Slashdot Mirror
IE Vulnerabilities Page Removed
Henry V .009 writes "PivX Solutions has removed its (in)famous Unpatched IE Vulnerabilities page. Is Microsoft really getting better? From the site: 'Given Microsoft's recent positive actions together with the current rise in attacks against IE we have agreed to give Microsoft a good faith reprieve and have taken down our 'Unpatched' page. This was done in both a spirit of cooperation and for the good of the internet as a whole. As the ubiquitous browser that is utilized to access the internet, we all depend on IE too much to have crooks, social deviants, malcontents and crackers from messing with our lifestyles and our livelihoods. ENOUGH IS ENOUGH!'"
Google cache
As the ubiquitous browser that is utilized to access the internet, we all depend on IE too much...
Who, exactly, is we? And have this "we" ever heard of any alternate browsers such as Mozilla and the like? For those in the loop, it's just nice to know there is some light in the darkness of the internet browser.
What's in a sig?
Any time one piece of software from one company can be responsible for such negative impact on our lives because of how poorly it was designed, while still remaining far and away the dominant product in its category in spite of superior software being readily available, that's a sign that the ill effects of monopoly power are at play.
Read the EFF's Fair Use FAQ
What were the reasons against a monopoly that my economics teacher tested me on again?
"1984" was ment to be a warning, not a guidebook. You hear that Kim Jong-il!? BushCo?!
We all should give pivx a huge hand!
First, they applied the pressure to help force microsoft into fixing the software.
Second, they are now giving microsoft some slack (negative reinforcement?) for trying to fix its browser.
Bravo guys!
Plus, these guys are hiring!
How fortunate this is for the internet community! Imagine if IE were open source like this Mozilla thing! Keeping every working detail and possible vulnerability all very hush-hush is what makes IE the great browser that it is! How does Mozilla survive? I mean, come on... Bugzilla? They should follow these guys example and shut down.
For the good of the internet as a whole!
It's not really valid HTML though. I assume that IE looks in comments and parses stuff inside them ([If IE]...[endif]).
Yes, I cheated so I could pass W3C validation. They're called conditional comments. If I wasn't using conditional comments, the code would not validate, but IE would still crash, and other browsers would not crash (although they would show a form field, defaulting to type="text").
$x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
$x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;
Why aren't other pages keeping track of unpatched vulnerabilities in other software? Well, have you ever tried to match up the CVE database with patches? It's difficult. I don't know anyone who can answer how many unpatched vulnerabilities are present in W2K, XP, and the like. Has to be boatloads.
Vulnerability disclsoure doesn't create pressure on MS, however. Malicious code creates pressure. Consider the MSIE vulnerability that led to QHosts. That one was old -- in August MS said that the patch they produced should have correct the Object Type vulnerability, but didn't. Yet the patch wasn't corrected until October, and that was only after QHosts exploited it. The exploit, however, raised MS's concern so much that they issued the patch on a Saturday instead of their regular Wednesday schedule....wow, the vulnerability is known for two months, then suddenly a patch appears AFTER the exploit is released.
What are the lessons?
(1) Apparently ALL MS software has unpatched vulnerabilities
(2) Apparently vulnerabilities are not priorities for MS unless exploits become newsworthy, (3) Trusting on MS patches to correct vulnerabilities is a recipe for disaster.
A short history of vulnerabilities reported by PivX:
- June 18, 2002: 18 vulnerabilities
- August 8, 2002: 22 vulnerabilities
- September 9, 2002: 19 vulnerabilities
- November 19, 2002: 32 vulnerabilities
- December 9, 2002: 19 vulnerabilities. (Microsoft fixed 15 on Nov. 20, but two new ones were found.)
(From my article: Windows XP Shows the Direction Microsoft is Going.I sincerely hope that if Microsoft doesn't fix each and every valid vulnerability that was listed on that page, within six months, that the page gets restored.
It has been proven time and again and again and again that vendors, especially monopoly vendors, will not fix their systems in a timely manner unless they're pressured to. And by "timely manner", I mean within four weeks.
The last five or six MS security bulletins I've seen had lapses of between SIX AND NINE MONTHS between the reporting of the problem and the release of the patch.
So two things:
1) If Microsoft doesn't fix all the currently-known vulnerabilities within six months, somebody should take it upon themselves to start tracking them again
2) If Microsoft can't get their act together and release patches for new vulnerabilities in a timely manner (instead opting to waffle for six months while real people's systems are getting exploited because MS is _never_ the only entity to know a vulnerability, and it's almost guaranteed that somebody with nefarious intentions does), then somebody should take it upon themselves to start disseminating as much information as is required for *real* preventative measures to be put in place
I'm all for giving them one more chance, but I'm not willing to sacrifice my clients' systems by changing my standards for this "chance". They either do what they should do, or they have to deal with me telling my clients exactly what they need to do to protect themselves from a given vulnerability - and that information would almost certainly be enough for a black-hat to use if it ever got leaked.
If you think my standards are too high, consider that other vendors whose software is used on systems which literally control life-or-death systems often release fixes within hours and days, not weeks and months.
Barclay family motto:
Aut agere aut mori.
(Either action or death.)
Unless you're a geek, you don't know about Mozilla. You might know about Netscape and think 4.1 was about the end of the line. You may even have tried one of Netscape's releases of Mozilla and thought it sucked (which, let's face it, it does). Most users of IE think that installing a different browser on their computer will break IE. They fear losing their bookmarks and their history. All that's really needed is a good public education program. Most of which can be achieved by each of us sending our non-geek friends to www.mozilla.org.
How we know is more important than what we know.
Am I the only one who read "IE Vulnerabilities Removed"? I knew it was to good to be true...
That's funny, but jokes aside,
I believe this is what Microsoft should be doing, id est removing the vulnerabilities themselves, not merely the discussion about them. Those greedy bastards have so much cash that patching IE should take them less than 6 weeks. So I am asking: why aren't they doing that? Is there any Microsoft employee reading this who could answer my question? I surely hope so.
Sincerely,
Pan Tarhei Hosé, PhD.
"Homo sum et cogito ergo odi profanum vulgus et libido."
Huh, I don't know. It crashed it when I clicked straight through this time. Maybe different versions of Moz? I am running Mozilla 1.4 on both a WinXP and Linux, and it crashes on both.
Its not what it is, its something else.
"So why was that left out? Reading the summary I just thought that these people were being nice guys to Microsoft, and not that Microsoft actually addressed and fixed many issues with IE.
One sided journalism?"
Ah, new to Slashdot?
This is exactly the reason that so many 'Microsoft Apologists', as they're affectionately called here, argue with popular opinion. Simply put, you really have to RTFA with stories about MS because they ALWAYS have the worst possible spin here. As a result, people come out and say "Microsoft isn't really assymilating the world here..." and nobody else wants to believe that so they are ridiculed.
It'd be nice if Slashdot's MS reporting was a little more balanced. The way it is now, seriously, it's like watching Jerry Springer sometimes.
"Derp de derp."
The patch "renders several IE vulns obselete". Most software vendors release patches for their software, and it's nice to see Microsoft continue to do so. That's not really news, though. The news is that the service that tells us what vulnerabilities remain has gone.
That releasing a patch removes the need to know about the outstanding vulnerabilities is simply nonsense.
Which IE vulnerabilities are rendered obselete by the patch? Which remain? "Several" is not "all". It's quite likely not even "most". Which ones are still there? Well, suddenly pivx aren't going to tell us.
It's dark. You are likely to be eaten by a grue.
Charles Miller
The more I learn about the Internet, the more amazed I am that it works at all.
I did too, and it crashed. (Mozilla 1.4, Linux).
Don't drop the soap, Tommy!
-- Will program for bandwidth
I will run my own "IE Unpatched" list.
Hopefully it'll be up in a few days. No URL yet. This knowledge must be available to people.
It's a long and twisted story.
Netscape wanted to 0wn the net and they riled up Microsoft and now Microsoft sorta 0wns it instead.
I'm not sure either would have been a good thing, but I know there wasn't anybody involved who was a nice guy.
A Good Intro to NetBS
to have crooks, social deviants, malcontents and crackers from messing with our lifestyles and our livelihoods.
Now that's gotta be the most fitting description of Microsoft that i've ever heard!
"See, Bobs, it's not that I'm lazy, it's that I just don't care."
/., check for updates for Trillian or some other software I might use, or update a driver. Yes, I'm a boring user. But I really don't have time for much else, and since I don't think my bank nor any of those other sites I visit have an interest in doing malicious things to me... I just don't care, plain and simple.
I am a web designer, and I am fully aware of the problems with IE - security and otherwise. But personally, I really don't care about its vulnerabilities. My job is to make my web pages look correct in maybe this version and a few versions back of IE, but that's really it.
Ok. So you can take over my computer with a web page. Well, I'm not going to YOUR web page.
My email filters out spam. Not going. I don't look for warez, don't check out pr0n, don't download any hip new software.
I DO go to my bank's web site and look at my balance, read
I know it's not a safe way to live, and I think that if my computer were destroyed right now I'd shrug and say "meh." And then build another one.
Maybe others feel the same?
"They said I probly shouldn't fly with just one eye," "I am Bender. Please insert girder."
From the site:
Try Mozilla or Konqueror instead--two fine free software web browsers (and there are many others). Then consider switching to a free software operating system so you don't bump into holes in other applications and have to wait for the proprietor to fix them for you. If you want to inspect, copy, distribute, or modify free software programs you can do so (or get someone else to do so for you). Freedom is really worthwhile.
Digital Citizen
Was that supposed to crash Mozilla? Id didn't do squat with MozillaFirebird 0.6.1. Maybe that only worked on some old 0.x version of Mozilla?
If Tyranny and Oppression come to this land,
it will be in the guise of fighting a foreign enemy. -James Madison
That's quite disingeneous.
It shouldn't be ubiquitous because people should put more value on quality and less on convenience. Ultimately, it is this laziness which lets slipshod products (in any market, not just browsers) ride the tide of marketshare.
This is both under Windows, but it shouldn't matter. The important part is new Packages.sun.plugin.javascript.navig5.JSObject(1,1 ) which, obviously, shouldn't crash the browser. I think this is really a problem with the Java plugin, but I can't guarentee that. (So this may really be a plugin problem, not a Mozilla problem. Or it may be a Mozilla problem with the Javascript/plugin interface. I don't really know.)
You are in a maze of twisty little relative jumps, all alike.
As Schneier predicted, for Microsoft, the threat is bad publicity, and they are going to produce a security system that deals with the threat. Without some kind of disclosure, sysadmins cannot take stop gap measures to secure their systems. This is just another instance of rather than working on securing its products to a level needed for the Internet, the issue is being handled as a PR problem.
Time to upgrade if you haven't already.
Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.