Slashdot Mirror

The problem is not that security is being handled by obscurity in some browsers. The problem is that some browser vendors are not as aggressive in patching security problems as other vendors are.

"The only secure web browser is less..."

The Secunia website lists open security issues for:

http://secunia.com/product/4932/ Opera (0 issues),
http://secunia.com/product/4227/ Mozilla 1.x (3 issues) and
http://secunia.com/product/11/ IE (19 issues).

It's also interesting to look at the past history of issues and maybe take a peek at those pie charts near the bottom of the page.

Mmmm... Pie!

"The only secure web browser is less..."

The Secunia website lists open security issues for:

http://secunia.com/product/4932/ Opera (0 issues),
http://secunia.com/product/4227/ Mozilla 1.x (3 issues) and
http://secunia.com/product/11/ IE (19 issues).

It's also interesting to look at the past history of issues and maybe take a peek at those pie charts near the bottom of the page.

Mmmm... Pie!

"The only secure web browser is less..."

The Secunia website lists open security issues for:

http://secunia.com/product/4932/ Opera (0 issues),
http://secunia.com/product/4227/ Mozilla 1.x (3 issues) and
http://secunia.com/product/11/ IE (19 issues).

It's also interesting to look at the past history of issues and maybe take a peek at those pie charts near the bottom of the page.

Mmmm... Pie!

If it is so swift at responding to security, then why did it take 7 years to notice and fix a critical vulnerability? Furthermore, if the developers care so much about security, then why the organization allows certain people in the bug group to censor security flaws within Mozilla's projects, thus making users vulnerable to browser bugs for YEARS? Is it one of those M$ scheme designed to destroy the hard-earned reputations of the browser?

It is one thing to have old bugs, but it is another matter when Mozilla developers being hypocritical when they allow such moronic security practice to take place. Long live IE!!!

A new flaw affecting Firefox users under Unix allows webmasters to craft a URL that when run from an application like Evolution can execute any command. The flaw stems from the use of backticks in the shell script used to launch Firefox. Read more about it here on the Secunia advisory. Version 1.0.7 fixing the flaw is already out.

This is actually not right at all. Exactly at the time of the symantec report, FF had ONE exploit that was more critical than IE. In general they have less severe exploits, and A LOT less unpatched exploits. Check out the following links: Secunia IE vulnerabilities Secunia FF vulnerabilities As you can see, FF has 3 unpatched vulnerabilities, while IE has 19, the highest rated of these being more severe than FFs. I would say it is quite clear that FF has less unpatched vulnerabilities.

This is actually not right at all. Exactly at the time of the symantec report, FF had ONE exploit that was more critical than IE. In general they have less severe exploits, and A LOT less unpatched exploits. Check out the following links: Secunia IE vulnerabilities Secunia FF vulnerabilities As you can see, FF has 3 unpatched vulnerabilities, while IE has 19, the highest rated of these being more severe than FFs. I would say it is quite clear that FF has less unpatched vulnerabilities.

And that is my point. If the possible variance in the number of actual bugs (reported or otherwise) gets to be comparable to the number of bugs reported, then the reports mean nothing. The actual number of bugs encountered could range from zero to infinity and the stats would still be "correct".

What about the Secunia Secuirty advisories.

http://secunia.com/product/4227/

Cant see them running to fix some of those issues?

The biggest Opera security problem recently was the news-making cross-platform popup origin spoofing vulnerability. Secuna released a security advisory to the general public on 6/21/2005. Opera fixed it with Opera 8.01 on 6/16/2005, five days before the report was released. Firefox, on the other hand, took until 7/12/2005 to fix it in Firefox 1.0.5, three weeks after the advisory's public release.

Also, this vulnerability was the biggest security fix in Opera 8.01; Firefox 1.0.5 fixed 9 vulnerabilities that were more severe.

"Malicious popups"?? "Crashing browler only"??

Yeah right. Please! Stop! I'm laughing so hard it hurts.

2003-2005
http://secunia.com/graph/?type=imp&period=all&prod =4227
2005 Alone
http://secunia.com/graph/?type=imp&period=2005&pro d=4227

"Malicious popups"?? "Crashing browler only"??

Yeah right. Please! Stop! I'm laughing so hard it hurts.

2003-2005
http://secunia.com/graph/?type=imp&period=all&prod =4227
2005 Alone
http://secunia.com/graph/?type=imp&period=2005&pro d=4227

Aside from the question raised in many posts about whether the fact that Firefox is open source leads to faster and fuller disclosure, the following is an email I sent this past weekend regarding this article.

Lots is being made the past few days about the number of security holes found in various browsers. Just to try to keep the discussion from descending to complete irrelevance, here's the stats that actually matter:

Solution Status (has it been fixed?):
http://secunia.com/graph/?type=sol&period=all&prod =11
http://secunia.com/graph/?type=sol&period=all&prod =4227

Criticality (how bad is it if I get hit?):
http://secunia.com/graph/?type=cri&period=all&prod =11
http://secunia.com/graph/?type=cri&period=all&prod =4227

Unpatched Criticality (what can happen to me today?) Requires a little more looking - see the list at the bottom of each page:
http://secunia.com/product/11/
http://secunia.com/product/4227/
IE: 5 unpatched moderate or greater criticality
Firefox: 0 unpatched moderate or greater criticality

Finally, and unfortunately not clearly covered in [the Secunia] report is vulnerability window - how long does a bug go without being patched. You can, however, make a fairly good estimate by looking at the patch time for highly critical or worse bugs:

MS has been making big improvements lately, so I'll only look at the MS holes from the past year (the older ones have dramatically longer vulnerability windows) (I've also left out holes which were publicly discovered as a result of a windows patch)

IE Highly+ Critical Windows (past year)
http://secunia.com/advisories/12806/ 103 days
http://secunia.com/advisories/12889/ 108 days
http://secunia.com/advisories/12959/ 29 days
http://secunia.com/advisories/13482/ 53 days
http://secunia.com/advisories/15891/ 7 days

Firefox Highly+ Critical Windows (all time)
http://secunia.com/advisories/14654/ 7 days
http://secunia.com/advisories/14938/ 24 days
http://secunia.com/advisories/15292/ 5 days
http://secunia.com/advisories/16043/ 7 days
http://secunia.com/advisories/16764/ 3 days

Keep the discussion rational - security is hard, so is assessing security. Be skeptical of anyone who has a dog in the fight (eg: Symantec). [Which is not to say that Symantec cannot be trusted for Windows security, only that their PR department's press releases regarding software security should be treated as suspect - particularly when they draw questionable conclusions from insufficient data.]

Aside from the question raised in many posts about whether the fact that Firefox is open source leads to faster and fuller disclosure, the following is an email I sent this past weekend regarding this article.

Lots is being made the past few days about the number of security holes found in various browsers. Just to try to keep the discussion from descending to complete irrelevance, here's the stats that actually matter:

Solution Status (has it been fixed?):
http://secunia.com/graph/?type=sol&period=all&prod =11
http://secunia.com/graph/?type=sol&period=all&prod =4227

Criticality (how bad is it if I get hit?):
http://secunia.com/graph/?type=cri&period=all&prod =11
http://secunia.com/graph/?type=cri&period=all&prod =4227

Unpatched Criticality (what can happen to me today?) Requires a little more looking - see the list at the bottom of each page:
http://secunia.com/product/11/
http://secunia.com/product/4227/
IE: 5 unpatched moderate or greater criticality
Firefox: 0 unpatched moderate or greater criticality

Finally, and unfortunately not clearly covered in [the Secunia] report is vulnerability window - how long does a bug go without being patched. You can, however, make a fairly good estimate by looking at the patch time for highly critical or worse bugs:

MS has been making big improvements lately, so I'll only look at the MS holes from the past year (the older ones have dramatically longer vulnerability windows) (I've also left out holes which were publicly discovered as a result of a windows patch)

IE Highly+ Critical Windows (past year)
http://secunia.com/advisories/12806/ 103 days
http://secunia.com/advisories/12889/ 108 days
http://secunia.com/advisories/12959/ 29 days
http://secunia.com/advisories/13482/ 53 days
http://secunia.com/advisories/15891/ 7 days

Firefox Highly+ Critical Windows (all time)
http://secunia.com/advisories/14654/ 7 days
http://secunia.com/advisories/14938/ 24 days
http://secunia.com/advisories/15292/ 5 days
http://secunia.com/advisories/16043/ 7 days
http://secunia.com/advisories/16764/ 3 days

Keep the discussion rational - security is hard, so is assessing security. Be skeptical of anyone who has a dog in the fight (eg: Symantec). [Which is not to say that Symantec cannot be trusted for Windows security, only that their PR department's press releases regarding software security should be treated as suspect - particularly when they draw questionable conclusions from insufficient data.]

Aside from the question raised in many posts about whether the fact that Firefox is open source leads to faster and fuller disclosure, the following is an email I sent this past weekend regarding this article.

Lots is being made the past few days about the number of security holes found in various browsers. Just to try to keep the discussion from descending to complete irrelevance, here's the stats that actually matter:

Solution Status (has it been fixed?):
http://secunia.com/graph/?type=sol&period=all&prod =11
http://secunia.com/graph/?type=sol&period=all&prod =4227

Criticality (how bad is it if I get hit?):
http://secunia.com/graph/?type=cri&period=all&prod =11
http://secunia.com/graph/?type=cri&period=all&prod =4227

Unpatched Criticality (what can happen to me today?) Requires a little more looking - see the list at the bottom of each page:
http://secunia.com/product/11/
http://secunia.com/product/4227/
IE: 5 unpatched moderate or greater criticality
Firefox: 0 unpatched moderate or greater criticality

Finally, and unfortunately not clearly covered in [the Secunia] report is vulnerability window - how long does a bug go without being patched. You can, however, make a fairly good estimate by looking at the patch time for highly critical or worse bugs:

MS has been making big improvements lately, so I'll only look at the MS holes from the past year (the older ones have dramatically longer vulnerability windows) (I've also left out holes which were publicly discovered as a result of a windows patch)

IE Highly+ Critical Windows (past year)
http://secunia.com/advisories/12806/ 103 days
http://secunia.com/advisories/12889/ 108 days
http://secunia.com/advisories/12959/ 29 days
http://secunia.com/advisories/13482/ 53 days
http://secunia.com/advisories/15891/ 7 days

Firefox Highly+ Critical Windows (all time)
http://secunia.com/advisories/14654/ 7 days
http://secunia.com/advisories/14938/ 24 days
http://secunia.com/advisories/15292/ 5 days
http://secunia.com/advisories/16043/ 7 days
http://secunia.com/advisories/16764/ 3 days

Keep the discussion rational - security is hard, so is assessing security. Be skeptical of anyone who has a dog in the fight (eg: Symantec). [Which is not to say that Symantec cannot be trusted for Windows security, only that their PR department's press releases regarding software security should be treated as suspect - particularly when they draw questionable conclusions from insufficient data.]

Aside from the question raised in many posts about whether the fact that Firefox is open source leads to faster and fuller disclosure, the following is an email I sent this past weekend regarding this article.

Lots is being made the past few days about the number of security holes found in various browsers. Just to try to keep the discussion from descending to complete irrelevance, here's the stats that actually matter:

Solution Status (has it been fixed?):
http://secunia.com/graph/?type=sol&period=all&prod =11
http://secunia.com/graph/?type=sol&period=all&prod =4227

Criticality (how bad is it if I get hit?):
http://secunia.com/graph/?type=cri&period=all&prod =11
http://secunia.com/graph/?type=cri&period=all&prod =4227

Unpatched Criticality (what can happen to me today?) Requires a little more looking - see the list at the bottom of each page:
http://secunia.com/product/11/
http://secunia.com/product/4227/
IE: 5 unpatched moderate or greater criticality
Firefox: 0 unpatched moderate or greater criticality

Finally, and unfortunately not clearly covered in [the Secunia] report is vulnerability window - how long does a bug go without being patched. You can, however, make a fairly good estimate by looking at the patch time for highly critical or worse bugs:

MS has been making big improvements lately, so I'll only look at the MS holes from the past year (the older ones have dramatically longer vulnerability windows) (I've also left out holes which were publicly discovered as a result of a windows patch)

IE Highly+ Critical Windows (past year)
http://secunia.com/advisories/12806/ 103 days
http://secunia.com/advisories/12889/ 108 days
http://secunia.com/advisories/12959/ 29 days
http://secunia.com/advisories/13482/ 53 days
http://secunia.com/advisories/15891/ 7 days

Firefox Highly+ Critical Windows (all time)
http://secunia.com/advisories/14654/ 7 days
http://secunia.com/advisories/14938/ 24 days
http://secunia.com/advisories/15292/ 5 days
http://secunia.com/advisories/16043/ 7 days
http://secunia.com/advisories/16764/ 3 days

Keep the discussion rational - security is hard, so is assessing security. Be skeptical of anyone who has a dog in the fight (eg: Symantec). [Which is not to say that Symantec cannot be trusted for Windows security, only that their PR department's press releases regarding software security should be treated as suspect - particularly when they draw questionable conclusions from insufficient data.]

Aside from the question raised in many posts about whether the fact that Firefox is open source leads to faster and fuller disclosure, the following is an email I sent this past weekend regarding this article.

Lots is being made the past few days about the number of security holes found in various browsers. Just to try to keep the discussion from descending to complete irrelevance, here's the stats that actually matter:

Solution Status (has it been fixed?):
http://secunia.com/graph/?type=sol&period=all&prod =11
http://secunia.com/graph/?type=sol&period=all&prod =4227

Criticality (how bad is it if I get hit?):
http://secunia.com/graph/?type=cri&period=all&prod =11
http://secunia.com/graph/?type=cri&period=all&prod =4227

Unpatched Criticality (what can happen to me today?) Requires a little more looking - see the list at the bottom of each page:
http://secunia.com/product/11/
http://secunia.com/product/4227/
IE: 5 unpatched moderate or greater criticality
Firefox: 0 unpatched moderate or greater criticality

Finally, and unfortunately not clearly covered in [the Secunia] report is vulnerability window - how long does a bug go without being patched. You can, however, make a fairly good estimate by looking at the patch time for highly critical or worse bugs:

MS has been making big improvements lately, so I'll only look at the MS holes from the past year (the older ones have dramatically longer vulnerability windows) (I've also left out holes which were publicly discovered as a result of a windows patch)

IE Highly+ Critical Windows (past year)
http://secunia.com/advisories/12806/ 103 days
http://secunia.com/advisories/12889/ 108 days
http://secunia.com/advisories/12959/ 29 days
http://secunia.com/advisories/13482/ 53 days
http://secunia.com/advisories/15891/ 7 days

Firefox Highly+ Critical Windows (all time)
http://secunia.com/advisories/14654/ 7 days
http://secunia.com/advisories/14938/ 24 days
http://secunia.com/advisories/15292/ 5 days
http://secunia.com/advisories/16043/ 7 days
http://secunia.com/advisories/16764/ 3 days

Keep the discussion rational - security is hard, so is assessing security. Be skeptical of anyone who has a dog in the fight (eg: Symantec). [Which is not to say that Symantec cannot be trusted for Windows security, only that their PR department's press releases regarding software security should be treated as suspect - particularly when they draw questionable conclusions from insufficient data.]

Aside from the question raised in many posts about whether the fact that Firefox is open source leads to faster and fuller disclosure, the following is an email I sent this past weekend regarding this article.

Lots is being made the past few days about the number of security holes found in various browsers. Just to try to keep the discussion from descending to complete irrelevance, here's the stats that actually matter:

Solution Status (has it been fixed?):
http://secunia.com/graph/?type=sol&period=all&prod =11
http://secunia.com/graph/?type=sol&period=all&prod =4227

Criticality (how bad is it if I get hit?):
http://secunia.com/graph/?type=cri&period=all&prod =11
http://secunia.com/graph/?type=cri&period=all&prod =4227

Unpatched Criticality (what can happen to me today?) Requires a little more looking - see the list at the bottom of each page:
http://secunia.com/product/11/
http://secunia.com/product/4227/
IE: 5 unpatched moderate or greater criticality
Firefox: 0 unpatched moderate or greater criticality

Finally, and unfortunately not clearly covered in [the Secunia] report is vulnerability window - how long does a bug go without being patched. You can, however, make a fairly good estimate by looking at the patch time for highly critical or worse bugs:

MS has been making big improvements lately, so I'll only look at the MS holes from the past year (the older ones have dramatically longer vulnerability windows) (I've also left out holes which were publicly discovered as a result of a windows patch)

IE Highly+ Critical Windows (past year)
http://secunia.com/advisories/12806/ 103 days
http://secunia.com/advisories/12889/ 108 days
http://secunia.com/advisories/12959/ 29 days
http://secunia.com/advisories/13482/ 53 days
http://secunia.com/advisories/15891/ 7 days

Firefox Highly+ Critical Windows (all time)
http://secunia.com/advisories/14654/ 7 days
http://secunia.com/advisories/14938/ 24 days
http://secunia.com/advisories/15292/ 5 days
http://secunia.com/advisories/16043/ 7 days
http://secunia.com/advisories/16764/ 3 days

Keep the discussion rational - security is hard, so is assessing security. Be skeptical of anyone who has a dog in the fight (eg: Symantec). [Which is not to say that Symantec cannot be trusted for Windows security, only that their PR department's press releases regarding software security should be treated as suspect - particularly when they draw questionable conclusions from insufficient data.]

Aside from the question raised in many posts about whether the fact that Firefox is open source leads to faster and fuller disclosure, the following is an email I sent this past weekend regarding this article.

Lots is being made the past few days about the number of security holes found in various browsers. Just to try to keep the discussion from descending to complete irrelevance, here's the stats that actually matter:

Solution Status (has it been fixed?):
http://secunia.com/graph/?type=sol&period=all&prod =11
http://secunia.com/graph/?type=sol&period=all&prod =4227

Criticality (how bad is it if I get hit?):
http://secunia.com/graph/?type=cri&period=all&prod =11
http://secunia.com/graph/?type=cri&period=all&prod =4227

Unpatched Criticality (what can happen to me today?) Requires a little more looking - see the list at the bottom of each page:
http://secunia.com/product/11/
http://secunia.com/product/4227/
IE: 5 unpatched moderate or greater criticality
Firefox: 0 unpatched moderate or greater criticality

Finally, and unfortunately not clearly covered in [the Secunia] report is vulnerability window - how long does a bug go without being patched. You can, however, make a fairly good estimate by looking at the patch time for highly critical or worse bugs:

MS has been making big improvements lately, so I'll only look at the MS holes from the past year (the older ones have dramatically longer vulnerability windows) (I've also left out holes which were publicly discovered as a result of a windows patch)

IE Highly+ Critical Windows (past year)
http://secunia.com/advisories/12806/ 103 days
http://secunia.com/advisories/12889/ 108 days
http://secunia.com/advisories/12959/ 29 days
http://secunia.com/advisories/13482/ 53 days
http://secunia.com/advisories/15891/ 7 days

Firefox Highly+ Critical Windows (all time)
http://secunia.com/advisories/14654/ 7 days
http://secunia.com/advisories/14938/ 24 days
http://secunia.com/advisories/15292/ 5 days
http://secunia.com/advisories/16043/ 7 days
http://secunia.com/advisories/16764/ 3 days

Keep the discussion rational - security is hard, so is assessing security. Be skeptical of anyone who has a dog in the fight (eg: Symantec). [Which is not to say that Symantec cannot be trusted for Windows security, only that their PR department's press releases regarding software security should be treated as suspect - particularly when they draw questionable conclusions from insufficient data.]

Aside from the question raised in many posts about whether the fact that Firefox is open source leads to faster and fuller disclosure, the following is an email I sent this past weekend regarding this article.

Lots is being made the past few days about the number of security holes found in various browsers. Just to try to keep the discussion from descending to complete irrelevance, here's the stats that actually matter:

Solution Status (has it been fixed?):
http://secunia.com/graph/?type=sol&period=all&prod =11
http://secunia.com/graph/?type=sol&period=all&prod =4227

Criticality (how bad is it if I get hit?):
http://secunia.com/graph/?type=cri&period=all&prod =11
http://secunia.com/graph/?type=cri&period=all&prod =4227

Unpatched Criticality (what can happen to me today?) Requires a little more looking - see the list at the bottom of each page:
http://secunia.com/product/11/
http://secunia.com/product/4227/
IE: 5 unpatched moderate or greater criticality
Firefox: 0 unpatched moderate or greater criticality

Finally, and unfortunately not clearly covered in [the Secunia] report is vulnerability window - how long does a bug go without being patched. You can, however, make a fairly good estimate by looking at the patch time for highly critical or worse bugs:

MS has been making big improvements lately, so I'll only look at the MS holes from the past year (the older ones have dramatically longer vulnerability windows) (I've also left out holes which were publicly discovered as a result of a windows patch)

IE Highly+ Critical Windows (past year)
http://secunia.com/advisories/12806/ 103 days
http://secunia.com/advisories/12889/ 108 days
http://secunia.com/advisories/12959/ 29 days
http://secunia.com/advisories/13482/ 53 days
http://secunia.com/advisories/15891/ 7 days

Firefox Highly+ Critical Windows (all time)
http://secunia.com/advisories/14654/ 7 days
http://secunia.com/advisories/14938/ 24 days
http://secunia.com/advisories/15292/ 5 days
http://secunia.com/advisories/16043/ 7 days
http://secunia.com/advisories/16764/ 3 days

Keep the discussion rational - security is hard, so is assessing security. Be skeptical of anyone who has a dog in the fight (eg: Symantec). [Which is not to say that Symantec cannot be trusted for Windows security, only that their PR department's press releases regarding software security should be treated as suspect - particularly when they draw questionable conclusions from insufficient data.]

Aside from the question raised in many posts about whether the fact that Firefox is open source leads to faster and fuller disclosure, the following is an email I sent this past weekend regarding this article.

Lots is being made the past few days about the number of security holes found in various browsers. Just to try to keep the discussion from descending to complete irrelevance, here's the stats that actually matter:

Solution Status (has it been fixed?):
http://secunia.com/graph/?type=sol&period=all&prod =11
http://secunia.com/graph/?type=sol&period=all&prod =4227

Criticality (how bad is it if I get hit?):
http://secunia.com/graph/?type=cri&period=all&prod =11
http://secunia.com/graph/?type=cri&period=all&prod =4227

Unpatched Criticality (what can happen to me today?) Requires a little more looking - see the list at the bottom of each page:
http://secunia.com/product/11/
http://secunia.com/product/4227/
IE: 5 unpatched moderate or greater criticality
Firefox: 0 unpatched moderate or greater criticality

Finally, and unfortunately not clearly covered in [the Secunia] report is vulnerability window - how long does a bug go without being patched. You can, however, make a fairly good estimate by looking at the patch time for highly critical or worse bugs:

MS has been making big improvements lately, so I'll only look at the MS holes from the past year (the older ones have dramatically longer vulnerability windows) (I've also left out holes which were publicly discovered as a result of a windows patch)

IE Highly+ Critical Windows (past year)
http://secunia.com/advisories/12806/ 103 days
http://secunia.com/advisories/12889/ 108 days
http://secunia.com/advisories/12959/ 29 days
http://secunia.com/advisories/13482/ 53 days
http://secunia.com/advisories/15891/ 7 days

Firefox Highly+ Critical Windows (all time)
http://secunia.com/advisories/14654/ 7 days
http://secunia.com/advisories/14938/ 24 days
http://secunia.com/advisories/15292/ 5 days
http://secunia.com/advisories/16043/ 7 days
http://secunia.com/advisories/16764/ 3 days

Keep the discussion rational - security is hard, so is assessing security. Be skeptical of anyone who has a dog in the fight (eg: Symantec). [Which is not to say that Symantec cannot be trusted for Windows security, only that their PR department's press releases regarding software security should be treated as suspect - particularly when they draw questionable conclusions from insufficient data.]

Aside from the question raised in many posts about whether the fact that Firefox is open source leads to faster and fuller disclosure, the following is an email I sent this past weekend regarding this article.

Lots is being made the past few days about the number of security holes found in various browsers. Just to try to keep the discussion from descending to complete irrelevance, here's the stats that actually matter:

Solution Status (has it been fixed?):
http://secunia.com/graph/?type=sol&period=all&prod =11
http://secunia.com/graph/?type=sol&period=all&prod =4227

Criticality (how bad is it if I get hit?):
http://secunia.com/graph/?type=cri&period=all&prod =11
http://secunia.com/graph/?type=cri&period=all&prod =4227

Unpatched Criticality (what can happen to me today?) Requires a little more looking - see the list at the bottom of each page:
http://secunia.com/product/11/
http://secunia.com/product/4227/
IE: 5 unpatched moderate or greater criticality
Firefox: 0 unpatched moderate or greater criticality

Finally, and unfortunately not clearly covered in [the Secunia] report is vulnerability window - how long does a bug go without being patched. You can, however, make a fairly good estimate by looking at the patch time for highly critical or worse bugs:

MS has been making big improvements lately, so I'll only look at the MS holes from the past year (the older ones have dramatically longer vulnerability windows) (I've also left out holes which were publicly discovered as a result of a windows patch)

IE Highly+ Critical Windows (past year)
http://secunia.com/advisories/12806/ 103 days
http://secunia.com/advisories/12889/ 108 days
http://secunia.com/advisories/12959/ 29 days
http://secunia.com/advisories/13482/ 53 days
http://secunia.com/advisories/15891/ 7 days

Firefox Highly+ Critical Windows (all time)
http://secunia.com/advisories/14654/ 7 days
http://secunia.com/advisories/14938/ 24 days
http://secunia.com/advisories/15292/ 5 days
http://secunia.com/advisories/16043/ 7 days
http://secunia.com/advisories/16764/ 3 days

Keep the discussion rational - security is hard, so is assessing security. Be skeptical of anyone who has a dog in the fight (eg: Symantec). [Which is not to say that Symantec cannot be trusted for Windows security, only that their PR department's press releases regarding software security should be treated as suspect - particularly when they draw questionable conclusions from insufficient data.]

Aside from the question raised in many posts about whether the fact that Firefox is open source leads to faster and fuller disclosure, the following is an email I sent this past weekend regarding this article.

Lots is being made the past few days about the number of security holes found in various browsers. Just to try to keep the discussion from descending to complete irrelevance, here's the stats that actually matter:

Solution Status (has it been fixed?):
http://secunia.com/graph/?type=sol&period=all&prod =11
http://secunia.com/graph/?type=sol&period=all&prod =4227

Criticality (how bad is it if I get hit?):
http://secunia.com/graph/?type=cri&period=all&prod =11
http://secunia.com/graph/?type=cri&period=all&prod =4227

Unpatched Criticality (what can happen to me today?) Requires a little more looking - see the list at the bottom of each page:
http://secunia.com/product/11/
http://secunia.com/product/4227/
IE: 5 unpatched moderate or greater criticality
Firefox: 0 unpatched moderate or greater criticality

Finally, and unfortunately not clearly covered in [the Secunia] report is vulnerability window - how long does a bug go without being patched. You can, however, make a fairly good estimate by looking at the patch time for highly critical or worse bugs:

MS has been making big improvements lately, so I'll only look at the MS holes from the past year (the older ones have dramatically longer vulnerability windows) (I've also left out holes which were publicly discovered as a result of a windows patch)

IE Highly+ Critical Windows (past year)
http://secunia.com/advisories/12806/ 103 days
http://secunia.com/advisories/12889/ 108 days
http://secunia.com/advisories/12959/ 29 days
http://secunia.com/advisories/13482/ 53 days
http://secunia.com/advisories/15891/ 7 days

Firefox Highly+ Critical Windows (all time)
http://secunia.com/advisories/14654/ 7 days
http://secunia.com/advisories/14938/ 24 days
http://secunia.com/advisories/15292/ 5 days
http://secunia.com/advisories/16043/ 7 days
http://secunia.com/advisories/16764/ 3 days

Keep the discussion rational - security is hard, so is assessing security. Be skeptical of anyone who has a dog in the fight (eg: Symantec). [Which is not to say that Symantec cannot be trusted for Windows security, only that their PR department's press releases regarding software security should be treated as suspect - particularly when they draw questionable conclusions from insufficient data.]

Aside from the question raised in many posts about whether the fact that Firefox is open source leads to faster and fuller disclosure, the following is an email I sent this past weekend regarding this article.

Lots is being made the past few days about the number of security holes found in various browsers. Just to try to keep the discussion from descending to complete irrelevance, here's the stats that actually matter:

Solution Status (has it been fixed?):
http://secunia.com/graph/?type=sol&period=all&prod =11
http://secunia.com/graph/?type=sol&period=all&prod =4227

Criticality (how bad is it if I get hit?):
http://secunia.com/graph/?type=cri&period=all&prod =11
http://secunia.com/graph/?type=cri&period=all&prod =4227

Unpatched Criticality (what can happen to me today?) Requires a little more looking - see the list at the bottom of each page:
http://secunia.com/product/11/
http://secunia.com/product/4227/
IE: 5 unpatched moderate or greater criticality
Firefox: 0 unpatched moderate or greater criticality

Finally, and unfortunately not clearly covered in [the Secunia] report is vulnerability window - how long does a bug go without being patched. You can, however, make a fairly good estimate by looking at the patch time for highly critical or worse bugs:

MS has been making big improvements lately, so I'll only look at the MS holes from the past year (the older ones have dramatically longer vulnerability windows) (I've also left out holes which were publicly discovered as a result of a windows patch)

IE Highly+ Critical Windows (past year)
http://secunia.com/advisories/12806/ 103 days
http://secunia.com/advisories/12889/ 108 days
http://secunia.com/advisories/12959/ 29 days
http://secunia.com/advisories/13482/ 53 days
http://secunia.com/advisories/15891/ 7 days

Firefox Highly+ Critical Windows (all time)
http://secunia.com/advisories/14654/ 7 days
http://secunia.com/advisories/14938/ 24 days
http://secunia.com/advisories/15292/ 5 days
http://secunia.com/advisories/16043/ 7 days
http://secunia.com/advisories/16764/ 3 days

Keep the discussion rational - security is hard, so is assessing security. Be skeptical of anyone who has a dog in the fight (eg: Symantec). [Which is not to say that Symantec cannot be trusted for Windows security, only that their PR department's press releases regarding software security should be treated as suspect - particularly when they draw questionable conclusions from insufficient data.]

Aside from the question raised in many posts about whether the fact that Firefox is open source leads to faster and fuller disclosure, the following is an email I sent this past weekend regarding this article.

Lots is being made the past few days about the number of security holes found in various browsers. Just to try to keep the discussion from descending to complete irrelevance, here's the stats that actually matter:

Solution Status (has it been fixed?):
http://secunia.com/graph/?type=sol&period=all&prod =11
http://secunia.com/graph/?type=sol&period=all&prod =4227

Criticality (how bad is it if I get hit?):
http://secunia.com/graph/?type=cri&period=all&prod =11
http://secunia.com/graph/?type=cri&period=all&prod =4227

Unpatched Criticality (what can happen to me today?) Requires a little more looking - see the list at the bottom of each page:
http://secunia.com/product/11/
http://secunia.com/product/4227/
IE: 5 unpatched moderate or greater criticality
Firefox: 0 unpatched moderate or greater criticality

Finally, and unfortunately not clearly covered in [the Secunia] report is vulnerability window - how long does a bug go without being patched. You can, however, make a fairly good estimate by looking at the patch time for highly critical or worse bugs:

MS has been making big improvements lately, so I'll only look at the MS holes from the past year (the older ones have dramatically longer vulnerability windows) (I've also left out holes which were publicly discovered as a result of a windows patch)

IE Highly+ Critical Windows (past year)
http://secunia.com/advisories/12806/ 103 days
http://secunia.com/advisories/12889/ 108 days
http://secunia.com/advisories/12959/ 29 days
http://secunia.com/advisories/13482/ 53 days
http://secunia.com/advisories/15891/ 7 days

Firefox Highly+ Critical Windows (all time)
http://secunia.com/advisories/14654/ 7 days
http://secunia.com/advisories/14938/ 24 days
http://secunia.com/advisories/15292/ 5 days
http://secunia.com/advisories/16043/ 7 days
http://secunia.com/advisories/16764/ 3 days

Keep the discussion rational - security is hard, so is assessing security. Be skeptical of anyone who has a dog in the fight (eg: Symantec). [Which is not to say that Symantec cannot be trusted for Windows security, only that their PR department's press releases regarding software security should be treated as suspect - particularly when they draw questionable conclusions from insufficient data.]

Aside from the question raised in many posts about whether the fact that Firefox is open source leads to faster and fuller disclosure, the following is an email I sent this past weekend regarding this article.

Lots is being made the past few days about the number of security holes found in various browsers. Just to try to keep the discussion from descending to complete irrelevance, here's the stats that actually matter:

Solution Status (has it been fixed?):
http://secunia.com/graph/?type=sol&period=all&prod =11
http://secunia.com/graph/?type=sol&period=all&prod =4227

Criticality (how bad is it if I get hit?):
http://secunia.com/graph/?type=cri&period=all&prod =11
http://secunia.com/graph/?type=cri&period=all&prod =4227

Unpatched Criticality (what can happen to me today?) Requires a little more looking - see the list at the bottom of each page:
http://secunia.com/product/11/
http://secunia.com/product/4227/
IE: 5 unpatched moderate or greater criticality
Firefox: 0 unpatched moderate or greater criticality

Finally, and unfortunately not clearly covered in [the Secunia] report is vulnerability window - how long does a bug go without being patched. You can, however, make a fairly good estimate by looking at the patch time for highly critical or worse bugs:

MS has been making big improvements lately, so I'll only look at the MS holes from the past year (the older ones have dramatically longer vulnerability windows) (I've also left out holes which were publicly discovered as a result of a windows patch)

IE Highly+ Critical Windows (past year)
http://secunia.com/advisories/12806/ 103 days
http://secunia.com/advisories/12889/ 108 days
http://secunia.com/advisories/12959/ 29 days
http://secunia.com/advisories/13482/ 53 days
http://secunia.com/advisories/15891/ 7 days

Firefox Highly+ Critical Windows (all time)
http://secunia.com/advisories/14654/ 7 days
http://secunia.com/advisories/14938/ 24 days
http://secunia.com/advisories/15292/ 5 days
http://secunia.com/advisories/16043/ 7 days
http://secunia.com/advisories/16764/ 3 days

Keep the discussion rational - security is hard, so is assessing security. Be skeptical of anyone who has a dog in the fight (eg: Symantec). [Which is not to say that Symantec cannot be trusted for Windows security, only that their PR department's press releases regarding software security should be treated as suspect - particularly when they draw questionable conclusions from insufficient data.]

Aside from the question raised in many posts about whether the fact that Firefox is open source leads to faster and fuller disclosure, the following is an email I sent this past weekend regarding this article.

Lots is being made the past few days about the number of security holes found in various browsers. Just to try to keep the discussion from descending to complete irrelevance, here's the stats that actually matter:

Solution Status (has it been fixed?):
http://secunia.com/graph/?type=sol&period=all&prod =11
http://secunia.com/graph/?type=sol&period=all&prod =4227

Criticality (how bad is it if I get hit?):
http://secunia.com/graph/?type=cri&period=all&prod =11
http://secunia.com/graph/?type=cri&period=all&prod =4227

Unpatched Criticality (what can happen to me today?) Requires a little more looking - see the list at the bottom of each page:
http://secunia.com/product/11/
http://secunia.com/product/4227/
IE: 5 unpatched moderate or greater criticality
Firefox: 0 unpatched moderate or greater criticality

Finally, and unfortunately not clearly covered in [the Secunia] report is vulnerability window - how long does a bug go without being patched. You can, however, make a fairly good estimate by looking at the patch time for highly critical or worse bugs:

MS has been making big improvements lately, so I'll only look at the MS holes from the past year (the older ones have dramatically longer vulnerability windows) (I've also left out holes which were publicly discovered as a result of a windows patch)

IE Highly+ Critical Windows (past year)
http://secunia.com/advisories/12806/ 103 days
http://secunia.com/advisories/12889/ 108 days
http://secunia.com/advisories/12959/ 29 days
http://secunia.com/advisories/13482/ 53 days
http://secunia.com/advisories/15891/ 7 days

Firefox Highly+ Critical Windows (all time)
http://secunia.com/advisories/14654/ 7 days
http://secunia.com/advisories/14938/ 24 days
http://secunia.com/advisories/15292/ 5 days
http://secunia.com/advisories/16043/ 7 days
http://secunia.com/advisories/16764/ 3 days

Keep the discussion rational - security is hard, so is assessing security. Be skeptical of anyone who has a dog in the fight (eg: Symantec). [Which is not to say that Symantec cannot be trusted for Windows security, only that their PR department's press releases regarding software security should be treated as suspect - particularly when they draw questionable conclusions from insufficient data.]

Aside from the question raised in many posts about whether the fact that Firefox is open source leads to faster and fuller disclosure, the following is an email I sent this past weekend regarding this article.

Lots is being made the past few days about the number of security holes found in various browsers. Just to try to keep the discussion from descending to complete irrelevance, here's the stats that actually matter:

Solution Status (has it been fixed?):
http://secunia.com/graph/?type=sol&period=all&prod =11
http://secunia.com/graph/?type=sol&period=all&prod =4227

Criticality (how bad is it if I get hit?):
http://secunia.com/graph/?type=cri&period=all&prod =11
http://secunia.com/graph/?type=cri&period=all&prod =4227

Unpatched Criticality (what can happen to me today?) Requires a little more looking - see the list at the bottom of each page:
http://secunia.com/product/11/
http://secunia.com/product/4227/
IE: 5 unpatched moderate or greater criticality
Firefox: 0 unpatched moderate or greater criticality

Finally, and unfortunately not clearly covered in [the Secunia] report is vulnerability window - how long does a bug go without being patched. You can, however, make a fairly good estimate by looking at the patch time for highly critical or worse bugs:

MS has been making big improvements lately, so I'll only look at the MS holes from the past year (the older ones have dramatically longer vulnerability windows) (I've also left out holes which were publicly discovered as a result of a windows patch)

IE Highly+ Critical Windows (past year)
http://secunia.com/advisories/12806/ 103 days
http://secunia.com/advisories/12889/ 108 days
http://secunia.com/advisories/12959/ 29 days
http://secunia.com/advisories/13482/ 53 days
http://secunia.com/advisories/15891/ 7 days

Firefox Highly+ Critical Windows (all time)
http://secunia.com/advisories/14654/ 7 days
http://secunia.com/advisories/14938/ 24 days
http://secunia.com/advisories/15292/ 5 days
http://secunia.com/advisories/16043/ 7 days
http://secunia.com/advisories/16764/ 3 days

Keep the discussion rational - security is hard, so is assessing security. Be skeptical of anyone who has a dog in the fight (eg: Symantec). [Which is not to say that Symantec cannot be trusted for Windows security, only that their PR department's press releases regarding software security should be treated as suspect - particularly when they draw questionable conclusions from insufficient data.]

I have to say that this report is really quite flawed for a couple reasons here.

1)They cover only a short period of time (6 months presumably).
2)They do not count unpatched vulnerabilities, of which IE 6 has 85 and Firefox 1.X has 22 (according to Secunia).
3)Nor do they count patch reaction time (Microsoft takes anywhere from a few hours to a couple weeks, The Firefox team usually takes from 24 hours to a week).

This doesn't say that Firefox is more secure (even though in my personal opinion it is), but it does say that Symantec's alleged study proves little by simply saying IE is more secure since it had less security exploits in a six month period.

However some people prefer Opera because it's
1) more secure .... link 1 .... link 2 .... link 3 .... link 4 .... link 5 .... link 6, September 16th 2005
2) faster
3) Is actively worked on -from Mike Connor, an important Firefox developer
4) smaller (3.7mb vs 4.7mb)
5) less bloat/ram usage

However some people prefer Opera because it's
1) more secure .... link 1 .... link 2 .... link 3 .... link 4 .... link 5 .... link 6, September 16th 2005
2) faster
3) Is actively worked on -from Mike Connor, an important Firefox developer
4) smaller (3.7mb vs 4.7mb)
5) less bloat/ram usage

Oh, I read the article. I'll grant you one thing: Firefox has more advisories listed on Secunia in the given time period.

So I beg your pardon for citing the overall numbers. I'd ask you to take a look, anyway:

• Firefox: 18 Advisories in 2005 (5 in March)
  • We see 6% of 18 unpatched, leaving FF with 1 unpatched from this time period. If we view the overall status, we see that this is 1 of a total of 3 unpatched.
• IE: 11 Advisories in 2005 (0 in March)
  • We see 45% of 11 unpatched, leaving IE with 5 unpatched from this time period. If we view the overall status, we see that these are 5 out of a total of 19 unpatched.

Firefox experienced more advisories in March than IE. That's great. Overall, IE has still shown many more. Even if that trend continues to change, the Mozilla team has a much better response time - just take a look at some of the release dates for unpatched IE advisories: (2003-03-13, 2003-08-14, 2003-11-07, 2004-02-09, 2004-04-01, etc etc etc). That second date is Highly Critical, and has gone unpatched for two years. This is why we raise such an outcry against the article - for a few months, Firefox is finding more bugs, yes. They also happen to fix the problems that come their way (the oldest and most crictical unpatched being a one-year old Less Critical) incredibly faster and more reliably.

Oh, I read the article. I'll grant you one thing: Firefox has more advisories listed on Secunia in the given time period.

So I beg your pardon for citing the overall numbers. I'd ask you to take a look, anyway:

• Firefox: 18 Advisories in 2005 (5 in March)
  • We see 6% of 18 unpatched, leaving FF with 1 unpatched from this time period. If we view the overall status, we see that this is 1 of a total of 3 unpatched.
• IE: 11 Advisories in 2005 (0 in March)
  • We see 45% of 11 unpatched, leaving IE with 5 unpatched from this time period. If we view the overall status, we see that these are 5 out of a total of 19 unpatched.

Firefox experienced more advisories in March than IE. That's great. Overall, IE has still shown many more. Even if that trend continues to change, the Mozilla team has a much better response time - just take a look at some of the release dates for unpatched IE advisories: (2003-03-13, 2003-08-14, 2003-11-07, 2004-02-09, 2004-04-01, etc etc etc). That second date is Highly Critical, and has gone unpatched for two years. This is why we raise such an outcry against the article - for a few months, Firefox is finding more bugs, yes. They also happen to fix the problems that come their way (the oldest and most crictical unpatched being a one-year old Less Critical) incredibly faster and more reliably.

Oh, I read the article. I'll grant you one thing: Firefox has more advisories listed on Secunia in the given time period.

So I beg your pardon for citing the overall numbers. I'd ask you to take a look, anyway:

• Firefox: 18 Advisories in 2005 (5 in March)
  • We see 6% of 18 unpatched, leaving FF with 1 unpatched from this time period. If we view the overall status, we see that this is 1 of a total of 3 unpatched.
• IE: 11 Advisories in 2005 (0 in March)
  • We see 45% of 11 unpatched, leaving IE with 5 unpatched from this time period. If we view the overall status, we see that these are 5 out of a total of 19 unpatched.

Firefox experienced more advisories in March than IE. That's great. Overall, IE has still shown many more. Even if that trend continues to change, the Mozilla team has a much better response time - just take a look at some of the release dates for unpatched IE advisories: (2003-03-13, 2003-08-14, 2003-11-07, 2004-02-09, 2004-04-01, etc etc etc). That second date is Highly Critical, and has gone unpatched for two years. This is why we raise such an outcry against the article - for a few months, Firefox is finding more bugs, yes. They also happen to fix the problems that come their way (the oldest and most crictical unpatched being a one-year old Less Critical) incredibly faster and more reliably.

Oh, I read the article. I'll grant you one thing: Firefox has more advisories listed on Secunia in the given time period.

So I beg your pardon for citing the overall numbers. I'd ask you to take a look, anyway:

• Firefox: 18 Advisories in 2005 (5 in March)
  • We see 6% of 18 unpatched, leaving FF with 1 unpatched from this time period. If we view the overall status, we see that this is 1 of a total of 3 unpatched.
• IE: 11 Advisories in 2005 (0 in March)
  • We see 45% of 11 unpatched, leaving IE with 5 unpatched from this time period. If we view the overall status, we see that these are 5 out of a total of 19 unpatched.

Firefox experienced more advisories in March than IE. That's great. Overall, IE has still shown many more. Even if that trend continues to change, the Mozilla team has a much better response time - just take a look at some of the release dates for unpatched IE advisories: (2003-03-13, 2003-08-14, 2003-11-07, 2004-02-09, 2004-04-01, etc etc etc). That second date is Highly Critical, and has gone unpatched for two years. This is why we raise such an outcry against the article - for a few months, Firefox is finding more bugs, yes. They also happen to fix the problems that come their way (the oldest and most crictical unpatched being a one-year old Less Critical) incredibly faster and more reliably.

Oh, I read the article. I'll grant you one thing: Firefox has more advisories listed on Secunia in the given time period.

So I beg your pardon for citing the overall numbers. I'd ask you to take a look, anyway:

• Firefox: 18 Advisories in 2005 (5 in March)
  • We see 6% of 18 unpatched, leaving FF with 1 unpatched from this time period. If we view the overall status, we see that this is 1 of a total of 3 unpatched.
• IE: 11 Advisories in 2005 (0 in March)
  • We see 45% of 11 unpatched, leaving IE with 5 unpatched from this time period. If we view the overall status, we see that these are 5 out of a total of 19 unpatched.

Firefox experienced more advisories in March than IE. That's great. Overall, IE has still shown many more. Even if that trend continues to change, the Mozilla team has a much better response time - just take a look at some of the release dates for unpatched IE advisories: (2003-03-13, 2003-08-14, 2003-11-07, 2004-02-09, 2004-04-01, etc etc etc). That second date is Highly Critical, and has gone unpatched for two years. This is why we raise such an outcry against the article - for a few months, Firefox is finding more bugs, yes. They also happen to fix the problems that come their way (the oldest and most crictical unpatched being a one-year old Less Critical) incredibly faster and more reliably.

Oh, I read the article. I'll grant you one thing: Firefox has more advisories listed on Secunia in the given time period.

So I beg your pardon for citing the overall numbers. I'd ask you to take a look, anyway:

• Firefox: 18 Advisories in 2005 (5 in March)
  • We see 6% of 18 unpatched, leaving FF with 1 unpatched from this time period. If we view the overall status, we see that this is 1 of a total of 3 unpatched.
• IE: 11 Advisories in 2005 (0 in March)
  • We see 45% of 11 unpatched, leaving IE with 5 unpatched from this time period. If we view the overall status, we see that these are 5 out of a total of 19 unpatched.

Firefox experienced more advisories in March than IE. That's great. Overall, IE has still shown many more. Even if that trend continues to change, the Mozilla team has a much better response time - just take a look at some of the release dates for unpatched IE advisories: (2003-03-13, 2003-08-14, 2003-11-07, 2004-02-09, 2004-04-01, etc etc etc). That second date is Highly Critical, and has gone unpatched for two years. This is why we raise such an outcry against the article - for a few months, Firefox is finding more bugs, yes. They also happen to fix the problems that come their way (the oldest and most crictical unpatched being a one-year old Less Critical) incredibly faster and more reliably.

Well, yes, but what about Opera? I was going to include Safari, but it seems to have had a bad day a while ago.

Well, yes, but what about Opera? I was going to include Safari, but it seems to have had a bad day a while ago.

Secunia has very informative pages about the relative security of IE and firefox.

Firefox

IE

The problems with firefox compared to IE are:

IE bugs are more frecuently critical
IE critical bugs take longer to patch
Fully patched IE is less secure than Fully patched Firefox

Secunia has very informative pages about the relative security of IE and firefox.

Firefox

IE

The problems with firefox compared to IE are:

IE bugs are more frecuently critical
IE critical bugs take longer to patch
Fully patched IE is less secure than Fully patched Firefox

Yes, I'm looking at the Secunia statistics for both browsers. If you know a more complete list, show me it.

That said, when I view Firefox's "Criticality" breakdown, it says "(Based on 22 Advisories from 2003-2005)".

When I view the criticality breakdown for IE, it says "(Based on 69 advisories from 2003-2005)".

• Don't accuse other people of making up numbers when the source is obviously mentioned (Secunia - the links to IE and Firefox on the top of the main page where anyone can find them). By all means, check the numbers - but don't say I'm making them up until you have.
• Second, my numbers are about advisories - the root problem of the vulnerability. Note: Mr. Ou himself indicates that many vulnerabilities are often comprised in one advisory, because the advisory sums the entire problem. 40 vulnerabilities? OK. 22 unique problems vs. 69? IE's sunk.

Yes, I'm looking at the Secunia statistics for both browsers. If you know a more complete list, show me it.

That said, when I view Firefox's "Criticality" breakdown, it says "(Based on 22 Advisories from 2003-2005)".

When I view the criticality breakdown for IE, it says "(Based on 69 advisories from 2003-2005)".

• Don't accuse other people of making up numbers when the source is obviously mentioned (Secunia - the links to IE and Firefox on the top of the main page where anyone can find them). By all means, check the numbers - but don't say I'm making them up until you have.
• Second, my numbers are about advisories - the root problem of the vulnerability. Note: Mr. Ou himself indicates that many vulnerabilities are often comprised in one advisory, because the advisory sums the entire problem. 40 vulnerabilities? OK. 22 unique problems vs. 69? IE's sunk.

> Yes, Apache is everywhere, exploit-free

Are you taking the piss! Exploit free! And you claim to be a knowledgable user. LOL.

Apache 2.0.x has more then 27 security exploits (http://secunia.com/product/73/) which is extremely high when compares to IIS 6 (which has 2! http://secunia.com/product/1438/)

> Yes, Apache is everywhere, exploit-free

Are you taking the piss! Exploit free! And you claim to be a knowledgable user. LOL.

Apache 2.0.x has more then 27 security exploits (http://secunia.com/product/73/) which is extremely high when compares to IIS 6 (which has 2! http://secunia.com/product/1438/)

D'oh! I'm on Linux... *snaps* dang.

Note that only one of those is a 'critical' flaw, and that one is an ActiveX buffer overflow than can be avoided by just not using ActiveX. The rest are spoofing or system information flaws.

Actually, at least one other involves the possible exploitation of malicious code, although it requires active user input to do so.

But let's look at that one big famous doozie, the ActiveX exploit. That was reported in August 2003 - that's over two years ago!! It requires no user intervention if ActiveX is enabled, can do just about anything it wants to and it affects any MS ActiveX enabled product that can read HTML. The only solution is to turn off ActiveX, or to get it to prompt the user before it installs anything (which is not guarantee of safety). This is far, far worse than any exploit Firefox has ever had!

But even if it wasn't so potentially disasterous, don't you think MS would have been interested in fixing something that involves their pride-and-joy, ActiveX?? How could anyone ever look at such incompetence and claim that IE is more secure?!

Note that only one of those is a 'critical' flaw, and that one is an ActiveX buffer overflow than can be avoided by just not using ActiveX. The rest are spoofing or system information flaws.

Actually, at least one other involves the possible exploitation of malicious code, although it requires active user input to do so.

But let's look at that one big famous doozie, the ActiveX exploit. That was reported in August 2003 - that's over two years ago!! It requires no user intervention if ActiveX is enabled, can do just about anything it wants to and it affects any MS ActiveX enabled product that can read HTML. The only solution is to turn off ActiveX, or to get it to prompt the user before it installs anything (which is not guarantee of safety). This is far, far worse than any exploit Firefox has ever had!

But even if it wasn't so potentially disasterous, don't you think MS would have been interested in fixing something that involves their pride-and-joy, ActiveX?? How could anyone ever look at such incompetence and claim that IE is more secure?!

Rather than simply counting vulnerabilities, take at look at the reports for Firefox and Internet Explorer 6. Firefox 1.x shows 22 holes, 3 unpatched and rated 'less critical.' IE6 has 85 holes, 1/4 unpatched, and a 'highly critical' buffer overflow in ActiveX that's been open since 2003. Now, tell me, which one is more secure?

[Insert usual mantra of anyone being able to fix F/OSS but only MS being able to fix MSIE here] [Append snide remark about companies trying to hide rather than fix vulnerabilities here] [Insert random Zeeky Boogy Doog here]