Slashdot Mirror

Rather than simply counting vulnerabilities, take at look at the reports for Firefox and Internet Explorer 6. Firefox 1.x shows 22 holes, 3 unpatched and rated 'less critical.' IE6 has 85 holes, 1/4 unpatched, and a 'highly critical' buffer overflow in ActiveX that's been open since 2003. Now, tell me, which one is more secure?

[Insert usual mantra of anyone being able to fix F/OSS but only MS being able to fix MSIE here] [Append snide remark about companies trying to hide rather than fix vulnerabilities here] [Insert random Zeeky Boogy Doog here]

http://secunia.com/product/4227/

This shows you all the vulnerabilities they mention. The article doesn't link the exploits unfortunately.

http://secunia.com/product/4227/

"Less critical". There are 18 though.

You missed Opera (which is IMO the best browser ever made). According to Secunia (http://secunia.com/product/4932/): "0 out of 7 Secunia advisories, is marked as "Unpatched" in the Secunia database", while for Firefox there is: "3 out of 22 Secunia advisories, is marked as "Unpatched" in the Secunia database."

This author picked a date range that favored IE on the surface, and then quoted some pretty useless numbers which were skewed toward IE for the casual observer. Better numbers would be how many vulnerabilities REMAIN OPEN and HOW LONG they took to close from report date to fix date... I went to Secunia and pulled the following statistics In 2005 -- Firefox had 18 advisories posted. 1 remains unfixed, 1 remains partially fixed, 16 are fixed. -- IE 6.x had 11 advisories posted. 5 remain unfixed, 1 remains partially fixed, and 5 are fixed. Looking from 2003-2005 -- Firefox 1.x had 22 advisories posted (1 partial fix and 3 unfixed still) -- IE 6.x had 69 advisories posted (10 partial fix and 19 unfixed still) On Criticality of any advisory ever issued -- Firefox has had 0% extremely, 23% highly and 36% moderate -- IE has had 14% extremely, 29% highly and 20% moderate If you want tons more stats and graphs, go to... http://secunia.com/product/11/ (IE stats @ Secunia http://secunia.com/product/4227/ (Firefox stats @ Secunia)

This author picked a date range that favored IE on the surface, and then quoted some pretty useless numbers which were skewed toward IE for the casual observer. Better numbers would be how many vulnerabilities REMAIN OPEN and HOW LONG they took to close from report date to fix date... I went to Secunia and pulled the following statistics In 2005 -- Firefox had 18 advisories posted. 1 remains unfixed, 1 remains partially fixed, 16 are fixed. -- IE 6.x had 11 advisories posted. 5 remain unfixed, 1 remains partially fixed, and 5 are fixed. Looking from 2003-2005 -- Firefox 1.x had 22 advisories posted (1 partial fix and 3 unfixed still) -- IE 6.x had 69 advisories posted (10 partial fix and 19 unfixed still) On Criticality of any advisory ever issued -- Firefox has had 0% extremely, 23% highly and 36% moderate -- IE has had 14% extremely, 29% highly and 20% moderate If you want tons more stats and graphs, go to... http://secunia.com/product/11/ (IE stats @ Secunia http://secunia.com/product/4227/ (Firefox stats @ Secunia)

Just one?

How bout this one?

A vulnerability has been identified in a Microsoft ActiveX plugin called MCIWNDX.OCX, which possibly allows malicious HTML documents to execute arbitrary code on a vulnerable system.

The problem is that a property called "Filename" isn't properly verified allowing malicious websites or HTML emails to cause a buffer overflow by supplying an overly long string. This could potentially be exploited to execute arbitrary code on the system.

unpatched since: 2003-08-14

Granted, thats only a little more than 2 years...
hey...not important.

But there are oodles more at:
http://secunia.com/product/11/#advisories

I'll give you not one but 19.

http://secunia.com/product/11/

Watch what you ask for, you just might get it.

Better Links:

http://secunia.com/product/11/

http://secunia.com/product/4227/

Also note that a high number of the IE vulns are "multiple" ones grouped together.

Better Links:

http://secunia.com/product/11/

http://secunia.com/product/4227/

Also note that a high number of the IE vulns are "multiple" ones grouped together.

1) The number of vulnerabilities reported has almost nothing to do with the number in the code. At most it dictates a minimum number that exist. Perhaps the firefox community is much more active at searching for bugs in the much newer firefox code.

Or perhaps you're being a hypocrite. Strange, I've never once seen this defense come up for MSIE on Slashdot. You seem to think that the number of known vulnerabilities doesn't matter, but then you go on to address the criticality of the known vulnerabilities as if that matters latter on. Make up your mind, don't contradict yourself and don't be a hypocrite.

It's funny, people always scream "ZOMG L@@K @ TEH NUMBER OF VULNERABILITIES FOR MSIE3) How effective are the fixes? MS seems to have the same recurring problems because they only do triage. They don't fix the bigger problem (VERY poor browser design).

Is that your SCIENTIFIC opinion based on a study of FACTS or just anti-MS FUD on your part? Don't bother answering that, the answer is obvious. For someone who blasts a legitimate finding for being 'bad science', you sure are fond of using bad science when it suits you. You simply ASSUME--with absolutely no factual grounding (unless you count hearsay) that it's a result of poor browser design.

The firefox team appears to address the bigger problem, not just stop the current bleeding.

Again, what are you basing this on? Your "scientific opinion"? The multiple dialog spoof and frame injection vulnerabilities? The multiple, related cross-site scripting vulnerabilities? The partial fixes? THe workarounds?

I'm sorry, but firefox isn't fixing the source, its design is flawed too. Have you even LOOKED at the design of Firefox? After all, you're the expert, surely you've seen the strides they've taken in security design. OH wait, no, just like with all browsers, security was an afterthought in design.

2) How critical are these vulnerabilities. The article makes no mention of any ranking. He lumps everything into the same category.

Interesting that at first known vulnerabilities don't matter, now they do when it comes to criticality. Way to be incosistent.

As it turns out, there are the same number of highly to extremely critical fixes according to JUST secunia statistics. Secunia only released advisories for a little under half of the Firefox vulnerabilities. Those stats are going to go up and have Firefox beat the pants off MSIE in terms of more serious vunlerabilities.

Here are the statistics:
http://secunia.com/product/4227/?period=2005#stati stics
http://secunia.com/product/11/?period=2005#statist ics

MS is known to sit on bugs as long as possible. Perhaps the Firefox team is just being more responsive to the people looking for them.

6% workarounds, 6% partial fixes as per the above statistics. Yeah, they're awesome :-) Firefox is great enough to have a simple auto-patching system, whereby you don't have to wait for an entirely new version to come out and install it over the new ones, thus not having any compatibility issues with plug-ins or the like. Doesn't happen with Firefox. Nope.

IAAITG (I am a IT guy)

But not a scientist, nor a rational thinker, apparently.

1) The number of vulnerabilities reported has almost nothing to do with the number in the code. At most it dictates a minimum number that exist. Perhaps the firefox community is much more active at searching for bugs in the much newer firefox code.

Or perhaps you're being a hypocrite. Strange, I've never once seen this defense come up for MSIE on Slashdot. You seem to think that the number of known vulnerabilities doesn't matter, but then you go on to address the criticality of the known vulnerabilities as if that matters latter on. Make up your mind, don't contradict yourself and don't be a hypocrite.

It's funny, people always scream "ZOMG L@@K @ TEH NUMBER OF VULNERABILITIES FOR MSIE3) How effective are the fixes? MS seems to have the same recurring problems because they only do triage. They don't fix the bigger problem (VERY poor browser design).

Is that your SCIENTIFIC opinion based on a study of FACTS or just anti-MS FUD on your part? Don't bother answering that, the answer is obvious. For someone who blasts a legitimate finding for being 'bad science', you sure are fond of using bad science when it suits you. You simply ASSUME--with absolutely no factual grounding (unless you count hearsay) that it's a result of poor browser design.

The firefox team appears to address the bigger problem, not just stop the current bleeding.

Again, what are you basing this on? Your "scientific opinion"? The multiple dialog spoof and frame injection vulnerabilities? The multiple, related cross-site scripting vulnerabilities? The partial fixes? THe workarounds?

I'm sorry, but firefox isn't fixing the source, its design is flawed too. Have you even LOOKED at the design of Firefox? After all, you're the expert, surely you've seen the strides they've taken in security design. OH wait, no, just like with all browsers, security was an afterthought in design.

2) How critical are these vulnerabilities. The article makes no mention of any ranking. He lumps everything into the same category.

Interesting that at first known vulnerabilities don't matter, now they do when it comes to criticality. Way to be incosistent.

As it turns out, there are the same number of highly to extremely critical fixes according to JUST secunia statistics. Secunia only released advisories for a little under half of the Firefox vulnerabilities. Those stats are going to go up and have Firefox beat the pants off MSIE in terms of more serious vunlerabilities.

Here are the statistics:
http://secunia.com/product/4227/?period=2005#stati stics
http://secunia.com/product/11/?period=2005#statist ics

MS is known to sit on bugs as long as possible. Perhaps the Firefox team is just being more responsive to the people looking for them.

6% workarounds, 6% partial fixes as per the above statistics. Yeah, they're awesome :-) Firefox is great enough to have a simple auto-patching system, whereby you don't have to wait for an entirely new version to come out and install it over the new ones, thus not having any compatibility issues with plug-ins or the like. Doesn't happen with Firefox. Nope.

IAAITG (I am a IT guy)

But not a scientist, nor a rational thinker, apparently.

This is such a ridiculous use of statistics. These were all pulled from the Secunia website. Using the same stats from the website you'll see that:

http://secunia.com/product/11/?period=2005#statist ics Secunia Stats for IE

http://secunia.com/product/4227/?period=2005#stati stics Secunia Stats for Firefox

While IE has less advisories, they also have a higher unpatched percentage as well as a higher severity of exploits percentage.

What is even more funny is that a co-worker of mine always uses the number of advisories to indicate how much better IE is over Firefox, but never mentions that most of the advisories remain unpatched as well as more critical from the same website.

Apples to Oranges indeed.

This is such a ridiculous use of statistics. These were all pulled from the Secunia website. Using the same stats from the website you'll see that:

http://secunia.com/product/11/?period=2005#statist ics Secunia Stats for IE

http://secunia.com/product/4227/?period=2005#stati stics Secunia Stats for Firefox

While IE has less advisories, they also have a higher unpatched percentage as well as a higher severity of exploits percentage.

What is even more funny is that a co-worker of mine always uses the number of advisories to indicate how much better IE is over Firefox, but never mentions that most of the advisories remain unpatched as well as more critical from the same website.

Apples to Oranges indeed.

For Mozilla, there has been 0% of extremely critical vulnerabilities and 23% of highly critical in 2003-2005, whereas for IE 14% were extremely critical and 29% highly critical in the same time period.

Furthermore, a total of 31% (out of of 69 advisories, or 21 individual cases) of IE vulnerabilities may result in system access. In Mozilla, the corresponding numbers are 18% and 4 advisories.

For Mozilla, there has been 0% of extremely critical vulnerabilities and 23% of highly critical in 2003-2005, whereas for IE 14% were extremely critical and 29% highly critical in the same time period.

Furthermore, a total of 31% (out of of 69 advisories, or 21 individual cases) of IE vulnerabilities may result in system access. In Mozilla, the corresponding numbers are 18% and 4 advisories.

The most important thing this author should have asked is: what is the severity of these vulnerabilities? Something like a DoS is a PITA, but compared to a vulerability that opens a machine to remote system access-- come on! Let's compare: IE Firefox

IE integrated into the base OS gives a lot of those buffer overflows much more destructive potential than some regular old program. I'm not ruling FF out as a potential threat, but so far, it has shown itself to be far less dangerous than IE.

The most important thing this author should have asked is: what is the severity of these vulnerabilities? Something like a DoS is a PITA, but compared to a vulerability that opens a machine to remote system access-- come on! Let's compare: IE Firefox

IE integrated into the base OS gives a lot of those buffer overflows much more destructive potential than some regular old program. I'm not ruling FF out as a potential threat, but so far, it has shown itself to be far less dangerous than IE.

The most important thing this author should have asked is: what is the severity of these vulnerabilities? Something like a DoS is a PITA, but compared to a vulerability that opens a machine to remote system access-- come on! Let's compare: IE Firefox

IE integrated into the base OS gives a lot of those buffer overflows much more destructive potential than some regular old program. I'm not ruling FF out as a potential threat, but so far, it has shown itself to be far less dangerous than IE.

The most important thing this author should have asked is: what is the severity of these vulnerabilities? Something like a DoS is a PITA, but compared to a vulerability that opens a machine to remote system access-- come on! Let's compare: IE Firefox

IE integrated into the base OS gives a lot of those buffer overflows much more destructive potential than some regular old program. I'm not ruling FF out as a potential threat, but so far, it has shown itself to be far less dangerous than IE.

I think these reports give the answer.

Firefox

Internet Explorer

To conclude firefox has three unpatched advisories of which the most severe is less critical. IE has nineteen unpatched advisories of which the most severe is highly critical. Notice that actually IE had more advisories both patched and unpatched.

I think these reports give the answer.

Firefox

Internet Explorer

To conclude firefox has three unpatched advisories of which the most severe is less critical. IE has nineteen unpatched advisories of which the most severe is highly critical. Notice that actually IE had more advisories both patched and unpatched.

Here:

Firefox 1.x 2005
IE 6.x 2005

Here:

Firefox 1.x 2005
IE 6.x 2005

Im to lazy to go though it all but by looking at the pretty pie charts the IE bugs are indeed more critical.

Im to lazy to go though it all but by looking at the pretty pie charts the IE bugs are indeed more critical.

Apparently IIS 6.0 got the brunt of the focus on 'security' since there has been one serious hole in part of IIS that is 'off' by default, and a minor issue where ie could be used to aquire information about scripts running on the host system.

http://secunia.com/product/1438/#advisories_2004

That's hardly "lip service" to security. Sure, IE hasn't gotten much better, and probably never will, but Microsoft's 'efforts' in security were aimed at making windows a 'real' option for a 'server' OS.

You are right though, windows is attractive because of the features, like sparkle, that are by nature insecure. It doesn't make any sense for MS to make the desktop any more 'secure' by default, as long as 'profesionals' can 'secure it' or teach users how not to get exploit xyz.. Imagine, how easy it would be for say, yahoo messenger or the likes to 'write' the IM client interface in sparkle, so that everytime they tweaked the UI people wouldn't have to be brought to some 'download now' page, but rather just be served a simple file off there webserver that could completely reskin the whole IM client interface.
Yes, I realise, Yahoo already uses flash for this, they call them IMvironments, and they only take over the UI for a single chat window. With Sparkle there would be no need for them to force users to constantly upgrade flash if they didn't use IE for websurfing etc. ,

the IIS evangelist at the TechEd 2002 IIS 6.0 pep rally said that there will not be any vulnerabilities in IIS6.0. Oh aye, I'll believe that when me shit turns purple and tastes like rainbow sherbert!

He wasn't too far off... The two vulnerabilities that IIS6 has had in it's 2.5 years so far weren't even remotely serious. Do you really think that's going to change, and suddenly 100s of bugs will pop up overnight? Come on.

Statistics say that IIS6 has been doing MUCH better than apache 2

Statistics say that IIS6 has been doing MUCH better than apache 2

I'm sorry, but that's quite the opposite: Statistics are showing that IIS6 has been doing MUCH better than apache 2.

I'm sorry, but that's quite the opposite: Statistics are showing that IIS6 has been doing MUCH better than apache 2.

I'm sorry, but that's quite the opposite: Statistics are showing that IIS6 has been doing MUCH better than apache lately.

I'm sorry, but that's quite the opposite: Statistics are showing that IIS6 has been doing MUCH better than apache lately.

Bugs in IE? Like what? I take it you've never done any CSS coding and haven't seen this list? Anyway, by ghetto he also means that it is missing many new features that other browsers have. Do you think the IE7 team looked at IE6 and could find nothing at all to improve?

Here he rags on the favorites in IE. The 'Organize Favorites' dialog doesn't have sorting, you can't view the URLs, you can't check if the sites still exist, it's very unaesthetic, and you can't create a folder in a particular spot just at the bottom (compared to right click on FireFox Bookmarks menu and clicking 'New Folder'). From the menu itself you can't create spacers or new folders. Plus you can't just right-click an item in the menu to get a properties dialog to rename a particular item.

FF is 'smooth, reliable, and clean?' The UI designer for IE is saying that he thinks Firefox is a cleaned up and reliable alternative to IE that's equivelently or slightly more polished. It's an opinion that many people agree with. Then you add to that all the features like search bar, RSS reader, tabs, spyware immunity, fewer security problems, text resizing not locked, and dev tools like source view/script css dom debugger-page info. Then on top of all that you add a few key extensions like the dev toolbar, Tab Mix Plus, Adblock & Flashblock and it's in a completely separate league.

mainstream product not a reason to switch I don't think he was saying IE was not mainstream, just that he was pleased Firefox was so polished and painless to switch to.

You realize that you can turn these security warnings off. IE nags continuously to enable ActiveX if you disable it. In pre-SP2 you get a "Page may not display correctly." popup that's impossible to remove. In XP SP2 you get the 'information bar' with "Page may not display correctly. Click here for options." Clicking it gives a help popup. The help says you can turn off the information bar for each possible messages but it doesn't tell how and says that it is not recommended. The only way I've managed to kill it is Maxthon's 'Remove Web Annoyances' add-in.

You are correct; the previous one was a IDN spoofing vulnerability, which I thought was largely a flaw in the IDN specification itself, rather than in any particular implementation thereof (is this correct...?). This time around, however, the flaw lies in the Firefox code itself.

• Opera: 8, 7.
• Safari 2.0, 1.0

This may sound trollish, but is it fair to state on getfirefox.com that "Firefox empowers you to browse faster, more safely and more efficiently than with any other browser."
IMHO it should be "that other browser" or "any other Microsoft browser".

• Opera: 8, 7.
• Safari 2.0, 1.0

This may sound trollish, but is it fair to state on getfirefox.com that "Firefox empowers you to browse faster, more safely and more efficiently than with any other browser."
IMHO it should be "that other browser" or "any other Microsoft browser".

• Opera: 8, 7.
• Safari 2.0, 1.0

This may sound trollish, but is it fair to state on getfirefox.com that "Firefox empowers you to browse faster, more safely and more efficiently than with any other browser."
IMHO it should be "that other browser" or "any other Microsoft browser".

• Opera: 8, 7.
• Safari 2.0, 1.0

This may sound trollish, but is it fair to state on getfirefox.com that "Firefox empowers you to browse faster, more safely and more efficiently than with any other browser."
IMHO it should be "that other browser" or "any other Microsoft browser".

How about telling him that IE has 18 unpatched vunerabilites (http://secunia.com/product/11/) compared to 4 (http://secunia.com/product/4227/) in Firefox.

Theer is also the rate at which patches are rolled out. MS has multiple programs of various types they must keep uptodate. Mozilla has a handfull (T-bird, FF, Mozilla, and Sunbird). The mozilla team usually gets their patches out faster than the MS team. (Going by the average time between release date and last update date on the patched vunerablities listed on secunia)

If you are looking for 0 vunerabilities try Opera
(http://secunia.com/product/4932/)

Of, course IE is free(well bundled with windoze) and Firefox IS free while Opera costs money.

Pick your poison.

Yay FF

How about telling him that IE has 18 unpatched vunerabilites (http://secunia.com/product/11/) compared to 4 (http://secunia.com/product/4227/) in Firefox.

Theer is also the rate at which patches are rolled out. MS has multiple programs of various types they must keep uptodate. Mozilla has a handfull (T-bird, FF, Mozilla, and Sunbird). The mozilla team usually gets their patches out faster than the MS team. (Going by the average time between release date and last update date on the patched vunerablities listed on secunia)

If you are looking for 0 vunerabilities try Opera
(http://secunia.com/product/4932/)

Of, course IE is free(well bundled with windoze) and Firefox IS free while Opera costs money.

Pick your poison.

Yay FF

How about telling him that IE has 18 unpatched vunerabilites (http://secunia.com/product/11/) compared to 4 (http://secunia.com/product/4227/) in Firefox.

Theer is also the rate at which patches are rolled out. MS has multiple programs of various types they must keep uptodate. Mozilla has a handfull (T-bird, FF, Mozilla, and Sunbird). The mozilla team usually gets their patches out faster than the MS team. (Going by the average time between release date and last update date on the patched vunerablities listed on secunia)

If you are looking for 0 vunerabilities try Opera
(http://secunia.com/product/4932/)

Of, course IE is free(well bundled with windoze) and Firefox IS free while Opera costs money.

Pick your poison.

Yay FF

Currently that would be Opera, 0 unpatched vunerablities

http://secunia.com/product/4932/

(I still like Firefox better)

Fewer vulnerabilities is more secure, right? Yes.

chance of being pwned = SUM over vulnerabilities of (chance of vulnerability being exploited)*(chance of user encountering exploit).

You can't measure security on number of vulnerabilities alone, because many of them will either affect a small number of users or be encountered in rare conditions.

That said, Firefox still beats IE hands-down because ... IE is used by about 10 x the user base, has a larger number of vulnerabilities, and has vulnerabilities that affect common situations (like those related to clicking on links).

Those links don't work no matter what I do.

Internet Explorer vulneravbility page
Firefox vulneravbility page
Opera vulneravbility page


I'll stick with Opera 8x for now.

Those links don't work no matter what I do.

Internet Explorer vulneravbility page
Firefox vulneravbility page
Opera vulneravbility page


I'll stick with Opera 8x for now.

Those links don't work no matter what I do.

Internet Explorer vulneravbility page
Firefox vulneravbility page
Opera vulneravbility page


I'll stick with Opera 8x for now.

Your links got raped. Try these:

IE6: http://secunia.com/graph/?type=adv&period=2005&pro d=11
Firefox 1.x http://secunia.com/graph/?type=adv&period=2005&pro d=4227

Your links got raped. Try these:

IE6: http://secunia.com/graph/?type=adv&period=2005&pro d=11
Firefox 1.x http://secunia.com/graph/?type=adv&period=2005&pro d=4227