixed in version 8. This is mislisted by Secunia as a hole in Opera?! (But not Firefox. If my tin foil hat still worked, I'd be using it 24x7.)

Security should be easy. Fedora comes with it preconfigured and has an excellent default policy that you can modify at your desire. The more obstructions in the way, the less likely the security features are to be used, Fedora literally removes all obstructions. Gentoo has significantly more vulnerabilites than Fedora, even if you add up all the vulnerabilities for all 4 cores (not that those raw numbers really matter in the end as long as they all get patched). The difference is that most of the vulnerabilities announced in Fedora can't actually be used against the system for a couple of reasons including SELinux, exec-shield, randomized memory mappings and compiling with fortify source for all major public facing services . All of this is done and implemented without the user having to do anything, that is the way to implement security (if you want it to be used). Keep it simple, and keep it out of the way. In addition to this, Fedora/RHEL have the fastest rate of getting patches out, followed by Novell which is sometimes 2 or 3 days later, and then followed by others (Its been a few months since I've read the report, but it was on /.) I'm not knocking Gentoo, it has its place, but it isn't really made for the desktop or the server, it is a really good learning tool that some people use as their main OS (of course it also has other purposes). I've ran Gentoo before, and learned alot about my system, but as far as speed goes I noticed nothing above Fedora (which has all optimized packages). Infact the only distro that I've ever used where there was a huge noticable speed difference over the others was Yoper., unfortunately its development seems stagnant.
REgards,
Steve

Security should be easy. Fedora comes with it preconfigured and has an excellent default policy that you can modify at your desire. The more obstructions in the way, the less likely the security features are to be used, Fedora literally removes all obstructions. Gentoo has significantly more vulnerabilites than Fedora, even if you add up all the vulnerabilities for all 4 cores (not that those raw numbers really matter in the end as long as they all get patched). The difference is that most of the vulnerabilities announced in Fedora can't actually be used against the system for a couple of reasons including SELinux, exec-shield, randomized memory mappings and compiling with fortify source for all major public facing services . All of this is done and implemented without the user having to do anything, that is the way to implement security (if you want it to be used). Keep it simple, and keep it out of the way. In addition to this, Fedora/RHEL have the fastest rate of getting patches out, followed by Novell which is sometimes 2 or 3 days later, and then followed by others (Its been a few months since I've read the report, but it was on /.) I'm not knocking Gentoo, it has its place, but it isn't really made for the desktop or the server, it is a really good learning tool that some people use as their main OS (of course it also has other purposes). I've ran Gentoo before, and learned alot about my system, but as far as speed goes I noticed nothing above Fedora (which has all optimized packages). Infact the only distro that I've ever used where there was a huge noticable speed difference over the others was Yoper., unfortunately its development seems stagnant.
REgards,
Steve

I know right! I mean Linux doesn't have anything... oh wait.

Yipee, the good ole days never ended...
http://secunia.com/product/22/
http://secunia.com/product/11/

It seems "hot fixes" are just for some of the old (and mildly warm) vulnerabilties.

Yipee, the good ole days never ended...
http://secunia.com/product/22/
http://secunia.com/product/11/

It seems "hot fixes" are just for some of the old (and mildly warm) vulnerabilties.

What every sysadmin should know is that the unpatched known holes of today are not only open doors for crackers, they are the open doors for the next worms.
Every sysadmin should check security sites like Secunia, with a list of unpatched known holes for each software they use:
http://secunia.com/

Well, would you blame Microsoft for the vulnerabilities in aspWebCalendar 4.x or ASP Nuke? Or perhaps it's Microsoft's fault that there is a exploitable flaw in Macromedia Flash Player (it's an option during the IE6 install)? If you want to complain about double standards, how about we start with that one?

Well, would you blame Microsoft for the vulnerabilities in aspWebCalendar 4.x or ASP Nuke? Or perhaps it's Microsoft's fault that there is a exploitable flaw in Macromedia Flash Player (it's an option during the IE6 install)? If you want to complain about double standards, how about we start with that one?

Well, would you blame Microsoft for the vulnerabilities in aspWebCalendar 4.x or ASP Nuke? Or perhaps it's Microsoft's fault that there is a exploitable flaw in Macromedia Flash Player (it's an option during the IE6 install)? If you want to complain about double standards, how about we start with that one?

All signs point to linux having anywhere from the same market share as macs up to 3 times the market share of macs, particularly if you take into account webservers which would not show up in places like traditional webstats because web servers don't browse web sites, same thing for HPCs. Also, most linux machines are converted wintel boxes, meaning that as far as sales stats go, Windows makes out really well. Take into account that alot of linux boxes are old as well as new, meaning that alot of people who run linux often run more then one linux box, some of which may be a decade or so old (or much older in some cases). The average wintel box is replaced every 2~3 years. That means, for the sake of argument, if I set up a linux box today and a windows box, in 6 years after the first wintel box is replaced,Microsoft will have 2 "points" and linux will have 1 even though there is still 1 linux box and 1 wintel box running. Now if that linux box originally was a windows box, as it is in most cases, then Microsoft would have 3 "points" and linux none.

Apple often uses sales figures to make their market share appear larger than it is, those numbers are not accurate and highly biased against linux. But as far as your little rant goes, this is an exploit in php and only php. But it is even more specific than that, you must have a very speicific configuration which pretty much allows anyone to own your machine. This worm doesn't use an exploit, it uses people's stupidity that configure machines for convenience rather than security. It's akin to be leavning the door to my house not only unlocked, but wide open because I didn't feel like being inconvenienced by opening it every day. I've never heard of a box being configured the way the aritcle describes so this is indeed a rare occurence.

But just in case you forgot, Mac OSX does have its problems, despite the limited amount of software that comes with them and the limited liability that Apple takes. Apple's track record is on par with any linux distro, for instance Debian or Fedora, but this actually means that Apple's record is worse because in a distro like Debian or Fedora, these projects take responsibility for something like 10,000 packages. If you look at Fedora's page in secunia you'll see that its advisories include updates for Mozilla, Squid, Wget, Abiword and every other package. Considering that one project has the burden of having to report and patch so many packages, you would expect the number to be much higher. Looks like linux is still kicking both Microsoft's and Apple's ass as far as security goes.
Regards,
Steve

I use NoScript.

One recent exploit that worked even with NoScript enabled was the highly critical 'Firefox IDN URL Domain Name Buffer Overflow'.

http://secunia.com/advisories/16764/

Secunia has released a security advisory about the Sony DRM at this link: http://secunia.com/advisories/17408/

Sony CD First4Internet XCP DRM Software Security Issue
...with a simple solution : Use another product.

Could you explain how IIS is more secure than Apache?

I could: Apache 2.0.x had 28 security advisories since release (2 still unpatched at the time of writing), while IIS 6.0 had only 2 until now, and they were both patched.

Could you explain how IIS is more secure than Apache?

I could: Apache 2.0.x had 28 security advisories since release (2 still unpatched at the time of writing), while IIS 6.0 had only 2 until now, and they were both patched.

Wouldn't it be possible to send a specially crafted audio stream to VoIP programs such as Skype to explore eventual vulnerabilities on the audio codec routines?

I know it sounds far-fetched, but you know, jpegs were once safe too. Skype had its vulnerabilities (even on Linux), but were there any on the audio codec?

I hate these "must-have-a-firewall-passage" kind of programs, and I've so far managed to keep them out of my network, but now I'm trying hard to convince my boss not to install Skype on a CAD user's PC "because a customer wants to talk with him"!! CAN'T HE USE A PHONE??!

A huge unidentified virus is approaching the Computer. It was made in the far past by another life than the human race, and occupied and inhabited by a vicious exploit in the long period. In order to save the Computer, the strongest Windows patches go into action.

A huge unidentified virus is approaching the Computer. It was made in the far past by another life than the human race, and occupied and inhabited by a vicious exploit in the long period. In order to save the Computer, the strongest Windows patches go into action.

A huge unidentified virus is approaching the Computer. It was made in the far past by another life than the human race, and occupied and inhabited by a vicious exploit in the long period. In order to save the Computer, the strongest Windows patches go into action.

Firefox was "regarded as" bullet proof until it started gaining market share, and as soon as it did, there came the holes.

I think there is some truth the to bullet proof remark as many people assumed there would be no holes in Firefox because they had not seen continual bug reports like they had seen for the Intenet Explorer counter part. However, I think there is still some justification to the perception of a more secure product from the mozilla foundation than from Microsoft. I am basing this opinion off the statistics at secunia.com:

Internet Explorer stats
http://secunia.com/product/11/

Fire Fox stats
http://secunia.com/product/4227/

Pay close attention to the statistics charts and you can draw the following conclusions:
1) The rate at which bugs are found in the two applications is very nearly the same. On average about 2 per month for each application.

2) Internet Explorer tends to have more bugs which are unpatched or partialy fixed. Fire Fox is much better at patching.

3) The severity of the bugs found in Internet Explorer tend to be much higher than those of Fire Fox. The bugs in Internet Explorer are more than 3 times likely to be of extreme severity when compared to Fire Fox.

4) And more of the bugs found in Internet Explorer tend to give system access when exploited than Fire Fox bugs.

So the perception that Fire Fox is more secure than Internet Explorer is justified. But bullet proof, far from it.

The Linux market is so incredibly tiny that no hacker looking to make money takes the time to hack Linux.

Somehow I doubt that most of the hackers out there do what they do to make money. But I'm more concerned with you "incredibly tiny" market share theory. Perhaps in desktops the linux market share is small, however, there are a significant number of linux servers out there especially in the web server space. I tried searching for data but the only thing I could find was some old 2001 data from a Netcraft survey.

http://survey.netcraft.com/index-200106.html

But based on that survey in June of 2001 there were about 8.5 million linux web servers alone. That is 29% of the market. And if the market share numbers are the same today that number is over 21 million. So I'd say there are plenty of linux boxes just waiting to be hacked.

And interestingly, when you compare the secunia reports for similar products, Windows 2003 Web Server and Red Hat Enterprise AS 3, you find similar results to the web browsers:

Windows 2003 Web Server
http://secunia.com/product/1176/

Red Hat Enterprise AS 3
http://secunia.com/product/2534/

One may look at the number of reported vulnerabilities and say ooh open source security sucks, but then when you dig a little deeper you see that on average Windows security bugs are patched slower, the severity is greater, and they are more likely to provide system access if exploited.

Others spread FUD about MS just as much as MS spreads FUD about Linux.

I'd say its rather dishonest to put some Slashdot poster FUD on the same level as the expensive marketing campaigns used by Microsoft to spread FUD. Not quite the same thing. And besides, could you give some examples of non-blog/message board FUD spread about Mic

Firefox was "regarded as" bullet proof until it started gaining market share, and as soon as it did, there came the holes.

I think there is some truth the to bullet proof remark as many people assumed there would be no holes in Firefox because they had not seen continual bug reports like they had seen for the Intenet Explorer counter part. However, I think there is still some justification to the perception of a more secure product from the mozilla foundation than from Microsoft. I am basing this opinion off the statistics at secunia.com:

Internet Explorer stats
http://secunia.com/product/11/

Fire Fox stats
http://secunia.com/product/4227/

Pay close attention to the statistics charts and you can draw the following conclusions:
1) The rate at which bugs are found in the two applications is very nearly the same. On average about 2 per month for each application.

2) Internet Explorer tends to have more bugs which are unpatched or partialy fixed. Fire Fox is much better at patching.

3) The severity of the bugs found in Internet Explorer tend to be much higher than those of Fire Fox. The bugs in Internet Explorer are more than 3 times likely to be of extreme severity when compared to Fire Fox.

4) And more of the bugs found in Internet Explorer tend to give system access when exploited than Fire Fox bugs.

So the perception that Fire Fox is more secure than Internet Explorer is justified. But bullet proof, far from it.

The Linux market is so incredibly tiny that no hacker looking to make money takes the time to hack Linux.

Somehow I doubt that most of the hackers out there do what they do to make money. But I'm more concerned with you "incredibly tiny" market share theory. Perhaps in desktops the linux market share is small, however, there are a significant number of linux servers out there especially in the web server space. I tried searching for data but the only thing I could find was some old 2001 data from a Netcraft survey.

http://survey.netcraft.com/index-200106.html

But based on that survey in June of 2001 there were about 8.5 million linux web servers alone. That is 29% of the market. And if the market share numbers are the same today that number is over 21 million. So I'd say there are plenty of linux boxes just waiting to be hacked.

And interestingly, when you compare the secunia reports for similar products, Windows 2003 Web Server and Red Hat Enterprise AS 3, you find similar results to the web browsers:

Windows 2003 Web Server
http://secunia.com/product/1176/

Red Hat Enterprise AS 3
http://secunia.com/product/2534/

One may look at the number of reported vulnerabilities and say ooh open source security sucks, but then when you dig a little deeper you see that on average Windows security bugs are patched slower, the severity is greater, and they are more likely to provide system access if exploited.

Others spread FUD about MS just as much as MS spreads FUD about Linux.

I'd say its rather dishonest to put some Slashdot poster FUD on the same level as the expensive marketing campaigns used by Microsoft to spread FUD. Not quite the same thing. And besides, could you give some examples of non-blog/message board FUD spread about Mic

Firefox was "regarded as" bullet proof until it started gaining market share, and as soon as it did, there came the holes.

I think there is some truth the to bullet proof remark as many people assumed there would be no holes in Firefox because they had not seen continual bug reports like they had seen for the Intenet Explorer counter part. However, I think there is still some justification to the perception of a more secure product from the mozilla foundation than from Microsoft. I am basing this opinion off the statistics at secunia.com:

Internet Explorer stats
http://secunia.com/product/11/

Fire Fox stats
http://secunia.com/product/4227/

Pay close attention to the statistics charts and you can draw the following conclusions:
1) The rate at which bugs are found in the two applications is very nearly the same. On average about 2 per month for each application.

2) Internet Explorer tends to have more bugs which are unpatched or partialy fixed. Fire Fox is much better at patching.

3) The severity of the bugs found in Internet Explorer tend to be much higher than those of Fire Fox. The bugs in Internet Explorer are more than 3 times likely to be of extreme severity when compared to Fire Fox.

4) And more of the bugs found in Internet Explorer tend to give system access when exploited than Fire Fox bugs.

So the perception that Fire Fox is more secure than Internet Explorer is justified. But bullet proof, far from it.

The Linux market is so incredibly tiny that no hacker looking to make money takes the time to hack Linux.

Somehow I doubt that most of the hackers out there do what they do to make money. But I'm more concerned with you "incredibly tiny" market share theory. Perhaps in desktops the linux market share is small, however, there are a significant number of linux servers out there especially in the web server space. I tried searching for data but the only thing I could find was some old 2001 data from a Netcraft survey.

http://survey.netcraft.com/index-200106.html

But based on that survey in June of 2001 there were about 8.5 million linux web servers alone. That is 29% of the market. And if the market share numbers are the same today that number is over 21 million. So I'd say there are plenty of linux boxes just waiting to be hacked.

And interestingly, when you compare the secunia reports for similar products, Windows 2003 Web Server and Red Hat Enterprise AS 3, you find similar results to the web browsers:

Windows 2003 Web Server
http://secunia.com/product/1176/

Red Hat Enterprise AS 3
http://secunia.com/product/2534/

One may look at the number of reported vulnerabilities and say ooh open source security sucks, but then when you dig a little deeper you see that on average Windows security bugs are patched slower, the severity is greater, and they are more likely to provide system access if exploited.

Others spread FUD about MS just as much as MS spreads FUD about Linux.

I'd say its rather dishonest to put some Slashdot poster FUD on the same level as the expensive marketing campaigns used by Microsoft to spread FUD. Not quite the same thing. And besides, could you give some examples of non-blog/message board FUD spread about Mic

Firefox was "regarded as" bullet proof until it started gaining market share, and as soon as it did, there came the holes.

I think there is some truth the to bullet proof remark as many people assumed there would be no holes in Firefox because they had not seen continual bug reports like they had seen for the Intenet Explorer counter part. However, I think there is still some justification to the perception of a more secure product from the mozilla foundation than from Microsoft. I am basing this opinion off the statistics at secunia.com:

Internet Explorer stats
http://secunia.com/product/11/

Fire Fox stats
http://secunia.com/product/4227/

Pay close attention to the statistics charts and you can draw the following conclusions:
1) The rate at which bugs are found in the two applications is very nearly the same. On average about 2 per month for each application.

2) Internet Explorer tends to have more bugs which are unpatched or partialy fixed. Fire Fox is much better at patching.

3) The severity of the bugs found in Internet Explorer tend to be much higher than those of Fire Fox. The bugs in Internet Explorer are more than 3 times likely to be of extreme severity when compared to Fire Fox.

4) And more of the bugs found in Internet Explorer tend to give system access when exploited than Fire Fox bugs.

So the perception that Fire Fox is more secure than Internet Explorer is justified. But bullet proof, far from it.

The Linux market is so incredibly tiny that no hacker looking to make money takes the time to hack Linux.

Somehow I doubt that most of the hackers out there do what they do to make money. But I'm more concerned with you "incredibly tiny" market share theory. Perhaps in desktops the linux market share is small, however, there are a significant number of linux servers out there especially in the web server space. I tried searching for data but the only thing I could find was some old 2001 data from a Netcraft survey.

http://survey.netcraft.com/index-200106.html

But based on that survey in June of 2001 there were about 8.5 million linux web servers alone. That is 29% of the market. And if the market share numbers are the same today that number is over 21 million. So I'd say there are plenty of linux boxes just waiting to be hacked.

And interestingly, when you compare the secunia reports for similar products, Windows 2003 Web Server and Red Hat Enterprise AS 3, you find similar results to the web browsers:

Windows 2003 Web Server
http://secunia.com/product/1176/

Red Hat Enterprise AS 3
http://secunia.com/product/2534/

One may look at the number of reported vulnerabilities and say ooh open source security sucks, but then when you dig a little deeper you see that on average Windows security bugs are patched slower, the severity is greater, and they are more likely to provide system access if exploited.

Others spread FUD about MS just as much as MS spreads FUD about Linux.

I'd say its rather dishonest to put some Slashdot poster FUD on the same level as the expensive marketing campaigns used by Microsoft to spread FUD. Not quite the same thing. And besides, could you give some examples of non-blog/message board FUD spread about Mic

I would not rate a 30-40% webserver marketshare as 'incredibly tiny', and yet Red Hat, the most popular Linux distribution for servers has 0 unpatched vulnerabilities whilst Windows Server 2003 suffers from 8 unpatched vulnerabilities and Windows XP Professional suffers from a full 26 vulnerabilities one or more of which are marked as as highly critical.

Just wondering... how can Red Hat have no vulnerabilities, when the 2.6 linux kernel alone has 15 unpatched vulnerabilities?

Perhaps you don't understand how to read those pages?

Ya, just like Firefox is more secure then IE.

As of writing, Internet Explorer 6 has 20 unpatched vulnerabilies, one or more of which are marked as highly critical. Firefox has 3 vulnerabilities, with one or more marked as less critical. So yes, Firefox is more secure than IE.

The Linux market is so incredibly tiny that no hacker looking to make money takes the time to hack Linux.

I would not rate a 30-40% webserver marketshare as 'incredibly tiny', and yet Red Hat, the most popular Linux distribution for servers has 0 unpatched vulnerabilities whilst Windows Server 2003 suffers from 8 unpatched vulnerabilities and Windows XP Professional suffers from a full 26 vulnerabilities one or more of which are marked as as highly critical.

How can claim that Linux is less secure than Windows, when it has less unpatched vulnerabilities?

Ya, just like Firefox is more secure then IE.

As of writing, Internet Explorer 6 has 20 unpatched vulnerabilies, one or more of which are marked as highly critical. Firefox has 3 vulnerabilities, with one or more marked as less critical. So yes, Firefox is more secure than IE.

The Linux market is so incredibly tiny that no hacker looking to make money takes the time to hack Linux.

I would not rate a 30-40% webserver marketshare as 'incredibly tiny', and yet Red Hat, the most popular Linux distribution for servers has 0 unpatched vulnerabilities whilst Windows Server 2003 suffers from 8 unpatched vulnerabilities and Windows XP Professional suffers from a full 26 vulnerabilities one or more of which are marked as as highly critical.

How can claim that Linux is less secure than Windows, when it has less unpatched vulnerabilities?

Ya, just like Firefox is more secure then IE.

As of writing, Internet Explorer 6 has 20 unpatched vulnerabilies, one or more of which are marked as highly critical. Firefox has 3 vulnerabilities, with one or more marked as less critical. So yes, Firefox is more secure than IE.

The Linux market is so incredibly tiny that no hacker looking to make money takes the time to hack Linux.

I would not rate a 30-40% webserver marketshare as 'incredibly tiny', and yet Red Hat, the most popular Linux distribution for servers has 0 unpatched vulnerabilities whilst Windows Server 2003 suffers from 8 unpatched vulnerabilities and Windows XP Professional suffers from a full 26 vulnerabilities one or more of which are marked as as highly critical.

How can claim that Linux is less secure than Windows, when it has less unpatched vulnerabilities?

Ya, just like Firefox is more secure then IE.

As of writing, Internet Explorer 6 has 20 unpatched vulnerabilies, one or more of which are marked as highly critical. Firefox has 3 vulnerabilities, with one or more marked as less critical. So yes, Firefox is more secure than IE.

The Linux market is so incredibly tiny that no hacker looking to make money takes the time to hack Linux.

I would not rate a 30-40% webserver marketshare as 'incredibly tiny', and yet Red Hat, the most popular Linux distribution for servers has 0 unpatched vulnerabilities whilst Windows Server 2003 suffers from 8 unpatched vulnerabilities and Windows XP Professional suffers from a full 26 vulnerabilities one or more of which are marked as as highly critical.

How can claim that Linux is less secure than Windows, when it has less unpatched vulnerabilities?

Ya, just like Firefox is more secure then IE.

As of writing, Internet Explorer 6 has 20 unpatched vulnerabilies, one or more of which are marked as highly critical. Firefox has 3 vulnerabilities, with one or more marked as less critical. So yes, Firefox is more secure than IE.

The Linux market is so incredibly tiny that no hacker looking to make money takes the time to hack Linux.

I would not rate a 30-40% webserver marketshare as 'incredibly tiny', and yet Red Hat, the most popular Linux distribution for servers has 0 unpatched vulnerabilities whilst Windows Server 2003 suffers from 8 unpatched vulnerabilities and Windows XP Professional suffers from a full 26 vulnerabilities one or more of which are marked as as highly critical.

How can claim that Linux is less secure than Windows, when it has less unpatched vulnerabilities?

Okay genius, how about this one? If you're trying to insinuate that I couldn't find a DoS exploit for IE 6.x, guess again. At some point, proving a point that's obvious becomes tiresome. Next time, go look up your owned damned exploits, because I was right to begin with and I'm still right.

assuming the Secunia Advisory is referring to the same vulnerability linked to in the /. article, its Critical level is the lowest, Not Critical

This is really unfortunate. It is fantastic that even an 'option' is being offered, but Netscape had been installed on HP and Compaq computers in the past (Netscape 6.2.1) and nobody used it. What's going to change that now? The only option would be to make it the default -- and unfortunately, Netscape is not much more secure than Internet Explorer at the present time. They still haven't released a fix for the "critical" soft-hyphen IDN exploit, but Firefox had a new release with the fix out within a week. I can't see a whole lot of good coming out of this.

Actually, I disagree. I've been running Windows networks for over a decade without a single virus or spyware infection. Interestingly, we've had a nearly identical amount of successful hacks on both our web-facing Windows and Linux machines. I would say I'm pretty much on par with the Linux admin in terms of skills and knowledge, and we are both in agreeance that no matter what you do, eventually you will get hacked. Just like you will eventually be a victim of some sort of crime in the Real World, if you spend enough time in it. With a combination of flaws and ignorance / mistakes, every OS under the sun is suceptable to penetration, regardless of how skilled the Admin is. Just ask the Linux admin at my place of work, who lost a server thanks to a vendor-coded exploit. It happens. Live, learn, patch and move on.

It seems that Secunia advisory has new information now, late update from Friday says that Linux issue was fixed: http://secunia.com/advisories/16901/

Thank God a simlar vulnerability could never exist in Firefox

I'll start with the securia site.

Internet Explorer: Microsoft Internet Explorer 6.x with all vendor patches installed and all vendor workarounds applied, is currently affected by one or more Secunia advisories rated Highly critical...Currently, 20 out of 86 Secunia advisories, is marked as "Unpatched" in the Secunia database.

FireFox: Mozilla Firefox 1.x with all vendor patches installed and all vendor workarounds applied, is currently affected by one or more Secunia advisories rated Less critical...Currently, 3 out of 24 Secunia advisories, is marked as "Unpatched" in the Secunia database.

I'll start with the securia site.

Internet Explorer: Microsoft Internet Explorer 6.x with all vendor patches installed and all vendor workarounds applied, is currently affected by one or more Secunia advisories rated Highly critical...Currently, 20 out of 86 Secunia advisories, is marked as "Unpatched" in the Secunia database.

FireFox: Mozilla Firefox 1.x with all vendor patches installed and all vendor workarounds applied, is currently affected by one or more Secunia advisories rated Less critical...Currently, 3 out of 24 Secunia advisories, is marked as "Unpatched" in the Secunia database.

CNET reports that a new flaw in Internet Explorer could be exploited to launch spoof-based attacks, or access and change data on vulnerable PCs, security experts have warned.

The vulnerability could be exploited with specially crafted code. An attacker could spoof a legitimate Web site, access data from the Web browser's cache or stage a so-called man-in-the-middle attack, which taps into traffic between a user and another Web site, according to Klein's write-up.

Fully-patched computers running Windows XP with Service Pack 2 and Internet Explorer 6.0 are vulnerable to this issue, security monitoring company Secunia said in an advisory.

Zonk is a Microsoft's shill, I think.

Firefox was supposed to be more secure than IE. But exploits for both browsers are close in numbers

If you compare numbers, please compare them correctly. According to Secunia, IE has much more OPEN security holes than Firefox has.
http://secunia.com/product/4227/
http://secunia.com/product/11/

I also suggest you to read this article about the "Fun with statistics", which is about the security holes in Firefox and IE:
http://reviews.cnet.com/4520-3513_7-6333507-1.html

Firefox was supposed to be more secure than IE. But exploits for both browsers are close in numbers

If you compare numbers, please compare them correctly. According to Secunia, IE has much more OPEN security holes than Firefox has.
http://secunia.com/product/4227/
http://secunia.com/product/11/

I also suggest you to read this article about the "Fun with statistics", which is about the security holes in Firefox and IE:
http://reviews.cnet.com/4520-3513_7-6333507-1.html

CNET reports that a new flaw in Internet Explorer could be exploited to launch spoof-based attacks, or access and change data on vulnerable PCs, security experts have warned.

The vulnerability could be exploited with specially crafted code. An attacker could spoof a legitimate Web site, access data from the Web browser's cache or stage a so-called man-in-the-middle attack, which taps into traffic between a user and another Web site, according to Klein's write-up.

Fully-patched computers running Windows XP with Service Pack 2 and Internet Explorer 6.0 are vulnerable to this issue, security monitoring company Secunia said in an advisory.

Somehow, this story never made it to the front page.

What extra features do you need out of SSH anyway? I ask not to be a smart arse, but as a genuine inquiry.

Security?

Secunia Advisories:

SSH Communications
- SSH Secure Shell for Servers 2.x
- SSH Secure Shell for Servers 3.x
- SSH Secure Shell for Windows Servers 3.x
- SSH Secure Shell for Workstations 2.x
- SSH Secure Shell for Workstations 3.x
- SSH Sentinel 1.x
- SSH Tectia Client 4.x
- SSH Tectia Server 4.x

OpenBSD
- OpenSSH 3.x
- OpenSSH 4.x

OpenBSD has a pretty good reputation for being secure and I didn't see anything in the advisories above that made me worry. I don't think this pay-to-play ssh is going to give me more security. I think I'll stick with OpenSSH.

-Joe

What extra features do you need out of SSH anyway? I ask not to be a smart arse, but as a genuine inquiry.

Security?

Secunia Advisories:

SSH Communications
- SSH Secure Shell for Servers 2.x
- SSH Secure Shell for Servers 3.x
- SSH Secure Shell for Windows Servers 3.x
- SSH Secure Shell for Workstations 2.x
- SSH Secure Shell for Workstations 3.x
- SSH Sentinel 1.x
- SSH Tectia Client 4.x
- SSH Tectia Server 4.x

OpenBSD
- OpenSSH 3.x
- OpenSSH 4.x

OpenBSD has a pretty good reputation for being secure and I didn't see anything in the advisories above that made me worry. I don't think this pay-to-play ssh is going to give me more security. I think I'll stick with OpenSSH.

-Joe

I hate to break it to you, but Firefox has had way more than one hole in the last year:

http://secunia.com/product/4227/

23 since the release of 1.0. We're now on 1.07. Seven major security releases.

Is it better than IE? Probably. Firefox vulnerabilities tend to be fixed more quickly and are less secure than IE vulnerabilities. That said, IE is considerably easier to update for both corporate users and home users.

Firefox can do better. Fortunately, the update mechanism is much-improved in 1.5. But, remember, Firefox is supposed to be the darling of the Open Source movement. We can do better.

The problem is not that security is being handled by obscurity in some browsers. The problem is that some browser vendors are not as aggressive in patching security problems as other vendors are.

The problem is not that security is being handled by obscurity in some browsers. The problem is that some browser vendors are not as aggressive in patching security problems as other vendors are.

The problem is not that security is being handled by obscurity in some browsers. The problem is that some browser vendors are not as aggressive in patching security problems as other vendors are.

The problem is not that security is being handled by obscurity in some browsers. The problem is that some browser vendors are not as aggressive in patching security problems as other vendors are.