Slashdot Mirror
Is The Firefox Honeymoon Over?
prostoalex writes "With Firefox market share reaching a substantial level, is the popular Internet browser becoming a security nightmare for IT administrators? George Ou takes a look at the hard numbers. From the article: 'From March 2005 to September 2005 10 vulnerabilities were published for Microsoft Internet Explorer, 40 for Mozilla Firefox. In April-September timespan there were 6 exploits for MSIE, 11 for Firefox. Conclusion? As you can see, the facade that Firefox is the cure to the Internet Explorer security blues is quickly fading. It just goes to prove that any popular software worth hacking that has security vulnerabilities will eventually have to deal with live working exploits. Firefox mostly managed to stay under the radar from hackers before April of 2005.'"
There is one significant difference. I'm a knowledgable user. I program and sys-admin. I practice good security. Regardless of the number of exploits out there, I've never been hit by a FF exploit. I have been hit by IE exploits.
But the submitter is right. Though code security is important, the number of users is also a huge factor.
Cue someone to mention Apache.
Yes, Apache is everywhere, exploit-free. So are lots and lots of other binaries. It's only when you compare Apache to IIS 4/5 that it's really such a perfect example. Compare it to WinAMP, or Bash, or Finder, and its no more, no less secure.
Implicit Evaluation with PHP
Well, this is a good example of bad journalism. I don't want to get into a flame ware about which browser is more secure (although I have an obvious bias). What I'm try to say is that this guy is quoting useless statistics and this is a great example of bad science/tech reporting in the media.
1) The number of vulnerabilities reported has almost nothing to do with the number in the code. At most it dictates a minimum number that exist. Perhaps the firefox community is much more active at searching for bugs in the much newer firefox code.
3) How effective are the fixes? MS seems to have the same recurring problems because they only do triage. They don't fix the bigger problem (VERY poor browser design). The firefox team appears to address the bigger problem, not just stop the current bleeding.
2) How critical are these vulnerabilities. The article makes no mention of any ranking. He lumps everything into the same category. MANY of the IE bugs over the last 5 years have been SUPER critical, allowing remote access with little or no user intervention and no settings work around. Are the fire fox bugs the same?
3) Different organizations handle the vulnerabilities: MS and the Mozilla Foundation. MS is known to sit on bugs as long as possible. Perhaps the Firefox team is just being more responsive to the people looking for them.
Remember 99% of people that have cancer have eaten pickles. That doesn't tell you squat about the relationship of pickles and cancer.
IAAITG (I am a IT guy)
Spell check? Why bother. That is what grammer/spelling Nazi freaks who waiste band width posting "spell right" are for.
As well, how many of these vulnerabilities/exploits were "critical" and how severely did they expose your computer to running unauthorized code vs. the MS ones? How much effort did it take to repair them? The last vulnerability I recall patching required making a minor change to my Firefox config by hand rather than patching or upgrading.
Because IE is so tied in not only to the OS, but to various Visual Studio API's, were Microsoft's vulnerabilities more far-reaching?
I'm no MS apologist, but I'm also not a Linux or OSS zealot. I like to use what works best for my needs and habits, which ends up being a mix of Closed Source and Open Source products. I don't want to be biased on one side or another, but I'd like to be sure that comparisons like this are apples to apples.
- Greg
Start a happiness pandemic
I use it because its a better browser. It has more (and better) features than the competition. THAT is why I use it and recommend it to those who ask, not because of its security track record.
Here's the difference.
If the Firefox web browser sucks, the average Joe can uninstall that web browser from a Windows box....
if IE sucks...
guns kill people like spoons make Rosie O'Donnell fat.
It's great that as a sysadmin/programmer using firefox, you've had less problems than with IE.
More importantly, when I switch my users to Firefox, they cease to have problems. More exploits or not, FF causes fewer headaches. When it's all said and done, I'll choose FF's problems over IE's problems.
Procrastination -- because good things come to those who wait.
This is exactly true. I administer over 2,000 machines (mixed platform environment). We started installing Firefox as part our standard package over a year ago. There has never been one report of a problem with security involving Mozilla Firefox. There have, in the same time period, been numerous security problems originating in the Microsoft Internet Explorer web browser. It doesn't matter how many exploits get published if they aren't being exploited or their exploit does not result in any significant harm. As posters below have noted, this article is a result of bad journalism.
"I set MSN Search as my default search engine on Firefox"
I set my Firefox home page to open MSN search with the default search strings "openoffice.org google 'how do I replace microsoft windows with linux?'".
It's the little things that make life enjoyable.
Also.. the most important factor. The Firefox community fixes the problems.
There are flaws in IE that have been known for better than 6-8 months and still there is no fix.
Digital is, by definition, imperfect. Analog is the way to go.
Losing my mod points to say this but...
Really; are you in imminent danger of being modded down on Slashdot because you posted something negative about Microsoft and positive about Firefox?
Are you also worried about being flamed because you compress your music with ogg?
Do you live in fear of being outed to the slashdot community for creating documents in Open Office?
You're such a rebel.
[smile]
Mod my comments down. It'll be fun.
I really want to give Firefox to all my users, but there's no good way of managing the updates for my users. Until the Firefox comes packaged as an MSI so that I can force an upgrade via Group Policy, I won't install it on my users machines. And when they do make an MSI for it, how am I to keep people up-to-date with extensions? The Grease Monkey extension had a vulnerability awhile back, and I don't see a way for Firefox to allow me to force an upgrade to everyone for extensions. IE works well because I can release patches for it via WSUS. And since SP2 for XP, we've had less calls about spy/adware installs.
Let's go through your objections point by point
If this is so it just leads to the question: Why should people use Firefox now then? Lets wait until 2010 when it will actually be better and stick to IE which is better now.
Except then Firefox will not get developed to as high a level as IE has and will never reach that point. Note that this observer has the same problem as most observers who say, "It's better!" And that problem is that the numbers aren't exactly fairly proportioned. An IE hack that gives someone access to all your 'net data then wipes your entire hard drive is counted as one bug, as is a firefox flaw that gives someone access to your last ten sites viewed. That's a biased and unfounded example, but the reality stands regardless - THIS IS NOT A GOOD WAY TO DO A SECURITY STUDY.
I don't really believe in this, but arguing like that is arguing against Firefox.
It is arguing against the further development of Firefox, too. No users, no development.
My personal opinion on these things is: People care way too much about browser religion. Let people use IE, not that much wrong with it.
There's piles of things wrong with IE, they're just not user-visible all the time and that is a main portion of the problem's gestalt.
Both IE and Firefox are huge complex applications processing huge amounts of diverse untrusted data. Sure it'd be great if they were secure, but it is just not happening that way yet.
You can lock Firefox down if you want. Won't be able to see EVERYTHING, but it will definitely be secure. Not quite anywhere near as true with IE.
There might be some hope on the horizon with low-rights IE7. It might be that it really does manage to remove the impact of the bugs, which is really the best case scenario as things stand.
You can do this in linux. Natively. Just make yourself a different user with no rights to do certain things. Try that in Windows and see if it works for you. As to the, "Microsoft will solve everything in the end" mentality, well, I can't really argue with that.
If so we will no doubt see similar approaches integrated in Linux desktops and see Firefox refactored to use the same approach.
You're looking at it the wrong way. Microsoft is behind and has been so for a very long time. The stuff you want is part of the problem with their occasional 'buy instead of implement' business model.
My little site.
You need only to look at secunia.com's summaries to see through the idiocy of this article:
vs.
Firefox: 0% Extremely Critical
IE: 14% Extremley Critical
Need we say more?
I'll give you not one but 19.
http://secunia.com/product/11/
Watch what you ask for, you just might get it.
ActiveX?
Read my blog.
More exploits or not, FF causes fewer headaches. When it's all said and done, I'll choose FF's problems over IE's problems.
exactly. and really, at the end of the day it's not just number of the exploits, is it? maybe firefox has 44 exploits, all of which are easily implemented by a supreme diety who speaks assembler like a native speakers, and which, once done, make the browser a little slower or the graphics render funny.
whereas there may be only 6 exploits for IE, but my dog can (and does) routinely use them, and every single one of the roots the box the browser's running on.
this is clearly exagerated a bit, but the simple *number* of exploits isn't too relevent
As for IE7, I haven't seen any features promised that Firefox doesn't already have. And I think Firefox is still more standards-compliant, which is a pretty big deal to me. Also, Microsoft's general attitude toward their web services has been contrary to the spirit of common standards with multiple implementations, and has almost always been some kind of maneuver to force a lock-in. They thought they had that with IE 4.0, which explains why they didn't really take the broswer any further until maybe now.
This presents a kind of moral argument for using Firefox over IE. It sounds ridiculous on the surface, and it would be in any kind of sane universe. But we have Microsoft.