Slashdot Mirror
Mozilla Hits Back at Browser Security Claim
UltimaGuy writes "Mozilla has reacted to the Symantec report issued on Monday which said serious vulnerabilities were being found in Mozilla's browsers faster than in Microsoft's Internet Explorer. Tristan Nitot, president of Mozilla Europe, hit back by claiming on Monday that when a vulnerability is found Mozilla's 'ability to react, find a solution and put it into the user's hands is better than Microsoft.'"
Symantec biased? NEVER!!!
Open-source Full disclosure vs Close-source Please-wait-for-us-to-fix-the-vulnerability-before -publishing-it-else-we-sue
just because mozilla can react quicker to security flaws found in its browser, doesn't make Symantec's report that greater security flaws are being found in Firefox less valid.
it's a rarity to see ZDNet make that kind of mistake.
Martini Glasses
https://ses.symantec.com/Content/displaypdf.cfm?S
But to save you some trouble, here's the excerpts about Mozilla:
bug.gd: error search engine. Humanity working together to solve all errors.
maybe more vulnerabilities are found in mozilla because it is open-source
arguably, one could say this is better than in IE, where there may be some which are not known until some hacker exploits it.
Marge, get me your address book, 4 beers, and my conversation hat.
When other people can see the code, problems are spotted more quickly. That's probably why Mozilla seems to have more problems than IE to them--the problems in Mozilla are spotted before they can be exploited, while IE's problems are noticed when exploits are made and used in the wild. That said, good job to the Mozilla team.
US businesses that currently accept chip and PIN/signature
"faster than a dog with no legs. If the dog's up to its waist in treacle. And dead." /you'd think DOJ lawyers could tell if a newsgroup posting was a forward or not //you'd be right if you guessed "not".
This isn't a dupe, technically, but shouldn't this bit have gone with the dupe of the Symantec report below as an update or something? After all, someone posted the link in the comments to that (duped) story shortly after it appeared.
But if this is a dupe, what might it be called? A trupe? April-fools joke on a regular day?
"If a nation expects to be ignorant and free in a state of civilization, it expects what never was and never will be."
Symantec's report is also slanted becasue it uses vendor confirmed vulnerabilities rather than both confirmed and unconfirmed ones. This leads to misleading headlines and hurts Mozilla's reputation. I am suprised that Mozilla didn't say anything about that.
I've had far fewer problems since I switched to Mozilla/Firefox, period. It operates faster than IE and is more stable. The only problem I've had is getting Flash to install properly. Small price to pay. Any site that won't play right I switch to IE then immediately go back to Firefox.
What about the Secunia Secuirty advisories.
http://secunia.com/product/4227/
Cant see them running to fix some of those issues?
IMO, all this bandying about with numbers is next to pointless. All I know is that in my experience:
1. When I used IE, I got infected out the wazoo; colleagues I know using IE still have problems.
2. After switching to Firefox while still running Windows, I had zero infections. ZERO. Nothing else on the system changed.
3. Now I use Linux exclusively (unless doing work on a client's computer on their behalf), and I sure am not using IE.
On the one hand, it's nice to see Moz hitting back with the PR. But, I wonder if this will ultimately hurt migration away from IE. That is, I can just about hear folks saying "MS says one thing, Mozilla says another...who to believe?"
To the non-techie, MS is a known quantity and The Mozilla Foundation is not (I'm thinking along similar lines to name-recognition at the polls). At the very least, a I-say, they-say approach seems to muddle the issue more than clarify it for those not willing to do their own research.
Computational Chemistry products and services.
the time-to-patch, how long it takes between the discovery of a vulnerability and its repair. Frequently with Microshaft, this can be weeks. Maybe months, even. With Mozilla, I keep seeing the patch on either the same day or the next day.
Microsoft (the bully) is scared of Mozilla (the other weak little kids). If Microsoft was not scared of Mozilla, it would not bother trying to tarnish Mozilla's image by using it's bully friends (Symantec).
Mozilla is a disaster waiting to happen. It's that simple. A large portion of the browser is written in JavaScript. In fact, the browser's UI JavaScript can actually call JavaScript functions located in an HTML page.
Eventually someone is going to figure out how to reverse the process and call "chrome" JavaScript from "non-chrome" JavaScript, and then it's all over. Since JavaScript can access literally anything in Mozilla, you've got a nice cross-platform vulnerability waiting to happen.
Extensions are proof enough of this. Yes, extensions can add a lot of functionality - but there really isn't that much different between an extension and a web page.
Internet Explorer may be a security joke now, but if Mozilla ever gains any popularity, it'll be an even bigger joke than Internet Explorer. It's a disaster waiting to happen.
The Symantec report is proof that this is starting to happen. If you want to use a secure browser, they're out there, but Mozilla most certainly ISN'T one.
Symantec programs try to block Trillian every time I used my internet security suite and instant messenger at the same time. Of course, I gave up Symantec. Additionally, I wish I would have taken a screenshot when it tried to block the command-line ftp program. I also conjecture that they have some bias in favor of IE, since my default browser is set to Firefox, but webpages launched from Symantec anti-virus programs always launch in Internet Explorer anyway. That being said, I'm no expert in internet security, but when I used IE, I very rarely had to opportunity to close it myself - it was always ended by an illegal operation, and I often had my homepage hijacked and search bars added. Neither has ever happened to me since I switched to Firefox. While that doesn't necessarily prove anything, I feel that Firefox is more secure.
or did it, I mean to say.. It did not take ohh whatever! who cares as long as I don't have to tell people to start using IE!
i dont care about which broswer has the most Vulnerabilities. I only care when it come down to broswer which has its the most infectious. So if Firefox has very far fewer infection, then I favour it over Internet Explorer anytime.
I dont know whatever i make is the valid points, but to be said because i hate spywares in IE anyway... My common belief that internet Explorer should be seperated from OS, otherwise It remain untouchable. So that is reason why I browsering Firefox than I use Internet Explorer. (imagine pop-up showup while i search the files on my harddrive!)
Does Symantec know customers who did?
Is Ed Gibson a Firefox user?
Symantec may be right in saying "Mozilla gets more critial holes reported," but it forgets that Mozilla is open source, and that the bug reporters can send in a patch to Mozilla.
So, Symantec? How many critical holes are there, that are reported to Mozilla are fully ID'ed down to the lines of source code and have patches to fix them? Mozilla is right in this reguard: Being open source means you get a faster responce time, as the folks who are finding out about these bugs can (and probably are) the ones that are fixing them.
--
# Canmephians for a better Linux Kernel
$Stalag99{"URL"}="http://stalag99.net";
Don't reporters do research any more? This article does nothing more than parrot what Mozilla has to say about the matter. I wonder if it would be possible for a company to completely forgo a PR departmet and just use the news media directly.
This was zdnet's first article on the recent situation, "Symantec: Mozilla browsers more vulnerable than IE". Basically, "This is what Symantec said about Mozilla". And now this article is titled, "Mozilla hits back at browser security claim". Which translates to "This is what Mozilla said back".
You could probably just take a few +5 rated comments from the first slashdot discussion about this and come up with a better article... In fact that might be a good business plan: write a script to automatically grab the highest rated comments from each story, splice them together into an article and then put on a website as original content, <msb>your articles might even be posted back to slashdot from time to time</msb>.
(msb = mandatory slashdot bashing).We always knew Comcast was corrupt, here's the proof: http://tech.slashdot.org/comments.pl?sid=1909890&cid=34545432
I can't imagine it takes the Mozilla team that long to select the "Confidential" classification for critical security vulnerabilities submitted to Bugzilla and hit 'Enter'.
Software piracy is victimless theft.
Seriously, guys who make these kind of comparisons shouldnt be let out of the room; just stay inside and code. And let others do PR work.
And Firefox is in version 1.0.6 and IE is in version 6.x... Need I elaborate on this subject? :roll:
Firefox 1.0.7 Released, and the bug is fixed.
Oh well, Symantec of course, riding on the proprietary platform of Microsloth is going to be biased.
There are many ways you can look at this..
In 2005, IE has already been around for YEARS, if you follow that perspective, it should have many less flaws...But that's not the case.
You could say FireFox is newer, so of course more flaws are expected, you could also say they should have learn from IE's mistakes, and avoided those pitfalls.
You can also say Firefox is open source, people who find the flaws don't have malicious intent, they are trying to improve the software and make it a viable option in the real world..
Those who find flaws in IE usually do it for fun and profit, spyware spam porn diallers etc, all strapped into the world of IE..there are XX number of unknown exploits in IE due to the closed source, and they are probably being exploited right now, case in point is Microsofts new Honeymonkey project discovered one in the first couple of days..
The article is basically a press release from Mozilla, but still, it's just numbers, numbers can be pulled from any generic poopshoot and manipulated anyway they want.
Share your Knowlege - Kung-Fu Geekery
I wonder who is being bullied. I seem to remember microsoft has bought a series of companies that compete with Symantec hmm. Do what we say or else. At the moment symantecs only real hope for a long term future is Linux, perhaps they just don't believe they have a future in either direction and management are just doing what management does (covering their own arse first).
Chaos - everything, everywhere, everywhen
"""The study was conducted over the first six months of 2005."""
... the Microsoft vulnerabilities were more critical,"""
When did the litmus test for long term security become the short term?
""" by claiming """
"""Nitot said that Mozilla's reaction"""
"""according to Nitot."""
"""He also argued that
All these quotes are from the article and in a place where they implicitly put into question what Mr. Nitot is trying to say.
But, when Mr. Whitehouse speaks even "IE is closed source, and so it's more difficult to access the code." Which implicitly says that closed source is more secure (security through obscurity - provably false). This "journalist" doesn't call him on it.
And this "journalist" continues to let this guy speak implicitly calling into question the security of and wisdom of using Firefox without making him justify the claims.
So, all in all, we have Mr. Nitot arguing a point and bringing facts to the table that support his claims and Mr. Whitehouse bringing implications and conjecture almost completely unsupported. Also, in the middle is this "journalist" who phrases things in a way that supports Mr. Whitehouse.
What happened to all the real journalists? You know, the ones that get as close to unbiased reporting as possible; the ones that report only facts leaving out editorials marked as fact.
*sigh*
... would be that of course more vulnerabilities were found for Mozilla, it's several years younger than IE. How many exploits were being found (announced or not) when IE was at roughly the same maturity? He could also go into Open Source vs. proprietary, but that's already been covered by other posters...
Flying is easy, just throw yourself at the ground and miss. -Douglas Adams
The big issue is that 99% of all users never update their software, so they won't have their system patched against the spl0itz.
Thus, the system that is best protected is the one that has fewer critical vulnerabilities, not the one that gets patched soonest. What good is a quick patch when exploits usually don't occur until the patch comes out anyway!
I can make sure that I patch my own system as soon as possible, but what about my mother? I can easily just turn on auto-update in Windows and know that she is always within a few days of having the latest patches. I just did an auto-update of FireFox yesterday, and it wanted me to close windows, blah, blah, blah. It needs to happen when the software is NOT running, not when you start it up!
dom
Same here. I've been using browsers for over 10 years and I can say I've never been "infected" with anyting by going to a website.
My diagnosis on Mr Wazoo infection is: user probably doesn't know the difference between IE and the Explorer.
I guess there's just no patch for dumbass.
Microsoft has less (this year) is because they've gone through 6 versions. Someone oughta write a report of all of the IE bugs, and then compare it Firefox.
On average, for the first 182 days of 2005:
How many security alerts were open for Microsoft Internet Explorer?
What was the average severity of those alerts?
How many security alerts were open for Mozilla Firefox?
What was the average severity of those alerts?
The less severe the alert, and the faster it is resolved, the better the support behind the browser. It's that simple.
Symantec is the (proud?) publisher of the absolutely worst piece of software that I've ever used: WinFAX Pro 10.2. Not only did every major mode fail to work in some way, but it disabled my phone system for days after it was installed on a machine on my network. This software was so flawed that it convinced me to abandon the Windows platform altogether.
Earlier this evening I was cleaning up a friend's Windows 2000 machine. After removing a collection of obsolete software, TCP/IP no longer worked. The culprit: Symantec Antivirus. It had left invalid service dependencies in the registry. I had to remove them by hand.
Symantec can't even understand their own software, much less someone else's. Even ignoring the obvious corporate bias, I have no faith that they can begin to understand the actual severity of defects in either IE or Firefox. It would be far better to ask "how many machines have been compromised by this fault?" than to present simple defect counts.
Boy, you might be mentally retarded.
This data doesn't seem like a relevant comparison considering IE has been considered a full version for years now, and Firefox has only recently hit 1.0.
Nevermind the trash can fire over there, look at this shiny object!
I call shennigans on Mozilla, and I'm not falling for their sleight-of-hand bullshit. They get patches in user's hands faster? Whoop de freaking do. Whatever happened to Mozilla writing superior code? The "tens of thousands of eyes makes flaws shallow"? Microsoft isn't innocent, but shame on Mozilla for stooping to the same tactics.
Slashdot biased? NEVER!!!
The Internet is full. Go Away!!!
The OPERA browser is now freeware. No advertisements, no nag screens.
Security by obscurity?
Charles Angelich
I volunteer to fix PCs for a group of teachers in the US. I am not part of their official school board sanctifed tech support crew (because those guys are snowed under).
The group of teachers were given Compaq and Dell laptops a few years back... and encouraged to use them at school and at home to help them in their work.
The schools gave them Symantec free subscriptions for a year... and Windows 98.
Over this summer I have fixed five of those PCs... a lot of hours in total. They were finally slowing to a halt (it is like a plague really finally hit those old Windows 98 machines) but the hardware was still going strong for what they needed. They were hijacked, malwared, and spywared to bits.
None of those teachers had bothered to upgrade their PCs via Microsoft Update ever as they did not know they had to (all of those laptops needed an update as far back as 2001 from MS), none of the teachers were going to shell out any money personally to keep their Symantec subscription up to date, and none of them had anytime to learn how to protect their machines.
Why? Because they are too frigging busy doing other things!
But they were pissed that their machines were hosed and all they used them to do was write out lesson plans on MS Word and surf the net.
I did the usual Micorsoft Update (and update and restart and update), Ad-Aware install and scan, Spybot install, schedule and scan, Spyware Blaster install, uninstall Symantec, install AVG-free, schedule and scan, remove IE shortcut from the desktop, install Firefox with a shortcut on the desktop pointing to it as the "new" IE, and give a quick tutorial (with a printout) to them when they came around to pick their machines up.
A few months later after the start of the school year and no call-backs. None.
Symantec + IE vs. AVG/Spybot/Ad-Aware + Firefox? No contest.
In my mind, and the minds of the users I helped, Symantec is part of the problem.
They never got five subscriptions from those users and they never will.
Symantec are like a bunch of gangsters selling "protection". They need their own series on HBO!
For that matter, who gets to decide what a bug is, rather than a "feature"? The DRM in the current version of the Acrobat format allows you to run embedded Javascript with no access controls. This is arguably an exploit, but Adobe would doubtless classify it as a feature, as it means you cannot circumvent DRM by turning the Javascript off.
Secondly, the numbers are not directly comparable, as Mozilla is standalone whereas IE is built into the OS. (This is important, as integration means that bugs that are strictly in the OS could be exploited through the web browser, without it being a web browser bug.)
Thirdly, there are deals over the reporting of security holes in software, whereby a report can be held back until a patch has been readied. This means that even "unconfirmed" (but reported) bugs by security vendors may be capped by the manufacturer. (Not always, even with those manufacturers who do this, but it does introduce uncertainty.)
Finally, Mozilla is cross-platform but bugs may not always be. Any buggy code that is OS-specific, for example, or any bug which relies on some OS-specific or library-specific bug in order to be exploitable, may only affect certain platforms as a result.
There is a second part to this one! It is also possible to have one bug that appears in multiple forms, but only one form per OS (due to OS-specific characteristics). Does it count as one bug or as many? (Remember, it still only takes one form in a given OS, but because of dependencies, changes in some way between different operating systems.)
Now, you can argue that many of the above are very hypothetical and do not apply in this specific study. Perhaps that is true, but the point is that unless you have rigorous controls on how you produce the statistics, the uncertainties are bound to be comparable to the number of incidents, making the statistics worthless.
And that is my point. If the possible variance in the number of actual bugs (reported or otherwise) gets to be comparable to the number of bugs reported, then the reports mean nothing. The actual number of bugs encountered could range from zero to infinity and the stats would still be "correct".
Ideally, the security companies would produce sufficient additional information to demonstrate the confidence they have in the values produced as opposed to simply citing the numbers but not really backing them up with anything concrete.
Where uncertainty is required by the vendor, then publish a range or some other indicator of how many unpublishable but reported bugs are believed to exist. (Since there is no guarantee that the unpublishable data is circulated with security vendors, an accurate figure may not be producable at all.)
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
Yeah but who gives a shit? Opera sucks monkey balls.
Would porting IE to Linux be considered an infection?
25 serious bugfixes for Mozilla, while only 13 (for the same period) for IE. So who does better job finding and fixing bugs?
May Peace Prevail On Earth
'Mozilla's 'ability to react, find a solution and put it into the user's hands is better than Microsoft.'
When an update for IE is available, it is automatically installed. When an updat for Firefox is ready, I have to download the browser itself and install it on top of the existing. (No, the auto-updates in Firefox doesn't work very well).
He may be right about the other points, though I doubt it, but it's far easier to update IE than Firefox.
A more adult -- probably truthfull also -- response to the number of vulnerabilities would be:
Run IE and your machine will probalby get infected with tons of spyware which will cripple your machine if you do a lot of web browsing.
Run Mozilla and it probably won't.
That's been my experience so far.
Rating software's security as lower when they fix more bugs seems like it would motivate exactly the wrong behavior. Also, it's invalid on it's face. If IE has 1000 security flaws and fixes 10 and Mozilla has 50 and fixes 15 IE isn't more secure, before or after. There is no scientific measure of security but the bug fix count hardly seems worth looking at.
set softtabstop=4 shiftwidth=4 expandtab nocp worlddomination
Which browser is more secure?
Any vulnerablilty in IE turns out to be of the sort ' A remote attacker can gain complete control of the system'. Compare this to the flaws in Mozilla. How many bugs in Moz can take that credit?
IT security is in such a fucking sad state. Is this the best we can do? Patch, patch, patch?
What, it's some kind of tornado or hurricane that came through your software and made it buggy?? NO, you guys WROTE IT WITH BUGS! You put buggy software into our hands already!
Instead of playing this ridiculous game of "write crap, patch it when we get free security audits, lather, rinse, repeat", can we try "write simple, secure software"?
How about releasing something that isn't "extensible" and supports "plugins" and all this other junk? Some of us just want to render HTML and graphics and that's it. Is the choice really just Lynx and bloatware? How about running each component of your app in a chroot jail? How about we come up with some simple OS extensions to partition software better?
I can't believe that this is the best we can do.
eEye's "upcoming advisories" page is worth a look if you're interested in just how severe microsoft's lapse in patching can be. note that this page only catalogues vulnerabilities that microsoft acknowledge and the time since such acknowledgment, not since exploit nor since they were notified.
quoth eEye's product manager: "The more critical, the more pervasive the vulnerability, the longer it takes Microsoft to patch."
So maybe Microsoft's not telling? :)
Browser/version: ---- Hits
- MSIE
- FIREFOX
- NETSCAPE ----
- OTHERS ----
IE = 1699 hits,MSIE 6.0 ---- 1699
Total: 1699
Firefox 1.6 ---- 1
Firefox 1.4 ---- 233
Firefox 1.0.6 ---- 3218
Firefox 1.0.4 ---- 1123
Firefox 1.0.3 ---- 4
Firefox 1.0.2 ---- 2437
Firefox 1.0.1 ---- 130
Firefox 1.0 ---- 31
Firefox 0.10.1 ---- 4
Total: 7181
Netscape 4.04 ---- 1
Unknown ---- 155
Safari ---- 111
Mozilla ---- 98
Opera ---- 16
Dillo ---- 12
FF = 7181 hits
..out of 9273 total hits*. Hmm. Interesting.
*data via awstats 6.4
Another item is also the time it takes from a vulnerability to be publicized to the fix (or workaround). A moderate problem that isn't fixed for 6 months is more likely to be exploited than a hig-security problem fixed within days.
The real problem here is that even though both products generally are good products with some flaws (there will always be bugs, some more prominent than others) there may be need to address some of the security risks present today from a basic point of view. This may even mean sandboxing within sandboxes to control interaction between browser frames/iframes/embedding. like the effect of the following example (for Mozilla).
(Nothing ill-meant about slashdot here, just an example).
My point is that this could as well have been your bank that was framed this way, and if there was a way for the bank to indicate the framing permissions and that browsers were able to catch this a lot would have been gained in security. (OK, I haven't considered every issue arised by this, but I hope that you see my point.)
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
Otherwise, anyone can skew the outcome.
For example, I assert that Mozilla has 300 vulnerabilities. Mozilla hasn't confirmed them, but you count them. So now the numbers are skewed in IE's favor. Yes, this is a somewhat forced example, but it shows how you can't just go counting all accusations.
I know there are problems with letting the fox guard the henhouse (in the case of Mozilla or IE), but really it is the writer(s)/manager(s) of the respective browsers who best know the code and behavior of the app, and before they confirm something you just don't have any real idea whether it is truly as the accuser says. Even if people can reproduce it, so you know it can happen, the people who made the app can best determine the scope of the problem, that is, what percentage of people are likely to be at risk.
I find it odd that people say the good part of open source is that lots of eyes look at it and find the problems and presumably they get fixed (see hidden bugs in Mozilla database right now). Yet when problems are found (and usually fixed) in IE, it's seen as showing IE is junk. If going over something with a fine tooth comb helps you improve something, then both Firefox and IE are being improved right now.
Anyway. I do know the hackers go after IE primarily. So it'll be tough for IE to come out as the more secure browser (that and it running ActiveX controls at the drop of a hat), but I am also not conviced the people at Mozilla really know all the ins and outs of security either.
I'll also say that the level of vulnerability being found in IE now is pretty fine-grained. There are plenty of programs of the complexity of IE that have never reached this level of security such that we need to look this far into the cracks to find the problems. When I started using UNIX back in 1987, it had holes far larger than IE currently has in many many tasks, many of which ran as root (think of the original sendmail internet worm). So things are not as bad as people make it seem right now.
Finally, having worked at a company that releases major software products that many many people use, I agree that if possible it is best to release patches on a schedule so that users have some time to keep up. If a user has to patch and reboot every couple days, it gets annoying. Eventually, they'll just stop patching due to the annoyance of it. Out of phase patches should only be used in emergencies.
For the record, I use IE (I'm using it right now). But I recently changed the security settings so that only specially selected sites (of which I have none right now) can use ActiveX controls.
http://lkml.org/lkml/2005/8/20/95
Symantec's business os based upon the fact that software has security issues - they sell software to fill the holes. Perhaps the fact that so many people are switching from IE to Firefox is affecting their bottom line.
Electronic Music Made Using Linux http://soundcloud.com/polyp
Companies such as Symantec are interested in blurring the line between 'faults found' and 'security'. An unfound and easily exploitable fault can make a product more prone to attack, i.e more insecure. Which is opposite to found flaws that are fixed.
So if a less skilled programmer is looking for faults, they are going to find less of them. So pretend we have two equally insecure products, by Symantec's paradigm one product would appear more secure than the other merely because less faults have been discovered. I'd trust a product created by many, rather than a product created by a recycled team.
To combat the same paradigm which Symantec promotes (i.e more flaws found = bad, instead of good.) companies such as Microsoft bundle multiple updates together(such as monthly updates) such that numerous groups of security flaws can be perceived as a lesser quantity of issues(Or in MS's case "one critical update"). The reality though is that security is based entirely on your track record, and not by how many faults you've discovered in your code. So we all know what the track record for MS products are versus Firefox.
The only thing this report lets people know ist, that they need Symantec protection/products whether they use IE or Mozilla.
...when people don't bother to install the updates.
Look at any website's detailed statistics and I guarantee you you would find a sizable portion of the Firefox visitors are not running the latest version of Firefox.
Heck, I still get hits from "Firebird" on my site!
I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
...Firefox runs on far more operating systems than IE.
This entire article is about these "Mozilla browsers." But let's be real, the different "Mozilla browsers" that are out there are all patched on their own and modified and distributed on their own.
Is it really fair to charge the problems of these different browsers to one application framework? Not that many aren't core problems - I'm sure most are. But we are comparing a group of products with one. The many products being developed by people, for free, around the world - the other product is developed by a major multinational corporation with millions at their disposal.
That corporation has been trying to stop "Mozilla" for a long time too. It's just sad that we
I mean, jeez, people aren't even able to look at the source.
Get your Unix fortune now!
Yeah... its 'friends' like Symantec, who Microsoft is pushing out of the industry with Microsoft AntiVirus, Microsoft AntiSpyware and Microsoft AntiCompetitor
It's clear that Mozilla ACCEPTED that FireFox has MORE security bugs than IE...
You know what? Many people with unpatched systems are due to the fact that they don't have Windows Update activated at all, otherwise another story will be here.
Anyway, I have my XP system patched and after reading this crap I'll stay FAR AWAY from Mozilla shit.
A better measure would be vulnerability days. The idea would be to sum up across all exploits the number of days between the vulnerability being discovered and a patch being available.
This statistic could be refined by weighting each vulnerability according to its severity.
Of course, for IE we probably won't get good info on just when the vulnerability was discovered.
Mozilla's 'ability to react, find a solution and put it into the user's hands is better than Microsoft.'
Mozilla's ability to "put it into the user's hands" is NOT better than Microsoft's. For IE, all you have to do is go to Windows Update, and select the patch.. and it will automagically do everything for you (even more automatic if you have automatic updates turned on). With Mozilla, you must download the latest version of the browser (which usually has more stuff than just the bug fix you're interested in), uninstall the old one, and install the new one from scratch (including specifying options like install directory and other preferences Mozilla *should* already know and use).
Patches from Microsoft take more time (amongst other reasons) because they do more extensive regression testing than Mozilla.. how many times have I downloaded the latest FF only to find several things broken (especially extensions)?
To be sure, Microsoft's response time leaves much to be desired (I'd personally rather receive a fix as soon as it's available, rather than waiting for a once-a-month patch, for one), but Mozilla's process leaves much to be desired as well.
I am the maverick of Slashdot
From yesterdays article re: IE more secure blah blah
"There is one caveat: Symantec counts only those security flaws that have been confirmed by the vendor. According to security monitoring company Secunia, there are 19 security issues that Microsoft still has to deal with for Internet Explorer, while there are only three for Firefox.
Secunia: Errr MS, you have another security flaw in IE.
MS Employee: Really? OK, let me test the problem and get back to you with confirmation.
MS Employee to boss: We have another security flaw in IE.
MS Boss: Can we fix it??
MS Employee: It'll take a *insert long period here*
MS Boss to Secunia: Are you sure theres a flaw? We can't find a problem.
Haydn.
Time is an illusion. Lunchtime doubly so. - Douglas Adams
Ive read thatr article yesterday, (MEZ) and was shocked. IE more secure than firefox (which i use myself) ore mozilla? NO WAY. If you look closeley, the funding of that survey came out of a certain company in redmond.
Speaking of security, looks like Firefox 1.0.7 was just released sometime last night on Mozilla's web site.
If security problems are found faster, they can be fixed faster. We should get suspicious if no security problems are found any more. Then someone maybe tries to hide them, doesn't care, or development on the software just has stopped (the latter case would be obvious though).
So maybe we could use the time after a release until a security problem is found, and the number of security problems found as an indicator how good the security of the software is: The faster problems are found and the more problems are found the better the security. This might sound counter-intuitive, but not if you think about it. It shows that the _process_ of security is doing well.
I'm assuming you are using the 'free' versions of this software, otherwise igore the rest of this message!
Bearing in mind you are a non-commercial organization - and a worthy one - I would double check the licenses for these as far as educational and non-commercial organizational use is concerned. And perhaps a complimentary email to vendors for clarification where necessary?
SpywareBlaster looks OK for teachers.
Spybot I would confirm with author. They seem 'edu' friendly, from their tone.
AVG License is perhaps slightly ambiguous in this case. Schools are non-commercial but they are 'Organizations'.
Ad-Aware not free for educational use.
You may have omitted your firewall of choice but most of them have similar organizational clauses. I think Outpost Free may be OK.
You're aware that they freed it earlier in the week, right? http://opera.com/free/
Sounds familiar...
Not to say, Mozilla is wrong, but the point they are bringing up would've been better left "understated".
In Soviet Washington the swamp drains you.
Why such tripe is modded insightful is beyond me. Inciteful, maybe, but certainly not insightful.
We all know that sex sells.
So try to look at this site www.thelovesearch.com using Microsoft
Internet Explore. It will try to convince your to use Firefox using
sex appeal.
If we could convince all porn sites to only support Firefox the battle
would be won in a few weeks.
Or am I dreaming now ??
This is actually not right at all. Exactly at the time of the symantec report, FF had ONE exploit that was more critical than IE. In general they have less severe exploits, and A LOT less unpatched exploits. Check out the following links: Secunia IE vulnerabilities Secunia FF vulnerabilities As you can see, FF has 3 unpatched vulnerabilities, while IE has 19, the highest rated of these being more severe than FFs. I would say it is quite clear that FF has less unpatched vulnerabilities.
Let's set aside the "vendor acknowledged vulnerabilites" and discuss the one cold fact that matters: we don't really know what's secure or not in IE because we cannot check the source code. That allows an exploit to exist that not even Symantec knows about.
-- $G
It's not hard to see where Symantec's motivation is coming from. But in any discussion of computer topics, the mere fact of there being computers involved seems to make people say stupid things. So let's look at a simple non-computer-based analogy.
Bloggs Builders Ltd. build new houses with wooden window frames and doors and cheap, easily-picked rim locks. Fred Bloggs, the owner of Bloggs Builders, also happens to have a not insubstantial stake in Bettavue PVCu Ltd., manufacturers of a range of high-security PVCu replacement windows and doors.
Jones Family Homes Ltd. build new houses with PVCu windows and doors with multipoint locking as standard from day one.
When Bettavue produce a long list of statistics, comparing the relative security of Bloggs' and Jones' houses, who do you think they are going to favour?
Je fume. Tu fumes. Nous fûmes!
...Is that the average person uses Internet Explorer. The reason why there aren't as many holes in IE discovered could also be that some of the average users send in many more bug reports to Microsoft. When a userbase such as IE's is so huge, there is a great possibility that when an exploit is discovered, a large amount of users will come across the flaw, and at least one person will send in a report. But with Mozilla's Firefox, there is lower userbase, which also means there's a change only a few people will come across a flaw, but not report it. And on another note, I noticed any site can install themes to Firefox. Personally, I think it's a disaster waiting to happen there.
All these predictions about firefox and open source about security blah blah blah blah blah blah...
All the reports and studies and bickering don't matter much to me because firefox JUST WORKS.
When I start getting so much spyware and pop ups via firefox that my system is almost unbootable, I'll look for an alternative. For now, I have a browser that works reliably out of the box.
People make a million arguments that it's only seemingly safer because it's less popular. Well fine, until the day comes that it's so popular your predictions come true, I'm going to keep using it. And if your predictions do come true, people will either find another alternative, or force firefox to clean up it's act. Until that day...
Who am I going to trust, a browser that has proven itself historically to be a secure broswer, or one that tells me it is a secure broswer?
If an officer ever threatens to taze you, say you have a pacemaker.
Something to remember about the original report: Symantec has a vested interest in seeing Mozilla/Firefox fail.
Why? Because their line of products depends on Windows getting exploited and compromised. Firefox reduces the number of vectors through which that can (easily) happen.
~/ssh slashdot.org ssh: connect to host slashdot.org port 22: too many beers
I mean, fine, Mozilla may be able to quickly patch a sever security hole, but the fact remains that the severe security hole exists, AND as we have found among MS users, a patch does not necessarily make the platform secure, especially with the general apathy users have towards PC security and applying patches.
This is splitting hairs, Mozilla is on the defence and trying to diffuse this will bomb before it gets out of hand, by saing "Yeah, we have greater security flaws, but we can fix them faster". Don't cry about it, simply admit that your going through growing pains and will work hard to fix these issues as quickly as possible and prevent them in the future. Admit to your mistakes.
I don't believe that FireFox is less of a product then IE. Remember that IE has had a LONG history of security flaws, by now MS should have made IE bullet-proof, instead you still get a number of big security holes in IE, even if it is less then FireFox. The bottom line is, given the same amount of time for FireFox to mature, FireFox will be bulit-proof while IE still has major security issues 5 years from now.
I haven't thought of anything clever to put here, but then again most of you haven't either.
If saying that you patch faster is the only thing you have going for you then you have a problem, this may be the case for a while but Microsoft is making improvements here. It's not one of those excuses that makes you any better, just better than the next person, perception...
I'm using Opera anyway ;)
What is a coercive argument? Is it when Don Corleone claims to have a syllogism that you can't refute?
I think it's been mentioned before, but it bares repeating...
...Translation...M$ sits on exploits until they know they are in the wild...this we have pretty much expected, but this time we hear it from the horse's mouth so to speak...
Mozilla's reporting system is completely open to the public...nothing is really kept "under wraps" when it comes to reported bugs...
Microsoft's reporting system is closed...they sit on exploits that are not "in the wild"...
From Microsoft's own mouth...
In early July 2005, the project discovered its first exploit for a vulnerability that had not been publicly disclosed, the researchers said in the paper. The attack used the JView profiler vulnerability that Microsoft announced later in July.
Symantec's report counts up only the vulnerabilities acknowledged by the vendor. If you don't want to have a vulnerability included in their study, just don't acknowledge it. If you go to Secunia and add in all the unacknowledged vulnerabilities (but that are still known to the public), you find out that Internet Explorer has had more vulnerabilities in the same amount of time than Firefox. My thanks to Bruce Perens for pointing that out.
- David A. Wheeler (see my Secure Programming HOWTO)
"Mozilla's ability to react, find a solution and put it into the user's hands is better than Microsoft."
This from the folks who wanted us all to "run to FireFox" because it was safer than IE. Well guess what, it doesn't matter how fast you fix'em. If you have a vulnerability, you are at risk. Whether it takes a week or three months, yer still vulnerable and attacks are still happening.
Joint the rat-race, FireFox.
It's called "learning from experience". :-)
Mainframe/UNIX Bit Twiddler and long time Windows/Linux Hobbyist.
The Theorem Theorem: If If, Then Then.
Troll through ZD's (and other cnet) pages and see who's buying their ads. Microsoft, Symantic, Vonage... see any Mozilla ads anywhere?
Follow the money. There is no longer any such thing as "journalistic integrity," if there ever was such a thing.
Symantec, as a corporate whole, did what all people who can't write software do. They switched over to making reports. Since nobody every crashed from reading a defective report, this allows them to hide their incompetence.
Honestly, I'd rather just take Ballmer's word for it rather than relying on Symantec, much like I'd rather have a virus than to let Norton do what it does to PCs its installed on.
MS is like communism, if there is a problem, we suppress it, and the central planner will let you know when an update is released.
Mozilla is like libertarianism. There's a problem, YOU are free to fix it. Someone else may fix it and share their solution.
Unfortunately, your comment is very true, and becoming more so with the current political environment.
I'm all for closed software but, I think it should be on open footing with open source. Full disclosure provides the only long term protection.
----- If communism is a system where the government owns business, what do you call a system where business owns govern
... is that after I switched to Firefox, Ad-aware started finding a lot less malware when I scanned the system, compared to when I was running IE. It seems to me that all the security holes that are found and reported seldom have any impact on my system at all.
http://www.softwareconsult.dk
What site do you guys go to get infected by just browsing? I've used Netscape 0.97 to the latest browsers and in all my years of using a web browser, I have never had a virus infection. Now I have used KAZAA, BitTorrent and the files you download are often infected with malware. So my guess is if you ever did manage to get infected by simply browsing it's probably your fault and no matter what browser you were using you would have gotten infected anyway by going to www.hackmydumbass.com.
So first it was "Firefox is secure", then "Firefox is more secure than IE", and now finally "Firefox patches come out faster than IE". Nice slippery slope the Mozilla fanboys have going there.
I don't really care who wins the browser wars but the events of recent months have only gone to show that it is market share, not software engineering, that is the deciding factor in browser vulnerability.
If it is so swift at responding to security, then why did it take 7 years to notice and fix a critical vulnerability? Furthermore, if the developers care so much about security, then why the organization allows certain people in the bug group to censor security flaws within Mozilla's projects, thus making users vulnerable to browser bugs for YEARS? Is it one of those M$ scheme designed to destroy the hard-earned reputations of the browser?
It is one thing to have old bugs, but it is another matter when Mozilla developers being hypocritical when they allow such moronic security practice to take place. Long live IE!!!
"The facts Symantec have stated are true, but they've used them to try to convince the reader that switching to Firefox isn't going to help obviate the need for Norton Antivirus/Internet Security/AntiSpyware, and *that's* the lie."
I guess you're trying to say that Symantec hasn't provided any data that shows anybody cares enough about firefox to exploit the security holes in the code. This is the only logical conclusion I can reach based on your comments anyway. Data clearly shows that firefox has exploits. You say there is no need for countermeasures. Therefore, no one cares enough about firefox to exploit its bugs.
Vote for Pedro
Fire Fox is more secure because it is more restricted. By this I mean that I have set up FireFox to prompt me on every cookie that a website tries to set. and I have used this to deny Mediaclick and adserve. I also use extentions like adblock and a few others to tell me where I am and to block Ads that I do not want to see. With Internet Poopyplorer I have to spent more money that is worth it to secure it to the same level that the Default install for win FireFox is without being sued. So I feel that Symantic is just working on FUD because Spybot and AdAware Personal are phaseing it out. Heck the only thing I would even think about using is System Works and mabey a new version of Ghost... But 5.1c still works beter than 2005
IT Specialist - Nottawaseppi Huron Band of Potawatomi Indians