Slashdot Mirror


Firefox Users Surf Safer

SenseOfHumor writes "According to two University of Washington Professors, Firefox users have a safer browsing experience than users of IE. These researchers sent their crawlers to 45,000 websites and studied the impact on Firefox and IE." From the article: "Levy and Gribble, along with graduate students Alexander Moshchuk and Tanya Bragin, set up IE in two configurations -- one where it behaved as if the user had given permission for all downloads, the other as if the user refused all download permission -- to track the number of successful spyware installations. During Levy's and Gribble's most recent crawl of October 2005, 1.6 percent of the domains infected the first IE configuration, the one mimicking a nave user blithely clicking 'Yes;' about a third as many domains (0.6 percent) did drive-by downloads by planting spyware even when the user rejected the installations."

240 comments

  1. Or 100% if its a new installation... by Anonymous Coward · · Score: 0, Informative

    Installing from an original Windows XP CD, I get infected before I can apply windows patches, without vising *ANY* websites! ARGH!

    1. Re:Or 100% if its a new installation... by caffeination · · Score: 1, Funny

      What a clown you are! Everyone knows you aren't meant to connect Windows XP to the internet! It's like putting your figure in a power socket!
      EndElitismSection

    2. Re:Or 100% if its a new installation... by Durinthal · · Score: 2, Informative

      It may be flamebait, but it's true. About a year ago I was helping set up a friend's computer with a clean install of XP, and a couple of minutes after first booting it was already infected, despite never opening a browser.

    3. Re:Or 100% if its a new installation... by 1point618 · · Score: 2, Insightful

      Then why don't you unplug the ethernet port on your computer until you've changed the "internet options" to be more secure and are ready to download updates? It's really not that hard.

    4. Re:Or 100% if its a new installation... by Anonymous Coward · · Score: 0

      What? I'm not supposed to put my finder in a power socket? Man, the world keep on a changin'.

    5. Re:Or 100% if its a new installation... by Anonymous Coward · · Score: 0

      How about you suck at teh intarweb, I never get infected. Maybe because of that cash grant I gave BillyG....

    6. Re:Or 100% if its a new installation... by drinkypoo · · Score: 4, Informative

      Heh heh. Here's how you avoid that: On XPSP1 installs, turn on the firewall before connecting. On XP without SP, you use the IP Filtering option, which has been there at least since NT4, and probably 3.51. Filter all incoming connections of all three filterable types (ICMP, TCP, UDP.)

      I know you were just making a funny but maybe this will help someone clueless... or, if you were serious, someone more clueless.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    7. Re:Or 100% if its a new installation... by Anonymous Coward · · Score: 0

      For a flaw in the OS itself, changing the internet options isn't going to do anything for you. As soon as you connect to the internet to download the updates, you're in a race you're not going to win.

      A better idea is to keep a hardware firewall handy.

    8. Re:Or 100% if its a new installation... by rts008 · · Score: 1

      "It's like putting your figure in a power socket!"
      I hope that you meant "finger", as I doubt that there are many power sockets that could handle a typical /.er's figure! LOL!!

      --
      Down With Slashdot BETA!!! I've been around the corner and seen the oliphant; you can only abuse me from your perspecti
    9. Re:Or 100% if its a new installation... by Anonymous Coward · · Score: 0

      The same happened to me a year ago. That was my last windows install.

      Users should not be expected to know that they need to block all incoming internet connections before going online. No matter how many howto's are printed about it, it is frustrating and ridiculous that it should happen at all.

    10. Re:Or 100% if its a new installation... by Anonymous Coward · · Score: 1, Informative

      A better idea is to keep a hardware firewall handy.

      Or even better yet, keep a copy of SP2 slipstreamed into Windows XP. Saves alot of time with having to patch too.

    11. Re:Or 100% if its a new installation... by pullmyfinger · · Score: 1

      Nice post. I didn't know you could do this during an install but am eager to try it out on a machine exposed directly to the internet (no firewall/router protection). Mod parent up (no more points, sorry!).

    12. Re:Or 100% if its a new installation... by Aeiri · · Score: 2, Informative

      big deal...last year, you could install a fresh linux server install while connected to the internet, and within 5 minutes 2 scripts running out of the west coast would have your root password changed...we tested it first hand several times with red hat...intall it while connected to the ethernet through a router/firewall ot the internet...and boom...root password changed within 5 minutes. The sources of these scripts were california and alaska..and there are/were many more like it that we researched and found.....so by the logic on this board, linux is now crappy insecure bloatware constructed by an evil corporation.....

      I'm not quite sure what to say to that...

      I don't think you could have a telnet server running on a system with a blank root/admin password behind a router and get hacked in 5 minutes, that's Windows, Linux, FreeBSD, Solaris... ANYTHING.

      Even if your router is extremely old and unsupported, people probably won't have worms/malware/viruses/whatever searching for routers like that constantly, that's absurd. New-ish and Newer routers are usually supported by their company, so I'm not quite sure what you are talking about.

      I've had a fresh install of Windows XP installed on my network (behind a router), no SP1, no SP2, no patches, no firewall, nothing, and it has never been infected by viruses (I periodically run HouseCall and NAV, which has auto-protect disabled), spyware (at that time I also run spybot (no teatimer), adaware and a couple other spyware removal things on it), or any type of malware on it.

      It's been up for years, and it's never had any problems. Considering the proliferation of Windows attacks out there, the router seems to be more than enough to protect that PC. How in the world did Linux of all things (small marketshare, I'm not going to get into a security discussion) get rooted in 5 minutes?

      Mods, your Insightful rating for this post was way off. I call -1, Bullshit.

    13. Re:Or 100% if its a new installation... by hazem · · Score: 4, Insightful

      Why are you installing XP (or any other OS) with it directly connected to the internet?

      Get a router with NAT to block most of the bad stuff - and heck, disconnect IT from the internet. Get the computer working and as much security in place before going online with it.

      A simple netgear or linksys router provides tons of protection and costs about $50... definitely worth the time saved from reinstalling windows once or twice.

      If you're really paranoid, download the security patches and burn them to CD so you can install them without going online.

    14. Re:Or 100% if its a new installation... by drinkypoo · · Score: 1

      You can do it right after the install, before you connect. If you are using a version of XP requiring activation, then tell it you want to activate later, log in, make the changes, THEN activate. You can't do it during the initial install that I know of, although it SHOULD be possible to make your own automated install disc (fun job! what a PITA!) that will not only answer questions for you, but will have SP2 in it, avoiding the whole problem entirely.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    15. Re:Or 100% if its a new installation... by jred · · Score: 1

      If you choose to manually set up networking during the install, you *should* be able to set up filtering then.

      --

      jred
      I'm not a mechanic but I play one in my garage...
    16. Re:Or 100% if its a new installation... by Firehed · · Score: 2, Insightful

      Someone needs a router, methinks. Just because your software firewall isn't running doesn't mean the hardware firewall isn't.

      --
      How are sites slashdotted when nobody reads TFAs?
    17. Re:Or 100% if its a new installation... by pclminion · · Score: 4, Informative
      He might not be bullshitting (well, the part about being firewalled might be crap). Back in the late 90's I had a Red Hat machine get rooted before it was even done installing. I'd configured the network information with a public IP address, there was no firewall. Flaw in ftpd if I remember right. Since then I leave the network unplugged until the install is complete and I've got the network set up safely.

      I don't remember the particular release of Red Hat.

    18. Re:Or 100% if its a new installation... by Anonymous Coward · · Score: 0

      Or you can use a Knoppix CD to download the service packs and various patches onto your USB disk, then install those before connecting to the net with Windows.... oops, Microsoft.com does not allow you do do that does it?

    19. Re:Or 100% if its a new installation... by atokata · · Score: 1

      Mod parent up. Everytime I see that stat saying, "WinXX will be infected x minutes after installation!" it just makes me want to beat my head. Sweet zombie Jesus, is it so hard to exercise proper protocol when you set these things up? Yes, windows sucks hard and fast, but as technologists, we've got to work around it.

    20. Re:Or 100% if its a new installation... by Anonymous Coward · · Score: 1, Insightful

      > Filter all incoming connections of all three filterable types (ICMP, TCP, UDP.)

      Wow, that'll REALLY make it easy to download the patches, Spanky.

      I mean, downloading the patches IS the reason you'd have it networked right after an install but before patching, right?

    21. Re:Or 100% if its a new installation... by caffeination · · Score: 1

      That's the weirdest fucking typo I've made in a while. I'm probably going to obsess for hours over it too - it's a pretty bad mistake. Thanks for pointing it out though mate.

    22. Re:Or 100% if its a new installation... by HairyCanary · · Score: 1, Troll
      Mod parent down. The vast, vast majority of Windows XP users are clueless. None of these things suggested come naturally to them. I can't fathom what would happen if I asked my mother to keep a CD of security patches handy, enable the software firewall, don't connect the cable until she's protected, etc... She can install the OS if need be, but that's about it.

      The real solution -- Microsoft should be sending free updates to all registered XP owners with updated CD's that contain pre-patched installations.

    23. Re:Or 100% if its a new installation... by atokata · · Score: 1

      Mod parent down. The vast, vast majority of Windows XP users are clueless. None of these things suggested come naturally to them. I can't fathom what would happen if I asked my mother to keep a CD of security patches handy, enable the software firewall, don't connect the cable until she's protected, etc... She can install the OS if need be, but that's about it. I understand what you're saying, and I do agree. The vast majority of XP users do not know proper security procedure to keep from fucking things up. Much the same way that the vast majority of automobile owners don't know the proper procedures to keep their vehicals running correctly.

      However, unlike computers, when a car owner encounters even a basic problem ("I need new oil/tires/shocks/headlamps") they don't just half-ass it themselves, they take their expensive machine to a qualified mechanic.

      Just because your mother can install the OS doesn't mean that she knows how to do it correctly, any more than a novice would know how to change their own oil in their car.

      It's long been obvious that there are two different types of computer users. Those who "just want it to work" and those who "want to know *how* it works." To continue my car analogy, those who just want it to work should open their wallets and hire a good mechanic. Those who want to know *how* it works will be willing to spend the time and effort to get it right.

      If you don't want to know how it works, then you probably shouldn't be doing your own upkeep, modifications, and tinkering, regardless if the machine is a car, a computer, or an other technologically complex machine. The real solution -- Microsoft should be sending free updates to all registered XP owners with updated CD's that contain pre-patched installations. Now *that* is a good idea.

    24. Re:Or 100% if its a new installation... by rts008 · · Score: 1

      No problem...honestly wasn't trying to be a Grammar Nazi!
      The mental image that came up had my rib muscles (ouch!) cramped from laughing too hard! :) I thank you for that, sir!

      --
      Down With Slashdot BETA!!! I've been around the corner and seen the oliphant; you can only abuse me from your perspecti
    25. Re:Or 100% if its a new installation... by Anonymous Coward · · Score: 0

      "2 scripts running out of the west coast would have your root password changed"...as a public service and to prove your point, perhaps you should identify those two IPs. Or is this third hand anecdotal, or are you a legit security guru who wishes to remain AC? If the former, ho humm,troll, the latter, you are smart enough to post really anon, so give the alleged IPs of the alleged malicious script spewers.

    26. Re:Or 100% if its a new installation... by InsaneGeek · · Score: 1

      When I went to a Sans conference years ago (think it was maybe 02??) for their forensic track they had the guys from the honeynet project present. They had a Redhat box found and rooted not in 5 min, but around 15-20 (that was the fastest time for Linux). Really all that is required is finding an older one, rooting is really easy with all the point and drool rootkit out there.

      I think you'd be really amazed at the sweep scans going toward your box all the time; majority of them are targetted towards greatest probability (i.e. Windows) but I've seen it personally happen where a guy (who should have known better) started a Linux install in the DMZ went for a long vendor lunch and when he was back someone had found it and gotten into it.

    27. Re:Or 100% if its a new installation... by setagllib · · Score: 2, Interesting

      Speaking of being clueless, ICMP and UDP are connectionless. TCP is the only one of the three protocols you mentioned which *does* maintain a bidirectional state on the protocol layer. So while it's nice that you think you've got it all worked out by using the pitiful filtering capacity you get out of the box... you still fail at the internet.

      --
      Sam ty sig.
    28. Re:Or 100% if its a new installation... by Mistshadow2k4 · · Score: 1

      Get patches here & burn them to cd. May seem a bit obvious, but lots of folks don't know where to get patches for Windows except from microsoft.com, which (unless it's changed recently) you can't make backups of.

      --
      I dream of a better world... one in which chickens can cross roads without their motives being questioned.
    29. Re:Or 100% if its a new installation... by Mistshadow2k4 · · Score: 1

      Well, for some reason the link turn out right right, crap. Sorry about that. Trying again: Windows patches

      --
      I dream of a better world... one in which chickens can cross roads without their motives being questioned.
    30. Re:Or 100% if its a new installation... by zCyl · · Score: 1

      Mod parent up. Everytime I see that stat saying, "WinXX will be infected x minutes after installation!" it just makes me want to beat my head. Sweet zombie Jesus, is it so hard to exercise proper protocol when you set these things up? Yes, windows sucks hard and fast, but as technologists, we've got to work around it.

      Yeah, by installing Linux. When an operating system can't even install and update itself in a networked environment without become an infected cesspool, then it's the fault of the operating system, not the user.

      "Proper protocol" should not have to be to have a spare computer around to download patches, or for all users to keep an external hardware firewall in stock for installations. This would be like having to get a tow truck to tow a new car home before starting it for the first time, rather than driving it off the lot.

    31. Re:Or 100% if its a new installation... by Phroggy · · Score: 1

      You can certainly download Service Pack 2 from their web site. I have it burned on a CD. Installing it is usually the first thing I do when working on an XP machine that doesn't already have it.

      --
      $x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
      $x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;
    32. Re:Or 100% if its a new installation... by Anonymous Coward · · Score: 0

      Nah, it's cause you're so anonymous the hackers don't know where to find you.

    33. Re:Or 100% if its a new installation... by chaoticgeek · · Score: 0

      Ya, I know what you mean, I did a fresh install the other day of XP and I am on my University's network. I had a virus no more than 5 minutes after I booted up and started to install everything. Thats why the first thing I ever install is my most recent backup of AVG then my firewall. Otherwise I will have to deal with so many problems in the long run.

      --
      hello
    34. Re:Or 100% if its a new installation... by Babbster · · Score: 1

      The worst part of this seemingly simple precaution is that broadband providers don't force the manufacturers of their hardware to provide DHCP/NAT right inside the "modems" they send out to their customers. Installation in such a situation would be no harder than a direct connection (just a matter of putting different numbers into the Windows network settings) and it would seem likely to save these ISPs a lot of money in terms of support. As far as I know, there's no reason this couldn't be done except that those hardware manufacturers want to be able to sell their router hardware separately.

      This of course wouldn't be a replacement for a good firewall but according to everything I've read on the subject, NAT protection is more than enough to get a user through a Windows installation without getting "owned," allowing their first infection to occur when they open that e-mail attachment calling itself a free screensaver...

    35. Re:Or 100% if its a new installation... by Anonymous Coward · · Score: 0

      Because they insist their edonkey/kazaa/bittorrent software is definitely slower behind a nat?

    36. Re:Or 100% if its a new installation... by cbiltcliffe · · Score: 1
      Try reading it again...

      Filter all incoming connections
      Won't affect your outgoing connections to download updates at all.
      --
      "City hall" in German is "Rathaus" Kinda explains a few things......
    37. Re:Or 100% if its a new installation... by Cal+Paterson · · Score: 1

      I love unix (it's all I use) but we're not quite at the "offer to everyone" level. We really just need to iron out the kinks. Ubuntu and a couple of others are really close, but I'd really like to see them ready for when Vista is released (and it looks like its gonna happen).

    38. Re:Or 100% if its a new installation... by Cal+Paterson · · Score: 1

      Hmmm. Alot of these mistakes come from starting things like your httpd or sshd before you're actually secure. It sounds like someone at Red Hat made a mistake.

    39. Re:Or 100% if its a new installation... by petermgreen · · Score: 1

      well with udp you can just reject if the ip/port combinations don't match a packet you've sent recently.

      --
      note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
    40. Re:Or 100% if its a new installation... by Briareos · · Score: 1
      it SHOULD be possible to make your own automated install disc (fun job! what a PITA!) that will not only answer questions for you, but will have SP2 in it, avoiding the whole problem entirely.

      Well, creating such a disc is a piece of cake with nLite...

      np: Maurizio - M04A (Full 12" Length) (M Series)
      --

      "I'm not anti-anything, I'm anti-everything, it fits better." - Sole

    41. Re:Or 100% if its a new installation... by drinkypoo · · Score: 1
      The point is that you don't need any incoming connections. All of the connections you need to make to run windows update etc are outgoing. There will probably not be any UDP or ICMP traffic anyway - at least, not anything desirable. Meanwhile, there might be a hole in something that can be exploited with a UDP or ICMP packet (at minimum, DoS.)

      Oddly enough, I am aware of the difference between TCP and UDP. Fuck, I even know what they stand for, and what the other three protocols in the TCP/IP protocol suite are. Where's my cookie?

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
  2. Who cares? by Arthur+B. · · Score: 3, Interesting

    Everyone knows that... I mean if a user has an idea what spywares are and heard of firefox he probably uses it, if not this study won't change anything.

    --
    \u262D = \u5350
    1. Re:Who cares? by OneSeventeen · · Score: 5, Insightful

      So if I user never heard of Firefox, but has heard of spyware, this study won't change anthing? I work in a department that switching to Firefox would solve 25% of the tech support calls, but the users still insist on IE because they don't know the severity of the situation, and also don't even know what Firefox is. This article will actually help to prove to the non-techies that switching would be a good idea.

      --
      "Now the trouble about trying to make yourself stupider than you really are is that you very often succeed." -C.S. Lewis
    2. Re:Who cares? by VENONA · · Score: 1

      If you're an admin, small-company Security Officer, orthe like ,the problem remains effectively communicating it to the users. How many will stumble across an obscure piece of Yahoo news on their own? I just (2330 hours UT Feb. 10) checked news.yahoo.com, and and the article has already rolled off the front page, if it was ever there. And it was datelined "By Gregg Keizer
      TechWeb.com Thu Feb 9, 2:15 PM ET". So I went to techweb.com, and didn't find it there, either.

      And of course the people who read TechWeb are probably less likely than most users to have a problem. Not that I'm a fan of the site, or their various 'pipelines'. At the end of the day, the news just isn't widespread enough, and it never has enough hang time. It's still a matter of either go do yet more face time, or send yet another mail which will largely go unread.

      So, while it's good to have a recent argument on your side, it only helps so much.

      --
      What you do with a computer does not constitute the whole of computing.
    3. Re:Who cares? by LordSnooty · · Score: 1

      Hopefully it'll be more useful to the tech workers who have to support those blithely clicking yes, by giving them some ammunition to take to management, in the hope of convincing them to deploy FF across the enterprise. "It's not just geek fanboys saying it, look at the stats"

    4. Re:Who cares? by Bert64 · · Score: 3, Interesting

      I've used firefox since it was called phoenix, and beta versions of mozilla before that... I'd never heard of spyware until quite recently, i also didn't really understand the concept of popups and other intrusive stuff...
      I went from amigaos (fast browsers with no javascript) to unix with mozilla (and popup blocking by default) and never encountered things like popups and spyware, i had a rose tinted view of the internet...

      Then i went to a friend's place, and saw him battling with IE... i was absoloutely disturbed, how could anyone's experience of the web be so horrendous, and yet he was still willing to use it!
      Had i first experienced the internet in that way, i'd not have had much interest in it at all.

      --
      http://spamdecoy.net - free throwaway anonymous email - avoid spam!
    5. Re:Who cares? by Anonymous Coward · · Score: 0

      You're right. I certainly don't care.

      --
      http://www.objectivedevices.biz/ Knives Canada - Knives, daggers, boot knives, throwing knives

  3. ORLY? by Anonymous Coward · · Score: 0, Redundant

    No way. I never would have noticed, I mean, with me using Firefox on an unprotected windows system/u> for over a year, and not getting a single virus/piece of spyware.

    1. Re:ORLY? by Anonymous Coward · · Score: 0

      If by unprotected you mean that you don't use spyware detectors or destroyers or anti-virus protection or any kind of firewalling, I must ask:

      How would you know?

  4. Post this in Public Somewhere by neonprimetime · · Score: 4, Insightful

    Could somebody with power please post results like this somewhere that the general public would see?
    Slashdot readers already know this!

    This needs to be in USA Today, New York Times, on Fox News, CNN, local newspapers, local news, etc.

    Then it would actually mean something.

    1. Re:Post this in Public Somewhere by pl1ght · · Score: 2, Insightful

      You mean like make Firefox the most used browser in the world and in turn become the highest targeted browser for these types of things? Its just a flip flop scenario.

    2. Re:Post this in Public Somewhere by commodoresloat · · Score: 1
      Could somebody with power please post results like this somewhere that the general public would see?

      Sure! I'll rush over to kuro5hin with this right away!

    3. Re:Post this in Public Somewhere by CyricZ · · Score: 2, Informative

      If we're dealing with solid software, written by those with a clue, a lack of security should have no relation to the market share.

      Look at Apache, for instance. It is used by an estimated 60% (if not more) of all web sites. But we rarely hear about serious security issues. Sure, bugs and exploits do crop up occasionally, but nowhere near at the rate of its competitors.

      Likewise, if Firefox is a well-written application, then it should be secure if it has one user, or if it has hundreds of millions of users. Unfortunately, the recent 1.5.x release of Firefox went poorly, and many these days are doubting its degree of security. A rushed development cycle, built upon a base that isn't exactly ideal, can lead to security issues.

      Let me reiterate: the security of a program is based on its development process and developers, not on the number of users it has.

      --
      Cyric Zndovzny at your service.
    4. Re:Post this in Public Somewhere by Ruff_ilb · · Score: 1

      Furthermore, Firefox devs are not-for-profit (afaik). They're attached to the browser, not the paycheck, so bringing in more users will increase support and bring in more devs that will work harder. You don't have the "Ok, we dominate the market, we can slack off now" mentality that you do with MS.

      --
      http://www.TheGamerNation.com/Forums
    5. Re:Post this in Public Somewhere by TheRaven64 · · Score: 2, Informative
      I wonder if you are familiar with the phrase 'ex falso quodlibet.' If FireFox is a well-written application, then it should be secure. Over the last year or two, however, I have noticed a strong tendency amongst the developers to prefer adding features to fixing 'minor' bugs.

      Ever wondered why OpenBSD is so secure? In part, it's because they don't differentiate between bugs which they know how to exploit, and ones they don't. If they find a bug, they categorise it and scour the code base for instances of the same class of bug. Then they go back to adding features. Then, when someone else works out a way of exploiting that kind of bug, they find that OpenBSD is not vulnerable.

      If a program is well written, then exposing it to a larger audience will make it a larger target, but it will still be difficult to hit. If it is not, then more exposure makes it an easy, and more attractive target.

      --
      I am TheRaven on Soylent News
    6. Re:Post this in Public Somewhere by Cl1mh4224rd · · Score: 1
      Furthermore, Firefox devs are not-for-profit (afaik).
      The Mozilla Foundation is not-for-profit, but that doesn't mean the main developers don't get paid.
      --
      People will pass up steak once a week, for crap every day.
    7. Re:Post this in Public Somewhere by Anonymous Coward · · Score: 0

      "... Let me reiterate: the security of a program is based on its development process and developers, not on the number of users it has."

      Bzzzzt,ThankYouForPlaying...

      What you have listed is a way to plan for security. It does not actually guarantee that "it" will be secure.

      Actual "security" is a trait that must be demonstrated. Assuming that the study cited here was setup in a valid fashion, you can not question the demonstrated trait; Firefox is more secure.

      Will it be more secure tomorrow? No one knows.
      (We might have some guesses. My guess is that it will demonstrate a higher level of security then IE a year from now.)

    8. Re:Post this in Public Somewhere by advocate_one · · Score: 1

      so what desktop are you running on top of that openbsd kernel then??? a fully bug fixed KDE 1??? or are you keeping things simple and sticking with the default command line...

      --
      Donald 'Duck' Dunn: We had a band powerful enough to turn goat piss into gasoline.
    9. Re:Post this in Public Somewhere by WhiteWolf666 · · Score: 1

      You have to qualify this statement: "Firefox is more secure."

      Firefox 1.0.5 is more secure than IE 6, unpatched.

      Not that I'm not a Firefox advocate, I'm the largest anti-MS hack out there. But make sure you make controlled statements you can backup.

      --
      WhiteWolf666 an exBush supporter. All you new-school,compassionate,save the children Republicans can rot in hell
  5. a quiet sense of dread... by revery · · Score: 0, Redundant

    Please dear God, let there be no "Hang 10" jokes in this thread...

    1. Re:a quiet sense of dread... by digitaldc · · Score: 2, Funny

      Please dear God, let there be no "Hang 10" jokes in this thread...

      Well you asked for it....

      The reason why Firefox is safer is that you don't have to 'hang 10' seconds while the domain infects the first Internet Explorer configuration.

      --
      He who knows best knows how little he knows. - Thomas Jefferson
  6. Targeted links to adware sites cropping up? by Jim+in+Buffalo · · Score: 0

    In a geek-oriented web forum that I help to moderate, I noticed a post that linked to a Russian website with graphics of the solar system (probably stolen), something that a lot of geeks might go and take a look at, particularly the younger ones. I didn't notice anything weird about the site, other than its blandness and lack of any real substance, until I glanced at the source code and saw the obfuscated link in a hidden iframe that pointed to a toolbar installer site. I quickly deleted the entire post, but I have to wonder if this is going to be a new tactic. Should forum administrators block links to websites in the former Soviet Union?

    --
    This sig, aah-ah, is comin' like a ghost-sig...
    1. Re:Targeted links to adware sites cropping up? by drinkypoo · · Score: 1, Flamebait

      No, they should advise their users to use a real browser and then let them do what they will. Unless you consider yourself a babysitter, or your T&C doesn't specify that you are not responsible for the content of external links...

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    2. Re:Targeted links to adware sites cropping up? by Jim+in+Buffalo · · Score: 1

      Yeah, it didn't affect me at the time because I was on a Mac, and, of course, I use Firefox when on Windows unless absolutely necessary, like a good little nerd.

      --
      This sig, aah-ah, is comin' like a ghost-sig...
    3. Re:Targeted links to adware sites cropping up? by GuidoW · · Score: 1

      Should forum administrators block links to websites in the former Soviet Union?

      Bah. I've seen plenty of bad sites from the US. Occasionally, I see a pretty interesting site from russia. (Famous example: http://www.artlebedev.com/portfolio/optimus/) I think blocking all russian sites would be shooting yourself in the foot.

      --
      If it's so secret, then how come I've never heard of it?
    4. Re:Targeted links to adware sites cropping up? by Anonymous Coward · · Score: 0

      Block Russian sites? Not a great idea- great cinema is flowing out of the former Red.
      Anyway, all you can do is tell as many people as you can that IE isn't as secure as they might thing, point them to the alternatives like FF and let them make up their own mind. Anyway, where would we, (who charge idiots to remove spyware for them), be if they all used FF?

    5. Re:Targeted links to adware sites cropping up? by Grimboy · · Score: 2, Insightful

      Yay, nationalism! Let's just treat people in one country different for people from another!

    6. Re:Targeted links to adware sites cropping up? by j79zlr · · Score: 1

      In Soviet Russia, Spyware installs YOU!

      --
      I'm not not licking toads.
    7. Re:Targeted links to adware sites cropping up? by ThePengwin · · Score: 1

      Well i for one dont live in soviet russia...

      Such a wierd place It would be to live... So opposite :P

  7. It just goes to show by Tufriast · · Score: 0, Troll

    Quality is quality, and education is education.
    I can't stress how much this figure impacts people who DO NOT have the money to upgrade their systems. Firefox is a boon to these people.
    While Microsoft is demanding more money for more protection, it is a reassuring thought that at least there is one benevolent group willing to make strides for all computer users.
    As a note, Katrina victims/poorer folks who survive disasters need internet access to get maintain any sort of life period. I've seen it first hand. They do not have the time to hunt, peck, and spend on software that is defective.

    --
    Help me, help you. - Jerry McGuire
  8. How Firefox fared by yfkar · · Score: 3, Insightful
    "In the same kind of configurations, Firefox survived relatively unscathed. Only .09 percent of domains infected the Mozilla Corp. browser when it was set, like IE, to act as if the user clicked through security dialogs; no domain managed to infect the Firefox-equipped PC in a drive-by download attack."

    So we can say that if you don't explicitly accept anything, you're safe with Firefox. Pretty much what I expected.

    I wonder what the numbers will be for IE 7.

    1. Re:How Firefox fared by skoaldipper · · Score: 1
      How IE fared?

      "1.6 percent of the domains infected the first IE configuration, the one mimicking a naive user blithely clicking 'Yes;'"

      That's not so alarming, as you have a choice.

      "(on IE) about a third as many domains (0.6 percent) did drive-by downloads by planting spyware even when the user rejected the installations."

      That IS, as you have no choice.
      --
      I hope, when they die, cartoon characters have to answer for their sins.
    2. Re:How Firefox fared by drinkypoo · · Score: 1

      People running the IE7 beta have already been owned through it. The browsers not even out yet and there's remote exploits already! Now THAT is innovation.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    3. Re:How Firefox fared by steeviant · · Score: 1

      Don't worry, it's just Microsoft testing some pre-release exploits ready to boost sales of their ONEcare package.

      We all know the problems Microsoft have had with quality control in the past, they just want to be sure they have all the kinks ironed out of their malware so that they can be sure have some Vista exploits to point to when they want to scare users into subscribing to their protection racket.

  9. Re:Also in the news: by jcgf · · Score: 0, Offtopic

    and rivers flow downstream.

  10. DUMBASS ZONK by Anonymous Coward · · Score: 2, Funny

    WTF IS AN EXPERICE?

    1. Re:DUMBASS ZONK by steeviant · · Score: 1

      EX-PE-RICE (pronounced XP rice) is Microsoft's new experiment in creating food. XP rice tastes ok, but is a disconcerting shade of blue, starts to rot as soon as you open it, and is prone to becoming infected with parasites that were thought to be extinct for many years as soon as it's exposed to air.

  11. How about a four-way matchup... by PFI_Optix · · Score: 5, Insightful

    From TFA:

    "We can't say IE is any less safe," explained Levy, "because we choose to use an unpatched version [of each browser.] We were trying to understand the number of [spyware] threats, so if we used unpatched browsers then we would see more threats."

    I hope they used a very old version of Firefox. Comparing FF1.5 to an old unpatched version of IE is hardly a fair comparison.

    They should have patched both browsers and had them run the same crawl. Then we could see how each browser in its most current state handles spyware, and how much each one has improved via patch releases.

    --
    120 characters for a sig? That's bloody useless.
    1. Re:How about a four-way matchup... by techno-vampire · · Score: 2, Insightful

      Your quote from TFA shows something very important: by pointing out the limits of their experiment, they demonstrated that they weren't just interested in spreading FUD about IE. Not that I'm a fan of IE or anything; I've been using Firefox for several years now. I just like to see objective studies, properly reported.

      --
      Good, inexpensive web hosting
    2. Re:How about a four-way matchup... by alan.briolat · · Score: 1

      Unfortunately, I don't think that would simulate "normal" users too well - most non-techs do not update their anti-virus, do not download patches (unless they have a computer that was pre-installed with SP2 and they accepted default update settings, which isn't as many as you would think) etc etc. Unpatched browsers and operating systems are usually a good simulation.

      I suppose it depends on what you are aiming to do - if you want to test for what can get through latest revision browsers, then yes, patch them. But if you are trying to show how vulnerable an average user is, don't.

      --
      I swear we should be allowed to give mod points to sigs... "-1, Offtopic"
    3. Re:How about a four-way matchup... by krunk4ever · · Score: 1

      Well, normal users don't switch to FireFox either. But I can totally see if you're willing to give FireFox a try, then you would've been downloading IE patches already.

    4. Re:How about a four-way matchup... by Spy+Hunter · · Score: 5, Informative
      They used computers running Windows XP without Service Packs 1 or 2. They tested IE 6.0 (no details about any patch installs separate from the [lack of] service packs) against Firefox 1.0.6. This is all from their paper (warning pdf), which has numerous other details.

      Somebody should start a news site that takes all the top news stories, finds the original research or primary source, and links to that instead of the dumbed-down yet sensationalistic news wire blurbs and blog whores. I know I'd appreciate it.

      --
      main(c,r){for(r=32;r;) printf(++c>31?c=!r--,"\n":c<r?" ":~c&r?" `":" #");}
    5. Re:How about a four-way matchup... by laffer1 · · Score: 1

      Yes and i think thats a problem with the pro firefox movement. People still need to patch IE because so many applications use IE's rendering engine for other content. Windows update (or the new Microsoft update) are your friends. If software is built into your operating system, someone might be able to use it to gain control of your machine. It still needs to be patched.

    6. Re:How about a four-way matchup... by P3NIS_CLEAVER · · Score: 1

      Come on now, auto update has been around for 5 years on windows.

      --
      Please sign petition to restore sanity to our banking system!!!

      http://financialpetition.org/
    7. Re:How about a four-way matchup... by Bert64 · · Score: 1

      Well IE6 compared to Firefox 1.5 is a fair comparison, both are the latest non-beta feature releases of each browser (with only security updates since, such as firefox 1.5.0.1), it's not firefox's fault that IE hasn't had any serious update in 5 years.

      --
      http://spamdecoy.net - free throwaway anonymous email - avoid spam!
    8. Re:How about a four-way matchup... by theborg1of4 · · Score: 1

      Well said, and thank you very much for linking to the actual research paper. Having skimmed it, I believe there is at least one serious flaw in the premises for their setup decisions: From the paper. They mention that they used Firefox 1.0.6, and also the following:

      We analyzed two different browser configurations, both based on Microsoft's Internet Explorer (IE) version 6.0, running on Windows XP without either SP1 or SP2 installed. We deliberately chose to use unpatched versions of XP, since the majority of existing exploits attack vulnerabilities in such older system configurations. In addition, most (but not all) newly found exploits affect both patched and unpatched systems.

      Firefox 1.0.6 was released July 2005. Internet Explorer 6.0 was released August 2001. This translates into a four and a half year delta between the two products. This hardly appears to be a fair comparison of the two browsers; according to the entry in Wikipedia (http://en.wikipedia.org/wiki/Firefox_Cookies_Plac eholder#Release_history), Firefox didn't even exist in any form prior to late 2002.

      Furthermore, their assertion that "most (but not all) newly found exploits affect both patched and unpatched systems" raises the question as to why they simply didn't use a more contemporary version of IE, at least one patched and up-to-date circa the July 2005 Firefox 1.0.6 release.

      Perhaps I've misinterpreted the data, or in skimming the paper overlooked relevant supporting information for their decisions. But on the surface of it appears to me that they deliberately set up the experiment in a rather biased way. Whether this is sensationalism intended to generate more traffic and publicity I don't know, but it doesn't have a very scientific feel to it.

    9. Re:How about a four-way matchup... by Spy+Hunter · · Score: 1
      I doubt it's due to any malice on their part toward IE; I suspect that originally they used an unpatched IE specifically to catch the largest variety of spyware, which was really the main focus of the study. Then I suspect they later decided they might as well test Firefox as well, and simply downloaded the then-current version.

      They probably didn't originally realize that their study would get much more press as a comparison between Firefox and IE than as a compilation of spyware statistics. And so the focus of their study was changed after-the-fact even though their setup wasn't specifically designed for fair comparison.

      --
      main(c,r){for(r=32;r;) printf(++c>31?c=!r--,"\n":c<r?" ":~c&r?" `":" #");}
    10. Re:How about a four-way matchup... by Kuvter · · Score: 1

      When I read you headline (subject), being a web designer, I immediately thought IE, Firefox, Opera, and Safari (or if only on Win XP, Netscape)

      --
      "To be is to do." --Socrates
      "To do is to be." -- Aristotle
      "Do-Be-Do-Be-Do..." --Sinatra
    11. Re:How about a four-way matchup... by Anonymous Coward · · Score: 0

      I just like to see objective studies, properly reported.

      You DO know this is Slashdot right?

  12. Firefox more successful than Linux? by IAAP · · Score: 4, Interesting
    Of all the FOSS projects out there, it looks as if Firefox is the most successful in terms of market penetration. People who never have heard of Linux/GNU know about Firefox.

    Could it mean the death of IE?

    1. Re:Firefox more successful than Linux? by Quantam · · Score: 1

      ...yeah... because ~80% market share is as good as dead...

      --
      You have tried to support your argument with faulty reasoning! Go directly to jail; do not pass Go, do not collect $200!
    2. Re:Firefox more successful than Linux? by Anonymous Coward · · Score: 0

      Could it mean the death of IE?

      No way. The only way IE will die is if MS stops bundling it with default Windows installs, or if PC manufacturers start installing Firefox as the default browser before shipping them off to the stores. I work as tech support at a college AND at a local PC repair shop, and I think I can safely venture that far more than half, if not three-quarters, of the systems I see are basic default configurations. Few consumers even get rid of the manufacturer-installed crapware (Dell, HP, Compaq, Gateway.... the list goes on) that comes bundled with Windows. And I see a LOT of computers that have the MSN browser set as the default when I know for a fact that they're not using MSN.

      The basic fact is that the base user, the one that would have to change to kill off a long-standing software product like IE, will blindly accept what's given them and assume it's the best.

    3. Re:Firefox more successful than Linux? by RandomPrecision · · Score: 1

      For successful FOSS projects, I'd put Apache at #1. MySQL #2.

    4. Re:Firefox more successful than Linux? by pluggo · · Score: 2, Interesting

      As far as desktop penetration, I'd have to concur. But Apache has eaten IIS for breakfast in the server market.

      --
      Pulling together is the aim of despotism and tyranny. Free men pull in all kinds of directions. It's the only way to mak
    5. Re:Firefox more successful than Linux? by Anonymous Coward · · Score: 0

      People who never have heard of Linux/GNU know about Firefox.

      It's GNU/Linux, fucker.

  13. activex sucks by Anonymous Coward · · Score: 0

    but usually i consider that a good thing.

  14. Why do users want this to happen? by MichaelSmith · · Score: 4, Funny

    Owning a computer now is a bit like having a pet rabbit. It never just is. You have to feed it the right stuff or it gets sick. If you leave the hutch door open it might run away then you have to search the street for the bloody thing.

    People could choose to have computers which just do their job from year to year but they seem to want to believe that the thing is alive, just like the pet. They want it to have issues and risks, to get "infected" and require "cleaning".

    They won't be happy with something which just browses the web and shows them pictures. It won't be as entertaining and involving that way.

    1. Re:Why do users want this to happen? by dotpavan · · Score: 1
      Owning a computer now is a bit like having a pet rabbit. It never just is. You have to feed it the right stuff or it gets sick. If you leave the hutch door open it might run away then you have to search the street for the bloody thing.

      even the viruses multiply like rabbits

    2. Re:Why do users want this to happen? by scaryjohn · · Score: 1

      I don't quite follow... Are you saying that computers inherently require proper care and feeding and that we don't abuse and neglect our computers? Or that users operate their computers negligently because they want to care for and feed their computers?

      --
      One might ask the same about birds. What ARE birds? We just don't know.
    3. Re:Why do users want this to happen? by Anonymous Coward · · Score: 0

      wtf?

    4. Re:Why do users want this to happen? by Nate+B. · · Score: 1

      I understood it to be the latter. Since most people find computers to rather complex, treating them as similar to a pet makes certain sense to me.

      --

      "Insanity is doing the same thing over again expecting a different result."
    5. Re:Why do users want this to happen? by MichaelSmith · · Score: 1
      Or that users operate their computers negligently because they want to care for and feed their computers?

      Yes, I think for the average common user (not the sort of person who would have had a computer at all more than 15 years ago) it is more comforting to think of their computer system as having some of the characteristics of life. They want it to be somewhat unpredictable.

      I don't think they go out looking for viruses, etc; but I do think the software market is adapting to this kind of user, in just the way those users choose certain types of software.

    6. Re:Why do users want this to happen? by marcosdumay · · Score: 1

      I don't think that users WANT the computers to be unpredictable (so, I disagree with the GP). I think that they BELIVE that they are unpredictable, and act much more like a pet than an VCR.

    7. Re:Why do users want this to happen? by HairyCanary · · Score: 2, Insightful
      That statement requires a bit of qualification. Owning a Windows PC now is a bit like having a pet rabbit, etc.

      At work I primarily use a Linux workstation. I give it no care and feeding, as it requires none. It has no registry, it has no spyware, adware, or virii. Completely boring, untinteresting, and extremely useful. Perfect for me, as I am more interested in doing my job than fighting my PC.

      And at home I primarily use a Macintosh running OSX. Similar experience to Linux, better graphics, better applications, but fundamentally the same result -- my day to day experience does not center around the operating system and dealing with it's bugs, security risks, and annoying "features." I had gotten so used to dealing with Windows that the first few weeks of using my Mac I kept feeling like I was missing something. Then I figured out what it was :-).

    8. Re:Why do users want this to happen? by VENONA · · Score: 2, Funny

      There never was a day when a PC 'just was'. Before LAN or Internet connections met the PC, there were virusus on floppies. Win systems then were single-user. Nothing was off-limits to malware. The *concept* of off-limits hadn't been implemented in Win systems.

      And users often had to futz around with memory segmentation (remember Quarterdeck's QEMM386? What a problem solver!), IRQs, etc. Adding hardware or just installing a game could cause you far more problems than you'll typically see now.

      Putting away the rose-tinted glasses, I think we've just exchanged one set of problems for another.

      Re: "They won't be happy with something which just browses the web and shows them pictures." That's where the problems truly begin! Win and Linux have had fairly recent problems with graphic rendering libraries, for example. And it's the network connection that's the primary driver for multiuser PC operating systems. That connection is what gives you that immediate and very broad attack surface.

      What you just said was actually something like, "They won't be happy with something which just increases the risk to their system a hundredfold." The problem is that few people know the risks.

      _I_ see people who are frustrated, have had identities stolen, etc. If _you_ see people who feel as if they're petting their friggin' bunny, please urge them to seek professional care.

      --
      What you do with a computer does not constitute the whole of computing.
    9. Re:Why do users want this to happen? by DVega · · Score: 1
      "People could choose to have computers which just do their job from year to year but they seem to want to believe that the thing is alive, just like the pet. They want it to have issues and risks"

      Then use Gentoo

      --
      MOD THE CHILD UP!
    10. Re:Why do users want this to happen? by WhiteWolf666 · · Score: 1

      Hear Hear!

      Disclaimer: I use Linux and OS X. My computers do not "feed" or "get sick".

      I was at my cousin's house last night, and I wanted to show him the new Xgl videos. I sat down at his desktop to download them, and grumbled, "Feels slow. And the videos are stuttering. Something's wrong with your computer."

      He replied, "It's because I'm running Limewire."

      I grumbled some more, quit Limewire. "Still slow. Something's wrong. Your anti-virus isn't even running. You should do something about this, I bet its infected out the wazoo."

      He replied, "No, it's just because I downloaded a lot of stuff. It'll get better later. It needs to recover from the download."

      My mind absolutely blown away, I leaned over and patted his computer, and said, "There, there. I hope it feels better in the morning."

      Absolute madness.

      --
      WhiteWolf666 an exBush supporter. All you new-school,compassionate,save the children Republicans can rot in hell
  15. Does it count if Spyware... by Hamster+Lover · · Score: 2, Funny

    installed Firefox for me? Probably scanned my machine and then installed it out of pity.

    Seriously though, since I installed Firefox last Summer it's made Ad Aware and HijackThis obsolete.

    1. Re:Does it count if Spyware... by drinkypoo · · Score: 2, Informative

      AdAware's obsolete if you don't pay for it anyway - they stopped updating the free version a long time ago. I would pay for spybot if I needed a corporate version, because it's free, but I would now NEVER EVER pay for AdAware and I try to encourage everyone else in the same direction, just because I'm a bitchy fucker and I don't think that security should cost money.

      I, too, have not been infected with anything since I stopped using IE and started using a firewall - which was quite some time ago. You do need the firewall though, because you never know when someone's going to find a hole in some service that should never have been open to the world at large anyway, like RPC...

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    2. Re:Does it count if Spyware... by The_Paulish · · Score: 1

      Someone should seriously consider writing that program you speak of. The one that scans for crappy computers, and auto-installs firefox...genius!

      Someone might argue that it would give firefox a bad rep, but I mean, if they got a crappy computer, they probably wouldn't even be able to say "firefox is bad" because they wouldn't even know what the hell is going on!

  16. User education by doombob · · Score: 4, Insightful

    A better, but longer headline: Firefox browser less likely to automagically download malware that damages the operating system than internet explorer browser.

    The misleading headline makes it sound like people who use firefox are less likely to visit a site that would take advantage of an unpatched exploit in their computer. That conclusion, however, would not surprise me if it were true.

    In addition, there are very few people who just go the websites of the world in a random fashion. So who cares if around four percent of the websites out there have malicious programs - that is a problem of domain hosts that allow nasties to keep their sites on those servers. In a world where most people (probably around 80% of internet users) visit the top websites (probably around 20% of sites), I think the problem is one of user education (don't go to sites you don't trust, don't randomly click on crap - which probably needs to be applied most to pr0n surfers).

  17. Think of the debates! by IAAP · · Score: 3, Funny
    ...on Fox News, CNN, ...,

    I just had this image of guys in suits yelling at each other about the merits of Firefox and IE; saying things like "Firefox is a liberal plot to undermine American values!", etc...

    1. Re:Think of the debates! by jorenko · · Score: 2, Funny

      I just know that Bill O'Rielly is a ferverent IE supporter.

    2. Re:Think of the debates! by Anonymous Coward · · Score: 0

      Shhhh! Don't hint at the master plan before we are ready to make our big move!
      -the Liberal Conspiracy

  18. Re:I can't take it any more! by olego · · Score: 2, Funny

    But you don't have any problems with "nave users"?

    n : the central area of a church

  19. Lets see the list of sites by kooky45 · · Score: 1

    If they kept the experiment going then the rest of the world could get an idea of how safe the sites are they're visting depending on which browser they're using. A bit like the service from Siteadvisor which I can't wait to see working.

    1. Re:Lets see the list of sites by jvolk · · Score: 1

      Exactly - I would love to see what they crawled and what general category those sites fit into.

      Did they just release the crawler to go nuts, crawling everything and anything? Did they start it at a safe point (like say, yahoo.com) or someplace else? Did it crawl the seedy underbelly of the web (pr0n, warez, etc)?

      Ultimately, with enough data you could assign a level of probable safety to a category of sites - browse that free pr0n site and you have a 3.4% chance of infection. Common sense for us but might be a decent educational tool for Joe Sixpack.

  20. Re:I can't take it any more! by Politburo · · Score: 1

    Grad students are free. I'd imagine the professors did very little work.

  21. Good timing by Anonymous Coward · · Score: 0

    I just stumbled on my first evil site which affected firefox. Only because I had temporarily turned off the popup blocker. I guess I should switch to internet explorer so I can experience more of what the internet has to offer. ***cough**.

  22. Re:wow by Anonymous Coward · · Score: 0

    But 2+2 = 5.

  23. What are those 0.6% evil sites doing? by frankie · · Score: 0

    Exactly what tricks are those sites using, that they still infect a supposedly locked-down and updated IE6? Or conversely, what vulnerable IE setting did the researchers fail to fix?

    Seriously, what is really going on there at the html level?

    1. Re:What are those 0.6% evil sites doing? by realmolo · · Score: 4, Insightful

      What are they doing?

      They're popping up a dialog box that says "To view this site, you must install the "Fuck My Computer Up Beyond Recognition" ActiveX Control". Please click "Yes" to continue."

      Sad but true. Most people just blindly click "OK, YES, I AGREE". There's no good way to stop that.

    2. Re:What are those 0.6% evil sites doing? by frankie · · Score: 1, Redundant

      Whoops, should have RTFAed. They intentionally used unpatched browser versions to maximize infections. That's really sucktacular of them. They should have at least included a fully updated XP SP2 IE in its default "secured by Microsoft" state, as an experimental control.

    3. Re:What are those 0.6% evil sites doing? by cooldev · · Score: 1

      Even more sucktacular is the fact that the summary omitted this detail. You know it was intentional.

    4. Re:What are those 0.6% evil sites doing? by I'm+Don+Giovanni · · Score: 1

      Yep. Slashdot at its finest!! :-)

      --
      -- "I never gave these stories much credence." - HAL 9000
    5. Re:What are those 0.6% evil sites doing? by Tony+Hoyle · · Score: 1

      SP2 out of the box is vulnerable - I've seen it happen.. unfortunately after installing windows the first thing you have to do is hunt down device drivers for everything, which means going on the web :(

      Still not got into the reflex of downloading FF as the very first thing.. bad I know.

    6. Re:What are those 0.6% evil sites doing? by atokata · · Score: 1

      Actually, the best way to stop it would be to have people who are functionally illiterate run from a read-only partition. ;-)

    7. Re:What are those 0.6% evil sites doing? by Ravatar · · Score: 1

      No kidding, with the ActiveX/Popup blocking capabilities of IE and SP2, that number would have fallen right to 0.00% or so. What a delightly FUDdy article.

    8. Re:What are those 0.6% evil sites doing? by Ohreally_factor · · Score: 1

      As opposed to run towards it?

      =)

      --
      It's not offtopic, dumbass. It's orthogonal.
  24. Re:Also in the news: by helmutvs · · Score: 0

    What's this about Solaris?

    --
    There are no uninteresting things. There are only uninterested people.
  25. Why isn't lynx ever in these comparisons? by ehaggis · · Score: 2, Funny

    Lynx is a very safe browser. Flash ads are rendered impotant. Animated GIFs are defeated on load. Active X; no way! Lynx is the browser of the future! Now let me get back to my 3270 terminal.

    --
    One ring to bind them - should probably have more fiber and less rings in their diet.
    1. Re:Why isn't lynx ever in these comparisons? by gall0ws · · Score: 0

      Right!
      Btw `links' (imho) is better than `lynx'.
      It supports frames and correct tables rendering. It's very nice ;)

      --
      | (ceci n'est pas une pipe)
    2. Re:Why isn't lynx ever in these comparisons? by smoker2 · · Score: 1
      Lynx is a very safe browser. Flash ads are rendered impotant. Animated GIFs are defeated on load. Active X; no way! Lynx is the browser of the future! Now let me get back to my 3270 terminal.
      shouldn't that be your 1337 terminal ?
    3. Re:Why isn't lynx ever in these comparisons? by Tinned_Tuna · · Score: 1

      Well... lynx is good for that, but what about w3m? or links! They rock!! Links has *gasp* frames! and still makes nearly all annoying adverts pointless! including popups, flash, gifs, java script and applets...

    4. Re:Why isn't lynx ever in these comparisons? by Anonymous Coward · · Score: 0

      w3m has frames too

    5. Re:Why isn't lynx ever in these comparisons? by Anonymous Coward · · Score: 0

      Your sig made me laugh because I don't think I'm up for a repeat performance after such an energetic morning.

  26. Another astonishing insight from academia by RoboSpork · · Score: 1

    Please, stop wasting funding researching things that are blatantly obvious. The rest of us knew this already and we dont consider ourselves lucky that you were able to scientifically prove this. This reminds me of the graduate psychology experiment I was a subject for. They ended up proving that the majority of people in the downtown area on a friday night are drunk. Way-to-go guys!! When you feel like doing something difficult and/or actually contributing to society I have a computer system for you to optomize, thanks.

    1. Re:Another astonishing insight from academia by superflyguy · · Score: 1

      Ask someone from a small village in africa whether people being drunk downtown on friday nights is obvious.

      Most people are from small african vilages in terms of computer usage: it works, or it doesen't, and tech support can help, or possibly not.

      Whether it's obvious to everyone with three years of experience in the subject is irrelevant, because most people don't know there is a subject. And when you tell them it's a subject, it's a lot easier to have a good study and personal experience than to just have personal experience and have them spend those three years blindly arguing with you.

    2. Re:Another astonishing insight from academia by pluggo · · Score: 1

      Sign seen today at Portillo's:

      "Our studies indicate that you like fries and a drink with your meal.

      Isn't research amazing?"

      --
      Pulling together is the aim of despotism and tyranny. Free men pull in all kinds of directions. It's the only way to mak
  27. Firefox user's mindset by amigabill · · Score: 3, Insightful

    What about comparing the mindset of people using Firefox to the mindset of those who use MSIE? I know people who are seriously under MS't thumb, in that they simply do not care if there is any alternative and quality is completely irrelevant. They also don't care enough about the world to be careful on the web. One friend of mine (who's nearly 31 years old now) I won't let use my computer without supervision because he doesn't want to "learn how" to use Firefox, and he's often impulsively copying crap from god knows where on to my machine or other people's machines to show off the latest stupid gimmick he's found out there someplace. I don't like gimmicks off some random web page running on my PC as I'm afraid of what computer illnesses may come along for the ride...

    I think that a lot of people using Firefox go beyond just having a different browser to be safer doing the exact same things. I think that the average firefox user probably has a somewhat different web surfing habit than IE users. Many are using Firefox because they sought out something "safer" than MSIE in general, and are probably actively trying to be safer in their usage as well by not doing some of the things or going to the sorts of sites that those less interested or less knowledgable are doing or going to.

    Regardless of the browser in use, who is more likely to click through the bank account phishers, the average MSIE user or the average Firefox user? Things like that...

    1. Re:Firefox user's mindset by PitaBred · · Score: 1

      If he's that much of an idiot, just remove all IE references from your computer. I know that I can't get to IE without either directly browsing to the executable or running iexplore.exe. Which is how I like it. Keeps other people from doing stupid things. If they want to use the Internet, they use Firefox, or they don't use it at all.

    2. Re:Firefox user's mindset by Anonymous Coward · · Score: 0

      doubleclick the "my computer" icon on your desktop. hey, look, there's IE now!

    3. Re:Firefox user's mindset by Anonymous Coward · · Score: 0

      To add to this I suggest changing the Firefox icon to IE's blue e. Most users will simply say their internet looks different now. I installed Firefox at work (against the rules at that time) and "hid" it by using the IE icon.
      Our IT department has since installed Firefox on everyone's pc but there are still users who insist on using IE for everything because they need claim they need it for one specific thing. Personally, I've never found anything I absolutely had to use that doesn't work on Firefox. There are some frivolous things that don't work on Firefox but in my mind I if they don't work I don't need them.

  28. They're not terribly good spellers however by Anonymous Coward · · Score: 0

    Experiece??

  29. Browse safely and smarlty! by feranick · · Score: 1

    From the article:

    "The moral, said Levy, is: "If you browse, you're eventually going to get hit with a spyware attack."

    I strongly disagree. If you browse smartly, you won't be hit, even when you use IE. You need to be really careful, but again using the computer properly, won't get any infection. What the author states above is simply an overstated semplification, just as saying that "if you will get enough emails with suspicious attachment, you will open them".

    Advise: 1) browse smartly (always). 2) Get Firefox (just in case you were not very focus on what you were browsing) 3) Get a Unix/Linux/Mac if you really plan to browse safely with little thinking.

    1. Re:Browse safely and smarlty! by Anonymous Coward · · Score: 0

      If you browse smartly, you won't be hit, even when you use IE. I strongly disagree. Microsoft software has been proven to be extremely weak when it comes to security. Even when using the very latest patches (as well as heaps of third-party software to help fill-in the other holes in Microsoft's flawed operating system) you're still going to get infected. Unless when you say You need to be really careful What you mean is "Ensure that the only address you use is http://localhost/". And the computer isn't networked in any way. Some more advice - use a virtual machine to browse.

    2. Re:Browse safely and smarlty! by VENONA · · Score: 1

      With IE, there's almost always an unpatched vulnerability. Even if you visit only the most mainstream of commercial sites, who's serving their adds, or possibly other content?

      http://www.theregister.co.uk/2004/11/22/falk_bofra _statement/

      Your advice goes a long way to mitigate the risk. It doesn't eliminate it. Attacks always get better.

      My preference is Linux, the Konqueror Web browser (Firefox for a couple of sites whose Javascript Konqueror can't deal with, though Konqueror generally does the better job of rendering HTML, IMHO), the netfilter firewall, regular system updates, and my own intrustion detection software. But I'm fortunate in that at the moment I don't have to deal with some lame corporate Web app which will only work with IE. Many aren't so fortunate.

      But even after following these at least arguably non-stupid rules, there are still things I'd never do, such as surf as root. Attacks always get better.

      --
      What you do with a computer does not constitute the whole of computing.
    3. Re:Browse safely and smarlty! by Sigma+7 · · Score: 1
      With IE, there's almost always an unpatched vulnerability. Even if you visit only the most mainstream of commercial sites, who's serving their adds, or possibly other content?


      With any browser that auto-executes any form of code that isn't trusted (or otherwise interferes with the browser or system), you have a vulnerability. It might not necessairly be a security leak, but it can and will disrupt normal operations.

      In particular, I'm talking about:
      - The Firefox Sun Java plugin, which locks the browser while it is downloading the applet. (Don't say get broadband - it still locks the browser for two seconds, more so if the server stops responding.)
      - The Flash plugin that plays those annoying "Jabber" flash ads that plug the CPU at 100%. Tabbed browsers are hit hard, since you would have several links open in the background. (I know of a quick fix for Firefox - force plugins to be one priority level lower.)

    4. Re:Browse safely and smarlty! by orthogonal · · Score: 1

      If you browse smartly, you won't be hit, even when you use IE.

      Yeah, let's bet on smart in a country where GDubya won a majority of the vote.

    5. Re:Browse safely and smarlty! by cyber-vandal · · Score: 1

      The Flashblocker extension (which I think should come installed as default) is a great way of stopping problem 2. Don't say that normal users won't know about that - Computeractive, a magazine for PC newbies here in the UK did a big article on FF and all the major extensions not long ago.

    6. Re:Browse safely and smarlty! by feranick · · Score: 1

      You got me on that one. VERY good point.

  30. "wow" by WeAreAllDoomed · · Score: 0, Redundant
    According to two University of Washington Professors, Firefox users have a safer browsing experice than users of IE.


    next week: "Professors Discover Sky Blue, Grass Green".

    --
    free software, open standards, open file formats, no software patents.
  31. Security from lower market share? by Phae · · Score: 0

    This test is not really a fair comparison for security (the article doesn't claim that it is) since Firefox is not anywhere near IE as far as market share goes.

    If you are writing a piece of spyware to attack a browser, would you rather write it for the browser that ~80% of the population uses, or the browser used by ~10-15% of the population (and consisting largely of internet-savvy users)?

    Combine that with the fact that Internet Explorer allows Active-X controls, and the choice is pretty clear.

    Both IE and Firefox are written by humans (yes, M$ employees are human too), so both will always contain bugs that can be used by the people writing spyware.

    I would expect to see attacks on Firefox increase as its market share continues to increase.

  32. I wonder... by Anonymous Coward · · Score: 0

    how many of those web sites was pr0n sites :) Coz it sure is funny to see virus attacks come in even thru FireFox.

  33. Re:I can't take it any more! by mpoulton · · Score: 1

    Argh! What the fuck does leveraged mean!? I was under the impression that it involves a lever and a pivot point. Yes, I know it's a buzzword, but this one is getting fucking ridicilous!

    With all due respect, the meaning of the word "leverage" in every example you gave is plainly obvious, and not really even that buzzwordy.

    Within the business world, "leverage" is ABSOLUTELY NOT a meaningless buzzword -- no more so than "quantum" is a buzzword in the science community. In case you really don't understand, the word is used to mean "utilize to one's own advantage", with a specific implication of coercive or forceful action. It's a single word that combines several concepts that would otherwise require more space to explain.

    Moreover, within financial circles, "leveraging assets" is the practice of using items of value as collateral for further borrowing. For example, a real estate investor may mortgage existing properties to purchase more properties. This reduces cash investment, but increases debt and risk. Asset leveraging of some type is a necessary component of most investment schemes to attain a reasonable rate of return. Thus, whem business types speak of "leveraging assets" they aren't blowing marketspeak out their asses -- they are using specific technical jargon just like computer geeks talking about those so-called "memory leaks".

    Now "synergy" on the other hand, is a total load of crap...

    --
    I am a geek attorney, but not your geek attorney unless you've already retained me. This is not legal advice.
  34. Whoa... by Red+Samurai · · Score: 0, Offtopic

    They have the internet on computers now?

  35. Firefox safer then IE? by Anonymous Coward · · Score: 0

    COLOUR ME SURPRISED!

  36. Is the browser really the reason? by Overneath42 · · Score: 2, Insightful

    While I use Firefox myself and believe it is marginally more immune to exploit, I suspect that the most likely reason for the results in the FA is that Web users who know how to use Firefox in the first place are more likely to be cognisant of such threats to begin with, and are also more likely to protect their computers from spyware/adware/etc.

    1. Re:Is the browser really the reason? by cnerd2025 · · Score: 1

      I think you have a sound point, but my experience is different. I find that even the non-techies like firefox and find it so much more "secure" than internet explorer. I've installed it for my parents and for some colleagues, and they all appreciate it. The only complaint is about the sometimes slow behavior (and they get bored when I explain what a "memory leak" is.) We all know that pop-ups and spyware are annoying, and I think my non-techie friends like a browser experience without that hastle. I put ad-block on one of my friend's machines and he was amazed by his ability to stop the ads (I have since stopped using ad-block because its code got fishy somewhere and now alters the flash animations on different pages, which is very annoying.) I think Average Joe User likes the clean look of firefox and the simplicity of it. I agree that people who use firefox are more likely to be computer geeks and therefore be more security conscious, but some geeks enforce security like the French in World War II, while others put shame to Hitler's Gestapo. Also, I know many "non-techie" users who are very conscious about security and make sure they don't download weird attachments or open unknown emails.

      BTW, this study indicates that the two who set up the experiment were both geeks, and set the browsers simply to crawl the web, rather than have each person sit down and browse. They each visited 45000 pages, and to have one person do this would be greuling.

      Peace,
      Andrew

    2. Re:Is the browser really the reason? by springbox · · Score: 1
      I suspect that the most likely reason for the results in the FA is that Web users who know how to use Firefox in the first place are more likely to be cognisant of such threats to begin with

      Their experiment tried to emulate the careless behavior of the "average user" and it was found that Firefox was much less susceptible to attacks. So yes, the browser does matter as well as its default configuration. It also helps that Firefox doesn't support ActiveX by default and isn't affected by drive by installations.

  37. Re:Also in the news: by octaene · · Score: 1

    Seriously, somebody queue up Ric Romero from Fark...

    /troll, I don't care.

  38. two words... by rmallico · · Score: 0, Troll

    no shit

    --
    sig goes here!
  39. I dunno... by hummassa · · Score: 1

    Ok, let me start by saying that I really don't know if you are right or not... but I think not. Do you think PCs are more common at homes or at corporations? In every corporation I worked, patches are installed automagically by the network admin. In every home I know of non-techs, it's the opposite -- patches are NEVER installed.

    --
    It's better to be the foot on the boot than the face on the pavement. ~~ tkx Kadin2048
  40. Yet another lame FF ra-ra post by fzammett · · Score: 4, Insightful

    I'm really sick to death of all the "Firefox kicks everyones' ass" pieces all over the place. I really can't stand being in the mindset to defend MS, but yet...

    This whole "study" was stupid in terms of proving one browser more secure from malware than the other (which wasn't their point apparently, which makes the /. post even more stupid). The conclusion is if you take two unpatched browsers, you'll get spyware a lot, and moreso for IE.

    Ok, as others have said, that's not exactly like finding out the Sun orbits the Earth or anything.

    It is much like saying "hey, you know, if you go into a burning building without firefighting gear, your gonna get burnt".

    REALLY?!? WOAH! HEADLINE NEWS!

    "If you have sex with a number of HIV-positive people you may well contract the virus".

    SERIOUSLY?!?

    "If you vote republican, you will slowly lose your personal rights".

    THE HELL YOU SAY?!?

    "If you vote democrat, you will pay a bunch more in taxes".

    YEAH, I GET IT, IT'S OBVIOUS!

    Let's see what happens with two FULLY-PATCHED browsers. Will FF still come out on top? Yes, I would imagine so. I'm not about to say IE isn't inherently more dangeruos than FF, because I think it is. But it's a question of degrees... are two completely up-to-date installs of FF and IE going to be *that* much different? I would seriously doubt it. I'd be willing to bet they are close enough that you could effectively ignore the difference (until your machine gets wiped out by the .00000001% of malware that got through I guess!)

    It's interesting to me... I've been using IE all along... there are some things that annoy me about FF that keeps me from using it full-time. In all that time, I can count on one hand how many times I've been infected with anything. And, once I moved to Maxthon a year or so ago, I haven't been infected with anything even once. The difference between IE and FF is not THAT big, when you are fully-patched.

    Talking about anything less is pointless... and yeah, I know the argument... "But grandma doesn't know she should be patching her browser and doesn't know how". Well, get grandma off the computer! We don't let kids drive cars because THEY DON'T KNOW HOW TO (neither do many adults of course, but I digress). Using a computer is no different than using any other tool: you can hurt yourself, and sometimes others, if you don't know how to use it. Can't you smash your hand with a hammer? Can't you cut a finger off with a can opener? Can't you badly burn yourself using your oven? There is a certain amount of risk to using any tool, and you accept that risk, but more importantly, you learn about the tool to some minimal degree that allows you to mitigate the risk as much as possible. People need to start doing the same with computers. Not everyone has to know how to hook a system call or spawn daemon threads in a VM or whatever else, but keeping a browser up to date, especially as relatively easy as it is today? Yeah, I'd say that's the MINIMUM level of knowledge one should have, and if you don't have it, git knit a sweater, you shouldn't be touching a computer.

    Enough with all the "FF rules and IE sux0rs" crap... if you like one or the other, great, no problem, choice is good, use what you like. But enough with constantly telling me how unsafe I am using IE (or an IE derivative). My experience does not bear it out, and even if it did, the answer would still be what it's been all along: the USER is more at fault than the browser.

    Hey, when something gets through FF by the way, do we start screaming that it is insecure and no good? Of course not! We first ask "well, what did the USER do to let the garbage in"? Because OF COURSE it could never be FF's fault. And you know what? 9 times out of ten, it isn't! Just like 9 times out of 10, it isn't IE's fault... ok, to be fair, 8.5 times out of 10 for IE... like I said, I don't doubt FF is a bit better.

    Ok, I'm done, rant over.

    --
    If a pion (n-) collides with a proton in the woods & noone is there to hear it, does lamdba decay into the source pa
    1. Re:Yet another lame FF ra-ra post by twinchang · · Score: 1

      So don't ask for help from any geek friends around you when your machine is loaded full of spywares and virus.

      You probarly didn't know that web developers are beaten to death by the broken implementation of web presentation technologies (CSS) from Internet Explorer. You probarly didn't know that "friend support" were so annoyed in the past 4 years just because Microsoft refused to improve and fix problems in its product in reasaonable time.

      You can go on to use any IE based "browser", just don't try to trouble others because you know that it is the USER fault, not the BROWSER.

    2. Re:Yet another lame FF ra-ra post by Anonymous Coward · · Score: 0

      Yeah. Quite. Talk to me about CSS compliance when firefox passes acid2.
      Oh, wait. I'm sorry. "It's ok. It's LESS broken! It's more vaguely compliant!"

    3. Re:Yet another lame FF ra-ra post by Anonymous Coward · · Score: 0

      I just tried Maxthon. It's pretty! But it has problems when you run it as a non-administrator user. Which tells me that you are running Windows logged in as an administrator-level user and THAT'S why you got infected with spyware.

    4. Re:Yet another lame FF ra-ra post by fzammett · · Score: 1

      Your right, I do. And I'm more than experienced enough to know it's not a smart idea.

      That being said, I am *also* more than experienced enough for it to not be a major risk because I know what activities to avoid. As I indicated in my original post, I've had scant few malware infections ever (only one I can think of that was of any severity, and that was completely my fault), and I have not had a virus infection in well over 10 years.

      So, I would NOT say running as admin being more dangerous is a myth, but I WOULD say, again, it comes down to the user being knowledgable enough to avoid those activities that are likely to make it as dangerous as it can be. Again, mitigating the risk, not eliminating it.

      --
      If a pion (n-) collides with a proton in the woods & noone is there to hear it, does lamdba decay into the source pa
    5. Re:Yet another lame FF ra-ra post by fzammett · · Score: 1

      As an enterprise developer who does all his work on the web these days (well, INTRANET technically if I'm being honest), I know what your saying and I don't disagree. The spec compliance issue is one area where FF *is* better than IE.

      But that's not what this piece was about, so for the sake of this discussion it's irrelevant.

      But, I can't resist the comment... I've had seemingly just as much trouble getting FF do display things the way I want, even when I'm spot-on spec-compliant. Is it better than IE? Yeah, probably. But not by such a wide margin that anyone should be bragging about it IMO. And, as another poster pointed out, it's FAR from perfect in its own right... it just gets less broken as time goes on. But then, so does IE frankly (again, in terms of spec compliance).

      Let me reiterate my key point from the original post... I'm not saying IE is better than FF. I personally see them as pretty close, which is a testament to the work the FF team has done to catch up to a much older product. What I AM saying though is I am sick to death of all the FF ra-ra pieces because they usually are trying to convince you of something using dubious psuedo-facts. The piece this Slashdot post describes was used in exactly that way, and it annoys me. And for the record, I get just as annoyed when someone comes along bashing FF with stupid pro-IE psuedo-facts. It's just that that seems to happen far less.

      --
      If a pion (n-) collides with a proton in the woods & noone is there to hear it, does lamdba decay into the source pa
    6. Re:Yet another lame FF ra-ra post by Anonymous Coward · · Score: 0

      If you vote democrat, you will pay a bunch more in taxes".

      YEAH, I GET IT, IT'S OBVIOUS!


      Yeah, makes tons of sense, I mean, I voted democrat, a republican got in and ran up debt with a war that noone wanted. At some point the taxes will go up because of this. Probably when sanity prevails and some reasonable person decides being in massive debt is a bad idea (democrat will get blamed).

      Oh, and personal rights are going out the window too! Best of both worlds, feck awesome!

  41. File Permissions by Skjellifetti · · Score: 1

    One of my routines when I install a new copy of Windows is to set all file/directory perms so that the average user can only write to their local home directory. This is usually a game of 1) set the perms, 2) see what breaks, 3) make an individual decision about whether to reset the perms for a particular file or directory to fix the brain dead program that requires users be able to write to a non-home directory in order to properly run.

    How many of the infections are caused by the silly default perms that Windows starts with? I once secured the permissions on NT3.5 and discovered that ordinary users could not use any system help files because they could not write to C:\winnt\system32\help or some such system directory. On that same NT3.5 box, I installed a utility from the resource disk that was supposed to set the system up to be C3 (or C-Something) secure. The utility immediately reset all permissions back to the default of "Anyone Can Do Anything Anywhere(tm)". NT4 and Win2K defaults were not much better.

    I've mostly given up on Windows for this and other reasons and have been running Linux on all but one of the family boxes for years which basically solves the default permission problem. But I've got one Windows laptop left that I need to upgrade to XP (my wife needs to run a student version of ArcView). Have they done anything to fix the lax default permissions and does this make any difference for preventing spyware?

    1. Re:File Permissions by drinkypoo · · Score: 1

      Dunno about 3.51, but NT 4.0 was C2 secure only if it had no floppy drive and no network...

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    2. Re:File Permissions by jofi · · Score: 1

      I've run as a regular User in 2000 and now in XP. If 3rd party applications break, it is because the programmer is incompetent, decided to write to Program Files or other system folders after being installed.

      --
      Blame the user, not the software.
    3. Re:File Permissions by drinkypoo · · Score: 1

      Have you thought about using vmware and not using real windows at all? At least, not as your base OS... vmware player is now free and there's ways to fool around with it and create a VM using it, or you could get someone with vmware to make you a system image...

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
  42. No Turning _Back_ by newr00tic · · Score: 1

    ..Firefox "beams on" faster; as

    option {BurnAllBridges: on;}, and, -alas-; there's no

    http://slashdot.org/comments.pl?sid=176645&cid=146 67513 Turning Back(tm)..

    [ Never trolling, but not quite serious either.. ]

    --
    A horse can't be sick, you know, even if he wants to.
  43. Re:Browse safely and smarlty![sic] by Anti-Trend · · Score: 1
    "I strongly disagree. If you browse smartly, you won't be hit, even when you use IE. You need to be really careful, but again using the computer properly, won't get any infection..."

    If by "browse smartly" you mean "only visit one or two well-known sites and go noplace else", then I agree, you probably won't get hit. But one of the points they made in this study was that spyware installed itself in a 'drive-by' fashion, with or without user interaction. Sometimes those suckers come from 3rd part ads on well-known sites, so it's hard to cover that particular vector of attack altogether. I suppose if you disabled ActiveX, Java and Flash, you might only come across malware in the case of exploitation of some unpatched flaw in IE or in Windows ... but we all know how on-the-ball Microsoft is for security, so that's not a problem, right? Right?

    --
    Working in a DevOps shop is like playing in a band made up entirely of keytarists.
  44. Taking it to the next level by dtfinch · · Score: 1

    Not a single user running Konqueror on FreeBSD has been infected by malware through their web browser.

    I'll probably be alright using Firefox on Linux though.

    1. Re:Taking it to the next level by Anonymous Coward · · Score: 0

      Also good to point out that Opera is an excellent browser for safe surfing. Even if they went back a few versions of Opera to add to this study as well, it would kick both IE and FF in terms of safer browsing.

      Think Smart - User Opera - http://www.opera.com/

  45. Re:I can't take it any more! by convolvatron · · Score: 1

    i agree about the funding issue. but at one point, university of washington and hank levy in particular did research into fundamental concepts of system design and performance. its very sad that this kind of thing is what the grad students are working on these days.

  46. They used unpatched browsers by I'm+Don+Giovanni · · Score: 3, Informative

    According to the article, "We can't say IE is any less safe," explained Levy, "because we choose to use an unpatched version [of each browser.] We were trying to understand the number of [spyware] threats, so if we used unpatched browsers then we would see more threats."

    So reporting this on CNN and the like wouldn't have the impact that you hope it would. In fact, this study might be useful in studying malware but is meaningless in comparing FF with IE regarding security (as they rightfully admit).

    --
    -- "I never gave these stories much credence." - HAL 9000
    1. Re:They used unpatched browsers by 6Yankee · · Score: 1

      I don't know about meaningless... how many real-world users, even the ones who download Firefox, do patch their browsers?

    2. Re:They used unpatched browsers by just_another_sean · · Score: 1

      They do say they can't judge the overall security of the browsers but I feel safe in drawing the conclusion that Firefox, by default, is more secure for my day to day needs.

      The fact that the Firefox configuration that said "No" to everything automatically had zero infections says a lot. It reiterates the fact that if a user has some sense and errs on the side of caution when confronted by something they don't understand or feel like bothering with at the moment then thy are much less likely to get infected. And Firefox clearly helps in this area as, if the user does "just say no", it is very resillient to automatic infection.

      I realize that it's unfair and inconclusive from a security standpoint to draw conclusions from this type of study but the fact is a lot of people don't patch their software. And they surf like idiots. So the browser that gets infected less in these situations *is* more secure in my mind.

      --
      Creationist Textbook Stickers Declared Unconstitutional by CowboyNeal
  47. This was on Yahoo! by bigjarom · · Score: 1

    This was on Yahoo's front page today at about 10:00 AM MST http://news.yahoo.com/s/cmp/20060210/tc_cmp/179102 616

  48. Re:Firefox doesn't prevent spyware. by PhoenixPath · · Score: 3, Insightful
    "It is quite easy for a Firefox user to unknowingly install malicious software."



    Really? Care to give us an example? Or are you just playing the "Opera Fanboy" again?

  49. Interesting News by DerKlempner · · Score: 1
    I was simply amazed to find out these results. In response, I decided to use my IE-enabled system to browse for some more internet facts...
    • Not only is the sky blue, but this little pop-up told me I can literally add inches with a new pill!
    • The pope is evidently catholic, and a new, unsolicited email said they would send me a free toolbar add-on for IE.
    • I can buy music from a store called "iTunes," and now it looks like my credit card has been used to solicit an escort for Saturday night.
    --
    UNIX: Find it, fsck it, forget it.
  50. In other news... by piper-noiter · · Score: 0, Redundant

    In other news the grass is green!

    --
    Shick's Law: There is no problem a good miracle can't solve.
  51. Test the browsers yourself... by linebackn · · Score: 1

    You can test the browsers yourself by placing the URL to the Yahoo Random Link http://random.yahoo.com/bin/ryl in a toolbar bookmark and click it a few thousand times. Although be warned it can take you anywhere! So I really wouldn't recommend using it in IE.

    There used to be a "browser buster" on mozilla.org that would reload this URL (loading a new page each time) automatically in a frame. But I don't see that out there anywhere any more. Probably because the YRL was busted for a long time.

    1. Re:Test the browsers yourself... by Anonymous Coward · · Score: 0

      gee. it still works.
      http://webtools.mozilla.org/buster/
      Differences between Firefox and Seamonkey: The latter still has Debug menu with lots of cool stuff.

    2. Re:Test the browsers yourself... by drinkypoo · · Score: 1

      They should call it YPL, the Yahoo Psuedorandom Link. The second time I ran it, it sent me to travel.yahoo.com.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
  52. More importantly: by amliebsch · · Score: 1

    Could this open some eyes and increase interest in alternative (Linux, Mac) offerings?

    --
    If you don't know where you are going, you will wind up somewhere else.
  53. OOH OOH I got another! by Red+Samurai · · Score: 1

    In Soviet Russia, obvious states YOU!

  54. Just an observation... by catdevnull · · Score: 0, Redundant

    Most people savvy enough to install and use Firefox are generally more aware of the risks and have safer habits in general. I'm not sure if this study will do much beyond stating the obvious otherwise. However, it's good to have concrete data for posterity's sake.

    --

    I might know what I'm talkin' about, but then again, this is Slashdot...
    1. Re:Just an observation... by BCW2 · · Score: 1

      As a tech in a whitebox store I try to educate my customers:

      Do not use IE, we will install Firefox on all machines with a broadband ISP or dialup that isn't AOL.
      Do not install any toolbars if you have to use IE. (I know that google & yahoo are supposedly safe, so what)
      All pop ups are evil, do not click on any.
      All ads for anything to stop spyware, are spyware. We install Ad-Aware and Spybot, update and run at least weekly.

      Since starting this we have fewer comebacks for infected machines and much happier customers.

      --
      Professional Politicians are not the solution, they ARE the problem.
    2. Re:Just an observation... by catdevnull · · Score: 1

      Stupid moderators: it wasn't redundant when it was posted :-p

      --

      I might know what I'm talkin' about, but then again, this is Slashdot...
  55. Re:Browse safely and smarlty![sic] by forkazoo · · Score: 1
    I suppose if you disabled ActiveX, Java and Flash, you might only come across malware in the case of exploitation of some unpatched flaw in IE or in Windows ... but we all know how on-the-ball Microsoft is for security, so that's not a problem, right? Right?


    I'm not sure if you were serious about disabling ActiveX, Java, and Flash completely, but you forgot to mention JavaScript. IMHO, it's usually more annoying than Java, which at least runs in a sandbox.
  56. In other news by geekee · · Score: 1

    birds more likely to get avian flu than fish.

    --
    Vote for Pedro
  57. So true - Safer and Healthier! by Acetysal · · Score: 0, Flamebait

    Since switching to Firefox I stand up from my seat much more often (every half hour) while waiting for the system to release the 1G of memory hogged by it. That has had a very positive effect on my piles problem.

  58. Isn't he forgetting... by Anonymous Coward · · Score: 0

    that opera is even safer

    if their experiments were to hold any merit they would have tested a wider variety of browsers instead of just the top two (windows browsers)

  59. Actually... by Burning+Plastic · · Score: 1

    I would think that a good number of people from small villages in Africa would tell you that drunk people on a Friday night is obvious.

    From personal experience (Madagascar not mainland Africa), I can say that without a doubt, most of the people 'downtown' in the village I lived in for a year would be drunk on Friday night. Especially if they were fishermen.

    --
    [All Your Fish Are Belong To Us]
  60. Re:I can't take it any more! by Acetysal · · Score: 1

    Further to this, in financial and business circles it means exactly what it means in physics - using some sort of mechanism to amplify the force of your action - like in futures contracts, or contracts for difference, or spread betting - where you can realise the same absolute loss or gain with much smaller capital.

  61. Who was the target? by jofi · · Score: 1
    Keyword: target.

    Of course IE is unsafe, because it is the primary target. Is there even a secondary target? Did any of the sites contain Firefox exploit code?

    It says they used an unpatched machine. No shit, you need patches. If Linux and OS X were completely immune, why is it that patches exist for them? Nothing to hide, right?

    --
    Blame the user, not the software.
    1. Re:Who was the target? by argent · · Score: 2, Informative

      Of course IE is unsafe, because it is the primary target.

      IE is the primary target because it is unsafe.

      Even back when IE was the minority browser, in 1997, when MS introduced "Active Desktop" it opened up a MASSIVE flood of malware targeting the gaping hole they created. There was no similar attack on netscape or Mosaic.

      No, IE is the primary target because it is unsafe, and it (or more properly the HTML control) is unsafe because it is inherently unsafe to give one component that kind of responsibility over rights when it has no mechanism to unambiguusly determine whether a document can be trusted.

      The security zones model is unfixable without changing the API. ALL existing applications that use the HTML control will have to be modified to control the execution of active content if Microsoft is to have a hope in hell of solving the problem.

      This was true last century, it's true this century. That is is the most common browser makes things worse, but it's an unacceptably insecure one regardless.

    2. Re:Who was the target? by jofi · · Score: 1

      Did any of the 45,000 pages contain FF exploit code? Availability of patch does not mean every one has it. Average Joe only patches when he buys a new computer, though he is not the one who did the patching. FF users are guilty of keeping older versions because x or y doesn't work with new versions.

      --
      Blame the user, not the software.
    3. Re:Who was the target? by argent · · Score: 1

      FF users are guilty of keeping older versions because x or y doesn't work with new versions.

      Err, no, you would be thinking of Internet Explorer there Every time there's a new release of IE we are required to hold off on upgrades until the IT guys at the head office update the intranet sites to work with it. Most large companies have to behave the same way. And have you seen the complaints about pages broken by the IE7 beta?. Newer versions of Firefox work better on more pages, because unlike Microsoft they can't just break stuff and expect every website in the world to change to suit them.

      Did any of the 45,000 pages contain FF exploit code?

      If there was anything like the same opportunity to exploit FF, they would, even if it is only a minority browser. When the Active Content problems in the HTML control surfaced, it was in the minority, but there was an immediate flood of exploits like I'd never seen before. And while Microsoft has patched the symptoms over and over again the underlying design flaw is still there.

    4. Re:Who was the target? by kaligraphic · · Score: 1

      I guess you haven't tried to upgrade FF to a recent release and found that - whoopsie! - half your extensions hadn't been updated to the new version, and weren't working. That's what keeps FF users on old versions.

      --
      You are standing in an open server west of a blue house, with a boarded front door. There is an Exchange mailbox here.
  62. Re:I can't take it any more! by Acetysal · · Score: 1

    And I don't believe synergy is total crap either. Synergy is what catalysts do in chemical reactions or what musical instruments do when combined - you can listen to a drum player and not get anything. You can listen to a bass player and not get anything either. Now put the two together, and they make sense... music... Add a violin solo, which on its own is crap, and the whole thing is better than its parts separately. Synergy is the difference between the value of the sum of the parts and the value of the parts acting together. Firefox with no extensions is quite basic. Mouse gestures on their own don't work. Put them together and you get something useful....

  63. That's nice by Anonymous Coward · · Score: 0

    I'll stick to using IE thanks. At least I can rest assured knowing that most every website will work properly. The only ones that don't are by asshats who put a bit of javasript on the page to not let you view it if you're using IE.
     
    //Not on the Firefox bandwagon

  64. I knew that :) by Angelox · · Score: 1

    .. and they are much more fun to use too!

  65. nLite! by corychristison · · Score: 1

    Use nLite to apply SP2 to the disc, silly. :-P

  66. Re:I can't take it any more! by meringuoid · · Score: 1
    With all due respect, the meaning of the word "leverage" in every example you gave is plainly obvious, and not really even that buzzwordy.

    Really? Let's try replacing the word 'leverage' with the word 'use' in all the three examples, and see if we lose any significant meaning:

    Most of the exploits that used IE vulnerabilities to plant spyware were based on ActiveX and JavaScript, said Gribb.
    World Wind uses satellite imagery and elevation data to allow users to experience Earth terrain in visually rich 3D, just as if they were really there.
    learn how other organizations leverage the pod

    Even given your argument concerning business use of 'leverage' - which I still consider dubious - the only one of the three that might fall into that category is the last one. The other two work just fine with 'use', and so to use the word 'leverage' can only be put down to the author thinking that it makes him seem more intelligent to leverage a long word when he could equally well use a short one.

    --
    Real Daleks don't climb stairs - they level the building.
  67. The University of Washington??! by ninja_assault_kitten · · Score: 1

    They're owned more times and by more people than the ipod.

  68. How much safer? by ben_1432 · · Score: 1

    How much safer is Firefoxs really, considering there's ~7000 open bugs, thousands of extensions, each a potential entry point, and millions of users with delusions of invulnerability? How exactly is 0.9% (Firefox) better than 1.6% (IE) anyway? Both mean spyware has been installed. Is it okay to have less spyware now?

    1. Re:How much safer? by Dan+Ost · · Score: 1

      Your number was wrong by an order of magnitude: it's .09%, not .9%.

      Still not perfect, but it is almost 20 times safer.

      The version that wasn't set to default accept had a 0% spyware infection rate.

      --

      *sigh* back to work...
  69. Re:I can't take it any more! by Anonymous Coward · · Score: 0

    What does it matter that 'leveraged' can be replaced by 'used'? That just adds more weight to the gp's point, which is that the meaning of the word 'leveraged' in the examples is plainly obvious. It means 'used' (except for the last example, where 'exploit' might be closer in meaning).

  70. big deal by expressovi · · Score: 1

    I got a virus on windows and I don't see any slashdot headline saying windows xp vunerable to virus attacks...

    --
    i agree
  71. Actually the weatherman... by cyfer2000 · · Score: 1

    Actually the weatherman and the traffic guy of our local radio station discussed FireFox a lot, I have never heard them talked anything about "mozilla suit" or Linux.

    --
    There is a spark in every single flame bait point.
  72. News at 10:00 by cthellis · · Score: 1

    Pudding is tasty.

    1. Re:News at 10:00 by Anonymous Coward · · Score: 0

      It sure is.

  73. Firefox and IE??? by Clazirus · · Score: 1

    Yeah sure Firefox is good. I used it everyday but don't you all realise how much it consumes your pc memory? and IE? wth is that? I'm sure i've heard it before... Now I'm using the netscape 8...

    --
    If dreams are like movies then memories are films about ghost..
  74. Ditto for Win2K by Digz · · Score: 2, Interesting

    In a move of utter brilliance, I forgot to unplug the network cable when doing a Win2K reinstall one time (and the network cable was hooked to DSL).

    Before it was done installing I'd been rooted and someone had already started making ISO'd warez available.

    Needless to say, I don't forget that part anymore (hey, it was 3 AM or something). ;)

    --
    SYS 64738
  75. Re:I can't take it any more! by linuxfanatic1024 · · Score: 1

    Yeah, I'd agree... The right word is "naive", or more correctly, "naïve".

    --
    Microsoft-free since March 28, 2004
  76. Can you feel AOL's hand? by queenb**ch · · Score: 1

    You know, I never thought I'd say this but Netscape really sucks. I still have my Netscape 1.0 CD. Times have changed though. If you're using Netscape anything, it's being released by AOL. You can rest assured it is no longer the superior product it once was. It's been hashed up and recoded by the same team that brough you the AOL ISP client software, which has been the death of many a Windows-based PC. You have to wonder what all it's phoning home to AOL, too.

    2 cents,

    Queen B

    --
    HDGary secures my bank :/
  77. FireFox v IE by aimew · · Score: 0, Insightful

    Here on Slashdot, this is the same discussion as Microsoft v Apple - very little intellectual discourse and lots of emotion. Might as well discus religion for all the difference there as well.

    Yeah, I read a lot of the comments - the 7000+ security problems with FireFox and the test using unpatched machines. (How about a real test showing IE on an unpatched machine v a patched machine?)

    Really, what's the use? Is there one single person here that will change their mind over their browser (or Op Sys) due to any of these articles? These things are just fuel for flame wars. That's all they are and that's all they're posted for. Period.

    I challenge anyone to disagree; but with an intelligent argument, not just emotion and flame. (BTW, I don't mean a clever 'flame' argument, a real intellectual one. One with real facts and figures. Tests with defined tests-beds. That sort of thing.)

    I, personally feel that there is better security with mature products, and not through using obscure ones that feel 'safe' because nobody will bother to attack them. We see the truth behind that now with FireFox and all the attacks it is getting. (Security through maturity, not obscurity.)

    I stopped using FireFox for two reasons: It was being attacked, successfully, far too often, especially with browser hijacks. Then I discovered Maxthon. It is a shell for IE that is like IE and FireFox combined with a huge dose of steroids, that makes both IE and FireFox seem anorexic by comparison. Will anybody here try it? (http://www.maxthon.com/ Well maybe those that use IE perhaps; but FireFox users? Blasphemy!

    BTW, I have nothing to do with the Maxthon product except that once I tried it (on the advice of a friend) I never used either IE of FireFox again. Well almost never, I still use FireFox to get my Excite Email, because it has low enough security to get me logged in; and I use IE to get Windows patches - I can still cheat with it!

    Get out the torches! Somebody diss'ed FireFox! This is like a depiction of Muhammad! Burn cars, embassies, everything. The horror, the horror!

    --
    Keeper of the terrible karma ---
    1. Re:FireFox v IE by mccalli · · Score: 1
      Is there one single person here that will change their mind over their browser (or Op Sys) due to any of these articles?

      Yes - my sister and brother-in-law. They won't read this article here of course, but I've read it and use such things when asked my opinion. They've moved over to Firefox, and they're about 80% convinced to move to OS X too.

      Now to the rest of the post:
      I challenge anyone to disagree; but with an intelligent argument, not just emotion and flame. (BTW, I don't mean a clever 'flame' argument, a real intellectual one. One with real facts and figures. Tests with defined tests-beds. That sort of thing.)

      A good sentiment, but is it one that sits particularly well with phrases such as:

      • These things are just fuel for flame wars. That's all they are and that's all they're posted for. Period.
      • It is a shell for IE that is like IE and FireFox combined with a huge dose of steroids, that makes both IE and FireFox seem anorexic by comparison. Will anybody here try it? (http://www.maxthon.com/ Well maybe those that use IE perhaps; but FireFox users? Blasphemy!
      • Get out the torches! Somebody diss'ed FireFox! This is like a depiction of Muhammad! Burn cars, embassies, everything. The horror, the horror!

      I see no facts or figures there. Just opinion and rabble-rousing. Personally, Firefox is my primary browser at work and at home I use Safari. I also gave Opera a try - I'm not religiously wed to a browser. There are useful facts and figures to be found I'll bet. I suggest, however, that your post does not contribute to that.

      Cheers,
      Ian

  78. YAY FOR MARKETEERS! by Anonymous Coward · · Score: 0

    Agreed.

    It would be financially prudent to leverage your buzzword knowledge base to facilitate the expedited rollout of your market-oriented banter into the channel prior to the commencement of the second fiscal quarter, any further delays in RTM could translate into a competitive advantage for other marketing targetted individuals such as yourself.

  79. Tried FF 3 times, and it SUX by meBigGuy · · Score: 1


    really ---- can't handle big lists of bookmarks (can't arrange them --- and i submitted this bug years ago), can't ^n to clone a new window, have to search through tons of stupid extentions, can't import IE bookmarks with correct positions. And, it doesn't work on a lot of sites. Oh ---- and it takes fricken forever to start up.

    If the researcher was worth his salt, he would know what mechanism was used to install the spyware and adjust settings to avoid it. Now, that information would be useful! Or at least publish the site so other could determine the real issues. What a STUPID article.

    Could be 1 difference in vulnerabilities was the whole issue. Statistically meaningless.

    The only thing firefox is good for is comics.com with adblock. Otherwise, forget it.

  80. And for that 0.09%... by Giorgio+Maone · · Score: 1

    "Levy and Gribble didn't set out to verify that, but they did note that the few successful spyware attacks on Firefox were made by Java applets ", but they can be easily blocked and allowed on trusted domains only using the NoScript Firefox extension, which takes care the same way of JavaScript, Flash and other plugins for a paranoid yet usable security level :)

    --
    There's a browser safer than Firefox, it is Firefox, with NoScript
  81. No, the cat does not "got my tongue." by Impy+the+Impiuos+Imp · · Score: 1

    If Firefox were being used by two hundred million people around the world and was therefore the target of thousands of hackers I submit it would have just as many holes if not more.

    Why is it surprising that the exploits, deliberately targetted at IE, shouldn't affect Firefox all that much? The same argument applies to the "awesome security" of Linux vs. Windows. Were Linux to be on hundreds of millions of PCs around the world, and it were under assault from thousands of hackers, to quote Yoda, "When 800 hackers per component you reach, hold up so well you will not."

    I now await flamebait or troll moderation. (Seriously, about 1/2 the time I bring this up, that's what happens around here.)

    --
    (-1: Post disagrees with my already-settled worldview) is not a valid mod option.
  82. Re:I can't take it any more! by fatphil · · Score: 1

    The principle (it's _not_ just a theory) of Conservation of Leverage says that the middle example should have been transformed into:

    World Wind uses satellite imagery and elevation data to allow leveragers to experience Earth terrain in visually rich 3D...

    HTH.
    FP.

    --
    Also FatPhil on SoylentNews, id 863
  83. Speaking of Safe Browsing by Free_Trial_Thinking · · Score: 1

    Would this VMWare browser appliance be overkill?

    http://www.vmware.com/vmtn/vm/browserapp.html

    It claims to be free.

    Discuss, discuss.

  84. http://www.firefoxmyths.com/ by MaTriXxx1 · · Score: 1

    http://www.firefoxmyths.com/ Dont blame IE for your bad browsing habbits

    --
    Do NOT goto this URL http://www.forthesims.com