Slashdot Mirror
FireFox as a Security Risk Compared to IE?
A not-so anonymous Anonymous Coward asks: "The administrator at my work gave me the following reason for not using Mozilla. What do you think? 'FireFox is a security risk. Please refrain from using it. Please continue to use IE 6.0. IE is our only supported browser. FireFox saves encrypted pages to disk and does not give you override capability. It also does not allow automatic cache clearing when closing a browser. These are security risks.'" Do any of you have information that could be used to contradict the administrators information on FireFox? Are there configuration options one can reach from about:config that a user can use to address the problem this administrator has cited?
How does Firefox prevent them from patching Windows software?
It doesn't. It's just an excuse for lazy MCSE admins who don't want to add an additional step to their daily advisory-reading / patch-installing cycle.
My point is this: in an established MS shop, it's often very hard to get the admins to approve usage of non-MS software. At my previous job we had many people using MS Publisher and that MS photo suite when InDesign and Photoshop would have been far better for their needs.
I'm not agreeing with the original poster's admin, I'm just saying that MS shops are often set in their ways.
While your admin may have issues with the default configuration for Firefox, there are genuine reasons for not deploying firefox to your network. Most security concious organisations have a very rigourous patching system for the authorised applications and operating systems. Any app which doesn't fit into that patching system (whether it be up2date, apt-get, SUS/WUS/SMS, yum or another flavour) presents a massive overhead to the IT team. Every time there is an update to Firefox, it needs to be repackaged and redeployed to every desktop in your organisation. And it's not just Firefox, but by setting a precedent of deploying MyRequestedAppX, they face pressure from all sides for AppY, AppZ, etc. Then the questions come - "you support Mr X's AppX with updates and patches - why not mine?".
Unless your organisation has the infrastructure to deal with non-baseline application patching, those apps WILL present a security risk while the IT team tries to find the resource to patch/update and deploy the latest version.
Why can't we all just get along?
... because i've switched all the machines i'm responsible for to using firefox precisely because it's n-times harder to get malware. not impossible mind, but a lot harder by default. perhaps inducing some blunt trauma with a clue-by-four might help...
The group policy (Worldwide) is to have *ONLY* Windows 2003 Servers. ....
Just was doing a scan on the German network, and the main online reporting server/portal is running Linux
Hehe.., either that or one of the clear german IT got MySQL and VSftpD http://vsftpd.beasts.org/ on Windows 2003.., and hacked the TCP fingerprint to show up as Linux 2.4
The Admin is just studit and does not have a clue of that Firefox really is.
You should, (which the Admin-Troll is off getting a coffee, install Firefox on his PC and delete the IE icon from desktop and startbar, and rename the Firefox one to "Internet Explorer" and change the icon to the stupid "E".
He probally will not even notice.....
P.S. His password is either "null" or print on a post-it on his monitor......
"Clutch my testes, bloody squirrel humpers!!" -Happy Noodle Boy
There's a wonderful little extension for Firefox called "Configuration Mania" and it works with 1.0. It has the ability to choose the option for the SSL disk cache mode as well as clear the disk cache every time you close the program, as well as other nifty little things. Give it a whirl.
Viva La Revolucion! Buy a Mac!
better: http://johnhaller.com/jh/mozilla/portable_firefox/
http://www.firefoxie.net/
As someone else here mentioned, allowing the installation of Firefox would disrupt the usual patching routines, since the admins want to minimize the number of things to be watched over (i.e. if I let you install Firefox, then besides Microsoft's updates, I have to watch for Mozilla.org's updates too.) I can imagine the admins are already in deep shit with the Microsoftian legion of security flaws, but (un)luckily Microsoft has provided a rather automatic means of unattended update for IT administrators to save the day. Thus, adding Firefox into the equation just doesn't help. Especially when considering that there's no well known mass updating mechanism for Firefox and open source softwares in general. Sure you can write a program to look for the updates, changelogs, and related bugtraqs for you, but you can't expect an MCSE to write a proper program can you? ;^)
With this in mind, I wonder if open source softwares, despite superior quality to M$'s offerings, are friendly to IT departments? This question is significant since if we can't make our softwares friendly to companies then the average users aren't likely to use them as well. If the answer is negative, how can we tackle this problem?
"the obvious minor stuff like the government only producing documents in MSWord format or WWW sites that are in MSHTML so only work in MSIE"
It could be worse. Your government could demand that all tax returns be filed electronically, make it illegal to not file electronically, and then create a website for filing so that it can't be used on non-Internet Explorer browsers
Of course, no real government would ever be that retarded.
IMHO, Firefox is more of a local security risk that could expose your sensitive data to others who use your computer. IE, OTOH, could expose your data to anyone on the internet.
Anthony Papillion
Advanced Data Concepts, Inc.
"Quality Custom Software and IT Services"
What would be more useful (and currently not possible) is a "be anonymous" button that when pressed toggled the browser into a full privacy mode. In this mode, sites would not be well trusted (javascript disabled, plugins don't load), the Refered_By HTTP header would not be set, and nothing would be stored (history, autocomplete).
This post written under Gentoo-linux with an SCO IP license.
But I can still save an encrypted page to disk using Firefox's File>Save. I cannot using IE. I personally like Firefox's behavior because if I can see it, I should be able to save it. Not being able to save it is a good option for those who want that behavior. And auto-clearing cache/cookies would be a great option to also have within FF's options. Let's see how fast the Firefox coders implement these functionalties. I'd give it a week.
Not only that; it's already the second (at least the second; there may have been even more) Ask Slashdot concerning a non-existent Firefox problem.
...and you'll see that their default search engine (on a screenshot advertising MSN Search) is Google. Ta-dish boom. Even for advertising bozos, that move really is dumber than a rock.
Got time? Spend some of it coding or testing
In Poland only electronical way to submit tax returns is by Windows-only closed-source program "Patnik" (made by Prokom, an unlawful goverment software monopolist)
Software itself is bloated s**t and government refuses to make it open-source. Bribes, bribes, bribes...
ZENWorks, is a third party option. And if your running a Novell network, it is practically mandatory. Sure it costs a lot (last time I looked, it was $70/seat), but if you have a VLA it becomes practically free. Anyway, whatever the cost, with the proper deployment it will save at least an FTE, and free up the guys admining the network to do something else in there free time. Why can it free up so much time? Simple there is:
There are a few more features, but those are the ones I use the most. ZEN, along with salvage(aka: undelete on Network shares), and the ACL's on the Directory and filesystems make managing Windows networks tolerable, almost enjoyable.