Slashdot Mirror
Firefox Users Surf Safer
SenseOfHumor writes "According to two University of Washington Professors, Firefox users have a safer browsing experience than users of IE. These researchers sent their crawlers to 45,000 websites and studied the impact on Firefox and IE." From the article: "Levy and Gribble, along with graduate students Alexander Moshchuk and Tanya Bragin, set up IE in two configurations -- one where it behaved as if the user had given permission for all downloads, the other as if the user refused all download permission -- to track the number of successful spyware installations. During Levy's and Gribble's most recent crawl of October 2005, 1.6 percent of the domains infected the first IE configuration, the one mimicking a nave user blithely clicking 'Yes;' about a third as many domains (0.6 percent) did drive-by downloads by planting spyware even when the user rejected the installations."
Installing from an original Windows XP CD, I get infected before I can apply windows patches, without vising *ANY* websites! ARGH!
If we're dealing with solid software, written by those with a clue, a lack of security should have no relation to the market share.
Look at Apache, for instance. It is used by an estimated 60% (if not more) of all web sites. But we rarely hear about serious security issues. Sure, bugs and exploits do crop up occasionally, but nowhere near at the rate of its competitors.
Likewise, if Firefox is a well-written application, then it should be secure if it has one user, or if it has hundreds of millions of users. Unfortunately, the recent 1.5.x release of Firefox went poorly, and many these days are doubting its degree of security. A rushed development cycle, built upon a base that isn't exactly ideal, can lead to security issues.
Let me reiterate: the security of a program is based on its development process and developers, not on the number of users it has.
Cyric Zndovzny at your service.
According to the article, "We can't say IE is any less safe," explained Levy, "because we choose to use an unpatched version [of each browser.] We were trying to understand the number of [spyware] threats, so if we used unpatched browsers then we would see more threats."
So reporting this on CNN and the like wouldn't have the impact that you hope it would. In fact, this study might be useful in studying malware but is meaningless in comparing FF with IE regarding security (as they rightfully admit).
-- "I never gave these stories much credence." - HAL 9000
Somebody should start a news site that takes all the top news stories, finds the original research or primary source, and links to that instead of the dumbed-down yet sensationalistic news wire blurbs and blog whores. I know I'd appreciate it.
main(c,r){for(r=32;r;) printf(++c>31?c=!r--,"\n":c<r?" ":~c&r?" `":" #");}
Ever wondered why OpenBSD is so secure? In part, it's because they don't differentiate between bugs which they know how to exploit, and ones they don't. If they find a bug, they categorise it and scour the code base for instances of the same class of bug. Then they go back to adding features. Then, when someone else works out a way of exploiting that kind of bug, they find that OpenBSD is not vulnerable.
If a program is well written, then exposing it to a larger audience will make it a larger target, but it will still be difficult to hit. If it is not, then more exposure makes it an easy, and more attractive target.
I am TheRaven on Soylent News
AdAware's obsolete if you don't pay for it anyway - they stopped updating the free version a long time ago. I would pay for spybot if I needed a corporate version, because it's free, but I would now NEVER EVER pay for AdAware and I try to encourage everyone else in the same direction, just because I'm a bitchy fucker and I don't think that security should cost money.
I, too, have not been infected with anything since I stopped using IE and started using a firewall - which was quite some time ago. You do need the firewall though, because you never know when someone's going to find a hole in some service that should never have been open to the world at large anyway, like RPC...
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Of course IE is unsafe, because it is the primary target.
IE is the primary target because it is unsafe.
Even back when IE was the minority browser, in 1997, when MS introduced "Active Desktop" it opened up a MASSIVE flood of malware targeting the gaping hole they created. There was no similar attack on netscape or Mosaic.
No, IE is the primary target because it is unsafe, and it (or more properly the HTML control) is unsafe because it is inherently unsafe to give one component that kind of responsibility over rights when it has no mechanism to unambiguusly determine whether a document can be trusted.
The security zones model is unfixable without changing the API. ALL existing applications that use the HTML control will have to be modified to control the execution of active content if Microsoft is to have a hope in hell of solving the problem.
This was true last century, it's true this century. That is is the most common browser makes things worse, but it's an unacceptably insecure one regardless.