FireFox as a Security Risk Compared to IE?

A not-so anonymous Anonymous Coward asks: "The administrator at my work gave me the following reason for not using Mozilla. What do you think? 'FireFox is a security risk. Please refrain from using it. Please continue to use IE 6.0. IE is our only supported browser. FireFox saves encrypted pages to disk and does not give you override capability. It also does not allow automatic cache clearing when closing a browser. These are security risks.'" Do any of you have information that could be used to contradict the administrators information on FireFox? Are there configuration options one can reach from about:config that a user can use to address the problem this administrator has cited?

Comments

Re:What is this, ask mozilla?

[over_exposed]

Or better yet, when you find out a good, definitive answer (that could potentially help those of us in the same boat to convince our higher-ups), do a nice write up of all of the info you collected and THEN submit it to slashdot.

Simple.

[mewyn]

Turn off caching. In the configuration, privacy, cache set that to 0, and caching is now disabled. Now, why anyone would claim that Mozilla/Firefox is less secure IE because of their own idocy should be shot.

Re:Simple.

[lhaeh]

Thats kinda like chopping off a finger to cure a hang nail. It will cure the problem, but isn't exactily good for the patient. Complete overkill.

A good way for the company to hike-up their bandwidth bill, and make things slower for users.

Re:Simple.

[randomblast]

It would be better for a site like that to use a caching proxy anyway. It puts all the effort on the server, and off the desktops, and you have no problem keeping track of what the desktops have stored on them, so if a desktop machine gets stolen, no sensitive info is on it. This has to be applied to other areas of their computing system as well, of course, but it probably already is, because it's really stupid to cache database results.
So, if you use a caching proxy instead of client-side caching, you save bandwidth, you save space, you keep it fast for the users, and you don't have to worry about caching SSL pages on your user's machines.

Re:Simple.

[yuri benjamin]

A good way for the company to hike-up their bandwidth bill, and make things slower for users.

Not if they have a proxy server between the internal LAN and the outside.

Re:Simple.

[Anonymous Coward]

"The administrator at my work gave me the following reason for not using Mozilla."

Someone's not going to be an anonymous coward for long...

"FireFox is a security risk. Please refrain from using it"

LOL. Very good.

"IE is our only supported browser"

Please don't make me change anything. I might have to test it.

"FireFox saves encrypted pages to disk and does not give you override capability. It also does not allow automatic cache clearing when closing a browser. These are security risks.'"

OMG, people write this stuff?

Internet Explorer runs programs if you put them in an XML stylesheet, it runs programs supplied in bitmap images, allows websites to save scripts to disk and run them from the "trusted" zone, and allows any website to run activeX programs with full access to your computer if you ever click OK to a dialog box. These are security risks.

Re:Simple.

[Tuxinatorium]

The university of Illinois uses the exact setup you described. It makes some things faster but they have other problems which make the network ridiculously unreliable.

Re:Simple.

[elmegil]

A good way for the company to hike-up their bandwidth bill, and make things slower for users.

Any enterprise of any significant size would likely have their own caching proxies. Why is that going to hurt their bandwidth?

Re:Simple.

[Anonymous Coward]

I think most of this risks was fixed. You can also turn off ActiveX.

It could be serious, or...

[Anonymous Coward]

Maybe it's a joke.

Adminstrator is full of it

[abartlett_219]

browser.cache.disk_cache_ssl? Q.19 here

by default, ssl cache is disabled on firefox.

Re:Adminstrator is full of it

[memodude]

Also, you can make it essentially clear the cache on each browser exit by setting browser.cache.memory.enable to true and browser.cache.disk.enable to false.

Re:Adminstrator is full of it

[andreMA]

Sounds like the biggest security risk here is the administrator...

Install it anyway

[Gothmolly]

Just install it anyway. There's no way that they can tell you're using it, unless they're looking over your shoulder. Any admin who would say this, wouldn't know to transparently proxy HTTP traffic and inspect the logs, or have 'remote asset tracking' spy^H^Hoftware on your system worth a damn.

Re:Install it anyway

[green pizza]

Just install it anyway. There's no way that they can tell you're using it, unless they're looking over your shoulder.
That kind of attitude will get you fired. Management is edgy these days and support/admin money is tight. There just isn't room for someone who doesn't want to go along with the flow. It's not 1998 anymore. The Aeron chairs and the foosball table have been auctioned off and there are many other people just waiting to take your job. Seriously. I've seen several people canned in 2004 by doing things "their own way" despite being told not to.

Re:Install it anyway

[Parsec]

If they use a system like M$'s Systems Management Server, they can create an automated query for Firefox binaries that will inform them of who has it installed. The data is collected with the default inventory schedule of the individual machine's SMS agent.

I think there would be a Control Panel called "Advertised Packages" on your machine if this was in use. There is another, but I'm not certain what it's called; it would show you information on the SMS server and the schedule it uses to check in.

Re:Install it anyway

[gnarlin]

Use a usb key and keep firefox on that. That way you don't have to install in on the machine ;-)

Re:Install it anyway

[legirons]

"That kind of attitude will get you fired. Management is edgy these days and support/admin money is tight. There just isn't room for someone who doesn't want to go along with the flow. It's not 1998 anymore. The Aeron chairs and the foosball table have been auctioned off and there are many other people just waiting to take your job."

+3 Insightful?

-1 Fucking scary that people even think like this anymore. Get away, dogbert! We (normal people, non-telecom companies) don't fire people for installing essential software.

Re:Install it anyway

[dougmc]

We (normal people, non-telecom companies) don't fire people for installing essential software.

Sorry, but Firefox does not qualify as essential software. IE, as provided by the IT department, provides approximately the same functionality. Perhaps Firefox is more secure, but since everybody else there runs IE, what difference does it make?

As for why they don't allow Firefox, it's probably that they don't want to support it. With XP, IE, Outlook and Office on everybody's desktop, with some relatively simple tools, they can update everybody at once. So in theory, they should be able to keep up on patches and such, and keep it as secure as possible (as MS software ever is, anyways.)

When people start installing their own software, then that either adds more things for IT to support, or adds things that IT does not update. If it's the latter, then it's possible that a hole will appear in Firefox that does not exist in IE, and the company could be compromised that way. (Yes, if the hole appears in IE, the company is compromised that way. But they like to limit the number of vulnerabilities.)

I'm not saying this attitude is correct, but it's pretty pervasive. When IT tells you to not do something, and you do it anyways, that's the sort of thing that can get you fired at many places, or at least make them think again about your name when making lists of people to sack for the newest round of layoffs ...

(For the record, I work in a land of Microsoft software, but I do run Linux (and the assorted applications that go with it) on my boxes at work. And I even have permission to do so -- but it certainly wasn't easy to get. But at least I know I won't get fired for it. (Ultimately, I was told to stop, and so I pushed for official permission rather than stop.))

Re:Install it anyway

[pyite]

It so happens that the pendulum has swung to the "conservative" management ideology. My office is Sun Ray and Windows 2000 based. Previously I only had a Sun Ray and was given a PC to run some Java software better. There was talk of removing UNIX workstations all together, to which I told my boss that my productivity would be halved at best. He thought that was a fair assessment and now we can use whichever is better for a given task. I'd say one of the most difficult IT jobs is to be an administrator of an office full of "administrators." Granted, we're all networking people, but a lot of us are hardcore UNIX guys and have always been. I sometimes feel bad for our admins and what they have to put up with from us. Usually they understand that it's best to help us do what we want.

Re:Install it anyway

[Anonymous Coward]

Don't install it.
Download the .zip, then run it from a folder containing the extracted files.

Re:Install it anyway

[Parsec]

I just saw this today... a version of Firefox optimised for a USB key.

Re:Install it anyway

[tonythor]

I agree with you in that if you mess with IT, you should get canned. And, I appreciate that you took the time to post your opinion. I do value it and I mostly agree with you.

On the other hand, there is so many lazy people out there just writing for IE these days that they're just left the standards that allowed the internet to grow in the first place.

In my industry, over 85% of my clients are NOT on IE, they're on MAC using Safari. All of those guys continually gripe that they can't see websites.

The truth is, much of corporate america is native IE, but some of the government is anti-IE, and I assure everybody that a huge portion of the entertainment industry is just flat anti PC. [IE on the mac doesn't count, it's a big fat boat anchor.]

In a nutshell, there are other things out there other than the standard windows ghosted win2k ghosted corporate installation that we've all had in our lives. Denial is a river in Egypt I say.

Just to prove my point a little more, on three occasions, I had outsourcing companies that were pretty microsoft driven contact me once asking me if they could do some work for our company. I checked their sites and none of them worked in anything but IE6. I told all three they should, instead of trying to get new busines, put available deveopers on their own sites.

If it doesn't work for everybody, in all browsers, it shouldn't be on the public internet.

tf

Spite him.

[Anonymous Coward]

Use MSIE and access as many problem pages as you can so that you end up with a system filled with viruses, spyware, adware, popups and everything else until the machine slows to a crawl and then let IT deal with it.

Re:Spite him.

[Anonymous Coward]

Hehe. I was just about to suggest this!

Re:Spite him.

[krymsin01]

That's a good way to get fired, seeing as how most of the problem pages will either A) be against the AUP (porn, etc) or B) Illegal (certain porn, warez, etc).

Re:Spite him.

[Anonymous Coward]

Or (more likely) C) typos of popular sites

Re:Spite him.

[Paul d'Aoust]

you've obviously never been to Neopets then. blasted evil website. Should be set to 127.0.0.1 on every Windows user's HOSTS file in the world. I have removed so much spyware as a result of my little brothers and sisters visiting that website...

Re:Spite him.

[rawg]

Why have internet access on your work computer at all if you can't even look at The Register, CNN.com, and other sites that could have exploits.

Just pressure from MS

[SpaceLifeForm]

The corps are under constant pressure to use MS software. The admin is just passing that on.

Re:Just pressure from MS

[Anonymous Coward]

The corps are under constant pressure to use MS software. The admin is just passing that on.

Flamebait? Hardly. Whomever moderated parent just can't stand the truth. But that's how it is these days, I've heard the same message at a shop that condones the use on non-IE browsers.

Re:Just pressure from MS

[sepluv]

There is a lot in this (especially with governments). I'm currently *trying* to persuade my uni have more free software on public machines starting with Firefox. I'll give some recent examples from my experience of this in relation to Firefox (as well as the obvious minor stuff like the government only producing documents in MSWord format or WWW sites that are in MSHTML so only work in MSIE):

1. In my old (state) college (where I've just left) the sysops told me (in person) that we were not allowed to use Firefox because and I quote, "Firebird [as it was] is a hacking [sic, should be cracking] tool like Kuzu [sic, should be Kazaa]". They also denied that it was a WWW browser and said that MSIE was the only WWW browser. They also said that they have a policy of only using Microsoft's software on the PCs.

2. A friend of mine uninstalled Firefox because his ISP told him that they did not support their users connecting to the WWW using Firefox. They also told him that just using MSIE (without uninstalling Firefox) instead would not work as Firefox also stops MSIE from connecting to the Internet when it is installed. (The same ISP also said that they only allow their users to check their email with Outlook Express and that my friend should not install any other mail client.)

I could go on...

Re:Just pressure from MS

[legirons]

"the obvious minor stuff like the government only producing documents in MSWord format or WWW sites that are in MSHTML so only work in MSIE"

It could be worse. Your government could demand that all tax returns be filed electronically, make it illegal to not file electronically, and then create a website for filing so that it can't be used on non-Internet Explorer browsers

Of course, no real government would ever be that retarded.

Re:Just pressure from MS

[sepluv]

No...this has to have been a late April Fool's joke...May?...Could just be...

It could be worse. Your government could demand...

As I'm as UK citizen and that article is about my government and I didn't know about it before you mentioned it, it know is worse, thank you very much ;-)

(When I said "the government" in grandparent I was talking about UK government obviously.)

Re:Just pressure from MS

[sepluv]

Can someone mod this poor guy up?

I'm not *necessarily* saying /. mods are all smoking something[*] but...I feel really guilty because my reply to his post basically repeating what he said and agreeing with him got modded +5 informative whereas his original post got modded Flamebait.

[*] which incidentally means that /.ers are all smoking something as nearly all if us are mods at some point.

Re:Just pressure from MS

[Anonymous Coward]

Holy God, at least tell us which college this was!

Re:Just pressure from MS

[sepluv]

Coleg Llandrillo Cymru, Wales, UK.

The story of my conversation with the BoFH that day is funnier and longer than that actually--I'm sure I wrote some of it down somewhere.

It was funny, not least, because the sysop who made those comments looks like an orangutan--loads of scraggily bright red hair, very large tum, scratches himself constantly, move's with an orangutan's gait.

Although, admittedly, the analogy does fall down when you consider the fact that he is missing one of the most important facets of the species--also they aren't evil and I can genuinely imagine him doing many of the most evil things in the BoFH series. Actually, according to Wikipedia's article:

Like the other great apes, Orangutans are remarkably intelligent. In the mid- 1990s, one population of , one population of Orangutans was found to use feeding tools regularly. Evidence of this had been earlier discovered among chimpanzees by Jane Goodall in the 1960s. A 2003 paper in the journal Science described the evidence for distinct Orangutan cultures...

and I cannot really describe this sysop as the sort who would be cultured (in any sense), have any sense of the rest of society (except maybe "kill...kill...") and defintely not the type to be able to use "feeding tools".

Re:Just pressure from MS

[sumdumass]

i have seen many ISPs do simular things. Recently had one claim they don't support SSH or VPN conections form an ADSL line that i payed to have a public ip adress. After going thru thier flunky tech suport staff i decided to ask for the supervisors while trying to explain that thier routers were blocking the ports and i paid to have them opened with the service they sold me.

After about 2 days of running around i finally called the saleman and he went onto a 3 way with the support personel and basicaly told them howto unblock the ports for my conection while the tech guys were telling us that it isn't verry secure.

They then said they didn't know how longm it would work or if it would even work because they don't support the VPN software. I conected to another system from acrossed the citty then tryed to conect to the one i was setting up and all was fine. THe tech support personel didn't understand how i could do that. Needless to say we are trying to get out of the contract now and are looking for another satilite dsl provider (and a 1500 dollar instalation fee refund). The conection is slow and lags quite a bit. we have already had to set up a caching proxy server so the other workstation could get inet access at a pace faster then dial up.

They even tryed to claim the slow conections was because of other software being installed and that some of the computers were windows 98 instead of windows xp. None of the workstations havew to run anysoftware other then standard networking stuff to get access to the DSL modem. I know what your saying first hand.

Re:Just pressure from MS

[Anonymous Coward]

I must say Portugal, my country, did an excellent job in that matter. The main interface was built in Java, it could be accessed on-line, and they also provided binaries for Windows, MacOSX, Linux, Solaris and a general Unix one. There was also a, much more simple, non-java on-line interface.

Re:Just pressure from MS

[sepluv]

BTW, I'm pretty sure he was not joking when he made the comments I quoted in the grandparent (and his colleagues were backing him up) though you can never be sure with these types.

If you need any more evidence of what idiots the sysops there (I could tell many a story...) look at their WWW site (linked to in parent, note lack of content, broken display, &c) which is designed by those same sysops.

Re:Just pressure from MS

[Anonymous Coward]

Your government could demand that all tax returns be filed electronically, make it illegal to not file electronically...

No they couldn't. This would fall foul of the Disability Discrimination Act and other discrimination laws, since there are people in the country who have to file tax returns but cannot use a computer.

Re:Just pressure from MS

[b17bmbr]

speaking of dumbshot admins, in my school district, i brought in my laptop running linux. admin comes into my room one day to do a tech inventory (since it was MY computer, i could do whatever the hell i wanted with it), and he can't understand how i can access the interent as "novell doesn't support linux". (this was 5 years ago.) he didn't understand tcp/ip. then, he couldn't see how i could access my novell shares (he didn't understand ipx). then, for my web design class, i had an old P200 i scrounged up from sitting in a closet collecting dust, threw debian on it, and ran httpd, ftpd, usual stuff ( so kids could view their work from anywhere on campus, etc.) and he goes apeshit that we'll be hacked and have security issues. i explained to him it was inside the firewall and had a private (172.27.X.X) ip address and was inaccessible from the outside. he didn't even grasp that. the list goes on.

for an ISP related story: a few years back, i get cable modem. so the install techs are in my house, and they needed the mac address of my NIC. so i know i'm gonna share the connection, and i got my router linux firewall/router/lan all set up, run ipconfig eth0 and he says, what is that? i say it's linux, and he says i can't run that as they only support windows clients. he won't even register the number. fianlly, i get him to register the mac address and viola, 10 minutes later, i got two computers sharing a connection. dude looks surprised. now of course they authenticate my cable modem number not mac address on nic, but hey, this was four years ago. anywyas, long story later, after spending 20 minutes talking to him, i burn him a cd with RH7.2 or .3 (can't remember). and these guys actaully get paid. damn!!

about:config is great

[Anonymous Coward]

In Mozilla my "browser.cache.disk_cache_ssl" was set to false by default, after checking Firefox, it's also set to false by default. So no it dosn't cache ssl pages, Unless you tell it too.

Also check "browser.cache.disk.enable" set it to false, and it won't write to disk cache at all, even more secure than IE, since no temporary files are written at all.

Next!

Call Bullshit

[TrebleJunkie]

I think I'm going to have to call bullshit on your admistrator.

In about:config, the property you want to look for is:

browser.cache.disk_cache_ssl

From This Page:

* Description: switch to enable caching of objects served over a secure connection (SSL).
* Type: boolean
* Default: false
* Recommendation: true on systems where it is secure to cache these objects.

By default, Firefox (and Mozilla. and Netscape.) will *NOT* cache SSL-served pages. And, contrary to your administrator's *other* claim, you most certainly *can* toggle this behaviour in Firefox.

Re:Call Bullshit

[2mcm]

Confimed. wow /stares in wonder at all the options avalible.

Re:Call Bullshit

[Anonymous Coward]

I'm going to go one further and call bullshit on the submitter.

The problem was non-existent, and a fix plain and simple in the config. This entire article is a made up troll to rile up the mozilla zealots.

Re:Call Bullshit

[kyhwana]

Hmm, after a quick look in about:config, I couldn't see anything that lets you clear disk cache on exit?

Re:Call Bullshit

[pyrros]

Since SSL pages aren't saved to disk by default, it's not much of an issue. Besides, if you don't need your cache to persist across sessions, you can probably get by with no disk cache, just memory.

Of course, that doesn't directly answer your question, but this is slashdot after all ;-)

Re:Call Bullshit

[cpeterso]

Someone pointed out that about:config lets you set browser.cache.memory.enable=TRUE (the default) and browser.cache.disk.enable=FALSE. This (apparently) disables Firefox's disk cache, so there is nothing cached to clear when you exit!

Re:Call Bullshit

[klui]

But I can still save an encrypted page to disk using Firefox's File>Save. I cannot using IE. I personally like Firefox's behavior because if I can see it, I should be able to save it. Not being able to save it is a good option for those who want that behavior. And auto-clearing cache/cookies would be a great option to also have within FF's options. Let's see how fast the Firefox coders implement these functionalties. I'd give it a week.

Re:Call Bullshit

[Anonymous Coward]

Not only that; it's already the second (at least the second; there may have been even more) Ask Slashdot concerning a non-existent Firefox problem.

Re:Call Bullshit

[GuyWithLag]

Bah. PrintScreen + OCR. Granted, it's more work, but then if you have hostile users you must keep them from pen and paper....

Re:Call Bullshit

[lewp]

It's a better idea to do this anyway, since I assume:

a) The cache can't be cleared if the browser exits abnormally (ie. the power goes out or the browser/system crashes)

b) The cache files probably aren't removed securely. It'd most likely be somewhat trivial to recover these files using any number of utilities.

If either of these assumptions are wrong about how either Firefox or IE manages their disk cache, I'd love to know :).

Re:Call Bullshit

[TrebleJunkie]

Of course you can -- why wouldn't you want to?

I can think of a number of commercial sites that would be rendered useless if you couldn't save a page/file that's been delivered via SSL.

Re:Call Bullshit

[gad_zuki!]

>This entire article is a made up troll to rile up the mozilla zealots.

Christ, just as I was getting my pitchfork and trying to light a torch. Oh well, maybe next time.

Re:Call Bullshit

[arkanes]

Call bullshit on this, too. IE will happily save SSL served pages, even with the "save SSL files to disk" option turned off. Explicitly saving is a totally different animal, from both a usability and a security standpoint, than cache saving anyway.

Re:Call Bullshit

[klui]

But in IE I can check "Do not save encrypted pages to disk" and enforce that through a group policy and prevent a "normal" user from changing it. I have tried this and IE will not save encrypted pages. It will save an almost empty .html file but it will not display the contents. So bullshit on your bullshit. :)

Depends on your admin

[green pizza]

I worked in an all-Windows shop for awhile. It wasn't too bad and the network and server admins were *very* tuned into the security notices from Microsoft. They would have every machine patched within one business day of the announcement. Maybe your company is the same way, and introducting non-Microsoft software may upset that cycle.

Re:Depends on your admin

[Anonymous Coward]

How does Firefox prevent them from patching Windows software?

Re:Depends on your admin

[green pizza]

How does Firefox prevent them from patching Windows software?
It doesn't. It's just an excuse for lazy MCSE admins who don't want to add an additional step to their daily advisory-reading / patch-installing cycle.

My point is this: in an established MS shop, it's often very hard to get the admins to approve usage of non-MS software. At my previous job we had many people using MS Publisher and that MS photo suite when InDesign and Photoshop would have been far better for their needs.

I'm not agreeing with the original poster's admin, I'm just saying that MS shops are often set in their ways.

Re:Depends on your admin

[Slime-dogg]

I hope that your admins test out the patches before they install them on production systems. I can't tell you how many times our Exchange server has been knocked out, due to a MS patch. Then, after about a day and a half without e-mail, a "hotfix" gets installed, which lets us have our mail again.

Re:Depends on your admin

[Anonymous Coward]

Do they have a picture of Bill on the wall that they bow down and give praise to at different times during the day?

Re:Depends on your admin

[reallocate]

>> ...MS shops are often set in their ways.

Not just MS admins. Every admin I've ever encountered has been as loathe to have his daily routine altered, regardless of whether the shop used MS or not.

Imagine the reaction if someone working in an all-Unix shop decides they want to run IE.

additional admin paycheck by msft?

[Anonymous Coward]

wow what a biased administrator you have.

tell him, he should get a job at microsoft instead. he fits nicely.

Just tell him

[Anonymous Coward]

Even Microsoft uses Firefox.

Even better

[Safety Cap]

You can configure FireFix to run from a keychain USB drive.

Add an autorun.inf to fire up firefox.exe (with command-line switches -- see the first link's discussion) automatically upon insert and you're good to go.

Re:Even better

[DietFluffy]

better: http://johnhaller.com/jh/mozilla/portable_firefox/

Re:Even better

[sepluv]

That is a version of Firefox optimised for use on portable drives (by reducing disk usage, reducing size on disk, making references to exntesions relative, &c).

Re:Even better

[westlake]

You can configure FireFix to run from a keychain USB drive

now all you need is an accessible USB port, something your boss may not be willing to give you...and a wife who thinks Firefox was worth your getting the chop a month before Christmas.

Any non-standard app is a security risk

[SoundGuy666]

While your admin may have issues with the default configuration for Firefox, there are genuine reasons for not deploying firefox to your network. Most security concious organisations have a very rigourous patching system for the authorised applications and operating systems. Any app which doesn't fit into that patching system (whether it be up2date, apt-get, SUS/WUS/SMS, yum or another flavour) presents a massive overhead to the IT team. Every time there is an update to Firefox, it needs to be repackaged and redeployed to every desktop in your organisation. And it's not just Firefox, but by setting a precedent of deploying MyRequestedAppX, they face pressure from all sides for AppY, AppZ, etc. Then the questions come - "you support Mr X's AppX with updates and patches - why not mine?".

Unless your organisation has the infrastructure to deal with non-baseline application patching, those apps WILL present a security risk while the IT team tries to find the resource to patch/update and deploy the latest version.

Re:Any non-standard app is a security risk

[Anonymous Coward]

Amen.

I happen to work in a f*cking big infrastructure and was absolutely astounded that I was not denied when I asked if I could install FireFox.
I'm user of the infrastructure, not a an admin, but I can imagine what a burden the administration of hudreds of thousands of workstations is.

I don't know what the point of this post was supposed to be. thank-your-admin-day went already :P

Anyway, Thanks, IM-ServiceDesk-Finland ;)

Re:Any non-standard app is a security risk

[Anonymous Coward]

Not to mention there's a number of ways that Firefox is not friendly to your standard managed Windows network -- no windows installer, can't be managed with group policies, doesn't play well with roaming profiles, auto-updater seems to be broken.

From an enduser standpoint, it's great, but due to the way it was built, it could be a major pain in the ass for IT types.

Re:Any non-standard app is a security risk

[Damhna]

Could not agree more.

Custom application standardisation across the install base means that issue resolution can be standardised and tweaked to meet the response/support requirement. The certification and testing processes that most serious companies use to pass apps as fitting are both rigourous and not condusive to incorporating the latest 'app du jour'. And rightly so.

It's easy for tech saavy folks to deem these practices as a symptom of the narrow mindedness of lazy MCSE admins (who would appear to be some sort of subspecies of a real admins). It's easy to see this as an organisation being inflexible due to undereducation but I believe that that is not the case. A pestered admin will often give the sort of pseudo answer this user recieved.It's not good to fudge that way , but without taking a user step by step through the security policies and application certification documetnation, it's difficult to explain the why of decisions such as this.

It can be difficult to meet the job function requirements of diverse departments and maintain the steady balancing act that will ensure your SourceSafe users will be as compliant as the receptionist.

For this organisation it may be useful to do a business case analysis exploring the usefulness or otherwise of Firefox but as it is still in it's first iteration a lot of companies will be loathe to abandon the practices they have in place on a whim.

Aa firefox moves ever closer to a dominant position the pressure will become greater and things will change. It will also become more a target and I'm betting that this will begin getting longer and looking far more serious as more and more authors start realising the potential success to be had in taking Firefox on.

Re:Any non-standard app is a security risk

[some_other_nerd]

I think it's great from an admin and user standpoint. All security patches are handled by debian-security and all I have to do is an apt-get upgrade on the master computer and then promulgate the changes to the workstations.

Re:Any non-standard app is a security risk

[Anonymous Coward]

The lack of standard packaging on the Win side is the easiest problem. You still can't push a button and change everyone's home page (which is the kind of thing you can do with stuff that uses the registry for settings.)

Re:Any non-standard app is a security risk

[Carrot007]

IT, keeping up to date?, Patching?

Hmm well coming from speaking from one very large company in the UK it seems that would be the exception rather than the norm.

Here we use NT 4 SP5 (maybe 5a, certainly not 6) and ie 5.5 and well hey most of the machines here are spyware infested and getting it to sort it out is so complicated thank to having to ring an offsite call centre who ring someone back on site to come out to have a look (don't you love modern it policy) who will generally just boot from the notwork to re-install from the disk image.

My machine is find because i know to say no to eveything and keep away from dodgy sites anyway.

Thankfully they generally stop us having any right son the machine that might enable us to fix things or change resolution or pretty much anything.

gotta love it.

It never was "1998"

[Gothmolly]

For people at any sane shop. I have local Admin rights on my laptop, as I need to install s/w. As a result, I have disabled much of the IT spyware that your profile loads. The result? When AD blows up, or Novell NDS-AD bridge goes down, I can still get on locally. The fact that you speak so readily of needing to "go with the flow" and wistfully of the "Aeron chairs" and "foosball" table tell me that your experience was markedly different, perhaps due to our differing skillsets and attitudes. Sorry for your loss.

Re:It never was "1998"

[BigGerman]

Sigh..

Speaking of "sane", I am currently contractin at big big big defense contractor. Desktops are so heavily "managed", 2GHz P4 machine is nearly useless as McAfee runs all the time. We are not local admins and to install something I need to find one of only two people who are.

Overall, I estimated I lose 80% of productivity this way. For a large group of contractors, the amount of money they are wasting is astronomical.

funny your admin should say that...

[blackcoot]

... because i've switched all the machines i'm responsible for to using firefox precisely because it's n-times harder to get malware. not impossible mind, but a lot harder by default. perhaps inducing some blunt trauma with a clue-by-four might help...

All Crap...

[Shadow_139]

The group policy (Worldwide) is to have *ONLY* Windows 2003 Servers.
Just was doing a scan on the German network, and the main online reporting server/portal is running Linux ....
Hehe.., either that or one of the clear german IT got MySQL and VSftpD http://vsftpd.beasts.org/ on Windows 2003.., and hacked the TCP fingerprint to show up as Linux 2.4


The Admin is just studit and does not have a clue of that Firefox really is.
You should, (which the Admin-Troll is off getting a coffee, install Firefox on his PC and delete the IE icon from desktop and startbar, and rename the Firefox one to "Internet Explorer" and change the icon to the stupid "E".
He probally will not even notice.....
P.S. His password is either "null" or print on a post-it on his monitor......

"Clutch my testes, bloody squirrel humpers!!" -Happy Noodle Boy

Re:MOD PARENT UP

[Anonymous Coward]

Get your own mod points!?

The mod system is supposed to be METAinformation. People yelling at moderators does not help anything.

When you have mod points, use 'em. When you don't, SHUT UP.

Thank you.

(This message brought to you by a person suffering severe coffee withdrawal.)

Firefox does not save encrypted pages to disk

[Anonymous Coward]

FireFox saves encrypted pages to disk and does not give you override capability.

That is a complete fucking lie. Unlike the security train wreck that is Internet Explorer, Firefox (and Mozilla and Netscape and ever other browser designed by people with a semblance of knowledge about security) does not save encrypted pages to the disk cache by default. Internet Explorer does (can be disabled by unchecking the 'Do not save encrypted pages to disk' box on the Advanced tab of the Internet Options dialogue).

It's set to NOT cache ssl pages by default.

[kyhwana]

set browser.disk_cache_ssl to false.
it's set to false by default, btw. :)

Re:It's set to NOT cache ssl pages by default.

[taxexile]

It's browser.cache.disk_cache_ssl And you're right. It is definately set to false by default

Also in recent news...

[comwiz56]

Also in recent news: jumping into a pit of lava is safer than swimming in your friends swimming pool.

Re:Also in recent news...

[BarryJacobsen]

Also in recent news: jumping into a pit of lava is safer than swimming in your friends swimming pool.

So you're friends with Syphilis Larry, too?

Re:Also in recent news...

[Stevyn]

Well, yeah! Have you ever heard of someone drowning in lava? I don't think so, pal.

Re:MOD PARENT UP

[empaler]

(This message brought to you by a person suffering severe coffee withdrawal.) ... who should be modded up ;p

I'm getting very tired of shouting idiots. There should be a free moderation when you're eligible: -1 STFU...

Funny!

[MeatBlast]

Your Admin either A) Works for Microsoft or B) Has mental problems.

Re:Funny!

[Anonymous Coward]

Those are not mutually exclusive. At all.

Re:Funny!

[jc42]

or 3) Is on the take.

Somehow, this possibility rarely gets mentioned in /. discussions. But in the Real World (TM), it's an ever-present possibility that explains a lot of otherwise inexplicable behavior on the part of management. (And I've noticed that The Market ideologists rarely if ever take this into consideration, perhaps because it throws a huge monkey wrench into their theories. ;-)

And, of course, 1), 2) and 3) can all be true for the same admin.

Anyone got a good 4) to contribute to the list?

Re:Funny!

[MeatBlast]

4) Was abused by a boy named Mozzila when he was a young boy

that's not what he said

[jeif1k]

But the admin didn't say "please use IE because we have defined patch and update mechanisms in place and we don't have the resources to do that for FF as well", the admin said "please use IE because FF is a security hole because [a bunch of bogus reasons]".

Re:that's not what he said

[francium de neobie]

I think that idiotic admin is irrelevent here. I think the problem that the parent mentioned is real, and it ought to be solved.

Re:that's not what he said

[jeif1k]

I think that idiotic admin is irrelevent here. I think the problem that the parent mentioned is real, and it ought to be solved.

What's there to be solved? Firefox has a built-in update mechanism, you can get third party automatic package updates for Windows, and you can install Linux, which provides you with fully automatic updates. What more do you want?

Re:that's not what he said

[francium de neobie]

Firefox's automatic update is good for the individual. But for IT departments, they'd want to test the patches before releasing them and they'd want to centralize the patching process. I think it's well known what happens if we let the non-computer savvy users choose whether to update or not themselves, or forcing them to take on untested patches ;^) (even the Linux kernel had problematic updates, remember 2.4.11?). So depending on Firefox's automatic update would likely make a mess sooner or later.

I don't know what you mean by "third party automatic package updates for Windows", but the third option is obviously nonsense. Converting to Linux is not a trivial undertaking for a company.

Re:that's not what he said

[mrscott]

In my experience, I've heard admins spout bogus reasoning in response to a user that just isn't listening to what they say. Eventually, SOMETHING gets across to said user, and it hopefully has the desired effect.

Re:that's not what he said

[francium de neobie]

wow, never guessed I'd loss my karma bonus like that. The mods have voted, I'd better shut up :o

Re:that's not what he said

[T-Ranger]

Depending on how you in interperet a "third party tool", ZENWorks, amongst others would qualify. If they poster means some kinda meta-IT department that produces network-deployable packages, then I dont know. I doubt it.

Re:that's not what he said

[Anonymous Brave Guy]

Firefox's automatic update is good for the individual. But for IT departments, they'd want to test the patches before releasing them and they'd want to centralize the patching process. I think it's well known what happens if we let the non-computer savvy users choose whether to update or not themselves, or forcing them to take on untested patches ;^)

Yeah, that's a really great plan, and never has problems if you stick to sysadmin-friendly Microsoft kit. ;-)

Did you ever get the feeling that the linked story there is going to get cited every time everyone ever claims Microsoft's stuff is more secure because of automatic updates, and every time the UK government ever says a centralised ID database for everything is a really good idea?

Re:that's not what he said

[A Naughty Moose]

I don't know what you mean by "third party automatic package updates for Windows"

ZENWorks, is a third party option. And if your running a Novell network, it is practically mandatory. Sure it costs a lot (last time I looked, it was $70/seat), but if you have a VLA it becomes practically free. Anyway, whatever the cost, with the proper deployment it will save at least an FTE, and free up the guys admining the network to do something else in there free time. Why can it free up so much time? Simple there is:

• Automatic application deployment. Can be assigned to users, workstations or users in a context, or workstations in a context. If the fix is something simple like a registry change, or a new dll, then a force run object can be created to push the change. Otherwise, the application, or an update can be installed by the user.
  
• How many times have you had to deal with a problem that the only solution was to re-install? (Someone deleted all the Word templates on there machine, for example). With NAL, the user can right-click the application and choose "Verify", thus forcing the application to be re-installed.
  
• Group policys: You can create and enforce group policies within ConsoleOne easier then you can with Microsoft's domain tools, and just as easy as with their Active Directory tools.
  
• Users no longer need administrative rights to their computer. Got an application that needs admin rights to install? No problem, as the NAL runs as a service, the install will work. Need the application to run as an supervisor? Not a problem, the NAL runs as a service and can launch the application with supervisory rights if need be.
  
• Easy printer management: Department got a new printer? Not a problem, push out the printer drivers through ZEN. Again, you can associate printers to users, workstations (indiviuals, or groups or contexts) so that you can always have your finance people print to the printer in accounting (for instance), no matter what computer they log into.
  
• Computer imaging services. Have a machine that needs to be backed up periodically? (Might be a computer that has an app that no one has the install disks for anymore, for instance?) Not a problem. Set up the imaging service to make a backup of the machine once a month (or whenever), restore is just a simple checkmark in ConsoleOne.
  

There are a few more features, but those are the ones I use the most. ZEN, along with salvage(aka: undelete on Network shares), and the ACL's on the Directory and filesystems make managing Windows networks tolerable, almost enjoyable.

Nobody's Mentioned This So I am...

[DiscoOnTheSide]

There's a wonderful little extension for Firefox called "Configuration Mania" and it works with 1.0. It has the ability to choose the option for the SSL disk cache mode as well as clear the disk cache every time you close the program, as well as other nifty little things. Give it a whirl.

Re:Nobody's Mentioned This So I am...

[Saiyine]

What about giving an url?

Re:Nobody's Mentioned This So I am...

[Cryptnotic]

What about giving an url?

Maybe because everyone knows about Google.

Dear slashdot...

[pyrros]

Dear slashdot, a friend of mine claims that his dad can beat my dad. Do any of you have information that could be used to contradict my friend's information on my dad, as I can't be bothered to check? Are there any options one can pursue (anabolics, boxing classed etc), that a kid can use to address the problem this friend has cited?

Re:Dear slashdot...

[metalix]

I know you like my dad way more than his dad, and his dad works for a corporation and therefore cannot be superior. Please ignore how often my dad has a nervous breakdown.

...Uh-huh... Dumb.

[Refrozen]

Wow. That guy is dumb. Set cache maximal size to 0 and you no longer save pages to disk. FireFox is far more secure then IE, it doesn't support ActiveSecurityhole, and isn't used by 90% of the population (who targets a browser that 10% use?)

Re:...Uh-huh... Dumb.

[seanellis]

... and isn't used by 90% of the population

Yet.

Your admin is an MCSE, isn't he?

[dacarr]

If he's less concerned about viruses, spyware, trojans, and in fact any malware, and more concerned about an encrypted cache document not being deleted (again, a bogus concern), he needs to be disposed of by way of being fired. But that's just my opinion.

Re:Your admin is an MCSE, isn't he?

[An Onerous Coward]

That depends on what sort of secure pages the people in the organization are accessing.

There is a slim-but-not-zero chance that the organization is using an internal website with SSL to distribute something they consider confidential.

If this is true, and if the admin's claims about caching were true (apparently they're not), then the admin might have identified a valid security concern. But it sounds like he just doesn't want to deal with alternate browsers, and used something he remembered reading somewhere in the hopes of defusing those who want them.

Tell him about ActiveX

[Gary Destruction]

Tell him that ActiveX controls have no restrictions on their actions and that controls marked "Safe for Scripting are by far some of the most dangerous security risks associated with that technology. Also be sure to let him know that ActiveX doesn't necessarily require user intervention to run. It can work without a user's knowledge or permission.

The Bullshit ...

[tqft]

is that the sysadmins security bots cannot read the cache and see what people have been up to (though he should be able to see the server logs).

Besides what you have written Kiosk mode should fix everything.

FirefoxIE

[file cabinet]

http://www.firefoxie.net/

Re:FirefoxIE

[carrowood]

Oh my God! Now I've seen everything!

Re:FirefoxIE

[Anonymous Coward]

omg 8 steps to install.... lol

Re:FirefoxIE

[Geoffreyerffoeg]

No.

You'll risk your job trying something sneaky like that.

Simply configue Firefox to address his security complaints and bring up the issue again.

Problem patching open source software?

[francium de neobie]

As someone else here mentioned, allowing the installation of Firefox would disrupt the usual patching routines, since the admins want to minimize the number of things to be watched over (i.e. if I let you install Firefox, then besides Microsoft's updates, I have to watch for Mozilla.org's updates too.) I can imagine the admins are already in deep shit with the Microsoftian legion of security flaws, but (un)luckily Microsoft has provided a rather automatic means of unattended update for IT administrators to save the day. Thus, adding Firefox into the equation just doesn't help. Especially when considering that there's no well known mass updating mechanism for Firefox and open source softwares in general. Sure you can write a program to look for the updates, changelogs, and related bugtraqs for you, but you can't expect an MCSE to write a proper program can you? ;^)

With this in mind, I wonder if open source softwares, despite superior quality to M$'s offerings, are friendly to IT departments? This question is significant since if we can't make our softwares friendly to companies then the average users aren't likely to use them as well. If the answer is negative, how can we tackle this problem?

Re:Problem patching open source software?

[Trepalium]

The patching issue would've been a valid excuse, or the generic "we do not have the resources to support that application on our network" would've been valid as well. BS answers filled with garbage excuses like above can make an admin look bad if the user is smart enough to find the way to prove them wrong. For most admins, this doesn't happen, but it's still no excuse for this behaviour.

Re:Problem patching open source software?

[deaddrunk]

It's quite easy to write a script to do that for you on Windows. You can even use Perl if you like.

Re:Problem patching open source software?

[mgkimsal2]

since the admins want to minimize the number of things to be watched over (i.e. if I let you install Firefox, then besides Microsoft's updates, I have to watch for Mozilla.org's updates too.)

This sort of makes sense if *all* you ever run is MS Office, MS Small Biz Server, IIS, etc. But if your org needs to run other things (Raiser's Edge, QuickBooks, Adobe products, etc.)

It used to be people chose to run Windows vs. Linux or Mac because 'Windows has all the software'. But it seems now more IT depts are using security as an excuse to not run/install anything *but* MS software, excluding a gigantic range of other software options (ostensibly much of the reason for using Windows in the first place!)

gotcha

[Anonymous Coward]

yeah i cant have it save my passwords without having the -functionality- (functionality my ass) to display them (in plain text on the screen!) to any wanderer that comes along and checks my computer while i piss

yeah i could set a master password and enter it everytime i want to access a site that uses passwords or i could not have it save passwords.

but i like the feature that keeps me from typing my password for every goddamn site that needs one (also a security risk as the chance to look over my shoulder increases)

oh and heres some salt for the wound: IE does not do that right? right!

save your hypotheticals for someone who cares about such sillyness

Idiots

[ZXIndustries]

IE should only be used if you have a deathwish. There is only one person I know who uses it (but his parents don't let him install stuff). Moving over to the point, why is it that all of the schools and the public libraries use IE? I've also noticed some schools I've been to don't even have firewalls.

Re:Idiots

[akeyes]

I believe that my local library only lets people browse with Netscape.

Advice?

[sheddd]

Here's an email I just sent to my company's sysadmin... what you think? (Hotel with ~100 desktops)

We discussed installing firefox on all machines...

After some thought and reading I'm not sure that's the right move now...

+ I like firefox
+ No ActiveX
- No easy autoupdater that I'm aware of
- Not controllable via Group Policy

Related discussion: http://ask.slashdot.org/article.pl?sid=04/11/24/18 41232

Web's getting nasty; I worry mostly about users going to our regions account (I don't know who has access, and there are lots of 'phishing' scams (emails saying 'Hi I'm you're bank and need more info. Click here so I can steal your password when you enter it' and then take your money). Gartner says these scams have cost 10.2 Billion!

If we get scammed the bank will probably take the loss itself but I'm not sure.

Phishing discussion: http://slashdot.org/article.pl?sid=04/11/26/199213 &tid=95&tid=172

Some info on customizing firefox install: http://www.firefoxie.net/

Some info on how to install firefox on every pc in the domain easily:
http://forums.mozillazine.org/viewtopic.p hp?t=1380 33&sid=42e903fcae0f8f25a49acf8e70071f13

Bottom line is:
- I think we need SP2 asap on all desktops (especially ****'s, and anyone else with the bank password... Many of the 'url spoofing in the address bar' issues are fixed by it). We should also send some basic info on phishing scams to anyone with regions access. (Note some apps are not 'SP2 certified'... like our credit card auth system).

- I don't think we should install firefox until we can get it to autoupdate, and maybe not until it's controllable by GP. It would be a PITA to manually update all the clients. Maybe IE will become somewhat secure before that happens.

- We need to disable ActiveX in group policy... Maybe by moving everyone into the gptest group... There may be a better solution; let me know if you have ideas. If you're a member of gptest you get annoying popups saying 'this page may not work because activex is disabled' on many sites.

Any input is appreciated.

Thanks

Paranoia Button

[kajoob]

Check out the Paranoia Button. It adds a button to your toolbar that you can click and it clears your history, browser cache, passwords, download history, cookies, etc. You can do the same thing in options, but if the black helicopters are right overhead, the Paranoia Button is nice and quick.

I call BS

[SanityInAnarchy]

How is it "overhead" for the IT team to look at Firefox just once to see that it already does automatically keep itself up-to-date if you tell it to? That and all its extensions. I have yet to see a Google bar or some such (can anyone say "Comet Cursor"?) keep itself up-to-date on IE.

Re:I call BS

[Anonymous Coward]

Uh, can Firefox keep itself up-to-date if the user does not have admin rights? Didn't think so. Do most business users have admin rights? Didn't think so. I just don't think the FF team is interested in trying to tackle that market at this time. Let's not pretend that they are.

Your system admin...

[CaptainTux]

What your system admin says is true. But consider this: with Firefox, one would probably have to have physical access to your machine to make any use of the information Firefox stores. With IE, one only needs to "reach out and touch you" using a malicious webpage or email.

IMHO, Firefox is more of a local security risk that could expose your sensitive data to others who use your computer. IE, OTOH, could expose your data to anyone on the internet.

Re:Your system admin...

[Anonymous Coward]

What your system admin says is true.

No it's not. You must work in sales at a large retail electronics dealer, the way you just make stuff up without checking the facts.

Re:Your system admin...

[algebraist]

although it's not open source and not free for purchase without advertisements, Opera 7 does everything the administrator says IE does but Firefox doesn't.

better, IE implements CSS2 more completely.

and it's available for Linux as well as Win32.

"Be Anonymous" Button

[cbr2702]

What would be more useful (and currently not possible) is a "be anonymous" button that when pressed toggled the browser into a full privacy mode. In this mode, sites would not be well trusted (javascript disabled, plugins don't load), the Refered_By HTTP header would not be set, and nothing would be stored (history, autocomplete).

Re:"Be Anonymous" Button

[Anonymous Coward]

It's coming to Safari.

Re:"Be Anonymous" Button

[cbr2702]

It looks like a very good idea. Of course it's no good on a public machine, because anyone could have modified the source, but it's still a good idea.

Case sensitiveness

[zentronium]

It's not FireFox but Firefox ;)

Re:Case sensitiveness

[Anonymous Coward]

You're a Perl (not PERL) user, aren't you?

New way to get support on /.

[DemENtoR]

A new way to get support on slashdot; diss your fav OSS app, and a hord of slashdot monkeys will fire up google for you, will have your answer in seconds. It's better than asking, "How do I...?", since otherwise everyone would be GVFG (go visit fucking google).

Re:New way to get support on /.

[jc42]

A new way to get support ...; diss your fav OSS app, and a hord of ... monkeys will ... have your answer in seconds.

True, but this isn't at all new. I've often used just this sort of approach to good effect in the old IBM/MS-vs-unix marketing war. The argument goes: With proprietary software like the stuff you get from IBM or MS, if you have a problem, and you can't find an answer in your docs, you have to go to the vendor, who has little motive to waste time digging out an answer. You can beg and plead, but unless your questions happen to reach just the right person, you don't get good answers.

OTOH, with most of the unix-like systems, there are public fora (newsgroups, mailing lists, slashdot, ...) that are frequented by knowledgeable geeks who enjoy showing off their expertise. You ask a question, go get a cup of coffee, and when you get back, there's and answer (or sometimes 3 or 4) sitting there for you.

Very often, the best way to get an answer is by dissing something that you like. If you just say that you can't get X to do Y, you may get only "RTFM". Instead, say that app X can't do Y, but the competing Z can. Lots of people will try to illustrate your ignorance by explaining how to do to get X to do Y.

You can often save some time by asking your question first. Then you dig around in your docs. Maybe you find an answer, maybe you don't. In any case, you should then check for online answers. Even if you found an answer, there are often several other answers that you didn't find, and you can pick the best. Or there are warnings and qualifications that weren't in your docs. Or there are suggestions that your software should be upgraded for some relevant reason (such as that you've stumbled across a bug that has been fixed).

Yeah, I know you were ragging on people who are out to get free support on /. But it's not all that unreasonable an approach. Well, you might find a more focused forum than /. This is certainly true in this case, since there are lots of good browser newsgroups out there. But asking a crowd of geeks is a viable approach in many cases. And it gives the geeks a chance to show off their expertise.

You just have to learn to tolerate the pseudo-geeks who insult you rather than answer your question.

(Some of them insult you and answer your question. You should learn that that's fine, as long as they answer your question. Some people like to not only show off their expertise, but also tell you how superior they are. Humor them.)

Firefox *is* a security risk

[Anonymous Coward]

Job secutity I mean, for anyone who lives from spyware and virii removal, like myself. :(

How to BSOD your MCSE

[renata.org]

I work at a MS-Friendly company (I'd say Microsoft is one of our major customers) and as they gave me Administrator permissions to my machine, I did not even ask if I could install Firefox - I simply got it installed. Once the sysadmin saw and told me I should not use non-IE browsers. I answered him that as a web developer, it was my job to test everything in the most popular browsers and that IE now has less than 90% of market. He didn't knew that and while he was trying to answer something-too-complex-for-a-non-mcse, I asked if he saw the Wired edition where the CSO of Microsoft says he uses Firefox. Obviously the mcse got a BSOD and never bothered me again.

Or, in fewer words: read slashdot and any tech news sites befere your mcse and tell them things they didn't know - they get totally b0rked if someone knows something they don't know. :D

Just post...

[jalet]

your sysadmin's email address here.

This will make him know better !

One real reason not to use it

[drsmithy]

Your admin's claims, as others have noted, are BS.

However, one reason I haven't rolled out Firefox across the board here is because it's a pain to centrally distribute, update and administer.

A word to the Firefox devs - if you really want to start making an impact into the corporate world:

Make centralised admin of Firefox under Windows easy and standard with GPOs (or even for just a start, obey the system-wide settings for things like homepages and proxies).

Package it into an MSI.

On a more personal note, fix the damn copy and paste bug that's been hanging around since (at least) the Firefox 0.7 days. It doesn't stop me using it (or recommending it to others), but it *does* make it EXTREMELY FRUSTRATING sometimes.

Re:One real reason not to use it

[montge]

Another option, contribute, figure out how to make Firefox use GPO's.

Risks..

[martin]

Good. Coming at you from a risk point of view.

Risk of IE - lots of vulnerabilities that are mainly high risk according to vendor. Threat is you get lots of spyware etc just by visiting sites. Probability of this happeningis high.

Risk of Firefox. few known vulnerabilities, mainly low risk occording to vendor.

See story a few up the list about a Win update...

[leonbrooks]

...trashing eighty thousand machines in one hit. Then tell me again why this...

They would have every machine patched within one business day of the announcement.

...is a good thing?

Look carefully at that image...

[leonbrooks]

...and you'll see that their default search engine (on a screenshot advertising MSN Search) is Google. Ta-dish boom. Even for advertising bozos, that move really is dumber than a rock.

_Somewhat_ secure...?

[leonbrooks]

I don't think we should install firefox until we can get it to autoupdate

It does.

maybe not until it's controllable by GP

Interesting project for the FF people, damn sure MS won't implement it until the Styx becomes icebound despite this.

Maybe IE will become somewhat secure before that happens.

Maybe if you leave enough teeth under your pillow, they will get swapped for negotiable cash overnight.

We need to disable ActiveX in group policy

This will kill some idiot PHB's favourite site and thus get rejected within a few days. If you force everyone but the idiot PHB(s) in question to use FireFox, and firewall their machines to within an inch of their lives, that will reduce your exposure.

Wish #2 granted

[leonbrooks]

clickety click

Wish #1 presumably in progress as I type.

What difference...?

[leonbrooks]

Perhaps Firefox is more secure, but since everybody else there runs IE, what difference does it make?

The difference is that the security breah is not traced to my machine, and I can browse without fear.

On top of this, I get the tabs and all of those bazillions of nice, easy-to-reach extensions and themes. It's almost as good as Konqueror (except that Konq's JavaScript sucks).

I.E vs Firefox

[JIM7]

Cliff: Firstly, does 'anonimous coward' have a vested interest in keeping I.E. as your browser? Secondly, 120 other answers easily show you that Firefox is *vastly* superior to I.E. Hell, it's even better than Netscape, when it comes to security!

IE is less secure.

[rice_burners_suck]

Any system administrator who thinks that IE is more secure than any other piece of software is not a system administrator at all. Nay, he has the mental capacity of a dead fly.

IE is not secure. Nor is it more secure than other software.

To compare the security of various packages, do this:

Install a Linux box. Install it with 10 NICs connected to 10 DS-3 connections to the Internet, with static IPs. Use no firewall. Open every port. Install every service. Run everything under 'root'. Serve web pages explaining that you have done this. Provide all of the static IPs and the root password. Offer a reward to anybody who manages to 0wn your box. Pay Google to place ads in its search results to bring people to your site. Go in all the IRC channels and tell everyone.

Install a Windows XP box. Run IE.

My guess is that the box running IE will physically explode within 10 seconds of starting IE. The box running Linux? It will take a day or so for it to get compromised.

Conclusion? IE less secure.

Re:IE is less secure.

[Anonymous Coward]

Thats one of the most retarted things ive read all day. Lick lead paint.

what the He** is a Microsoft cycle anyway?

[Anonymous Coward]

MS relases their patches when they feel like it. Though often that doesn't have much to do with the reality of a threat..

Internet Explorer. How do you know that you need a patch other than trawling the tech sites or hitting the MS update site, YOU DON'T!

Firefox, when a patch is needed, they change your home page to the site with the patch. how simple is that? (the only other time i had my home page re-directed was when I installed a pugin for [copy plain txt])

Firefox, easier to keep patched than I.E.

NEXT!

Re:what the He** is a Microsoft cycle anyway?

[Anonymous Coward]

Microsoft cycle...Microsoft spin...spin cycle...centrifugal force...aaaaargh...thump!

I'm going against the grain here, but...

[Anonymous Coward]

I use IE. I have used the 'trusted sites' system for nearly two years and (knock on wood) gotten zero spyware. The trick - I have ActiveX and scripting disabled for the 'internet zone'.

Unlike with Firefox, I actually *can* use ActiveX on pages that use it - provided I've added that site to the 'trusted sites' security zone. Plus, all the sites that have been carefully hacked to look a certain way in IE look exactly like what the authors intended.

The eternal conflict...

[Anonymous Brave Guy]

This must be the oldest conflict in IT. The paranoid sysadmin wants to keep everything everywhere the same and under their complete control. On the face of it, that's not unreasonable. They are, after all, the ones who have to clear up the mess when something goes wrong.

On the other hand, an informed user may know full-well that certain non-standard tools would help them to do their job better than the officially-recognised alternatives, and may be perfectly competent to install and maintain the non-standard software. Given that they're the ones doing the real work and IT are only a support function, this argument also has a lot of merit.

I'm stuck in a similar situation at work. Small company (lots of flexibility) let us install whatever we wanted as long as we didn't screw up and it was all legal, fit for purpose, etc. Large company (rigid procedures, absurd overheads, centralised IT) buys small company, and decides to upgrade loads of machines so everyone can run Outlook 2003. This results in the absurdity that support staff now have nice new 22" monitors and 3GHz, 1GB machines they don't need, while developers who've been asking for those specs for a year or more still get 19", 2GHz, 512MB machines (and all of those numbers actually matter to more than our egos in the work we do). More to the point, it means I expect to be told to give up Thunderbird in favour of Outlook 2003 imminently.

I'd have more sympathy for the sysadmin approach if I hadn't switched to Thunderbird after the official solution failed to do its job at all usefully: after a standard MS update took out my standard-configuration Dell PC, we were unable to restore the backed up mail due to the Outlook-inventing-a-non-existent-password bug. Moreover, Outlook's address book features stopped working, and the mail filters never worked properly in the first place, due to another well-known bug.

I recovered my mail flawlessly by importing into Thunderbird, which also has simple-but-effective address book and mail filtering features. It also doesn't second-guess the intentions of those sending me .exe files (handy if you work in a software house!), doesn't pose the same security risks, yada yada. Basically, Thunderbird does what I need a mail client to do in my job, simply and without fuss. Outlook didn't, and caused me more than a day of downtime when the official update failed.

When you've got this sort of thing going on, I don't see why any competent user should be denied the right to use appropriate software in their job just because paranoid sysadmins either aren't competent to provide a better alternative, or choose an alternative that isn't up to spec, whether or not it says Microsoft on the box.

As a final note, I'm also well aware that Outlook 2003 is a lot more than an e-mail client. Its ability to schedule meetings, publicise a person's diary, etc. has already resulted in at least one of my colleagues missing an important meeting because he didn't know it was happening (since the e-mail notification was added straight into the electronic diary he'd never used without further notice). It has also resulted in a string of nearly a dozen confused e-mails between people who sit three desks apart about another meeting, where previously either asking the people directly or, if they weren't in the office, a single e-mail would have sufficed. And this is Microsoft/the IT department's idea of improving efficiency? Stuff 'em.

Re:The eternal conflict...

[reallocate]

I've seen organizations set up a pool of alternative software that they are willing to support. Basically, they recognize that some employees have legitimate needs for specific programs that really don't need to be pushed out to every desktop. So, they set up a little server as a local repository for the alternatives they've tested and approved. Users can install at will from that server.

Re:The eternal conflict...

[martinX]

When you've got this sort of thing going on, I don't see why any competent user should be denied the right to use appropriate software in their job

Because everyone who knows how to make text bold in Word thinks they're a competent user.

However, understanding why IT does this doesn't stop me from running lots of non-standard stuff myself...

Re:The eternal conflict...

[Anonymous Brave Guy]

Because everyone who knows how to make text bold in Word thinks they're a competent user.

Sure, but I said "any competent user", not "anyone who thinks they're a competent user". :-)

For example, given that I work at a software development company, it's unsurprising that a lot of the "regular staff" know Unix as well or better than the official sysadmins. Many of us quite happily run Thunderbird and Firefox rather than the regulation Outlook and IE on Windows, too. How many of us do you suspect are incompetent at installing and configuring those?

No cache clearing...?

[Malevolyn]

I suppose he doesn't know the meaning of setting the cache to use 0kb of space...

There is retarded government

[porneL]

In Poland only electronical way to submit tax returns is by Windows-only closed-source program "Patnik" (made by Prokom, an unlawful goverment software monopolist)

Software itself is bloated s**t and government refuses to make it open-source. Bribes, bribes, bribes...

Re:There is retarded government

[Thu Anon Coward]

electronical? mus' be that newfangled method I done did been hearing uv...

Re:There is retarded government

[Anonymous Coward]

We can assume your Polish is pretty damn good, then?

Admin idiots

[Hippynz]

I once turned down a job because of stupid admin staff.
At the interview I asked what they used and if they allowed staff to install more secure aps if the ones they use are not secure. They said no, I explained FireFox and others (for email etc) and was told they would not look at it. I then told them (when I got accepted for the job) that I could not work for a company that does not take computer security seriously (or even takes advice of the issue). Ended up working for a croup that had a better approach to this issue. Found out that thier system got so infected it had to be re-done froum scratch and they got advise by an IT security company to use no IE or Outlook.
I told the mso !!!!!

They'll Know It Is There If They Want To

[reallocate]

Even if it doesn't get the guy fired at the time, it sure is a nice tool for management to use when they do want to get rid of him.

Besides, there's every chance they will know he installed, if not immediately, then sooner or later. I used to work at a place where each workstation was, in effect, periodically spidered to determine if any unauthorized software was present. If it was, it was removed.

Follow your IT Admin's advice!

[Seraphnote]

NOT because he's right, but BECAUSE its HIS responsibility to clean up the mess that IE will probably allow to sneak onto your network! Oh, ask him what a BHO is! (Answer: Browser Helper Object -- programs that can be integrated into IE, but can't be uninstalled from IE's built-in menus.) If he doesn't know about this, he's never REALLY dealt with the trash IE allows onto networks, so all the more reason to listen to him. As an IT Manager, I have to say, listen to your IT department. But I'm also going to say that after dealing with virii/worms coming onto my network via IE BHO's, (my 2nd week on the job too, what a mess!), we've been rolling out Firefox for people's main browser. As long as I have people using IE, I keep getting virii/worms trying to establish themselves. With Firefox, none of this. (Perhaps its only a matter of time... hope not.) I only have people use IE when they have to access some extranet site using "legacy" ActiveX controls. So you can't get rid of IE altogether, even if you wanted to, (although yes it can be done... but you won't be able to install MDAC then... but that's another story.) Just to clarify my position... Firefox rocks! But if you work for a company set on M$, follow your company's wisdom (or lack thereof). Its THEIR responsiblity to maintain your network's security, and to clean up the mess THEIR decisions make.

Who's going to know?

[Safety Cap]

You have a USB mouse, no? Just get a cheap-ass USB hub ($0.99 at Fry's when they have a sale) Plug in your dongle and you're done

Okay, suppose you work for IngSoc, and you really can't risk it, but you really, really want to surf the light fantastic. Get yourself a cheap-ass laptop (try retro box or ebay), get a t-mobile card and their cellular service (about $30/month, but it is all yours), and you're golden.

I call BS on your BS

[TheMMaster]

in fact, it *CAN* keep itself up to date if you install it as a non-admin user, it will just keep itself up to date without admin rights.

if it *is* installed by the IT department (as an admin) then I'd say that they'll have to have some sort of patching strategy, don't you?

Consevative management ideology

[Anonymous Coward]

I completely agree. My personal view is that 'consevative management ideology' is in place due to the social changes that have occured on a large scale basis as a result of 911 and the 'with us or against us' atmosphere set by the Bush Administration.

At my new job, I have been spared this a bit by having a great boss. Unfortunately, his job is in jeopardy by those who dislike his hands off approach and his relaxed attitude. To top it all off, I was only hired(as a temp) because he requested it. The 'management' felt that the 200+ employee organization only needs one comp tech. He disagreed. The other guy, whom they hired permanent, sits around all day and plays with Flash. I've got a 4 to 1 trouble ticket lead on him and most of his are still open. Why did they hire him over me? He's a great bullshitter. Ah well. We're in another dark age I guess.