Slashdot Mirror
IE Vulnerabilities Page Removed
Henry V .009 writes "PivX Solutions has removed its (in)famous Unpatched IE Vulnerabilities page. Is Microsoft really getting better? From the site: 'Given Microsoft's recent positive actions together with the current rise in attacks against IE we have agreed to give Microsoft a good faith reprieve and have taken down our 'Unpatched' page. This was done in both a spirit of cooperation and for the good of the internet as a whole. As the ubiquitous browser that is utilized to access the internet, we all depend on IE too much to have crooks, social deviants, malcontents and crackers from messing with our lifestyles and our livelihoods. ENOUGH IS ENOUGH!'"
What were the reasons against a monopoly that my economics teacher tested me on again?
"1984" was ment to be a warning, not a guidebook. You hear that Kim Jong-il!? BushCo?!
that's a sign that the ill effects of monopoly power are at play
And that the competition has no marketing ability. Not to harsh on your mellow or anything, but do you really believe technical superiority is what wins over the masses? Drop a billion or so per year on marketing and then see how your favorite browser does in terms of marketshare (or any software for that matter).
It is not enough to tout the technical advantage. You have to have someone who can translate into simple terms so Ma and Pa Walmart can understand that. Advertising is not about telling the truth, per se, but rather about making things look good regardless of any other factors. That's what Microsoft excels at (well, that and backroom deals).
The point of all this is: Microsoft may be a monopoly, and they may wield that power ham-handedly, but the competition let them get their by making assumptions that weren't true, namely that technical ability would actually mean more than it does to the public.
To celebrate the occasion of my 1000th post, I will post no more forever on Slashdot. Goodbye.
It's shouldn't matter if it's valid HTML or not. The browser still shouldn't crash. It should take all input, regardless of the input's validity, and not die. Perhaps an error message, but not crash.
I'm sure they're justified in doing so, too. When I need something done to my car, I take it to a mechanic so that the work is done right. Likewise, when someone needs a web browser, I expect them to rely on software written by people who know what they're doing. I might ask a mechanic for reference customers, and consult the Better Business Bureau or local car club to make sure his work is of good quality. A sensible mechanic who needs a browser might check the Internet for references on a particular browser, also to make sure the work is of good quality.
See any parallels here? There's no excuse for not doing one's homework. There are plenty of articles available and accessible to the lay computer user that describe the some of the many problems with IE. There's no reason for an intelligent user not to read them and make an informed decision. Quite frankly, as an expert in the field of software, I do not believe any intelligent user could make an informed, good faith decision to use IE. Therefore I conclude that most users are not intelligent, are not acting in good faith (ie they don't care about the quality of the products they use), or are too lazy to spend five minutes gathering information. Since the latter two are just subcases of the first, it's safe to assume that 90% of computer users are not very intelligent. This is independent of any expert bias - their use of IE is not foolish because they're expected to understand the problems with IE on a technical level, it's foolish because there's no need to understand those details in order to see that IE is not a quality product and is in fact unsafe to use. I don't need to understand intimate details about strengths of materials, bending moments, and energy absorbtion to know that a car is unsafe if its gas tank is likely to explode in a collision. In the same way, I don't need to understand the details of exploiting a buffer overflow to know that a browser which is known to compromise a user's personal information is unsafe.
Flamebait? Call it whatever you like, but if people spent 1/10 as much effort making sure they had a safe, effective, reliable computing environment as they spend to ensure the same about other aspects of their lives - such as their cars - there wouldn't be an IE as we know it today.
"while still remaining far and away the dominant product in its category in spite of superior software being readily available, that's a sign that the ill effects of monopoly power are at play."
No, it's a sign that Mozilla needs a PR firm.
Face facts: Lots of stuff that has been popular over has had a superior alternative. Newton/Palm. GameBoy/GameGear/Lynx/Nomad. Beta/VHS. USB/Firewire. Etc. You don't need a monopoly for that situation to be created.
Now, in this case, we do have a monopoly that puts IE in front of the users. Worse, IE does the job quite well. If you asked the average user out there what could be done to make IE better, the answer would not be "Tabbed browsing!". Why? Because they've never heard of that!
Cripes people. There are no commercials on TV about Mozilla or Opera. There are very few (if any) hints to Mozilla's existence on the mainstream news. You have to visit Slashdot to be blasted with Mo's zealotry. So tell me, how's anybody even supposed to know it exists?
Spare us the MS blame game. There are things that competing browsers can do that they simply aren't. When those avenues are exhausted, you can draw one of two conclusions: 1.) Microsoft has an impenetrable monopoly on the browser market. or 2.) The market has decided they like IE better. In the first case, you can bitch and moan. In the second case you can improve Mozilla.
"Derp de derp."
"So why was that left out? Reading the summary I just thought that these people were being nice guys to Microsoft, and not that Microsoft actually addressed and fixed many issues with IE.
One sided journalism?"
Ah, new to Slashdot?
This is exactly the reason that so many 'Microsoft Apologists', as they're affectionately called here, argue with popular opinion. Simply put, you really have to RTFA with stories about MS because they ALWAYS have the worst possible spin here. As a result, people come out and say "Microsoft isn't really assymilating the world here..." and nobody else wants to believe that so they are ridiculed.
It'd be nice if Slashdot's MS reporting was a little more balanced. The way it is now, seriously, it's like watching Jerry Springer sometimes.
"Derp de derp."
How about we wait until Lindows and Mozilla have 93% of the desktop market before answering that.
MSFT is the only convicted monopolist with a known insecure desktop that I can see.
Integration is irrelevant. The case was about monopolist behaviour. You are focussing on the technical but MSFT did not get convicted because of purely technical decisions.
- Stop interpreting those spam-friendly
http://2343455/ urls
- Stop interpreting scam-friendly
http://ebay.com:url@123456/ urls
- Stop whining when browsing to a site that has AX disabled. A small icon is ok; a dialog box 'you are getting a worse experience is not.
- Make it possible and easy to fully uninstall outlook express. you cannot even delete this on XP; system recovery brings it back. Ugly manual hacks last until the next critical upgrade gets forced on the machine, at which point it reappers.
- Crank up the security settings for everyone who isnt using win2k3
- Rebuild IE with VS.net 2003 and set the 'check for buffer overflows' flag in the build.
- Stop integrating Windows Scripting Host with IE. Every IE install forcibly adds
.js, .vbs and .wsh file extensions to the path and enables their execution. I have to rebind these to notepad on my machines.
- Give us a no-images options for the email zone.
There are probably lots more of these things to do. All I see for the current user base is after-the-fact bug fixes rolled out intermittently, not attempts to address fundamental problems.It's a long and twisted story.
Netscape wanted to 0wn the net and they riled up Microsoft and now Microsoft sorta 0wns it instead.
I'm not sure either would have been a good thing, but I know there wasn't anybody involved who was a nice guy.
A Good Intro to NetBS
Hi. I just wanted to let you know that I use Windows, but most of the time I browse with Mozilla. Personally, I *would* use IE for browsing on Windows, but I prefer only running Adaware or Spybot Search & Destroy only once a month or so. If I were to do my daily browsing with IE, I'd have to run them every day.
Yeah, I know... I'm not the average user. At least now you can say you know of somebody. Frankly, I'm surprised ANYONE that is aware of ad-ware and spy-ware continues to use IE.
GreyPoopon
--
Why is it I can write insightful comments but can't come up with a clever signature?
Dude, you're an ass. Despite all the mountains from molehills ranting that you've apparently bought into, IE is a fine browser.
What kind of jackass actually composes a sentence like: "...I do not believe any intelligent user could make an informed, good faith decision to use IE."? Truly asinine.
That's about as valid as someone saying "I do not believe any intelligent user could choose a Chevy over a Ford.". i.e. you're just an idiotic fanboy.
Was that supposed to crash Mozilla? Id didn't do squat with MozillaFirebird 0.6.1. Maybe that only worked on some old 0.x version of Mozilla?
If Tyranny and Oppression come to this land,
it will be in the guise of fighting a foreign enemy. -James Madison
If Tyranny and Oppression come to this land,
it will be in the guise of fighting a foreign enemy. -James Madison
That doesn't help much. The recent QHosts malware (which used one of the 31 unpatched IE holes to install itself) was distributed via a banner ad. You don't have to visit $badguy's web page if $badguy has hacked into one of the web sites you do visit, or if he can use the commercial banner ad network to serve up his exploits.
There are no such standards for computer software. The few standards organizations that do exist (in this case, W3C would apply, as well as IETF and perhaps a few others) do not have the power to enforce their standards. One cannot make any assumptions about the quality, feature set, reliability, performance, or safety of a piece of computer software. Even toasters, to which computers have been compared, are subject to testing in UL or similar lab environments to ensure at least that the product does meets minimal safety standards (though there is no guarantee that it will actually toast anything). Therefore the software market is more wide-open than any other, and caveat emptor is the order of the day.
Risk in software selection is minimized by reading impartial product reviews, performing evaluations in isolated test environments, closely following known issues and patches, and in the case of large customers, purchasing support and warranty contracts. For the individual user, a simple survey of the product landscape and frequent attention to security issues will suffice. Even a casual evaluation of web browsers by the most novice computer user will show that IE has, by a huge margin, the most security problems, both in number and severity. A look at a few reviews will show that it offers no significant feature advantages over other products in its space, and in fact lacks some features its competition includes. Worse still, the manufacturer has a history of ignoring, downplaying, and denying security problems in its products; thus, the actual number of known vulnerabilities is probably much greater than the number publicly circulated.
This type of information is easily gathered by a nontechnical individual in a matter of a few minutes. It seems only prudent that someone who is about to entrust a piece of software with his or her personal, financial, and professional information (and run it on a computer for which he or she is wholly responsible) would take the time to gather this information.
General Motors and Ford operate in a tightly regulated industry with a history of significant legal judgments and market punishment against manufacturers of inadequate products. Therefore all products, while differing in various aspects of performance, aesthetics, and quality, are guaranteed to meet certain minimum standards and have a certain level of manufacturer backing. Microsoft and its competitors operate in an unregulated, uncontrolled industry with little history of product liability litigation and a sales structure which heavily favours them in the event of such litigation. Compliance with any standards which may apply to their products is wholly voluntary, and warranties are nearly always explicitly disclaimed.
In the former environment, even ignorant buyers are unlikely to find themselves with a grossly inadequate vehicle. However, ignorant buyers of computer software are virtually certain to end up in the unenviable position of owning a license to use a defective product, with no ability to recover compensation of any kind, including for damages caused by the software.
Chevy and Ford have fanboys. It may well be that browsers do also. But nowhere in this discussion have I advocated any particular product as an alternative to IE; in fact I have explicitly avoided doing so. There are numerous options, and each buyer is encouraged to seek the one they believe is most likely to function properly. As someone familiar with the field, I do not believe that anyone can honestly form the opinion that IE is that option.
As Schneier predicted, for Microsoft, the threat is bad publicity, and they are going to produce a security system that deals with the threat. Without some kind of disclosure, sysadmins cannot take stop gap measures to secure their systems. This is just another instance of rather than working on securing its products to a level needed for the Internet, the issue is being handled as a PR problem.
Time to upgrade if you haven't already.
Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.
Why hasn't anyone thought of making a very cool looking series of "Looks Best With Mozilla" buttons?
Because usually the likes of the crowd behind Mozilla is also usually supporting Web standards. "Looks best with browser X" goes very much against that.
i ate crayons when i was a kid and now i have two braincells and the blue ones taste nicer