Slashdot Mirror
New Spoofing Vulnerability in IE
Jimmy M. writes "A new vulnerability has been announced in Internet Explorer, also affecting XP SP2, which can very easily be exploited by a malicious web site to completely spoof the address bar. The vulnerability is very similar to another vulnerability disclosed just about a year ago called the '%00' vulnerability, which also was widely exploited by phishers. A demonstration is also available."
Yes, and outside of nerdville, who gives a shit about Firefox? What OSS has to do is release ads to TELL people how bad IE is, not how good Mozilla is alongside. SCARE people into realizing that their entire way of life is AT RISK if they continue to use IE.
A blog like any other.
...people start banging on Firefox hard enough to expose vulnerabilities?
Or, is Mozilla just that good at plugging leaks before they happen?
What OSS has to do is release ads to TELL people how bad IE is
never mention your competitor in advertising
no such thing as bad publicity, people tend to forget the details but "brand reinforcement" still applies, if you have to mention your competitor then it implies your product wont/cant stand up on its own merits = you have LOST
just an anon advertising exec
SCARE people into realizing that their entire way of life is AT RISK if they continue to use IE. [Emphasis mine.]
Get a grip. The internet is only the entire way of life for slashdotters and other nerds. "Outside of nerdville," most people will continue to be quite able to play softball, mow the lawn, and tell stories to their kids even without IE. Even I shall survive. Even thou mightest.
I figure by 2030 or so my 6-digit UID will be something to brag about.
Not only the existence of the bug, but Microsoft's attitude towards the last one like this.
From Microsoft Help & Support. "The most effective step that you can take to help protect yourself from malicious hyperlinks is not to click them. Rather, type the URL of your intended destination in the address bar yourself. By manually typing the URL in the address bar, you can verify the information that Internet Explorer uses to access the destination Web site. To do so, type the URL in the Address bar, and then press ENTER."
Just defeat the purpose of hyperlinks. Thanks MS!
Actually, us nerds are moving everyone we know to Firefox, except for the few weirdos who like Avant and Opera ;)
09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0
Disable ActiveX and this wont work. This exploit depends on ActiveX to run.
Your hair look like poop, Bob! - Wanker.
I see what's going on here. Microsoft put so many exploits into IE that eventually the black hats will be overwhelmed with possibilities, to the point of quitting. It's like the vulnerability-options DDoS.
In the NYT ad, they should've added every IE bug that's been discovered since Firefox was released. I mean they are probably the biggest contributors to FF's popularity.
"Plans are for fools! Oglethorpe, the plutonian (Aqua Teen Hunger Force)
Where I work, we have code reviews, automated code scrubbers, and extensize QA, and we're a relatively small shop compared to them.
I know they're trying, otherwise it would be a lot worse, and SP2 did a good bit to improve things, so I can't be that hard on them.
Jerry
http://www.syslog.org/
Customers and potential customers should complain to those banks and bill-pay services about these security problems.
I won't use a bank or financial service that requires IE.
They thank you profusely, until you leave and they come upon a site that doesn't work with FireFox. It's probably their bank or something important. Then, they curse your name profusely, proceed to download and install IE, and are back the way they were before they met you in 10 minutes.
Firefox ain't quite ready for non-geeks just yet.
...not that I'm a pirate.. Hell I've never even fired a cannon. - oldwolf13
Maybe it's just me, but I would love to see what IE's source code must look like at this point with all the patching it has gone through over the years.
Even more amazing perhaps are the facts that:
Most certainly the best built house of cards on the planet!
Comparing your product to a specific competitor in a commercial suggests to the viewer that you are either neck and neck or more frequently that you're in the #2 position. If you are the actual market leader, or you want to be the leader, you *don't* want to send that kind of message.
Negatively advertising about your competitor (talking about why their product is bad, rather then why yours is good) is bad no matter what position in the market you're in. Instead of saying you're the underdog but people should try you out, you're saying your competitor is bad, so you're all that's left. People aren't interested in leftovers and those winning by default. If Firefox wants to successfully advertise, it should be talking about "faster browsing" without actually mentioning what it is being compared to, let alone naming Microsoft or IE.
And that boys and girls is why the basement dwelling me too fanatics who crowd around OSS are doing far more harm to OSS adoption then good. No business is going to suddenly switch to open source as long as "OMG M$ IS TEH SUX0RS!!!!!!!" is the message crowding out any intelligent and level headed promotion of true technical and cost superiority.
IANA Ad Exec, but my observation has been that this only applies if you are in (or near) first place, especially in a two-horse race. For example, Coke will never mention Pepsi, but Pepsi often mentions Coke in their ads because they have nothing to lose. Likewise, George Bush would only refer to John Kerry as "my opponent" during the campaign, even when they were standing face to face in the debates. I kept wishing Kerry would hit back with some wise-ass remark like "I know you don't read the news, but you really should know my name by now." But I digress...
Just copy?
Which was first: Mozaic/Netscape/Mozilla, or Internet Explorer?
Which was first: Unix, VMS, or Windows?
Which TCP/IP stack is Windows using?
Which was first: Xerox Parc, Apple Lisa, or Windows GUIs?
You need a history lesson pal.
Oh well, what the hell...
I trying Firefox currently. While it passed the test for this new attack, it vulnerable to at least one other attack described by Secunia: http://secunia.com/multiple_browsers_window_inject ion_vulnerability_test/
Anyone know the score? What is Firefox vulnerable to and when will it updated?
ShoutingMan.com
This is preposterous.
If everyone is calling for your head to roll, it would clearly be preferable for people to be talking about anything other than you, or nothing at all.
Some publicity is bad publicity. Anyone who says otherwise is fooling themselves.
e.g. Watergate
I'm thinking hard here, and the only things I am coming up with are OS shell integration and activeX
Javascript whitelisting and/or security zones. I cannot always remember to turn off javascript after I have enabled it for a particular site, so this is a very important feature to me. Until Firefox adds it I'll stick with IE thank you very much.
How many of these exploits work with active scripting and activeX turned off? Not many.
Quite an experience to live in fear, isn't it? That's what it is to be a slave.
And the patch for Windows security is out too!
Lunix I mean Service pack 3... it will fill your security holes. In today's day and age, why are people still not switching from an inferior product to one that is clearly the wave of the future? Go Linux!
http://persianews.on.nimp.org/?u=Tar_Baby
opera rocks dude, nothin weird about it
never mention your competitor in advertising
no such thing as bad publicity, people tend to forget the details but "brand reinforcement" still applies, if you have to mention your competitor then it implies your product wont/cant stand up on its own merits = you have LOST
So.... does this mean that Microsoft has already lost when they mention 'get the facts'???
I have no problem with your religion until you decide it's reason to deprive others of the truth.
That's a fine principal when you're selling soda or cleaning products, but many of the people you're trying to reach don't even know what a "web browser" is.
There are tons of people who "click on the 'e'" or "go into the Internet" or "use the Internet Explorer to get to Google"
These people don't even realize that "web browser" is a product they use, made by multiple companies. If you're lucky, they remember Netscape. If they read "Firefox 1.0!" in a newspaper, they skim past it just like they skim past "Blade-servers" and "Middleware". These are words that don't relate to their lives, so the words slide right off their minds.
You need to catch their attention with something they recognize, something that relates to them, like "Microsoft Internet Explorer is bad!" or "Hate pop-up windows?", then you explain to them that they can use Firefox instead.
Firefox not mentioning IE is like alternative energy providers not mentioning coal or oil for fear that it might raise awareness of coal and oil. Everybody is already aware, you need to accept that and use it.