Slashdot Mirror

Yes, by all means check out Secunia. Here's the links for Firefox and IE.

I found this part particularly interesting:

"Microsoft Internet Explorer 6 with all vendor patches installed and all vendor workarounds applied, is currently affected by one or more Secunia advisories rated Highly critical... Currently, 16 out of 63 Secunia advisories, is marked as "Unpatched" in the Secunia database."

And for Firefox:

Mozilla Firefox 0.x with all vendor patches installed and all vendor workarounds applied, is currently affected by one or more Secunia advisories rated Less critical... Currently, 3 out of 16 Secunia advisories, is marked as "Unpatched" in the Secunia database."

Also, the "criticality" break down for advisories in 2004:


IE Extremely: 13% Highly: 39% Moderately: 13% Less: 17% Not: 17%
FF Extremely: 0% Highly: 13% Moderately: 44% Less: 44% Not: 0%


For the months listed (going back to May), Firefox has had 16 advisories[1]. IE has had 14. But how many IE vulnerabilities have been outstanding during that time? The ONLY reason IE has a lower number of advisories since May is because the security holes were found earlier! No, Firefox has not had more vulnerabilities in the last six months. That's a flat-out lie. It's only had more *discovered* in that time. And all the critical ones have been fixed. And overall they've been much less severe than IE's holes.

As for them "sitting in the Moz codebase for years", where do you think the IE holes came from? That's right, they've been sitting in the IE codebase for years. Go figure. At least the Mozilla team fixes them promptly when they are found.

Hell, one of the Firefox vulnerabilities was actually a Windows vulnerability!

[1]I'm now noticing that some advisories include multiple vulnerabilities. I don't have time to examine each advisory to count actual vulnerabilities and check their severity, but I encourage anyone who has the time to do it. I'm reasonably confident that Firefox would come out on top in pretty much any reasonable comparison.

Yes, by all means check out Secunia. Here's the links for Firefox and IE.

I found this part particularly interesting:

"Microsoft Internet Explorer 6 with all vendor patches installed and all vendor workarounds applied, is currently affected by one or more Secunia advisories rated Highly critical... Currently, 16 out of 63 Secunia advisories, is marked as "Unpatched" in the Secunia database."

And for Firefox:

Mozilla Firefox 0.x with all vendor patches installed and all vendor workarounds applied, is currently affected by one or more Secunia advisories rated Less critical... Currently, 3 out of 16 Secunia advisories, is marked as "Unpatched" in the Secunia database."

Also, the "criticality" break down for advisories in 2004:


IE Extremely: 13% Highly: 39% Moderately: 13% Less: 17% Not: 17%
FF Extremely: 0% Highly: 13% Moderately: 44% Less: 44% Not: 0%


For the months listed (going back to May), Firefox has had 16 advisories[1]. IE has had 14. But how many IE vulnerabilities have been outstanding during that time? The ONLY reason IE has a lower number of advisories since May is because the security holes were found earlier! No, Firefox has not had more vulnerabilities in the last six months. That's a flat-out lie. It's only had more *discovered* in that time. And all the critical ones have been fixed. And overall they've been much less severe than IE's holes.

As for them "sitting in the Moz codebase for years", where do you think the IE holes came from? That's right, they've been sitting in the IE codebase for years. Go figure. At least the Mozilla team fixes them promptly when they are found.

Hell, one of the Firefox vulnerabilities was actually a Windows vulnerability!

[1]I'm now noticing that some advisories include multiple vulnerabilities. I don't have time to examine each advisory to count actual vulnerabilities and check their severity, but I encourage anyone who has the time to do it. I'm reasonably confident that Firefox would come out on top in pretty much any reasonable comparison.

Yes, by all means check out Secunia. Here's the links for Firefox and IE.

I found this part particularly interesting:

"Microsoft Internet Explorer 6 with all vendor patches installed and all vendor workarounds applied, is currently affected by one or more Secunia advisories rated Highly critical... Currently, 16 out of 63 Secunia advisories, is marked as "Unpatched" in the Secunia database."

And for Firefox:

Mozilla Firefox 0.x with all vendor patches installed and all vendor workarounds applied, is currently affected by one or more Secunia advisories rated Less critical... Currently, 3 out of 16 Secunia advisories, is marked as "Unpatched" in the Secunia database."

Also, the "criticality" break down for advisories in 2004:


IE Extremely: 13% Highly: 39% Moderately: 13% Less: 17% Not: 17%
FF Extremely: 0% Highly: 13% Moderately: 44% Less: 44% Not: 0%


For the months listed (going back to May), Firefox has had 16 advisories[1]. IE has had 14. But how many IE vulnerabilities have been outstanding during that time? The ONLY reason IE has a lower number of advisories since May is because the security holes were found earlier! No, Firefox has not had more vulnerabilities in the last six months. That's a flat-out lie. It's only had more *discovered* in that time. And all the critical ones have been fixed. And overall they've been much less severe than IE's holes.

As for them "sitting in the Moz codebase for years", where do you think the IE holes came from? That's right, they've been sitting in the IE codebase for years. Go figure. At least the Mozilla team fixes them promptly when they are found.

Hell, one of the Firefox vulnerabilities was actually a Windows vulnerability!

[1]I'm now noticing that some advisories include multiple vulnerabilities. I don't have time to examine each advisory to count actual vulnerabilities and check their severity, but I encourage anyone who has the time to do it. I'm reasonably confident that Firefox would come out on top in pretty much any reasonable comparison.

Not all vulnerabilities are equal. Not every security hole can result in your computer becoming a zombie.
Yet by merely counting them, you're implying this is somehow comparable to this

A better way to measure the security (or lack of) of a product could be to keep a calendar:
For every day that goes by with at least one publicly known yet unpatched serious vulnerability (and no, I don't think <script>prompt("enter your CC# now","")</script> qualifies), put a mark on the corresponding product for that day.
After a few weeks/months, tally up the number of days you were explicitely put at risk by using a particular product.

I'd be extremely surprised if FireFox didn't come out spectacularly ahead of IE on this kind of test.

Not all vulnerabilities are equal. Not every security hole can result in your computer becoming a zombie.
Yet by merely counting them, you're implying this is somehow comparable to this

A better way to measure the security (or lack of) of a product could be to keep a calendar:
For every day that goes by with at least one publicly known yet unpatched serious vulnerability (and no, I don't think <script>prompt("enter your CC# now","")</script> qualifies), put a mark on the corresponding product for that day.
After a few weeks/months, tally up the number of days you were explicitely put at risk by using a particular product.

I'd be extremely surprised if FireFox didn't come out spectacularly ahead of IE on this kind of test.

Of course it is possible to keep a Windows machine naked on the net without it getting cracked.

1. You can't connect an unpatched MS-Windows machine to the 'Net. Even Redmond admits that in their blame-the-admin campaign. See also articles like, "Unpatched {Windows} PC "Survival Time" Just 16 Minutes".

2. Even if you download the patch and install it before exposing the MS-Windows machine to the 'Net, the patch may not work. MS Patches are infamous for being incomplete, breaking 3rd party applications, failing to patch what they claim to patch, or even resurrecting old security problems. e.g. Attack pierces fully patched Windows XP

3. Even if the patch does work, there are many widely known problems left unaddressed by the patch, such as this problem that MS still hasn't acknowledged.

4. Even if the points above are magically resolved, you still have reality bite you: You can't patch fast enough.

A lot of folks are heavily in denial about just how bad shape MS really is in. It's been a great ride, but it's time to get off. If you weren't early in and at the top of the pyramid scheme, then don't even think about it. Either way it's time to look away from Redmond and back to software that works and is actually designed to work.

Looking at securityfocus.com and secunia.com it seems that IIS 6.0 has had at least 3 vulnerabilities discovered, one of which is still unpatched.

Apache 2.0.x, on the other hand, has at least 20 vulnerabilities listed so your point about IIS vs Apache is valid, but I just don't want you to fool yourself into thinking IIS 6.0 is somehow the savior of the web.

Its also interesting to note that Windows Server 2003 Enterprise Edition has 31 advisories while Red Hat Enterprise Linux AS 3 has 89 advisories

Now what is really interesting is to see the number of vulnerabilities that are unpatched when comparing Microsoft's solutions to the FOSS solutions. It seems that even though Microsoft has fewer advisories they also have more of them that seem to be unpatched. So that seems to be good news for FOSS and perhaps is proof in what has been said all along on the FOSS side, the bugs get fixed faster than on the closed source side.

Its interesting to look at the numbers anyhow, but I still see no reason to dump my linux installs for any expensive Microsoft offerings anytime soon.

burnin

Looking at securityfocus.com and secunia.com it seems that IIS 6.0 has had at least 3 vulnerabilities discovered, one of which is still unpatched.

Apache 2.0.x, on the other hand, has at least 20 vulnerabilities listed so your point about IIS vs Apache is valid, but I just don't want you to fool yourself into thinking IIS 6.0 is somehow the savior of the web.

Its also interesting to note that Windows Server 2003 Enterprise Edition has 31 advisories while Red Hat Enterprise Linux AS 3 has 89 advisories

Now what is really interesting is to see the number of vulnerabilities that are unpatched when comparing Microsoft's solutions to the FOSS solutions. It seems that even though Microsoft has fewer advisories they also have more of them that seem to be unpatched. So that seems to be good news for FOSS and perhaps is proof in what has been said all along on the FOSS side, the bugs get fixed faster than on the closed source side.

Its interesting to look at the numbers anyhow, but I still see no reason to dump my linux installs for any expensive Microsoft offerings anytime soon.

burnin

Looking at securityfocus.com and secunia.com it seems that IIS 6.0 has had at least 3 vulnerabilities discovered, one of which is still unpatched.

Apache 2.0.x, on the other hand, has at least 20 vulnerabilities listed so your point about IIS vs Apache is valid, but I just don't want you to fool yourself into thinking IIS 6.0 is somehow the savior of the web.

Its also interesting to note that Windows Server 2003 Enterprise Edition has 31 advisories while Red Hat Enterprise Linux AS 3 has 89 advisories

Now what is really interesting is to see the number of vulnerabilities that are unpatched when comparing Microsoft's solutions to the FOSS solutions. It seems that even though Microsoft has fewer advisories they also have more of them that seem to be unpatched. So that seems to be good news for FOSS and perhaps is proof in what has been said all along on the FOSS side, the bugs get fixed faster than on the closed source side.

Its interesting to look at the numbers anyhow, but I still see no reason to dump my linux installs for any expensive Microsoft offerings anytime soon.

burnin

Looking at securityfocus.com and secunia.com it seems that IIS 6.0 has had at least 3 vulnerabilities discovered, one of which is still unpatched.

Apache 2.0.x, on the other hand, has at least 20 vulnerabilities listed so your point about IIS vs Apache is valid, but I just don't want you to fool yourself into thinking IIS 6.0 is somehow the savior of the web.

Its also interesting to note that Windows Server 2003 Enterprise Edition has 31 advisories while Red Hat Enterprise Linux AS 3 has 89 advisories

Now what is really interesting is to see the number of vulnerabilities that are unpatched when comparing Microsoft's solutions to the FOSS solutions. It seems that even though Microsoft has fewer advisories they also have more of them that seem to be unpatched. So that seems to be good news for FOSS and perhaps is proof in what has been said all along on the FOSS side, the bugs get fixed faster than on the closed source side.

Its interesting to look at the numbers anyhow, but I still see no reason to dump my linux installs for any expensive Microsoft offerings anytime soon.

burnin

Fine, but why isn't ProPolice distributed/enabled by default in gcc?

Yeah, it's "been around for ages!".

But, if that's the case, then why do we have buffer overflow fixes in OpenSSH , Mozilla, and Apache?

See, I know I could probably install this compiler extension, and pass flags and all that. I'm sure Gentoo nuts do it all the time.

But why the hell is this not done by default, everwhere, if it's been available for NN years? This is where Microsoft may actually be ahead of us.

But, I guess pointing out this unpopular fact makes me a troll?

No matter how you cut the vulnerabilities in Win2K3 some of the vulnerabilities are definitely part of IIS 6.0. However I don't believe for a second that Microsoft is reporting all security problems, such as this problem that M$ still hasn't acknowledged.

The Apache group is much more forthcoming about security problems and I don't trust Windows as a server platform.

I use Konquerer as my main browser, with Mozilla and Epiphany as more "functional" browsers for specific sites I've found that need Java or Javascript (or cookies, for that matter). And lo and behold, that's exactly what's written in the article.

---
Solution:
Don't visit trusted web sites while visiting untrusted web sites or disable JavaScript.
---

If you goto the second issue for Mozilla here and then click on the citibank link, its interesting that it grabs text in the url textbox, or if you open any other XUL dialog box (New Bookmark Folder - Though in IE its not affected when adding a bookmark) it doesn't let you enter text... This same vuneribility exists in internet explorer (grabs text in url textbox too) but I wonder if it can be exploited in IE/Mozilla using a hidden frame, or inline? I tested it with autofill but that part was fine.

OOOhhhoo, finally my wish will be granted *ooooohhooo, bounces around out of happiness*

*fast reading*

• Secunia Research has discovered a vulnerability in Konqueror... [blah blah blah]...

  Inactive tabs can launch dialog boxes.... [blah balh blah] ...

  Successful exploitation would normally require that a user is tricked... [blah blah blah]...

  *Oohhh*A test is available * ooh ooh, does one dare ...*

  ...

  The vendor reports that the vulnerability has been fixed in KDE 3.3.1.

</sarcasm>

*Konqi User goes back to Yawning*

OOOhhhoo, finally my wish will be granted *ooooohhooo, bounces around out of happiness*

*fast reading*

• Secunia Research has discovered a vulnerability in Konqueror... [blah blah blah]...

  Inactive tabs can launch dialog boxes.... [blah balh blah] ...

  Successful exploitation would normally require that a user is tricked... [blah blah blah]...

  *Oohhh*A test is available * ooh ooh, does one dare ...*

  ...

  The vendor reports that the vulnerability has been fixed in KDE 3.3.1.

</sarcasm>

*Konqi User goes back to Yawning*

Coralize the links, they'll load WAY faster and more reliably:

http://secunia.com/advisories/12712/
Changes to:
http://secunia.com.nyud.net:8090/advisories/12712/

The same person tells us that Apache sucks when compared with IIS. Does this mean we've all been wrong about Microsoft products? If we take Microsofts word for it we have indeed and should seriously consider switching back to IIS. After all, [THE FOLLOWING IS SARCASM:] this conclusively proves that IIS is far superior to the Linux Apache Mysql Perl/Python/Php system.

The same person tells us that Apache sucks when compared with IIS. Does this mean we've all been wrong about Microsoft products? If we take Microsofts word for it we have indeed and should seriously consider switching back to IIS. After all, [THE FOLLOWING IS SARCASM:] this conclusively proves that IIS is far superior to the Linux Apache Mysql Perl/Python/Php system.

We understand that you are lying, Mr. Gates. There are plenty more where those come from.

I wouldn't take SANS's list of browser security holes too seriously. It lists the most publicized holes in Mozilla rather than the most serious holes. (To get a list of the most serious holes, look the "critical severity, high risk" holes (marked in red) on mozilla.org's list.) SANS's list includes Mozilla XPInstall Dialog Box Security Issue, which was fixed a few months ago, but fails to mention that a fully-updated version of IE in SP2 is still vulnerable. Under the list, SANS claims that Firefox does not have automatic updates, which is false.

If the number of exploits scaled by popularity, why are there more bugs for IIS than for Apache?

If the number of exploits scaled by popularity, why are there more bugs for IIS than for Apache?

Hmm... Perhaps.... http://secunia.com/product/3919/

I agree that PHP is only now learning the lessons that others learned a long time ago. But Perl only had one vulnerability.

And that vulnerability only applied if you were running Perl on Windows. Most people using Perl for web work run on something *nix based.

BTW secunia is an interesting resource. Thanks for the recommend.

Thats why I use Tomcat :) Java is a wonderful thing.
Regards,
Steve

Comparing PHP 4.3.x series to ASP.NET (both 1 and 1.1) at secunia. It seems to me that the vulnerabilities are 10 to 3. If you were recommending a product, at least do some research before you do.

Comparing PHP 4.3.x series to ASP.NET (both 1 and 1.1) at secunia. It seems to me that the vulnerabilities are 10 to 3. If you were recommending a product, at least do some research before you do.

MSI packages are Microsoft's RPM. They are significant because Microsoft's and other companies' application deployment tools use it.

For example, I administer about 80 PCs in a school. First thing I need to do with a new application is to get it into MSI form becuase usually they come as executables. Some companies like Sun (Java) and Adobe (Acrobat Reader etc) provide tools that help you make your own package. They also aren't ready for multiuser systems where users are non-privileged. So a lot of work before I can deploy a new application.

Once they are in MSI form, I can stick them on a network share and tell all the PCs to install the programs on the next bootup. I don't have to go through 80 machines and install Firefox on every one.

Firefox comes as an executable or flat zip file. I've been working putting FF in an MSI lately and have had enough success to roll it out. There are plans to offer it as an MSI when it hits 1.0 final.

Another component they mention is group policies. You can configure IE centrally from a server, for instance now that I've deployed FF I've shut off "active scripting" (ECMAscript/Javascript/vbcript whatever) from all unknown sites. Not that it helps much because according to Secunia it's possible to circumvent IE's security zone settings due to a 7-month old unpatched security hole in IE. FF doesn't use the Windows registry so group policies are useless. Other means of enforcing settings are being developed, however.

Just a quick note on those 2 advisories. One of those bugs is also found in IE. The other is ony on OSX.

Another advantage to firefox is that it alerts you when there are updates. The same can't be said of IE. IE has to rely on Windows Update.

Something seems right to me about the specific piece of software you are using being able to notify you about it's own problems. "Since you seem to use me, why don't you patch me?"

Just a quick note on those 2 advisories. One of those bugs is also found in IE. The other is ony on OSX.

Another advantage to firefox is that it alerts you when there are updates. The same can't be said of IE. IE has to rely on Windows Update.

Something seems right to me about the specific piece of software you are using being able to notify you about it's own problems. "Since you seem to use me, why don't you patch me?"

Or a little of both. I just keep all my downloads in one folder (R:\home\lachlan\program downloads (you can see which OS I like to use)). No subfolders inside, because I find it easier to remember the names than multiple directory levels when I type in filenames (eg. cp ~/program\ downloads/jdk-1_5_5-windows-i586.exe H:\\ is easier than cp ~/program\ downloads/java/jdk/jdk-1_5_5-windows-i586.exe H:\\). But if I got hit with something like this, 5.6GB of downloads disappears. And up until yesterday, I was on 56k. Not a week's downloads.

Of course, I'm not really a representative of the general public. They probably won't be affected by this exploit. They just have the other 19 to deal with ;)

Considering Firefox is supposed to be the secure alternative, 13 security advisories in the last 6 or so months isn't a good look.

Sure it isn't that bad, but nonetheless, it doesn't help the Firefox's image at all and looking at Secunia, Firefox has had more advisories than any other browser, (yes, that includes Internet Explorer and the Mozilla Suite) since May this year.

"The most ridiculous part is that EVERYBODY WILL ... FALL FOR IT AGAIN."

Exactly right: The U.S. government has bombed 24 countries since World War 2. The system of violence works by creating fear in U.S. citizens so rich people can profit. The problem happens largely because the U.S. government has a break-the-law department called the CIA. Secret government is not democratic.

This is the 55th serious vulnerability in IE found in two years. I've often wondered: Are Microsoft programmers that sloppy, or were the bugs put there to help with U.S. government surveillance? Why did the U.S. Department of Justice let Microsoft off so easily for its anti-trust violations?

Mozilla Multiple Vulnerabilities
Highly critical
Cross Site Scripting
Manipulation of data
Exposure of sensitive information
System access
From remote

That got me to upgrade ASAP!

I don't know if Mozilla should be bragging that up to a million users had to run out and get a critical security fix. It would be nice if there was a patch install, and they could separate out the new downloads from the upgraders.

You mean apart from these critical flaws which let any website take over your machine by exploiting all the buffer overflows in it. The difference between IE and Firefox is that IE has a better automatic update system for patching security issues.

See: http://secunia.com/advisories/12526/

Yet I see no mention of it on the Mozilla home page and the downloads look the same. Is there a patch is is there not a patch?

From Secunia:

Highly critical
Impact: Cross Site Scripting
Manipulation of data
Exposure of sensitive information
System access

Affects all versions.

Heh... while we are comparing Fedora and Windows XP, I was on Secunia today looking up some information for my employer. What I found was interesting. Fedora (both cores) according to Secunia are both "secured" and have nothing that is known about that isn't patched. Windows XP on the other hand has 25% of its vulnerabilities unpatched and secunia considers at least one of these unpatched things to be "highly critical". Also to put it in more perspective, the Windows alerts are only in regards to core windows components, whereas the Fedora Cores have the alerts for pretty much every product that comes with it, these include rsync, CVS, and squirrelmail. Many of these applications are 3rd party software and the Fedora crew isn't directly responsible for their securty, yet they are included in the Fedora evaluation. That'd be like saying Microsoft is responsible for Adobe's software. Despite the fact that Fedora has this going against it, Secunia still considers it more secure. One final thing, while it says Firefox has some moderately critical problems ( its two things, and both are related to spoofing), it says that Internet Explorer has many "Extrememly Critical" problems and then goes on to list too many to note here. Here are the links:
Fedora
WinXP
Firefox
IE

I'm sure glad I run Fedora:) I also run Debian on some servers and was a bit disappointed to see that they were marked as having some moderately critical vulnerabilities, one being released in 2002. It sure is stable as hell, but it's one more reason to keep me thinkign about migrating the servers and the only other real choices I'd consider are Red Hat, Suse (although past experiences with them haven't been the best), and maybe Gentoo on a non-production server.Debian.
Regards,
Steve

Heh... while we are comparing Fedora and Windows XP, I was on Secunia today looking up some information for my employer. What I found was interesting. Fedora (both cores) according to Secunia are both "secured" and have nothing that is known about that isn't patched. Windows XP on the other hand has 25% of its vulnerabilities unpatched and secunia considers at least one of these unpatched things to be "highly critical". Also to put it in more perspective, the Windows alerts are only in regards to core windows components, whereas the Fedora Cores have the alerts for pretty much every product that comes with it, these include rsync, CVS, and squirrelmail. Many of these applications are 3rd party software and the Fedora crew isn't directly responsible for their securty, yet they are included in the Fedora evaluation. That'd be like saying Microsoft is responsible for Adobe's software. Despite the fact that Fedora has this going against it, Secunia still considers it more secure. One final thing, while it says Firefox has some moderately critical problems ( its two things, and both are related to spoofing), it says that Internet Explorer has many "Extrememly Critical" problems and then goes on to list too many to note here. Here are the links:
Fedora
WinXP
Firefox
IE

I'm sure glad I run Fedora:) I also run Debian on some servers and was a bit disappointed to see that they were marked as having some moderately critical vulnerabilities, one being released in 2002. It sure is stable as hell, but it's one more reason to keep me thinkign about migrating the servers and the only other real choices I'd consider are Red Hat, Suse (although past experiences with them haven't been the best), and maybe Gentoo on a non-production server.Debian.
Regards,
Steve

Heh... while we are comparing Fedora and Windows XP, I was on Secunia today looking up some information for my employer. What I found was interesting. Fedora (both cores) according to Secunia are both "secured" and have nothing that is known about that isn't patched. Windows XP on the other hand has 25% of its vulnerabilities unpatched and secunia considers at least one of these unpatched things to be "highly critical". Also to put it in more perspective, the Windows alerts are only in regards to core windows components, whereas the Fedora Cores have the alerts for pretty much every product that comes with it, these include rsync, CVS, and squirrelmail. Many of these applications are 3rd party software and the Fedora crew isn't directly responsible for their securty, yet they are included in the Fedora evaluation. That'd be like saying Microsoft is responsible for Adobe's software. Despite the fact that Fedora has this going against it, Secunia still considers it more secure. One final thing, while it says Firefox has some moderately critical problems ( its two things, and both are related to spoofing), it says that Internet Explorer has many "Extrememly Critical" problems and then goes on to list too many to note here. Here are the links:
Fedora
WinXP
Firefox
IE

I'm sure glad I run Fedora:) I also run Debian on some servers and was a bit disappointed to see that they were marked as having some moderately critical vulnerabilities, one being released in 2002. It sure is stable as hell, but it's one more reason to keep me thinkign about migrating the servers and the only other real choices I'd consider are Red Hat, Suse (although past experiences with them haven't been the best), and maybe Gentoo on a non-production server.Debian.
Regards,
Steve

Heh... while we are comparing Fedora and Windows XP, I was on Secunia today looking up some information for my employer. What I found was interesting. Fedora (both cores) according to Secunia are both "secured" and have nothing that is known about that isn't patched. Windows XP on the other hand has 25% of its vulnerabilities unpatched and secunia considers at least one of these unpatched things to be "highly critical". Also to put it in more perspective, the Windows alerts are only in regards to core windows components, whereas the Fedora Cores have the alerts for pretty much every product that comes with it, these include rsync, CVS, and squirrelmail. Many of these applications are 3rd party software and the Fedora crew isn't directly responsible for their securty, yet they are included in the Fedora evaluation. That'd be like saying Microsoft is responsible for Adobe's software. Despite the fact that Fedora has this going against it, Secunia still considers it more secure. One final thing, while it says Firefox has some moderately critical problems ( its two things, and both are related to spoofing), it says that Internet Explorer has many "Extrememly Critical" problems and then goes on to list too many to note here. Here are the links:
Fedora
WinXP
Firefox
IE

I'm sure glad I run Fedora:) I also run Debian on some servers and was a bit disappointed to see that they were marked as having some moderately critical vulnerabilities, one being released in 2002. It sure is stable as hell, but it's one more reason to keep me thinkign about migrating the servers and the only other real choices I'd consider are Red Hat, Suse (although past experiences with them haven't been the best), and maybe Gentoo on a non-production server.Debian.
Regards,
Steve

Heh... while we are comparing Fedora and Windows XP, I was on Secunia today looking up some information for my employer. What I found was interesting. Fedora (both cores) according to Secunia are both "secured" and have nothing that is known about that isn't patched. Windows XP on the other hand has 25% of its vulnerabilities unpatched and secunia considers at least one of these unpatched things to be "highly critical". Also to put it in more perspective, the Windows alerts are only in regards to core windows components, whereas the Fedora Cores have the alerts for pretty much every product that comes with it, these include rsync, CVS, and squirrelmail. Many of these applications are 3rd party software and the Fedora crew isn't directly responsible for their securty, yet they are included in the Fedora evaluation. That'd be like saying Microsoft is responsible for Adobe's software. Despite the fact that Fedora has this going against it, Secunia still considers it more secure. One final thing, while it says Firefox has some moderately critical problems ( its two things, and both are related to spoofing), it says that Internet Explorer has many "Extrememly Critical" problems and then goes on to list too many to note here. Here are the links:
Fedora
WinXP
Firefox
IE

I'm sure glad I run Fedora:) I also run Debian on some servers and was a bit disappointed to see that they were marked as having some moderately critical vulnerabilities, one being released in 2002. It sure is stable as hell, but it's one more reason to keep me thinkign about migrating the servers and the only other real choices I'd consider are Red Hat, Suse (although past experiences with them haven't been the best), and maybe Gentoo on a non-production server.Debian.
Regards,
Steve

Apple has been a great demonstration for the added security of OSS. Of the few exploits that have arisen, they've mostly been related to the parts of the OS that are still closed, like AppleScript and Internet Connect.app. Maybe they should expand their OSS efforts into these areas...

(exceptions in recent libpng and libz exploits)

Apple has been a great demonstration for the added security of OSS. Of the few exploits that have arisen, they've mostly been related to the parts of the OS that are still closed, like AppleScript and Internet Connect.app. Maybe they should expand their OSS efforts into these areas...

(exceptions in recent libpng and libz exploits)

This one is labeled "Moderately Critical".

How many critical alerts have been released against IIS 6 in the 16 months since it's been released?

Answer: None.

It was in the link from a message posted by Egekrusher2K (610429) a few messages up the chain from here.

It was in reply to someone who said that MacOS X had no problems like this Winamp one. It was not referring to the original Winamp problem itself.

Uh, just because WinAmp is nice enough to put out a patch that will protect you from IE's vulnerable behavior does not mean it's their fault in the first place. Kinda like the whole Mozilla thing.

The Securia.com link in the profile says that only Winamp 3.x and 5.x. But doesn't mention 2.x... the vast majority of Winamp users I know don't use 3.x or 5.x due to the massive feature bloat.

Is 2.x actually susceptible or is the submitter incorrect?

http://secunia.com/advisories/12321/

For more info...