Symantec Rethinks Firefox vs IE Vulnerabilities

chill writes "Last September security software vendor Symantec issued a report claiming IE had fewer critical flaws than Firefox and thus was more secure. Well, it seem they have now rethought that position. 'How we did it before wasn't a fair comparison,' said Oliver Friedrichs, the senior manager of Symantec's security response group. 'It wasn't an apples to apples comparison.' The key was vendor acknowledged critical vulnerabilities. Thus, if Microsoft (or the Mozilla Foundation) didn't agree it was critical, then it didn't get counted."

Comments

imagine that

[Anonymous Coward]

profit motive = incentive to lie

I'm SHOCKED!

Re:imagine that

[nevernamed]

I agree. How can you believe that firefox is less secure than IE? You're probably on crack if you think that.

Re:imagine that

[Anonymous Coward]

Of course, the two concepts are completely unrelated, when one realizes that lying doesn't occur because the lier decided that lying was NOT in his best interest. Lying occurs because the lier, at the time, decided it would benefit him somehow. In other words, in order to profit. (Profit doesn't have to be measured in raw dollars, but can take the form of anything which an individual considers to benefit him.) Therefore, all lying is an attempt to profit, just like all truth telling is an attempt to profit. (Why would someone tell the truth if they didn't believe it was in their best interest, i.e. for profit?) People do things because they believe, at least at that moment, that those things are in their best interest.

So there is no more connection between lying and profit than truth-telling and profit. D'oh!

Re:imagine that

[causality]

(Why would someone tell the truth if they didn't believe it was in their best interest, i.e. for profit?)

I know this might come as a surprise to some of you, but there's a few strange individuals who have integrity, who do really strange things like telling the truth even when it may not be in their best interests. I suppose that might not fit into your worldview ...

Re:imagine that

[Skuld-Chan]

There's a support reason too - overly paranoid IT managers don't necessarily need to know about security issues that don't necessarily affect them.

Re:imagine that

[DarkJC]

If they tell the truth, then most likely they do get something out of it. Perhaps they think if they tell the truth in cases that it might not be in their best interest, they'll still earn and maintain the respect of people. People always tell the truth to benefit themselves, whether that's profit-wise or otherwise.

Re:imagine that

[Anonymous Coward]

You didn't get it. Individuals do things because they believe those things to be in their best interest, not because they believe those things to NOT be in thier best interest. That is why individuals make decisions. You don't get to chose whether something is in another individual's best interest or not. Only the individual in question gets to decide.

Human nature tells us that an individual can't possibly make a decision against what he sees as his best interests -- no matter how counter-producive you might see it. Even a person who climbs a bridge intending to jump off believes, at the time, that suicide is in their best interest. If he later decides to climb down off the bridge, he did so because he changed his evaluation of what's in his best interest. A person who smokes crack decides, at the time, that the benefits outweight the downside. Otherwise he wouldn't do it. If that person later quits smoking crack, he does it because at that time, he percieves the benefits to outweigh the downside. It doesn't matter if you or "society" considers smoking crack to have more downside than benefits; the point is that neither you, nor "society", gets to decide. Only the individual in question gets to decide, and human nature tells us that individuals don't make decisions -- even unpopular ones -- unless they somehow percieve the positives to outweigh the negatives.

Remember that profit doesn't necessarily mean financial gain -- it can take the form of anything an individual gains (or thinks he gains) as the result of a voluntary decision.

Re:imagine that

[Anonymous Coward]

I take issue with that:

You're completely discounting the possibility that some people may tell the truth because [gasp] it's the right thing to do. Are we so jaded that the mere possibility of someone telling the truth for no other reason is unimaginable?

I'm not saying that this was the case for article, but to say everyone lies unless they have something to gain is asinine

Re:imagine that

[Anonymous Coward]

Hmmm. Methinks this train of thought exhibits psychotic tendencies...
?

Re:imagine that

[LouisZepher]

What he means is that you'd be telling the truth in order to proft from that warm fuzzy feeling of having "done the right thing". In cases such as that however, I don't think it's a bad thing at all, even if society gets to the point where everyone is doing "the right thing" only to get that warm fuzzy feeling, it wouldn't change the fact that the right thing was getting done and everyone walks away happy.

Re:imagine that

[DarkJC]

That's exactly what I meant. And you're right, no, that's not a bad thing. The idea of profit varies widely from person to person, it's just that certain profits benefit society more than others.

Re:imagine that

[Anonymous Coward]

If I might add, the key here is really "voluntary decision". The nature of any voluntary decision is that -- by the definition of voluntary (meaning "of his will", not "against his will") -- it is made because it was percieved by the individual as a gain, not a loss (a "profit"). Given free will to make a decision, a person naturally makes that decision based on an evaluation of positives vs. negatives in his mind, no matter how crude, brief, incomplete, or wrong according to "society", that evaluation may be. That is the reality of human nature -- we are individual, thinking beings, and we do things not randomly, but for reasons. Life is a series of decisions, and the rationale behind those decisions simply cannot include "I did it because at the time, I belived it to be against my interest".

Re:imagine that

[tyme]

some nitwit of an anonymouse coward wrote:

Human nature tells us that an individual can't possibly make a decision against what he sees as his best interests

Complete bullshit, people do all sorts of things that are completely irrational, because at the moment that they did them they couldn't think straight (due to emotion, intoxication, haste, etc.). In a moment of irrational exuberence (or panic) a persion is at least as likely to act against their own best interests (whether we are talking monetary, psychological or even physical) as they are not to. This is the sort of circumstance in which a person might jump into a freezing cold river to save a drowning person or run into a burning house to save a person calling for help, even though ration thought would tell them that they are far more likely to perish themselves than to effect a successful rescue.

While this sort of action might benefit the species or society or the geneome, it is clearly detrimental to the individual, and can't be reconciled with some naive notion of pure utility and self-interest. Simply put, the absurd notion that people always act in some manner to maximize some intelectual goal (profit, moral integrity, etc.) depends upon the notion that people always act rationally, since it is clear that people don't always act rationally (in fact, many people seem to act irrationally most of the time) the proposition fails on it's own premises.

Re:imagine that

[Peaceful_Patriot]

I think there is a big difference between individual integrity and the lawyer and profit driven speak of companies. Of course there is personal honesty. Lots of people choose to tell the truth. Companies, however, tend to view honesty as a relative thing it is and highly subject to the influences of lawyers and shareholders.

Re:imagine that

[Anonymous Coward]

In a moment of irrational exuberence (or panic) a persion is at least as likely to act against their own best interests (whether we are talking monetary, psychological or even physical) as they are not to

Again, you don't get to decide whether those things are "irrational" or against the individual's interests, provided the individual's decision is voluntary; only the individual gets to decide that by the definition of voluntary!

You refuse to accept this and as a result, you cannot understand the logic of what I am saying.

If the decision is voluntary, then only the individual gets to decide, at the time when the decision is made, what is profit and what is loss. What you or "society" thinks is irrelevant! You can persuade the individual otherwise, but if the decision is 100% voluntary, then ultimately the decision is 100% his responsibility.

Take the most irrational thing in the world -- murder -- "not thinking straight" is a prerequisite of the murderer. Does it not take some degree of insanity or irrational thought to commit murder? Yet, at the moment, for whatever reason, the murderer made the decision for a reason. If the decision is voluntary, than that reason cannot possibly be "because I didn't intend to do it". That doesn't make sense. Therefore, it must have been made because he thought he would benefit from it at the time, however crudely or wrongly the rest of us sees it.

Re:imagine that

[killjoe]

People with integrity can't run big businesses. If a person with integrity starts a business and runs it ethically it will never get past the small to medium business range. Untethical people will always outcompete you because there is so much profit in sleaze.

So really there are no people of integrity (in charge) in a company with more then a 100 employees.

Re:imagine that

[procrastin8r]

so annoying.. what the hell has this to do with the article. please stop philosiphizing. you guys are a joke

Re:imagine that

[Hosiah]

Why would someone tell the truth if they didn't believe it was in their best interest, i.e. for profit?

Well, see, this story's example shows "the truth will always out." This is another one of those shifting paradigms you heard your PHB muttering about. In the present information age, with a battalion of bloggers on the job and snoopers ferreting to the very bottom of the data pile, it's damn near impossible to keep anything secret. So, you publicly deny that your product has *any* flaws, then get caught; you look bad in the long term. Or you frankly discuss the flaws up-front; you look bad in the short-term, but better in the long term, especially since you openly invite assistance from all concerned to find bugs and suggest ways to fix them, driving many of the flaws out anyway.

Conclusion: Free/Open Source Developers *are* telling the truth in their best interest; they're just thinking farther ahead.

Re:imagine that

[McGiraf]

"I suppose that might not fit into your worldview"

well it fits in my worldview but not in my view of the world, if you know what i mean ...

Re:imagine that

[Bazzalisk]

I would maintain that there is another (albeit rarer) reason to do something not in one's own best interest which has nothing to do with getting a warm fuzzy feeling out of doing the right thing.

Some people choose to act in a particular way as part of an intelectual construction of a particular way of acting. Motivations can be strange things.

Re:imagine that

[Mistshadow2k4]

Yes, but in this case? I don't think so. What appears to have happened is that he lied for the benefit of Microsoft and didn't get the compensation for it that he expected.

Re:imagine that

[Anonymous Coward]

Given that IE is a far more mature code base than Firefox (version 6 versus version 1.5) I would expect IE to be far more secure than Firefox. The fact that more people use IE causes more security flaws to be found anyway since more people look for flaws in it.

Plus, IE doesn't use the page renderer to handle the user interface like Firefox does - that's already bitten Firefox several times and doubtlessly will continue to as people find ways to jump from "unsafe" content to "chrome" content.

Re:imagine that

[sumdumass]

Yes he got the compensation expected.

You see, the idea of selling security related products and releasing reports that the more secure web browser is actualy less secure only increases those sales and deepens the need for the public to purchase thier products.

What they didn't count on was the target audience's core constituants aren't the type that know only what product advertising tells them. When people started calling bull on these claims and demonstrating the differences between the two browsers, and the benefits of why the numbers differed, symantec had to reissue thier prosition to save credit-ibility. I have no doubt that the only reason the numbers were released in the first place was to demonstrate the need to use thier products. This is a case of manipulating the nunmbers to meet thier purpose while not directly lieing. Fortunatly, enough people called thier motivation and methods into check that a fair comparison was called for. Also fortunate for symantec, this still demonstrates the need for thier products so while not as effective as before, it still suites thier prupose.

The real winner is the Mozilla fans who are vindicated officialy in thier statments about security. When i first read thier report, i was wondering if microsoft was finaly getting things right or if i was being lied to by the mozilla fanatics. I don't think these impresions set well with some mebers of the comunity.

Re:imagine that

[Anonymous Coward]

Take the most irrational thing in the world -- murder....

What the hell are you talking about?

Re:imagine that

[Anonymous Coward]

Bill? Is that you?

Re:imagine that

[hdparm]

Older is not necessary more mature.

Re:imagine that

[ozmanjusri]

The real winner is the Mozilla fans who are vindicated officialy in thier statments about security.

No, Microsoft has won this round. Before the concerted FUD effort that included this Symantec story, Firefox was on a roll, gaining ground at a rapid rate. Now adoption has slowed and by slowing the momentum Microsoft has bought time for the development of IE7.

Re:imagine that

[Anonymous Coward]

liar

Re:imagine that

[zippthorne]

Wait.. are you using PR version numbers as your basis for comparison?

That's like saying windows 95 is more mature than [linux distro using kernel version 2.6.x] because as anyone can see, 95 > 2.6.

Re:imagine that

[runderwo]

Bullshit.

Re:imagine that

[killjoe]

Which guys? Why are we a joke? How come this is annoying to you?

Re:imagine that

[ppanon]

Actually there are a number. But they tend to run privately owned companies, not publically-traded ones where the investor focus on quarterly profits, regardless of external market conditions, encourages result manipulation.

Re:imagine that

[rtb61]

The phrase your reaching for would be enlightened self interest, taking a longer view and understanding what benefits others benefits you. Lying for gain is always destructive, lying to prevent loss can sometimes be seen in a different light.

Symantec originally took one view point for reasons of it's own keeping that tended to support microsoft view point, as microsoft moves into competing with symantec attempting to appease them and delay the inevitable seems like a pretty pointless effort. Moving into a new product are most likely would be beneficial, although the new product area could be consider fairly secure already as it moves into mass market it will undoubtedly require security and management software that the mass market can cope with.

Re:imagine that

[Anonymous Coward]

I disagree.

Re:imagine that

[hey!]

People with integrity can't run big businesses. If a person with integrity starts a business and runs it ethically it will never get past the small to medium business range. Untethical people will always outcompete you because there is so much profit in sleaze.

Oh, I don't think that is true at all. Ask people about Bill Hewlett, and they'll tell you he was a great engineer who was fanaticaly about treating his employees with respect. Although ethics issues have arisen in some of Berkshire Hathaway's insurance subsidiaries, nobody has anything but stellar things to say about Warren Buffet's personal integrity and of course business acumen.

The thing is, these guys are are rare combinations of technical genius, organizational ability, and personal insight -- what they call these days "emotional intelligence". Most entrepreneurs fall short in one or more areas, and so bluster, pretense, and faking of results is common. With a bit of luck a sense of timing, these guys may achieve a measure of success. Nonetheless, while you can never predict how chance may affect the outcome of the best laid plans, in a one to one contest of entrepreneurship, I'd put my money on Warren Buffet against a guy who's main qualification is that he's willing to lie and cheat.

Re:imagine that

[releppes]

Jumping in a freezing river to save someone trapped in a burning house is irrational. The arguments you make just don't seem to fit.

Sure, putting ones life at risk (in a split second) to "increase the odds" of saving someone else may sound irrational. So let's add a little more detail. What if you 3yr son was trapped in a burning house. Running into that house to save your son may surely put your own life at severe risk. Say doing so gives you a 10% survival chance. If you do nothing, your son stands a 0% survival chance. You act of heroism may only increase that chance to a mere 5%. In a split second, you're probably not going through all these probability calculations in your head. All you see is the value on someone's life and any chance you have at saving that life is worth the odds.

Most parents would take a bullet for their kids and I suppose that's irrational too.....or maybe it really is rational, and it's just people who make up bullshit statements about the psychological studies that just don't understand human nature at all.

Re:imagine that

[tyme]

anonymous coward wrote:

Again, you don't get to decide whether those things are "irrational" or against the individual's interests, provided the individual's decision is voluntary; only the individual gets to decide that by the definition of voluntary!

You refuse to accept this and as a result, you cannot understand the logic of what I am saying.

So you're saying that nobody ever acts irrationally, under any circumstances, even by their own admission? That nobody has ever done anything in the heat of passion, panic or intoxication? That nobody, ever in the history of the world, has done anything that they later regretted and for which they could not provide, even to themselves, an adequate excuse? You honestly believe that all actions, by all people, under all circumstances are rational, calculated and exlicable?

You, sir, are a wanker.

Re:imagine that

[fruitbane]

He's not at all saying that nobody ever acts irrationally. He's saying that, irrational or not, it is still a conscious choice. If you are under the influence of alcohol when you make a decision are you not still responsible for that decision? However impaired your judgement is, you are still attempting to judge and make a decision. This is not to say at all that all actions are rational. But all actions are decisions made. And the individual is the only one who can make those decisions.

Meaning, if you are screwed up in the head and you make a decision that is, in retrospect, against your own best interest, it is only against your own best interest in retrospect. At the time, given your altered state, that decision made perfect sense and seemed, by all twisted logic, to be in your best interest.

The argument you make seems to be that people who act in panic or intoxication are somehow not responsible for their actions, but I take the opposite view. No matter how messed up you are, either because you took some substance or simply because the circumstances are so immediate or bizarre, you are still responsible for your decisions. While society makes certain allowances, for example killing in self-defense and evading criminal prosecution due to mental insanity, there are other things we do not allow. If someone is drunk and hurts someone or drives under the influence and kills someone the penalties are, and if they aren't, should be, stiffer than doing so when not under the influence. People choose to alter their judgement in many cases, which means that they are responsible for even the most poor decisions they make.

So, keep in mind that the best interest of the decision-maker changes moment to moment, as does the perception thereof.

Re:imagine that

[ivan256]

Your post caused my irony detector to overload and explode violently.

You will be receiving a bill.

Re:imagine that

[NumerusSpy]

are you from the US by any chance?

Re:imagine that

[Rufus88]

Human nature tells us that an individual can't possibly make a decision against what he sees as his best interests

I guess some people never studied human nature.

Re:imagine that

[NumerusSpy]

Most parents would take a bullet for their kids and I suppose that's irrational too.....or maybe it really is rational, and it's just people who make up bullshit statements about the psychological studies that just don't understand human nature at all.

Taking a bullet for your kid wouldn't be irrational it would be THE RIGHT THING TO DO.
I know of someone who was placed into a similar type situation and the reaction was immediate and instinctive, it wasn't his kid, he acted against his own best interests, saved the kids life, and had both his legs broken, he sprained the child's wrist saving its life and the worthless sack of shit mother wanted to sue him for injuring her child. He says he would do it again in an instant.

Re:imagine that

[barefootgenius]

Original post was by CmdrTaco on Sept 20th, 2005. Maybe this heralds a change in Symantecs position from partners with Microsoft to competitors dues to the Microsoft anti-virus forays?

Ps: Thanks CmdrTaco for unbanning my address. You should have waited, my next offer was to buy you a case of wine and change my name to scriptkiddy2.

So Symantec hates microsoft now??

[nich37ways]

I guess the latest TCO Microsoft is great checks failed to appear this week....

Re:So Symantec hates microsoft now??

[Anonymous Coward]

I guess the latest TCO Microsoft is great checks failed to appear this week....

Can we please have that in English?

Re:So Symantec hates microsoft now??

[Anonymous Coward]

Microsoft has been running the "get the facts" t.otal c.ost of o.wnership ad campaign all over the net. They pay for that, ie, "checks" or "cheques" or "notes du deposite" or however you call them things.

Re:So Symantec hates microsoft now??

[Jekler]

After rereading a few dozen times, I think the Grand Parent post was saying Microsoft didn't pay bribes this week (i.e. bribing authors to write articles supporting Microsoft products).

Re:So Symantec hates microsoft now??

[Anonymous Coward]

Isn't it amazing how much of a difference including a verb makes?

Re:So Symantec hates microsoft now??

[colinrichardday]

I guess the latest "TCO [of] Microsoft is great" checks failed to appear this week.

Re:So Symantec hates microsoft now??

[LouisZepher]

That was in English, or something like it. (As much as an orange is like a carburetor.) I think what you wanted was proper English.

It took them

[colonslashslash]

Over 6 months to realise and admit that? Nice going ...

Re:It took them

[who am i anyway]

Half a year for admitting a mistake ain't that bad... compared to the catholic church.

Re:It took them

[uptoeleven]

However it doesn't get added to the list of "spurious claims regarding potential adequacy or compliance of Microsoft products" until Symantec admit to it... So technically it was zero months since they admitted to it and changed the published list at the same time...

Maybe the best way to ensure your browser stays top of the pile is to admit nothing...

Re:It took them

[rbochan]

6 months! That's nothing compared to their virus/trojan detection updates!

Reason #1 to lie

[wap911]

If the Dept of Justice accepts your PR crap [lies] then everyone should.

Surely it's just about potential for harm.

[91degrees]

Weakest point, and amount of possible damage.

If one browser allows an attacker to read arbitrary files, and another allows an attacker to delete arbitrary files, then the one that allows the deletion is surely worse however many ways there are to read files.

If one browser can be attacked in a generic manner, and the other needs some knowledge of the victim, then the one that can be attacked in a generic manner is less secure.

Now, exactly how an easy to implement low impact and a hard to implement high impact attack compare is still going to be subjective, but wherever you draw the line, it's going to be better than simply counting the nuber of critical bugs.

Re:Surely it's just about potential for harm.

[syntaxglitch]

If one browser allows an attacker to read arbitrary files, and another allows an attacker to delete arbitrary files, then the one that allows the deletion is surely worse however many ways there are to read files.

This isn't necessarily true. For instance, if the files that can be read include ones with, say, credit card information, wouldn't it be better to have those deleted (you can always re-enter the info to order online) than to have the information read without your knowledge and let someone else charge to your credit card?

The basic point you're making is quite correct, though.

Re:Surely it's just about potential for harm.

[91degrees]

True. My examples were a huge oversimplification.

Re: Surely it's just about potential for harm.

[gidds]

Theoretically, yes; the trouble is, we don't know the potential for harm. We only know what exploits have actually been found -- in fact, we don't even know about all of those; we only know about those which have been exploited enough to have been recognised by security folks.

I'd say, based on previous performance, that both browsers probably have exploits allowing people to read files, delete files, get local root privileges, etc. The question should really be: how many such problems are there, how easy are they to find and exploit, and how quickly can they be fixed?

Personally, I'd say that we can make reasonable estimates of those answers by now, but we'll never know the actual values.

Re:Surely it's just about potential for harm.

[bubkus_jones]

I guess it depends, as you said, on the type of data the file contains, and what purpose it serves. However, isn't manually deleting information like credit card numbers and other sensitive information yourself part of proper/secure browsing techniques?

Re:Surely it's just about potential for harm.

[syntaxglitch]

However, isn't manually deleting information like credit card numbers and other sensitive information yourself part of proper/secure browsing techniques?

Yes, but since when has relying on users to follow "proper/secure technique" ever provided good results?

As tempting as it is for people who know better to brush off the mistakes of the untrained, sometimes their mistakes affect other people. Security needs to be the default behavior, not something extra you have to do.

Re:Surely it's just about potential for harm.

[mrchaotica]

But aren't the permissions on most files generally such that the ability to delete implies the ability to read? In that case, the "delete" vulnerability is actually a "read AND delete" vulnerability, which is always words than a "read BUT NOT delete" one.

Re:Surely it's just about potential for harm.

[syntaxglitch]

That'd depend on what the vulnerability is. If it's something like "feed a web browser bad info somehow and it'll flip out and trash files", even though the BROWSER has read access there's no way for the attacker to get that info sent out; all the attacker can do is destroy things.

It's not always as straightforward as "attacker is able to execute arbitrary code on target machine with flawed program's permissions and have full two-way communication".

Re:Surely it's just about potential for harm.

[NumerusSpy]

If one browser allows an attacker to read arbitrary files, and another allows an attacker to delete arbitrary files, then the one that allows the deletion is surely worse however many ways there are to read files.

Can the browser that deletes the files also read the files?

Stop blaming browsers!

OneCare

[ROOK*CA]

I wonder if Symantec's "rethinking" of it's position has anything to do with Microsoft Announcing a Competeing offering (OneCare Live), apparently Symantec will no longer just take Microsofts word whether a suspected flaw is actually a bug/vulnerability or not, Sorry Microsoft that ole "Naw, that's not a vulnerability, it's just an undocumented feature" doesn't look like it's going to fly anymore.

:D

Re:OneCare

[brian0918]

Of course they're connected; there's no other possibility. Listening to Symantec's opinion on this would be like asking Philip Morris for an opinion on the link between cigarettes and lung cancer. So, how long until MS OneCare starts getting flagged as malicious spyware by Norton, or vice versa?

Re:OneCare

[ROOK*CA]

So, how long until MS OneCare starts getting flagged as malicious spyware by Norton, or vice versa?

LOL, Great Point, I can see it now "Symantec Client Security Has Detected A Serious Vulnerability On Your Computer Click OK to Uninstall ..... Microsoft Office" :D

Great way to drive pay-per-incident Technical Support too.

"Personal Security Suite Wars 2006 Coming to a Windows PC Near You."

Re:OneCare

[ntsucks]

Perhaps the Symantec marketing trolls have embarked on a subtle campaign to undermind the general public's trust in Micro$oft's ability to deliver secure products. Basically a "Who do you trust?" positioning of themselves against OneCare Live. Strange as it may seem Joe Six Pack probably does not have the Slashdot crowd's contempt for Micro$oft's ability to deliver secure products, thus leaving some room for Symantec to discredit them.

Re:OneCare

[Bloater]

> Strange as it may seem Joe Six Pack probably does not have the Slashdot crowd's contempt for Micro$oft's ability to deliver secure products

Quite the opposite, Joe Six Pack is absolutely certain that Microsoft is the one and *only* software producer that can reliably produce secure, high quality software.

Re:OneCare

[dnoyeb]

Quite the opposite, Joe Six Pack is absolutely certain that Microsoft is the one and *only* software producer that can reliably produce secure, high quality software.

Thats what he said ;-)

Re:OneCare

[sqlrob]

vice versa happened a couple of weeks ago.

Re:OneCare

[Dehumanizer]

Almost there.

Joe Sixpack believes all software is from Microsoft. In fact, they invented computers, ya know.

Re:OneCare

[Bloater]

No, the OP wasn't any where near as strong. The OP said suggested that rather than know what Microsoft is like, Joe Pack Simply doesn't know. I suggest that Joe Six Pack's opinion is actually the polar opposite of the truth.

But I see how I was ambiguous.

Re:OneCare

[chill]

LOL, Great Point, I can see it now "Symantec Client Security Has Detected A Serious Vulnerability On Your Computer Click OK to Uninstall ..... Microsoft Office" :D

You were modded funny, only because "prophetic" isn't a legitimate mod. Actually, McAfee beat them to it. Their virus update sigs on Friday, March 10th classified MS Excel as a virus.

  -Charles

Re:OneCare

[Anonymous Coward]

These guy should be completly ignored. They have lousy software and are big time moeny hunters.

Re:OneCare

[TubeSteak]

It's easier to convince idiots to delete Excel than to bother scanning all spreadsheets for Macro Viruses.

Coming up with heuristics to sort out legit from malicious macros is probably a pain in the ass.

Re:OneCare

[Anonymous Coward]

The word you're looking for is 'undermine'. 'Undermind' is the colloquial term for /. commenters with poor vocabulary.

Re:OneCare

[burnin1965]

"Perhaps the Symantec marketing trolls have embarked on a subtle campaign to undermind the general public's trust in Micro$oft's ability to deliver secure products"

I suspect there is little public trust in the security of Microsoft's products that is worth undermining. Most people have been beaten into submission and have simply accepted their fate of dealing with the maladies which accompany Microsoft's products. At the same time everyone has also accepted that open source offerings are much more secure than Microsoft products but are beyond their technical skills.

It is more likely that the Symantec marketing trolls are merely attacking their new enemy, Microsoft. Before the enemy was open source because of its public perception as a secure solution that does not need Symantec services, now Microsoft is the enemy because they are competing directly with Symantec. By scaring people away from products which don't require Symantec's services by refuting wide spread beliefs they hoped to maintain their market of installed Microsoft products which require their service, but now their greatest risk is that of losing their market directly to Microsoft.

I'm with you in that Symantec's sudden change of heart concerning the security of IE verus Firefox appears rather disingenuous and loaded with ulterior motives, but I doubt there is a general feeling of trust between Microsoft and their customers which Symantec needs to break. Symantic is merely adding fuel to a long raging fire of mistrust of Microsoft and a perception of a need for protection against Microsoft's security failures. One could hardly say the negative perception of security in Microsoft's products is undeserving, to the contrary they made the mess they are in, but that doesn't mean that Symantec is suddenly devoid of malice towards Microsoft these days.

It is also possible that the people at Symantec are truely printing what they believe to be the truth, its always good to give people the benefit of the doubt, but it does seem rather suspicious considering the circumstances.

burnin

How can you trust them?

[putko]

How can you trust these guys with your security?

They make some b.s. statements that just aren't founded in logic, or in a reasonably cynical view of how people/companies behave. The result is that they suggest you do the ridiculous, with your security (not theirs). Then they (for whatever reason) say something else.

I'm not even suggesting that they "came to their senses", but perhaps, for one reason or another, decided that Microsoft was not their friend anymore (or maybe firefox is their friend now).

Re:How can you trust them?

[spiritraveller]

How can you trust these guys with your security?

No sane person would. By their own admission, it is clear that they gave a blank check to Microsoft. Whatever their motive for doing that, it shows a lack of devotion to the stated goal of their products.

If a company wants my money for securing my computers, they better show some integrity that doesn't shift depending on how their relationship with the bigger company is going that day.

Re:How can you trust them?

[booyabazooka]

How can you trust these guys with your security?

Maybe because the techs who write the software and virus definitions aren't the same people who make these announcements?

A Scenario

[BumpyCarrot]

Symantec: Internet Explorer feasted on my childs bones.

Microsoft: We don't consider that critical.

Re:A Scenario

[Khan]

ROFL!! That was too damn funny. It's like the ol' "It's just a flesh wound" bit from Holy Grail. Sometimes, I wonder WTF these AV companies really hope to accomplish by providing crap information like the initial report? No doubt they are now worried about MS's Av solution. These idiots will never learn.

But there's more...

[ABoerma]

I like the other part of TFA better:

"Windows XP Professional, said Symantec, stays safe just one hour and 12 seconds, while the Windows 2000 Server (with SP4) made it an hour and 17 minutes. An unpatched Windows Server 2003 system lasted somewhat longer.

In contrast, unpatched Linux installations of both Red Hat Enterprise Linux 3 and SuSE Linux 9 Desktop were never compromised during their month-and-a-half exposure to attackers."

Re:But there's more...

[DanteLysin]

So if you are a noob and don't patch your systems, you get by longer on Linux than Windows. No surprise there. My guess is that there are more Windows oriented viruses/worms circulating the Internet. The take home message is "patch your system". We Slashdotters know better, but does the regular home user?

Re:But there's more...

[Anonymous Coward]

I agree with you totaly. It also gives out another subtle point: linux right now has less risk, (if not absolutely zero from automated attack) on the net. As a result, less need for maintenance, and time consuming virus/spyware checks. This is a well known point that MS has dismissed with the 'If linux was as popular...' FUD. But coming from Symantec, this gives me a linux user the shivers... ;)

Re:But there's more...

[Tim C]

time consuming virus/spyware checks

My virus software performs a full scan daily at 8am. Weekdays at that time I'm on my way to work; weekends, I'm either still in bed or busy with something other than my PC. I rarely run full spyware scans, but when I do they take a few minutes and are always negative (other than the odd cookie).

Of course, I know what I'm doing, which is more than can be said for most PC users...

This is a well known point that MS has dismissed with the 'If linux was as popular...' FUD.

If Linux was as popular, you'd have just as many naive and clueless Linux users as you now have Windows users. They'd mostly either run as root, or happily type in the root password (or use sudo, or whatever) when prompted, and would still hose their systems by installing trojans.

The single biggest security threat to any system is the user. It doesn't matter how much you patch the OS if you never educate the user.

Re:But there's more...

[NutscrapeSucks]

The only news there is that software firewalls work.

(The original release of XP should have had a firewall active, but that's another story.)

Re:But there's more...

[doodleboy]

My guess is that there are more Windows oriented viruses/worms circulating the Internet.

Undoubtedly there are. And Microsoft's PR flacks, who apparently decided which vulnerabilities are labeled as critical in TFA (very few), also argue that Windows is attacked more because it's more popular. By that reasoning Apache should have a much worse security record than IIS since it's at least twice as popular. But if anything it's the other way around. The simple truth is your basic cracker/delinquent types are going to go after the low hanging fruit first. They attack Windows so much because it's easier.

Re:But there's more...

[ABoerma]

From TFA: "Among the other data in Symantec's report are new 'time to compromise' figures that try to gauge how long an unpatched, unprotected computer would last before it has snatched by a hacker."

So, no "viruses/worms circulating the internet". Active attackers.

Re:But there's more...

[AnyoneEB]

No, that's why in Windows XP SP2, the default setting is to have updates be downloaded and installed automatically.

Re:But there's more...

[uptoeleven]

If Linux was as popular, you'd have just as many naive and clueless Linux users as you now have Windows users.

Apple are pretty popular. OS X has it's fans and the majority of them aren't particularly technically adept. Of course OS X is Unix, not Linux, but the comparison stands, it's fairly popular and most of its users lack clue.

I'd love to see the user percentages of zombi-fied Apple boxes vs zombi-fied MS/Windows boxes if anyone has them, my suspicion is that your argument may be cromulent.

Re:But there's more...

[moria]

If Linux was as popular, you'd have just as many naive and clueless Linux users as you now have Windows users.

As always said, Linux (and OS X) is like a house securely locked by default. To let a theft in, you have to manually open the door or window. Windows by default leave the doors and windows open to welcome all potential intruders and think it as "not critical".

We all know that there is no absolute secure platform, especially when social attacking methods and hoax are used. So I would say, if Linux was as popular, you'd still have naive and clueless Linux users as you now have Windows users, but the number is dramatically smaller. Not all clueless users ever cheated by Windows will still be completely clueless in front of a big security warning and a red desktop when they log in as root and a dialog asking for sudo password: they know something bad might be happening. As an experienced computer user myself, who even did some research and programming work on anti-virus system, I guess I still have to be considered clueless on the Windows + IE platform, but not on Windows + Firefox or Linux + whatever platform.

Re:But there's more...

[NumbThumb]

So if you are a noob and don't patch your systems

That should be So if you are a noob and don't patch your systems within one hour of connecting it to the net ! People do connect vigin boxes directly to the net, you know...

Re:But there's more...

[DrDribble]

Windows users are used to the "just click the .exe to install", then press "ok" until it has completed. Linux users typically install software through (authenticated) package systems. Ubuntu will for example cry out loud if you install packets that are not "approved" by the Ubuntu organization.

In other words, the way people install Linux software would make them stay away from most bad software (including cracks and other ways to hose a computer due to saving a few bucks). Linux is, in this respect, a lot more secure than windows.

Oh, and you do of course also get security updates for the software you just installed. I've only seen the red "important update pending" notice in Firefox running on Windoze computers.

Re:But there's more...

[SeeMyNuts!]

It is not unknown for updates to have new "features" and EULA clauses. It isn't just a matter of repairing the original product, it is a matter of transforming the original product into something new and not necessarily what the customer intended to purchase.

It would be a good thing for the IT industry, in the long term, for these things to get a good legal test. This would rein in the abusers, while clarifying the rules of business for the honest folk.

Re:But there's more...

[Anonymous Coward]

My virus software performs a full scan daily at 8am. Weekdays at that time I'm on my way to work; weekends, I'm either still in bed or busy with something other than my PC. I rarely run full spyware scans, but when I do they take a few minutes and are always negative (other than the odd cookie).

Of course, I know what I'm doing, which is more than can be said for most PC users...

Well yes, but how much performance are you loosing by scaning attachments or .exe on the fly. Or how much an impact would it have if you, say, encode videos overnight. Sure an experienced user knows what he's doing, as you pointed out. It's the noobs I'm talking about though. ;)

If Linux was as popular, you'd have just as many naive and clueless Linux users as you now have Windows users. They'd mostly either run as root, or happily type in the root password (or use sudo, or whatever) when prompted, and would still hose their systems by installing trojans.

The single biggest security threat to any system is the user. It doesn't matter how much you patch the OS if you never educate the user.

Right again. An OS is as secure as it is configured to be most of the time. The problem is the average user. The average user will stick with the default configuration. By default windows isn't so secure... I'm not arguing that it can't be hardened to be secure. The tools are there. What about diversity of linux configurations? With windows (even updated systems) you have a tremendous chance of exploiting millions of machines with an unpublished exploit because they are all alike. In the same situation on linux, your malware would be confined to the machines running the stuff it needs to propagate. Still, I'm not saying malware is impossible (a stupid user is a stupid user), but saying linux would be as unreliable as windows if it was popular is just a 'guess' and certainly not a point to make to scare people away (FUD) from linux or OSX, at this point in time at least...

Re:But there's more...

[kimvette]

You need to connect to get the patches, unless you have another machine to download them to them put them on CD or isolate your LAN and copy them over to the virgin box.

Also, the numbers posted are MTBF - that doesn't mean your box won't get hit instantly - and it doesn't mean it is guaranteed to even within six hours or a full day. It's simply an average and there are highs and lows, and if you have a great ISP they may have scanners between you and everyone else. Or, if you're on, say, AOL, you'll have a pretty "antispyware" and "antivirus" program that does little to nothing, but looks really shiny!

Better Security for Linux

[Kream]

The article refers in addition to another interesting snippet:

Among the other data in Symantec's report are new "time to compromise" figures that try to gauge how long an unpatched, unprotected computer would last before it has snatched by a hacker.

Windows XP Professional, said Symantec, stays safe just one hour and 12 seconds, while the Windows 2000 Server (with SP4) made it an hour and 17 minutes. An unpatched Windows Server 2003 system lasted somewhat longer.

In contrast, unpatched Linux installations of both Red Hat Enterprise Linux 3 and SuSE Linux 9 Desktop were never compromised during their month-and-a-half exposure to attackers.

Re:Better Security for Linux

[Anonymous Coward]

"Windows XP Professional, said Symantec, stays safe just one hour and 12 seconds"

To me it stayed safe less than the time it took to activate norton internet security... Close to the 12 seconds....

Re:Better Security for Linux

[Anonymous Coward]

And once Norton activated, it was Game Over for security.

Not too surprising

[enigma48]

My first thought was that this makes perfect sense - now that MS is a competitor of Symantec, they're going to discredit them as much as they can.

But Symantec has known for ages that MS is pushing into their space. Maybe they had a Netscape-esque agreement with Symantec and maybe Symantec found new evidence that convinced them partnering with MS isn't the best way to go?

It *could* be as simple as an upper-management type listening to the feedback the last report got, but I haven't seen an icy weather forecast for Hell today.

(For those who missed the MS Anti-trust days: it was 'alleged' that when MS decided that the 'net was not just a fad and MS needed to throw all their resources into making IE the dominant browser, MS offered not to compete in Mac-space if they left the Windows market quietly. Netscape refused, MS bundled IE with windows, and the rest is history)

Re:Not too surprising

[Anonymous Coward]

Ummm..you are not up on the news. Microsoft now is competing with symantec DIRECTLY with their own antivirus and subscription service. They bought RAV Antivirus a while back.

Re:Not too surprising

[cozzano]

but I haven't seen an icy weather forecast for Hell today.

Yeah - its snowing here today.

Re:Not too surprising

[nvrrobx]

Microsoft was a strategic partner of Symantec until the day OneCare was released. Note I said was.

Yes, I work for Symantec. Any opinions I express in a post are my own and not necessarily those of my employer.

Re:Apples, oranges

[woot account]

No, "idiot", he said it wasn't an apples to apples comparison. Try again, Capt Pedant.

Actual security breaches compared?

[Mattygfunk]

Considering Firfox still has a fairly tech-savvy userbase (who in theory patch often), it'd be interesting to see what percentage of security exploits actually happen when using to two browers in the real world.

I believe that Firefox would have a significantly lower security breach rate than IE, but further compared with Opera or Safari?

__
Funny Adult Vids and Clips from Laugh Daily.com

Oi norton...

[djsmiley]

StartKeyLogger

another undocmented feature...

Re:Oi norton...

[El_Muerte_TDS]

Stop that. Now everytime I open this page my connection gets reset.
Some people do want to read the comments that come after yours.

Re:Oi norton...

[phaetonic]

He is referring to: http://www.theregister.co.uk/2006/03/03/symantec_s ecurity_glitch/

ooops, sorry

[yagu]

It seems almost disingenuous to "rethink" this so late. Of course it's more than a little irritating, it directly impacts the perceptions and usage levels of the competing browsers. It's kind of like yelling "fire" in a crowded theater, waiting until the resultant stampede kills many in the theater and then saying, "I'm rethinking this, and it looks as if there is no fire."

"We just stick to the facts"...yeah buddy..

[3seas]

RTFA....then think about it. Then ask which set of facts are they sticking too?

Maybe they should do a security software resource usage comparison!

There is a difference between "truth" and "honesty" where truth is about "a point truths" where you can be selective and deceptive. But "Honesty", thats full scope.

They are not very honest.

It does seem that one of teh things they do to help secure your system is to be having your system so busy running their software that it doesn't have time to run anything else. There is a less expensive way to do this. Just unplug your system. Hell you'll even save electricity, while being absolutely secure.

Obvious

[fireheadca]

With VISTA coming out, Symantec is going to
obviously be pushing its own products for that
platform.

However, to give the semblence of non-preferance
they will side with the better product for the
term being.

However, expect them to do a 360 in six months again
citing VISTA the most secure product ever, bar none.

Re:Obvious

[pla]

With VISTA coming out, Symantec is going to obviously be pushing its own products for that platform.

I agree, so far - All companies will want in on Vista, even though just about anyone who has seen or used Vista already will stick with XP until at least the server version comes out...


However, expect them to do a 360 in six months again citing VISTA the most secure product ever, bar none.

Why?

Symantec makes software that improves your PC's safety against attacks. If they can point to a million and one critical flaws in Vista, it makes their product (or one like it) all the more necessary.

People will not, in general, flee to Linux just because Vista sucks (which it does, and hard). They might stick with XP (for which Symantec also makes the same set of products).

People also won't switch to a different AV suite for Vista. People use what they have always used, which largely means Norton/Symantec.

Re:Obvious

[despisethesun]

They might stick with XP

Scratch that. They will stick with XP unless they buy a new computer with Vista already installed. You have no idea how many people I deal with on a given day that are still using Windows 98. I even come across people who think Windows 95 is the cat's meow. For most people, that shit is "good enough", so it's unlikely that people will jump en masse to Vista without some major incentive.

Re:Obvious

[Anonymous Coward]

A 180 might be more of a reversal, though...

Number of bugs means...

[plankrwf]

I'm working in the IT industry myself, and one of the well-known problems with bug-counting is... well, counting bugs.
I have seen IT managers getting upset because there were 100's og bugs*.
Turned out all of them were because of ONE faulty thing.

I have seen bug reports of the form
1. pressing button A and then pressing button Y gets critical error.
2. pressing button B and then pressing button Y gets critical error.
3. pressing button C and then pressing button Y gets critical error.
etc etc

In other situations a manager was not upset, "there were only a few bugs*".
Later, this same manager became upset at a time that there were on the order of 50 or so "bugs*".
Turned out fixing those few bugs took more than o month, while those 50 were 'fixed' within a week.

So my professional view is that bug-counting doesn't count, the correct question is:
how sick did you get? (Compare getting bitten by a tsetse fly to getting bitten by a red ant...)

* To be honest: I am referring to a non-English term which is NOT equivalent to a bug, but more to 'a problem'.

Re:Number of bugs means...

[Anonymous Coward]

* To be honest: I am referring to a non-English term which is NOT equivalent to a bug, but more to 'a problem'.

I tend to use "issue". Bottom line: Whatever "it" is does not mean "it" is a problem/defect/... at all.

If the issue turns out to be a real defect/problem, it gets fixed. If not, you end up either contacing some other group, working around the other groups problem, or explaining things such as "It is entirely normal for the DELETE button to DELETE the file."

Re:Number of bugs means...

[cgenman]

This sort of thing happens all the time in game development. Bugs 1 - 142 might be "Go to location 1. Jump. Wrong animation plays." "Go to location 2. Jump. Wrong animation plays." etc. Bug 143 might be that if you attempt to pause while saving the game it erases your memory card, eats all the food in your refridgerator, and puts gum in your DVD player.

At the beginning of a bug-squashing beta period, your team may be killing a hundred bugs per day. By the end, you may spend the last weeks desperately trying to eradicate two or three.

Bugs are generally rated A, B, and C in terms of severity. A bugs are nasty crashers, C bugs are little art tweaks. Unofficially, they also recieve a PITA rating. PITA bugs take a lot of re-engineering to fix, EZ bugs might be as simple as flipping a forgotton flag. Unfortunately, EZ bugs tend to get fixed first, meaning that the bugs caused by re-engineering at the last minute for PITA bugs can frequently slip into retail.

Re:Number of bugs means...

[SeeMyNuts!]

1) Project manager demands issue tracking software be used for whatever reason, sometimes as part of CMM or 6-sigma or ISO-something compliance. The fact that some issue tracking software requires high-skill system administration and end-user training doesn't register.

2) Project manager then whines when the non-technical testing staff finds hundreds of issues, entering every single one of them as separate issues not bothering to cross-reference any of them. This makes the developers look bad.

3) Project manager then complains about the hours it takes to maintain the issue database and clear out redundant issues. Even then, lots of stale issues collect and are never resolved. This makes the developers look bad.

4) Project manager also complains about the support costs, if commercial software was used, or lack of tangible support, of non-commercial software was used. This can also wear on the developers, who don't want to spend hours debugging their tools mid-project.

4) Staff eventually burns out and project stagnates. This also makes the developers look bad, but it can also make the manager look bad, depending on their B.S. skills.

Re:Number of bugs means...

[SeeMyNuts!]

Pedants: yes, I do know how to count to five.

Re:Number of bugs means...

[mav[LAG]]

This reminds me of a friend of mine who used to be a professional game tester for an EA dev team near where I live. Although somewhat looked down upon, testers are actually a terribly important part of the game dev process. If you're looking for budget to save, look somewhere else.

Nobody told that to the manager. For the next project my friend was given absolutely nothing to work with - no design docs, no resources, no source code, no debug version, no reporting sheets - zip. Just a crappy PC with - occasionally - the latest build on. All his requests for the basic tools to let him do his job properly went unheeded. So he started filing bug reports via email like this:

To: Developers
Subject: Game is broken - fix it

To: Developers
Subject: Game crashes - needs to be fixed

To: Developers
Subject: Game broken - needs fixing

He was quickly provided with the tools he needed :)

Re:Number of bugs means...

[Anonymous Coward]

A system I was working on at EDS had a real PITA bug, only happened once in a while but brought the whole system down. I took two years to find and fix it, but then it had to be added back in as other developers had assumed the affected module 'worked' that way and wrote other code that relied on it, it was deemed to expensive to fix the now faulty modules. Still, I was pleased I could tell them why it crashed.

Re:Number of bugs means...

[bogado]

And you're not counting that the "re-engenier" step in the "PITA" bugs can sometimes render some of the bugs you spent time fixing earlier a waste, since you may have to rework entire portions of the code.

Hi Symantec

[babbling]

Welcome to 2 years ago. This new Firefox browser is pretty cool, eh?

I wonder if anyone ever took Symantec seriously when they made this claim. Most computer illiterate users wouldn't have even heard about Symantec saying this, and those that did (eg. Slashdot readers) would already know better. It's as if Symantec is in their own little universe where it seems as thought everything incorrect is actually correct.

Re:Hi Symantec

[mabu]

It's not about whether or not anyone takes the claim seriously. It's a little public relations kickback from Symantec to Microsoft, that Microsoft's PR department can use when talking with big corporate clients who start to believe that IE is a security problem and might switch. "No, you don't understand! An independent study revealed that Firefox is less secure than IE."

Remember, these are corporate IT people. They don't think for themselves much. This way, if there's a total security meltdown, at least they can say well, the "figures" indicated this was the best choice. It's not about actually having a secure system. It's about covering your ass.

Re:Hi Symantec

[babbling]

True. I wonder if this latest admission from Symantec is a response to Microsoft's new (when Vista comes out...) virus/spyware scanner subscription service. Symantec are now competing with Microsoft.

Vendor acknowledged?

[DarthChris]

FTFS:

"The key was vendor acknowledged critical vulnerabilities. Thus, if Microsoft (or the Mozilla Foundation) didn't agree it was critical, then it didn't get counted."

Mozilla has Bugzilla to keep track of it's issues, MS is notorious for claiming bugs are in fact features.

Also, IMHO any security issue is 'critical'. Someone once said that MS's 'critical vulnerabilities' are security flaws that should never have made it past design stage.

Don't

[ELProphet]

They make BS statements, and use more system resources than the spyware they're trying to clean up!

Symantec tests windows xp

[Centurix]

"We have substatially tested Windows XP and have found the operating system to be completely bug free. Out tests were conducted in a time period of 1 minute, which contains 60 seconds. As all seconds are effectively the same, we can safely say that Windows XP will be safe for all future occurances of seconds."

Rethinking Symantec

[xianfox]

I guess I'll have to "rethink" my reliance on any Symantec security program.

Re:Rethinking Symantec

[Anonymous Coward]

You didn't do that when Symantec OK'd the Sony rootkit?

This coming from symantec

[saboola]

Whose company products in all my years of computer maintenance have overall caused me more problems than all the malware/viruses they were supposed to be fighting. Thanks for the heads up!

Re:This coming from symantec

[CRC'99]

Whose company products in all my years of computer maintenance have overall caused me more problems than all the malware/viruses they were supposed to be fighting. Thanks for the heads up!

You can say that again. Where I'm working now, "Are you using Norton Internet Security or Anti-Virus?" is about question number 2 on the process for troubleshooting email problem calls. The first one is "What is your email address?". It's a 50/50 decision on if I'd rather taken on the virus/trojan world.......

Re:This coming from symantec

[kiddygrinder]

Yah, i get that too. What is annoying is when they actually paid for the bloody thing and won't uninstall it and of course they don't have a record of the key to do a re-install. Good times

Seriously?

[user24]

You're seriously telling me that Symantec just added up the number of times a flaw was labelled "critical" by the owning company of the product, and based their 'report' on that - wtf?

I mean, *I* could have done that. When I hear that one of the leading security companies has issued a report on the security of two competing products, I assume that they've actually evaluated those products, rather than just spat back the company literature.

My already little faith in the company that brought us Norton has sunk lower still.

Re:Seriously?

[ScrewMaster]

That's not really fair to Peter Norton. The original Norton Utilities were a pretty decent package. I used them for years to help maintain a big Wildcat! BBS. Symantec eventually bought him out, but kept the Norton Utilities name for marketing purposes since it was about the best-known product of its kind at the time.

Re:Seriously?

[user24]

that's a fair comment.

Damn

[pHatidic]

Oh shit I'm going to have to switch back now! Do you have any idea how long it took to get IE running on Linux?

Re:Damn

[psocccer]

Do you have any idea how long it took to get IE running on Linux?

About 10 minutes? I run ie5.5 and ie6 under wine setup by this installer script so I can check web stuff without having to fire up qemu. And yes I know you were just kidding :p

The obvious answer

[ZakuSage]

Just use Konqueror. I'm sure 99.9% of malicious hackers haven't even heard of it!

Re:The obvious answer

[houghi]

Security through obscurity. That is not a very good idea.

Maker of the worst antivirus software ...

[Anonymous Coward]

Symantec used to make top notch products. When I recently was exposed to their client software again assisting friends, I was shocked to see that they now make the worst security suite. It is just completely unsuable for customers. Their failure to even have their software work with Windows XP SP2 (and letting their customers take the problems such as all programs stop having internet connectivity but their own ...) is evidence that they with their "platform play" is becoming increasingly at odds with Microsoft. If they were able to understand that at least until recently Microsoft have only provided basic functionality to help protect customers (such as the basic firewall and a central place to see security status) and that there is considerable space in which to provide superior technology, I might have believed some of their comments.

The way it stands now, I cannot possibly recommend their products nor their "advice".

How about: Flaw + User Base = Risk

[AngryNick]

It seems to me that a 1:1 comparison of flaw counts is just going to show you how may potential problems there are...not your risk of getting hit through one of them.

Let's say that I wrote the world's most flawed web browser (Anger Browser 1.0), with several hidden RC function and a welcome mat for specially scripted spyware installers. Yes, it has 500 more flaws than IE, but I only have an installed user base of two. Does this mean that my browser presents a higher risk than a browser with 100,000,000 users and one flaw?

All things the same, a flaw in IE presents a higher weighted risk than a browser with a fraction of the user base. Combining that with the relative ignorance of the average IE user, I say that a flaw in IE presents a much higher return to the bad guys than any other browser out there.

Re:How about: Flaw + User Base = Risk

[cyber-dragon.net]

The other thing to consider is weather or not this browser is forced on the user. How many sites REQUIRE IE in order to view the site? Far too many in IMHO. I was amazed even SonicWALL, a security appliance forces the use of IE. When confronted with this thier response was "most of our users run windows so we didn't think it was a big deal" (praphrased). Hell they even make you load IE to report that you think them requiring IE is a bug.

Re:How about: Flaw + User Base = Risk

[Quantam]

I suppose that's true for companies. For individual users, however, it doesn't matter, as the risk to THEM is what is important. Also a consequence of the massive difference in install base is the target profile. If you were going to develop a worm or other kind of exploit for some malicious purpose, would you want to target 7% of the market, or 80%? I'm betting the amount of effort put into developing malicious software is proportionate to the third or fourth power (at least) of the market share.

If you want "browser" safe, go get Opera

[sreekotay]

From the article:

"In the last six months of 2005, Microsoft confirmed 12 vulnerabilities in Internet Explorer, down slightly from the 14 in the first half of last year. Firefox, however, sported 13 vendor-confirmed flaws, one more than IE, but also down from the 27 in the previous period."

Even in the revised count it was 17 Firefox, 24 Internet Explorer...
And that doesn't account for the vulnerabilities within embedded tech like Java, Flash, Quictime, Windows Media, et al... that'll affect EVERY (modern) browser.

NONE of this is particularly great if you're a consumer. If you're Symantec of another Security vendor though - weel, life is OK. :P

Re:If you want "browser" safe, go get Opera

[whitehatlurker]

Well, if you want to compare with numbers from a rival company:
Opera 8.x had 13 flaws, 3 highly severe, 0 extremely severe;
Firefox 1.x had 27 flaws, 7 highly severe, 1 extremely severe;
MS IE 6.x had 77 flaws, 22 highly severe, 11 extremely severe.
It's still not apples to apples. (Time periods aren't the same, etc.)

I think the more important thing to note: all of the Opera flaws (to date) are fixed, there are still 2 open in FireFox, and 23 open in MS IE 6.x.

evaluate relative security by impact

[pikine]

Since arguing the merits of one browser over another leads to no end, I hope this post would be somewhat refreshing to read.

Assuming a security measurement can sway users for switching from one browser to another, I propose the following measurement: multiply the number of vulnerabilities by market share, and call this the impact. At first glance, this is brutally unfair for IE, which continues to have the majority market share, but hear me explain.

Let's make another assumption. Suppose all competing browsers have vulnerabilities that lead to the same outcome, then the likelihood that script kiddies choose one browser over another to exploit is more or less determined by the browser's market share. Every vulnerability adds to this likelihood. Therefore, in the end, we end up summing a browser's market share a number of times that is the number of vulnerabilities for that browser. This is the same as multiplying number of vulnerabilities by market share. The result is a measurement of insecurity impact.

What happens if we adopt measuring impact for insecurity?

Since Firefox is a minority in browser market share, it can afford to have more bugs and be relatively secure. Its most critical vulnerabilities have lower impact than IE's equivalent. Suppose users then decide to switch to Firefox. The increase in Firefox market share means its vulnerabilities have higher impact. At one point, it becomes less secure than IE, and users start to switch back. We go back and forth and eventually reach an equilibrium. If users are perfectly "browser elastic" (have no resistence to switch browsers), then at the equilibrium, market share is inversely proportional to the number of vulnerabilities for all browsers. Of course, in the real life, things are never that simple, but let's keep things simple. It is good enough to point out that letting impact determine market share is more desirable than letting vulnerability count to determine market share.

How can the impact score improve current measurement of security?

We all know that some vendors like to play the optimist game by purposely reducing the severity of a vulnerability or even hiding it. If a certain highly popular browser vendor wants to manipulate the impact score, it has to to cheat a lot, and at one point this cheating will become painfully obvious. Hopefully, the risk of causing a scandal would limit the vendor's cheating to a degree that does not significantly variate the impact score.

Par for the horse.

[g0at]

Well surprise surprise, Symantec demonstrates themselves to be of the calibre of Wall Street "analysts": regurgitating things that other people tell them, and passing it off as insight. How about doing some critical thinking of their own?

Why do we keep reading about opinions of "analysts" everywhere? I guess I need to stop reading the Mac rumor sites so regularly; their "news" are often just "analyst predicts ..." The news media certainly don't paint "analysts" as being anything more than sock puppet mouthpieces without any independent skills.

-b

Re:Par for the horse.

[Anonymous Coward]

I think that might outghta be "par for the course," as in "golf course."

Re:Par for the horse.

[whitehatlurker]

Oh good. For a second there I had thought someone had taught equines to golf. Though, it might be interesting to see a horse make par.

The Secret to Success

[burntsigil]

"Thus, if Microsoft (or the Mozilla Foundation) didn't agree it was critical, then it didn't get counted."

That's it! That's the secret to making bug-free software! Not fix anything then deny it's a bug! That's what I'm gonna do!

"Hey, this is a critical exploit!"
"No, it's not."
"Okay."

BRILLIANT!

Funny but

[Anonymous Coward]

But even with Symantec counting it "The Firefox Way" Firefox is still not looking "secure", just "slightly more secure".

Sure they have.

[jscotta44]

Sure they have, it is called Safari.

That's not exactly correct.

[khasim]

My guess is that there are more Windows oriented viruses/worms circulating the Internet.

"More" is correct. But the implication being that that is why the Linux boxes were not cracked is incorrect.

On the Internet, it is possible to scan whole ranges of addresses looking for vulnerabilities. Automatically. 24/7. And exploit them automatically, 24/7.

What matters is whether the box has open ports or not.

The take home message is "patch your system". We Slashdotters know better, but does the regular home user?

The system's security should be configured to account for the home user's non-patching.

Apple has. Their boxes, by default, have no open ports.
Ubuntu has. Their default install has no open ports.

No matter how many worms and infected machines are out there, a default Ubuntu box will never be infected by them.

The first step in security is to reduce the avenues of attack.

Re:That's not exactly correct.

[jZnat]

On the Internet, it is possible to scan whole ranges of addresses looking for vulnerabilities. Automatically. 24/7. And exploit them automatically, 24/7.

Scary thing is that it's true. I still get hits from bots trying to find old versions of PHP XML-RPC to exploit, and that itself is annoying. It's simple enough to run `nmap -p80 -oX boxen-to-pwn.xml 66.0.0.0/8 67.0.0.0/8` (or whatever IP subnets you wish) and then make a script to check all those servers that respond and to attempt to use the XML-RPC exploit. Of course, I'm willing to bet that most bots like that were written by one person and used by script kiddiez everywhere, so there isn't much to fear with these idiots.

Re:That's not exactly correct.

[A beautiful mind]

"No matter how many worms and infected machines are out there, a default Ubuntu box will never be infected by them."

Unless, of course there is a vulnerability in the networking part of the Linux kernel. It has happened before, but of course it is quite unlikely thing to happen - although I wouldn't say "never".

Re:That's not exactly correct.

[Quantam]

Mod parent up. The NT kernel is both very well made and stable. One of the things that plagues Windows, however, is low-quality drivers (even MS ones) and API layers (things above the kernel but below the application). Many of the Windows security warnings are due to this kind of thing. It seems both extremely arrogant and foolhardy to assume that Linux has 0 such vulnerabilities.

Re:That's not exactly correct.

[mallardtheduck]

Sorry, what exactly does your comment have to do with the parent?

The parent stated that it's possible, however unlikely, that there may be vulnerabilities in the linux kernel that don't require open ports.

You stated that the Windows NT kernel is quite secure and most vulnerabilities are in drivers and API layers and that Linux may have such (Driver and API) vulnerabilities.

I fail to see any connection here, although I agree that Linux certainly does have vulnerabilities in driver and API layers.

Re:That's not exactly correct.

[Ankur Dave]

How does having no ports open on OS X work? Aren't there any ports open by default for file/printer sharing? The average user probably wouldn't know to open ports on the firewall if file sharing isn't working.

Why didn't you post the next paragraph...

[thechink]

that stated:

Patched Windows systems, however, remained untouched throughout the test, backing both its and Microsoft's advice to patch regularly, and patch promptly. "Applying patches in a timely manner is an important component of an effective security strategy," the report read.

Or is this just convenient editing to bash Microsoft. Oh wait sorry, I forgot this is Slashdot.

Re:Why didn't you post the next paragraph...

[MightyYar]

It is important to point out how vulnerable an unpatched version is. I - like many other /.'ers - am my family's PC support. I also - like many /.'ers - have learned the hard way to keep the PC unplugged from the network until it is patched. This makes things very rough when I'm at a home with only one PC, but you apparently can mitigate your risk by killing most of the processes running on the machine before launching Windows Update.

In short, the "bashing" is justified. If I, a humble geek, can figure out on my own that killing all of these unnecessary services can make the unpatched machine safer, then why can't the smart geeks at Microsoft? Why does the thing ship with so many services enabled? The average user does not know that there are "services" or how to kill them. For the average user, it is impossible to install and patch Windows without getting infected - that is a pretty damning security situation.

Re:Why didn't you post the next paragraph...

[thechink]

While I too have my complaints about Microsoft most of what you complain about can be mitigated by turning on the Windows XP firewall prior to going online. In fact if you're installing Windows XP with SP2 integrated it's on by default. This shouldn't be an issue.

My problem with this article's statement about Windows XP being infected so quickly is that on an unpatched XP system the OS is over 4 years old. That's 4 years of known insecurities, it's not surprising that it would be compromised so quickly. Are the Linux systems that are being compared also 4 years old?

Re:Why didn't you post the next paragraph...

[Anonymous Coward]

Are the Linux systems that are being compared also 4 years old?

You're not seriously trying to use a cogent argument on Slashdot, are you?

Re:Why didn't you post the next paragraph...

[MightyYar]

I have never installed a system that had SP2 on it's install disks, so I can't comment. My relatives usually have either Windows ME, 2000, or an early version of XP home. In any case, once bitten, twice shy - I probably will continue to disable services even if the disk has SP2 on it.

As for Linux, I guess it depends on the distribution - but I imagine that the box would be okay long enough to get patches on it even if you start from a 4-year-old distribution. This is because there usually aren't any open ports, except for maybe ssh? I don't remember whether or not I've had to turn that on (I mostly play on OSX and Windows).

In any case, I hope you are right and MS has learned their lesson about opening all of these ports by default. They sure haven't learned to make people non-root by default. OSX is a little better here - at least the "Administrator" cannot screw up other user's folders or the main system files, though they can mess with the applications folder.

Re:Why didn't you post the next paragraph...

[Petrushka]

Well, which version of Windows do you think it would fair to compare to Ubuntu 5.10 or Mac OS X 10.4?

Re:Why didn't you post the next paragraph...

[dave1212]

Seriously, what the hell has MS done for you to make you so loyal to them? With their ill-acquired billions, do you think they need you defending their actions? They don't care about your loyalty, they consider you less than dirt and would do anything they can to use you and your info for profit. You're nothing to them, just another user.

If you're immature enough to let a Slashdot post get to you, you really need to work on your critical thinking skills.

Whee, you went and read an article full of lies, then came back here and complained about the anti-MS bias? Sorry, but they've earned that.

Are you in denial? Are you not aware of all the shit MS has pulled over the years?

Or are you just unable to think for yourself?

Re:Why didn't you post the next paragraph...

[farble1670]

Why does the thing ship with so many services enabled?

i think the answer is that it does not anymore. if you take a win XP, unpatched first release, it is a mess. if you then let it update itself, it locks it down pretty well. the problem is all of the unpatched or at least out of date versions of XP out there.

Re:Why didn't you post the next paragraph...

[Anonymous Coward]

Jeez dude take a pill. It seems you're much more worked up about this than I ever was. Critical thinking goes both ways, you should take your own advice.

Re:Why didn't you post the next paragraph...

[Brandybuck]

The key vulnerability we're talking about are open ports. Most 2002 Linux distros (and BSD, Solaris, HPUX, etc) have all their ports closed by default. Not every Linux, to be sure, but most.

Re:Why didn't you post the next paragraph...

[Anonymous Coward]

You missed the point entirely. It's to people like you who say things like 'you should take your own advice'.

Re:Why didn't you post the next paragraph...

[NumerusSpy]

I once did a clean XP install whilst the machine was physically connected to the Internet and it was compromised and rebooted before the install had finished.
With the amount of automated shit running out there I would hazard a guess that that is not an uncommon occurrence either.

Slashdotted Yahoo?

[Kangburra]

Sorry, Unable to process request at this time -- error 999.
Yahoo!

Unfortunately we are unable to process your request at this time. This error is usually temporary. Please try again later.

If you continue to experience this error, it may be caused by one of the following:

        * You may want to scan your system for spyware and viruses, as they may interfere with your ability to connect to Yahoo!. For detailed information on spyware and virus protection, please visit the Yahoo! Security Center.
        * This problem may be due to unusual network activity coming from your Internet Service Provider. We recommend that you report this problem to them.

Who would trust Symantec?

[OrangeDoor]

Symantec is hardly a trusted objective source of security information. For them it's all about fear factor. Now with the two articles combined they paint both browsers as being unsecure.

A trusted source would say:

1. Keep computer upto date.
2. Use Firefox as default browser.
3. Don't trust any ads, pop-ups, or unexpected e-mails.
4. Don't install every free screensaver you run across (or other stupid games/junk you might download)
5. Keep your A/V software upto date. (And use something better, cheaper, and faster than Norton/McAfee like AVG.

But if Symantec said do these 5 simple things, and make sure your kids can do these 5 simple things (or keep them off computer), then they'd be undermining the fear factor they count on to sell their bloated POS products (their corp. products don't seem that bad though.) Symantecs software will NOT keep a computer clean if the people using it don't use safe computing practices. At least Dell stopped bundling exclusively Symantec and McAfee products, should save people some grief from having their security software breaking their computers.

Re:Who would trust Symantec?

[sinewalker]

Indeed, there is value for consumers in paying attention to the brand:

• Several Symantec hard-drives I've owned have crashed repeatedly, for no known reason.
• Symantec Crystal Reports (the "premier" reporting tool used in businesses) is a dog's breakfast. It's since been sold to another company...
• Symantec A/V software is bloated, slow and not very reliable
• Symantec security reports are biased and untrustworthy...

Conclusion: Don't buy or use anything with Symantec (or Norton) in it's name.

Excuse me?

[mabu]

Since when does Symantec have any credibility relating to computer security issues?

Now when there's a report on the most efficient way to waste CPU time, memory and disk space, making computers slow down to a crawl, their commentary will be respected.

Agree completely: Worst Antivirus Software EVAR

[BenJeremy]

I spent two days removing thos POS from a friend's machine last week. Symantec publishes the instructions to uninstall manually, because the automatic install DOES NOT WORK.

FIVE PAGES OF INSTRUCTIONS.

Countless services and hooks into the operating system, tied into Microsoft's automatic installation system, forcing itself to re-install if you miss a trace of the uninstall procedure (which is, itself not complete).

Before uninstalling, it would take up to 5 minutes to boot XP, after uninstalling, the bootup was in seconds. Everything ran faster after installing another anti-virus client.... EVERYTHING!! Even though taskk manager showed no CPU usage being stolen by Symantec, it clearly was sucking as much as 90% of the processor bandwidth with it's huge number of processes and hooks.

My own impression was that Symantec laid out Antivirus like a virus itself, trying to restart itself on any attempt to remove it. The reality is that it was just badly designed bloatware.

Re:But...

[orionware]

The latest version for me crashes constantly. Unfortunately I'm so hooked on the Fox now I can't stop using it. I'm waiting for them to hammer out the flaws. As an aside, deleting the profiles and creating a new one seems to cause the stability to return for a few days. then back to crashing.

Reminds you of the CVSS right?

[brennz]

This makes me think of the CVSS http://www.first.org/cvss/ and how inaccurate it also is.

Most vendors will downrank/ignore/contest vulnerabilities. Then they will try to make comparisons between themselves and their competitors off a biased vulnerability score, impact, etc.

Software vendors should have no part in acknowledging/ranking the legitimacy of vulnerabilities, once the security community has properly identified them, and repeated results, apart from sending a Thank you note to the security gurus that found the flaws.

The tables have turned.

[babbling]

... and now the tables have turned, and Microsoft is competing with Symantec. (Windows OneCare)

All of a sudden Symantec retaliates by deciding that Internet Explorer does indeed have more "critical" flaws than Mozilla Firefox does.

Re:The tables have turned.

[SeeMyNuts!]

Isn't it wonderful how computer security is now a matter of politics? IMO, this invalidates the entire anti-virus industry (if that is news to anyone).

Re:The tables have turned.

[Bios_Hakr]

The AV industry has never worked. My company got hit by ILUVU; we were running Norton. My company (along with many others) have been affected by most of the major AV breakouts. As always, we are running the latest definitions.

AV products can protect you from what happened two weeks ago, but the will never protect you from what's going to happen next week. Never.

If you rely on AV to protect your assets, then you might as well declare bankruptcy.

Since SP2 was released, we've taken a different approach. We use the WinXP firewall coupled with non-admin users. On top of that, we VLAN every office off and implement severe traffic shaping between offices. We use MRTG with RRD Tool and a 24/7 watch center to notice any "spikes" in traffic. If the spike can't be identified, the VLAN is shut down until further notice.

The recent GDI bug really scared us. AV wasn't helping and LUA+firewalls were useless. We had even considered blocking all images at the firewall. Fortunately, it turned out to be a flash in the pan. But it still shows how useless computer security and information assurance is.

Re:The tables have turned.

[farble1670]

windows onecare. interesting. when MSFT released their antispyware suite, at least it was free. that makes sense. a software company should always offer free updates when it comes to security issues. i actually thought they were at least trying to do the right thing.

now, MSFT is trying to charge for security. they should be offering this service for free. i should not have to pay them to keep my PC running.

Re:The tables have turned.

[mrchaotica]

Indeed, Microsoft charging for anti-malware software to protect Windows is exactly like the mafia charging somebody to protect his business from their goons...

...except for the fact that Microsoft is getting away with it, that is!

Re:The tables have turned.

[TangoCharlie]

What do the following companies have in common:

Borland, Corel, WordPerfect, Novell, Symantec ?

1 )They all produce(d) products for Microsoft DOS/Windows and then found that Microsoft
was competing against them.

2) They're all doomed.

Symantec better find another business strategy.... fast, because as soon as the big OEM stop putting Norton on PC's as standard, and just ship with the default Microsoft products, then Symantec is truely dead.

Of course the real nail-in-the-coffin will be when Microsoft starts to delay the release of known threats and exploits until they have a fix, patch or update for thier product(s). You may ask yourself if Microsoft would really use thier privileged position to screw the competition.... well, of course they wouldn't!! ;-) Nor would they ever dream of charging people for critical operating system / application fixes.

Re:Apples, oranges

[Anonymous Coward]

No, it's Capt. Paedant.

Pro(prietary software) and con(fidence tricks)

[tepples]

Linux users typically install software through (authenticated) package systems. Ubuntu will for example cry out loud if you install packets that are not "approved" by the Ubuntu organization.

But then Ubuntu will never approve proprietary software. So then you have each publisher of proprietary software, legitimate or otherwise, trying to social-engineer potential users into authorizing said publisher. (And by "social engineer" I mean con.)

I can believe I am going to reply to this but...

[Lightzout]

This has to be the best troll ever. I feel like I am the moth, there is the flame, gonna die, cant turn back now, going in anyway! I think this is funny for two reasons. One symantec has no interest in securing anything but profits and secondly the fact that symantec could make the "news" by publicly admitting something so obvious to most saavy consumers is all the proof I need that the joke is me. Expect Symantec to announce its Firefox browser bundle soon.

Handgrenades?

[gstovall]

I understand, and by and large agree with, your thesis that humans are self-absorbed, self-interested beings. However, how would you interpret those individuals who have thrown themselves on handgrenades to save their platoon buddies from death? Death was virtually certain for these individuals, and there was some opportunity to escape from the situation with only minor or moderate injury, yet they chose to sacrifice themselves for their comrades. By the self-interest theory, it was an inappropriate decision, even if they considered the possibility of posthumus accolade, because they wouldn't be there to experience the reward.

Rather, I believe that people are able to rationally select a greater good, even if it brings personal harm. I'm not saying that most people actually do this on a regular basis, but the capability is there. On the other hand, I meet more and more people who meet the clinical definition of sociopaths, who truly are incapable of considering anything beyonds themselves, and they are scary people.

Re:Handgrenades?

[NumerusSpy]

If I had any idea how to mod posts (I don't even know if I am authorised to) I would mod you up. One of the first things i thought of while reading this was that some men have chosen death over life to save their comrades when they could have easily escaped harm.
I wonder how many republicans would do it?

Re:Handgrenades?

[gstovall]

Cowardice and Heroism exist on both sides of the aisle. Partisan arguments are pointless and fruitless. Both democrats and republicans desire to run the show the way they see fit, and both have good and bad points, both have honest and dishonest men and women wrapped in their respective cloaks.

The Fox counting the chickens

[Grand Facade]

I am seeing more and more of this crap!

Who in their right mind let the fox count the chickens?

You know the Fox by nature will always be holding a few chickens behind his back.

I even see this in major corporate contracts.

The Fox is in charge of the chicken coop, supplies the feed and builds the fences,

but the contractor is held responsible for the number of chickens.

Fuckin idiots put their own nuts in a vise when they signed the contract!

And then they have the nerve to pay me pennies on the dollar to make their mess work.

Bye Bye I'll left them to die a slow and ugly death on their own razor.

Too little too late

[pigs,3different1s]

Isn't the damage already done? While I do appreciate Symantec's admission to not applying due diligence when publishing their previous report, I don't think it's enough. Most slashdotters could tell right away that the previous article, and those like it, aren't doing apples to apples comparisons. The people that don't know any better, and look to these articles as sources of information, take these articles as gospel; because the folks that write them should know better!

If you are doing research, and you genuinely set your biases aside, you won't be disappointed with the results. In fact, you may learn something!

Hand grenade smothering == Externality!

[Dr_Barnowl]

people who meet the clinical definition of sociopaths

Alas, this group is disproportionately represented amongst those in charge of large corporations.

Some people are pointing out that veracity has evolutionary benefits (on a group level). However, it would seem that we have managed to create an corporate environment where sociopathy is the prime survival trait.

Symantec is not a security authority.

[dave1212]

Oliver Friedrichs?

Who is this loser? How can we still be stuck listening to this garbage?

Are we not men? Are we not people with critical thinking skills?

Where is the independent security consultant, the person who cares only for the study and the results? This Oliver Friedrichs guy only cares about profits. If a company doesn't agree with you that their product has vulnerabilities, then you publish the study anyway, and give them the results.

Where is the OSS front line these days? Do we even have a goal, or are we just hoping that things will work themselves out?

Re:But...

[Anonymous Coward]

It's probably due to some extension/skin that you are using, check for bug reports for all the extensions you have installed.

More Apples and Oranges

[JPyObjC Dude]

One important point regarding the apples to oranges comparisons is that we are comparing one dynamic development process with constant changes and improvements (FireFox/Mozilla) and one that has had no new improvements for many years (IE).

It is reasonable to expect that Mozilla/Firefox would have more flaws because over time because it is a product that is still in flux. Where in IE's case, we are still finding flaws that may have actually been there for many years or worse yet, were created through IE trying to fix other bugs.

Basically, boiling it down to the raw numbers, Firefox is way more secure than IE ... PERIOD

JsD

It's too late...

[gamer4Life]

It's too bad companies realize dealing with Microsoft is usually a bad idea in the long run. Make a profitable business based on Windows and Microsoft will always move in on your turf and leverage it's monopoly position against you.

There's no such thing as a symbiotic relationship with Microsoft.

*sigh*

[DarkProphet]

Not R'ing TFM because it'll just piss me off... I can no longer ignore or accept this sort of behavior from corporations that should definitely know better.

I realize this sort of dishonesty in product comparison happens all the time. I assume it likely happens even in analyses of products that do not originate in Redmond. What I don't understand is why the status quo is accepted. I have purchased Symantec products before. I'll NEVER do so again. If asked, I will discourage anyone else from doing so.

I'd expect this sort of behavior from Microsoft or its usual hired lackeys, but this takes the cake! Its pretty clear that comparing the totals of only the 'admitted' 'critical' security problems in each browser is practically as unscientific as you can get. Anyone who made a major infrastructure decision because of it should sue Symantec immediately, IMHO. This sort of behavior can potentially (and probably did) artificially influence the market.
</rant>

Of course, I am not saying that a company should face severe penalties every time they report research findings that turn out to be incorrect, but c'mon, any 1st year science student knows what the scientific method is. Willfully releasing false and/or misleading information that impacts a given market should at the very least prompt SEC investigation. I guess at least Symantec admitted what that did was the wrong way to conduct the comparison, though at this point, I have a hard time believing they are admitting fault for any virtuous reason.

Hmm... Looks like I got pissed off anyway. Time for a beer ;-)

In other news, on-line music theft disappears

[surfingmarmot]

"The key was vendor acknowledged critical vulnerabilities. Thus, if Microsoft (or the Mozilla Foundation) didn't agree it was critical, then it didn't get counted."

When asked if downloading music via P2P is 'stealing', respondents uniformly replied that it wasn't, so their downloads ceased being counted in MPAA music theft figures. The MPAA in a separate announcment stated it had no legal standing in curent cases and withdrew all complaints and charges against all music 'sharers'.

See we can use corporate logic too!

Re:In other news, on-line music theft disappears

[Phil John]

When asked if downloading music via P2P is 'stealing', respondents uniformly replied that it wasn't, so their downloads ceased being counted in MPAA music theft figures. The MPAA in a separate announcment stated it had no legal standing in curent cases and withdrew all complaints and charges against all music 'sharers'.

That is the case, the MPAA doesn't have any legal standing against music sharers. Movie uploaders on the other hand it does. MPAA=Motion Picture Ass. of America, RIAA=Recording Industry Ass. of America.

Tell that to Google

[Anonymous Coward]

You don't have to be unethical to succeed... I think Google is doing a pretty good job of it so far!

where the frig are the links?

[Devistater]

Where are the links to the symantec study recently released? Or am I blind?

Mitigating Factor for Windows Machines

[woolio]

Well, one mitigating factor for Windows machines is the number of reboots needed for regular operation/upgrading. They cannot be compromised before the network interface goes up during the boot.

On the other hand, I wonder if they are vulnerable in the few seconds during shutdown.... Does the 3rd-party firewall shut off before the network interface is disabled?

Mod Parent Up...

[anomalous cohort]

I agree and have recently gone into more detail about this in a blog entry.

Oi dude! This is Slashdot...

[Anonymous Coward]

...don't post links to a website that REQUIRES Windows Media player ONLY. Everybody knows only Linux geeks on Slashdot!

Re:Oi dude! This is Slashdot...

[NumerusSpy]

well they all worked in konqueror for me

Who really cares when experience shows otherwise

[trilliji]

Hmmm. Consider how many features of Internet Explorer would be considered bugs or security violations in Firefox. I reload windows machines for people infected by browser hijacks ,spyware and all that cruft. I advise people to use Firefox for their browsing. Those that follow my advice thank me, those that do not ask me to load windows for them again. I politely decline :)

Symantec's Credibility

[NumerusSpy]

I was reading that Symantec's Internet Security Suite (or whatever it's called - can't be bothered googling) disconnects its users from IRC if someone types the phrase 'startkeylogger' into a channel. If this is true then doesn't it naturally follow that they are crap?