Slashdot Mirror
IE Vulnerabilities Page Removed
Henry V .009 writes "PivX Solutions has removed its (in)famous Unpatched IE Vulnerabilities page. Is Microsoft really getting better? From the site: 'Given Microsoft's recent positive actions together with the current rise in attacks against IE we have agreed to give Microsoft a good faith reprieve and have taken down our 'Unpatched' page. This was done in both a spirit of cooperation and for the good of the internet as a whole. As the ubiquitous browser that is utilized to access the internet, we all depend on IE too much to have crooks, social deviants, malcontents and crackers from messing with our lifestyles and our livelihoods. ENOUGH IS ENOUGH!'"
Any time one piece of software from one company can be responsible for such negative impact on our lives because of how poorly it was designed, while still remaining far and away the dominant product in its category in spite of superior software being readily available, that's a sign that the ill effects of monopoly power are at play.
Read the EFF's Fair Use FAQ
We all should give pivx a huge hand!
First, they applied the pressure to help force microsoft into fixing the software.
Second, they are now giving microsoft some slack (negative reinforcement?) for trying to fix its browser.
Bravo guys!
Plus, these guys are hiring!
"We" is the Average Joe using the computer--obviously not the slashdot crew.
The world would be a much better place if everybody who used a computer knew as much as we did.
However... I'm sure people in the mechanic websites make fun of people like us all the time too because we phuck up our cars all the time.
Most of us know computers... most of them or at least the "we" in the quote above... do not really understand computers and computer security. That's why putting pressure on microsoft to fix its damn browser is such a good idea!
Of a side note...
Even though the website I have in my sig is mainly a solaris/unix based site... 80% of the people who visit my site from slashdot report as IE.
Something tells me this was accompanied by the greasing of palms.
"The United States has no right, no desire, and no intention to impose our form of government on anyone else." - Bush 05
Why aren't other pages keeping track of unpatched vulnerabilities in other software? Well, have you ever tried to match up the CVE database with patches? It's difficult. I don't know anyone who can answer how many unpatched vulnerabilities are present in W2K, XP, and the like. Has to be boatloads.
Vulnerability disclsoure doesn't create pressure on MS, however. Malicious code creates pressure. Consider the MSIE vulnerability that led to QHosts. That one was old -- in August MS said that the patch they produced should have correct the Object Type vulnerability, but didn't. Yet the patch wasn't corrected until October, and that was only after QHosts exploited it. The exploit, however, raised MS's concern so much that they issued the patch on a Saturday instead of their regular Wednesday schedule....wow, the vulnerability is known for two months, then suddenly a patch appears AFTER the exploit is released.
What are the lessons?
(1) Apparently ALL MS software has unpatched vulnerabilities
(2) Apparently vulnerabilities are not priorities for MS unless exploits become newsworthy, (3) Trusting on MS patches to correct vulnerabilities is a recipe for disaster.
I sincerely hope that if Microsoft doesn't fix each and every valid vulnerability that was listed on that page, within six months, that the page gets restored.
It has been proven time and again and again and again that vendors, especially monopoly vendors, will not fix their systems in a timely manner unless they're pressured to. And by "timely manner", I mean within four weeks.
The last five or six MS security bulletins I've seen had lapses of between SIX AND NINE MONTHS between the reporting of the problem and the release of the patch.
So two things:
1) If Microsoft doesn't fix all the currently-known vulnerabilities within six months, somebody should take it upon themselves to start tracking them again
2) If Microsoft can't get their act together and release patches for new vulnerabilities in a timely manner (instead opting to waffle for six months while real people's systems are getting exploited because MS is _never_ the only entity to know a vulnerability, and it's almost guaranteed that somebody with nefarious intentions does), then somebody should take it upon themselves to start disseminating as much information as is required for *real* preventative measures to be put in place
I'm all for giving them one more chance, but I'm not willing to sacrifice my clients' systems by changing my standards for this "chance". They either do what they should do, or they have to deal with me telling my clients exactly what they need to do to protect themselves from a given vulnerability - and that information would almost certainly be enough for a black-hat to use if it ever got leaked.
If you think my standards are too high, consider that other vendors whose software is used on systems which literally control life-or-death systems often release fixes within hours and days, not weeks and months.
Barclay family motto:
Aut agere aut mori.
(Either action or death.)
Unless you're a geek, you don't know about Mozilla. You might know about Netscape and think 4.1 was about the end of the line. You may even have tried one of Netscape's releases of Mozilla and thought it sucked (which, let's face it, it does). Most users of IE think that installing a different browser on their computer will break IE. They fear losing their bookmarks and their history. All that's really needed is a good public education program. Most of which can be achieved by each of us sending our non-geek friends to www.mozilla.org.
How we know is more important than what we know.
Am I the only one who read "IE Vulnerabilities Removed"? I knew it was to good to be true...
That's funny, but jokes aside,
I believe this is what Microsoft should be doing, id est removing the vulnerabilities themselves, not merely the discussion about them. Those greedy bastards have so much cash that patching IE should take them less than 6 weeks. So I am asking: why aren't they doing that? Is there any Microsoft employee reading this who could answer my question? I surely hope so.
Sincerely,
Pan Tarhei Hosé, PhD.
"Homo sum et cogito ergo odi profanum vulgus et libido."
Huh, I don't know. It crashed it when I clicked straight through this time. Maybe different versions of Moz? I am running Mozilla 1.4 on both a WinXP and Linux, and it crashes on both.
Its not what it is, its something else.
The patch "renders several IE vulns obselete". Most software vendors release patches for their software, and it's nice to see Microsoft continue to do so. That's not really news, though. The news is that the service that tells us what vulnerabilities remain has gone.
That releasing a patch removes the need to know about the outstanding vulnerabilities is simply nonsense.
Which IE vulnerabilities are rendered obselete by the patch? Which remain? "Several" is not "all". It's quite likely not even "most". Which ones are still there? Well, suddenly pivx aren't going to tell us.
It's dark. You are likely to be eaten by a grue.
Charles Miller
The more I learn about the Internet, the more amazed I am that it works at all.
I did too, and it crashed. (Mozilla 1.4, Linux).
Don't drop the soap, Tommy!
I will run my own "IE Unpatched" list.
Hopefully it'll be up in a few days. No URL yet. This knowledge must be available to people.
"See, Bobs, it's not that I'm lazy, it's that I just don't care."
/., check for updates for Trillian or some other software I might use, or update a driver. Yes, I'm a boring user. But I really don't have time for much else, and since I don't think my bank nor any of those other sites I visit have an interest in doing malicious things to me... I just don't care, plain and simple.
I am a web designer, and I am fully aware of the problems with IE - security and otherwise. But personally, I really don't care about its vulnerabilities. My job is to make my web pages look correct in maybe this version and a few versions back of IE, but that's really it.
Ok. So you can take over my computer with a web page. Well, I'm not going to YOUR web page.
My email filters out spam. Not going. I don't look for warez, don't check out pr0n, don't download any hip new software.
I DO go to my bank's web site and look at my balance, read
I know it's not a safe way to live, and I think that if my computer were destroyed right now I'd shrug and say "meh." And then build another one.
Maybe others feel the same?
"They said I probly shouldn't fly with just one eye," "I am Bender. Please insert girder."
From the site:
Try Mozilla or Konqueror instead--two fine free software web browsers (and there are many others). Then consider switching to a free software operating system so you don't bump into holes in other applications and have to wait for the proprietor to fix them for you. If you want to inspect, copy, distribute, or modify free software programs you can do so (or get someone else to do so for you). Freedom is really worthwhile.
Digital Citizen
Wrong. The point is 95% is a bullshit statistic. Its overblown by proxy servers and faked browser strings. The average user is in touch with the alternatives whether you think they are or not. I'm talking about people, for example, who bought a Dell with WinXP Home Edition to browse the web, chat/e-mail, write documents, play games, etc. If they understand how to install software, chances are they have replaced IE with something else because it is common knowledge that IE is a sucky-ass browser.
One person I know switched from IE to Netscape because she found that IE had a lot of trouble with Hotmail!
Another got sick of popups and switched to Mozilla and never looked back (yes, yes I know you can block popups in IE).
Everyone is using alternative browsers these days. Get with the times...
#!/
That's quite disingeneous.
It shouldn't be ubiquitous because people should put more value on quality and less on convenience. Ultimately, it is this laziness which lets slipshod products (in any market, not just browsers) ride the tide of marketshare.
This is both under Windows, but it shouldn't matter. The important part is new Packages.sun.plugin.javascript.navig5.JSObject(1,1 ) which, obviously, shouldn't crash the browser. I think this is really a problem with the Java plugin, but I can't guarentee that. (So this may really be a plugin problem, not a Mozilla problem. Or it may be a Mozilla problem with the Javascript/plugin interface. I don't really know.)
You are in a maze of twisty little relative jumps, all alike.