Slashdot Mirror
Symantec Rethinks Firefox vs IE Vulnerabilities
chill writes "Last September security software vendor Symantec issued a report claiming IE had fewer critical flaws than Firefox and thus was more secure. Well, it seem they have now rethought that position. 'How we did it before wasn't a fair comparison,' said Oliver Friedrichs, the senior manager of Symantec's security response group. 'It wasn't an apples to apples comparison.' The key was vendor acknowledged critical vulnerabilities. Thus, if Microsoft (or the Mozilla Foundation) didn't agree it was critical, then it didn't get counted."
Weakest point, and amount of possible damage.
If one browser allows an attacker to read arbitrary files, and another allows an attacker to delete arbitrary files, then the one that allows the deletion is surely worse however many ways there are to read files.
If one browser can be attacked in a generic manner, and the other needs some knowledge of the victim, then the one that can be attacked in a generic manner is less secure.
Now, exactly how an easy to implement low impact and a hard to implement high impact attack compare is still going to be subjective, but wherever you draw the line, it's going to be better than simply counting the nuber of critical bugs.
How can you trust these guys with your security?
They make some b.s. statements that just aren't founded in logic, or in a reasonably cynical view of how people/companies behave. The result is that they suggest you do the ridiculous, with your security (not theirs). Then they (for whatever reason) say something else.
I'm not even suggesting that they "came to their senses", but perhaps, for one reason or another, decided that Microsoft was not their friend anymore (or maybe firefox is their friend now).
http://www.thebricktestament.com/the_law/when_to_
Of course they're connected; there's no other possibility. Listening to Symantec's opinion on this would be like asking Philip Morris for an opinion on the link between cigarettes and lung cancer. So, how long until MS OneCare starts getting flagged as malicious spyware by Norton, or vice versa?
I'm working in the IT industry myself, and one of the well-known problems with bug-counting is... well, counting bugs.
I have seen IT managers getting upset because there were 100's og bugs*.
Turned out all of them were because of ONE faulty thing.
I have seen bug reports of the form
1. pressing button A and then pressing button Y gets critical error.
2. pressing button B and then pressing button Y gets critical error.
3. pressing button C and then pressing button Y gets critical error.
etc etc
In other situations a manager was not upset, "there were only a few bugs*".
Later, this same manager became upset at a time that there were on the order of 50 or so "bugs*".
Turned out fixing those few bugs took more than o month, while those 50 were 'fixed' within a week.
So my professional view is that bug-counting doesn't count, the correct question is:
how sick did you get? (Compare getting bitten by a tsetse fly to getting bitten by a red ant...)
* To be honest: I am referring to a non-English term which is NOT equivalent to a bug, but more to 'a problem'.
Welcome to 2 years ago. This new Firefox browser is pretty cool, eh?
I wonder if anyone ever took Symantec seriously when they made this claim. Most computer illiterate users wouldn't have even heard about Symantec saying this, and those that did (eg. Slashdot readers) would already know better. It's as if Symantec is in their own little universe where it seems as thought everything incorrect is actually correct.
So if you are a noob and don't patch your systems, you get by longer on Linux than Windows. No surprise there. My guess is that there are more Windows oriented viruses/worms circulating the Internet. The take home message is "patch your system". We Slashdotters know better, but does the regular home user?
Whose company products in all my years of computer maintenance have overall caused me more problems than all the malware/viruses they were supposed to be fighting. Thanks for the heads up!
I agree. How can you believe that firefox is less secure than IE? You're probably on crack if you think that.
You're seriously telling me that Symantec just added up the number of times a flaw was labelled "critical" by the owning company of the product, and based their 'report' on that - wtf?
I mean, *I* could have done that. When I hear that one of the leading security companies has issued a report on the security of two competing products, I assume that they've actually evaluated those products, rather than just spat back the company literature.
My already little faith in the company that brought us Norton has sunk lower still.
With VISTA coming out, Symantec is going to obviously be pushing its own products for that platform.
I agree, so far - All companies will want in on Vista, even though just about anyone who has seen or used Vista already will stick with XP until at least the server version comes out...
However, expect them to do a 360 in six months again citing VISTA the most secure product ever, bar none.
Why?
Symantec makes software that improves your PC's safety against attacks. If they can point to a million and one critical flaws in Vista, it makes their product (or one like it) all the more necessary.
People will not, in general, flee to Linux just because Vista sucks (which it does, and hard). They might stick with XP (for which Symantec also makes the same set of products).
People also won't switch to a different AV suite for Vista. People use what they have always used, which largely means Norton/Symantec.
Just use Konqueror. I'm sure 99.9% of malicious hackers haven't even heard of it!
Let's say that I wrote the world's most flawed web browser (Anger Browser 1.0), with several hidden RC function and a welcome mat for specially scripted spyware installers. Yes, it has 500 more flaws than IE, but I only have an installed user base of two. Does this mean that my browser presents a higher risk than a browser with 100,000,000 users and one flaw?
All things the same, a flaw in IE presents a higher weighted risk than a browser with a fraction of the user base. Combining that with the relative ignorance of the average IE user, I say that a flaw in IE presents a much higher return to the bad guys than any other browser out there.
Since arguing the merits of one browser over another leads to no end, I hope this post would be somewhat refreshing to read.
Assuming a security measurement can sway users for switching from one browser to another, I propose the following measurement: multiply the number of vulnerabilities by market share, and call this the impact. At first glance, this is brutally unfair for IE, which continues to have the majority market share, but hear me explain.
Let's make another assumption. Suppose all competing browsers have vulnerabilities that lead to the same outcome, then the likelihood that script kiddies choose one browser over another to exploit is more or less determined by the browser's market share. Every vulnerability adds to this likelihood. Therefore, in the end, we end up summing a browser's market share a number of times that is the number of vulnerabilities for that browser. This is the same as multiplying number of vulnerabilities by market share. The result is a measurement of insecurity impact.
What happens if we adopt measuring impact for insecurity?
Since Firefox is a minority in browser market share, it can afford to have more bugs and be relatively secure. Its most critical vulnerabilities have lower impact than IE's equivalent. Suppose users then decide to switch to Firefox. The increase in Firefox market share means its vulnerabilities have higher impact. At one point, it becomes less secure than IE, and users start to switch back. We go back and forth and eventually reach an equilibrium. If users are perfectly "browser elastic" (have no resistence to switch browsers), then at the equilibrium, market share is inversely proportional to the number of vulnerabilities for all browsers. Of course, in the real life, things are never that simple, but let's keep things simple. It is good enough to point out that letting impact determine market share is more desirable than letting vulnerability count to determine market share.
How can the impact score improve current measurement of security?
We all know that some vendors like to play the optimist game by purposely reducing the severity of a vulnerability or even hiding it. If a certain highly popular browser vendor wants to manipulate the impact score, it has to to cheat a lot, and at one point this cheating will become painfully obvious. Hopefully, the risk of causing a scandal would limit the vendor's cheating to a degree that does not significantly variate the impact score.
I once had a signature.
time consuming virus/spyware checks
My virus software performs a full scan daily at 8am. Weekdays at that time I'm on my way to work; weekends, I'm either still in bed or busy with something other than my PC. I rarely run full spyware scans, but when I do they take a few minutes and are always negative (other than the odd cookie).
Of course, I know what I'm doing, which is more than can be said for most PC users...
This is a well known point that MS has dismissed with the 'If linux was as popular...' FUD.
If Linux was as popular, you'd have just as many naive and clueless Linux users as you now have Windows users. They'd mostly either run as root, or happily type in the root password (or use sudo, or whatever) when prompted, and would still hose their systems by installing trojans.
The single biggest security threat to any system is the user. It doesn't matter how much you patch the OS if you never educate the user.
It's official. Most of you are morons.
On the Internet, it is possible to scan whole ranges of addresses looking for vulnerabilities. Automatically. 24/7. And exploit them automatically, 24/7.
What matters is whether the box has open ports or not.The system's security should be configured to account for the home user's non-patching.
Apple has. Their boxes, by default, have no open ports.
Ubuntu has. Their default install has no open ports.
No matter how many worms and infected machines are out there, a default Ubuntu box will never be infected by them.
The first step in security is to reduce the avenues of attack.
A trusted source would say:
But if Symantec said do these 5 simple things, and make sure your kids can do these 5 simple things (or keep them off computer), then they'd be undermining the fear factor they count on to sell their bloated POS products (their corp. products don't seem that bad though.) Symantecs software will NOT keep a computer clean if the people using it don't use safe computing practices. At least Dell stopped bundling exclusively Symantec and McAfee products, should save people some grief from having their security software breaking their computers.
"Too lazy to fail." - Heinlein
Since when does Symantec have any credibility relating to computer security issues?
Now when there's a report on the most efficient way to waste CPU time, memory and disk space, making computers slow down to a crawl, their commentary will be respected.
In short, the "bashing" is justified. If I, a humble geek, can figure out on my own that killing all of these unnecessary services can make the unpatched machine safer, then why can't the smart geeks at Microsoft? Why does the thing ship with so many services enabled? The average user does not know that there are "services" or how to kill them. For the average user, it is impossible to install and patch Windows without getting infected - that is a pretty damning security situation.
W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.
They might stick with XP
Scratch that. They will stick with XP unless they buy a new computer with Vista already installed. You have no idea how many people I deal with on a given day that are still using Windows 98. I even come across people who think Windows 95 is the cat's meow. For most people, that shit is "good enough", so it's unlikely that people will jump en masse to Vista without some major incentive.
This poo is cold.
I know this might come as a surprise to some of you, but there's a few strange individuals who have integrity, who do really strange things like telling the truth even when it may not be in their best interests. I suppose that might not fit into your worldview
It is a miracle that curiosity survives formal education. - Einstein
... and now the tables have turned, and Microsoft is competing with Symantec. (Windows OneCare)
All of a sudden Symantec retaliates by deciding that Internet Explorer does indeed have more "critical" flaws than Mozilla Firefox does.
If they tell the truth, then most likely they do get something out of it. Perhaps they think if they tell the truth in cases that it might not be in their best interest, they'll still earn and maintain the respect of people. People always tell the truth to benefit themselves, whether that's profit-wise or otherwise.
What he means is that you'd be telling the truth in order to proft from that warm fuzzy feeling of having "done the right thing". In cases such as that however, I don't think it's a bad thing at all, even if society gets to the point where everyone is doing "the right thing" only to get that warm fuzzy feeling, it wouldn't change the fact that the right thing was getting done and everyone walks away happy.
Complete bullshit, people do all sorts of things that are completely irrational, because at the moment that they did them they couldn't think straight (due to emotion, intoxication, haste, etc.). In a moment of irrational exuberence (or panic) a persion is at least as likely to act against their own best interests (whether we are talking monetary, psychological or even physical) as they are not to. This is the sort of circumstance in which a person might jump into a freezing cold river to save a drowning person or run into a burning house to save a person calling for help, even though ration thought would tell them that they are far more likely to perish themselves than to effect a successful rescue.
While this sort of action might benefit the species or society or the geneome, it is clearly detrimental to the individual, and can't be reconciled with some naive notion of pure utility and self-interest. Simply put, the absurd notion that people always act in some manner to maximize some intelectual goal (profit, moral integrity, etc.) depends upon the notion that people always act rationally, since it is clear that people don't always act rationally (in fact, many people seem to act irrationally most of the time) the proposition fails on it's own premises.
just a ghost in the machine.
"Perhaps the Symantec marketing trolls have embarked on a subtle campaign to undermind the general public's trust in Micro$oft's ability to deliver secure products"
I suspect there is little public trust in the security of Microsoft's products that is worth undermining. Most people have been beaten into submission and have simply accepted their fate of dealing with the maladies which accompany Microsoft's products. At the same time everyone has also accepted that open source offerings are much more secure than Microsoft products but are beyond their technical skills.
It is more likely that the Symantec marketing trolls are merely attacking their new enemy, Microsoft. Before the enemy was open source because of its public perception as a secure solution that does not need Symantec services, now Microsoft is the enemy because they are competing directly with Symantec. By scaring people away from products which don't require Symantec's services by refuting wide spread beliefs they hoped to maintain their market of installed Microsoft products which require their service, but now their greatest risk is that of losing their market directly to Microsoft.
I'm with you in that Symantec's sudden change of heart concerning the security of IE verus Firefox appears rather disingenuous and loaded with ulterior motives, but I doubt there is a general feeling of trust between Microsoft and their customers which Symantec needs to break. Symantic is merely adding fuel to a long raging fire of mistrust of Microsoft and a perception of a need for protection against Microsoft's security failures. One could hardly say the negative perception of security in Microsoft's products is undeserving, to the contrary they made the mess they are in, but that doesn't mean that Symantec is suddenly devoid of malice towards Microsoft these days.
It is also possible that the people at Symantec are truely printing what they believe to be the truth, its always good to give people the benefit of the doubt, but it does seem rather suspicious considering the circumstances.
burnin
People with integrity can't run big businesses. If a person with integrity starts a business and runs it ethically it will never get past the small to medium business range. Untethical people will always outcompete you because there is so much profit in sleaze.
So really there are no people of integrity (in charge) in a company with more then a 100 employees.
evil is as evil does
Well, see, this story's example shows "the truth will always out." This is another one of those shifting paradigms you heard your PHB muttering about. In the present information age, with a battalion of bloggers on the job and snoopers ferreting to the very bottom of the data pile, it's damn near impossible to keep anything secret. So, you publicly deny that your product has *any* flaws, then get caught; you look bad in the long term. Or you frankly discuss the flaws up-front; you look bad in the short-term, but better in the long term, especially since you openly invite assistance from all concerned to find bugs and suggest ways to fix them, driving many of the flaws out anyway.
Conclusion: Free/Open Source Developers *are* telling the truth in their best interest; they're just thinking farther ahead.
It is not unknown for updates to have new "features" and EULA clauses. It isn't just a matter of repairing the original product, it is a matter of transforming the original product into something new and not necessarily what the customer intended to purchase.
It would be a good thing for the IT industry, in the long term, for these things to get a good legal test. This would rein in the abusers, while clarifying the rules of business for the honest folk.
I understand, and by and large agree with, your thesis that humans are self-absorbed, self-interested beings. However, how would you interpret those individuals who have thrown themselves on handgrenades to save their platoon buddies from death? Death was virtually certain for these individuals, and there was some opportunity to escape from the situation with only minor or moderate injury, yet they chose to sacrifice themselves for their comrades. By the self-interest theory, it was an inappropriate decision, even if they considered the possibility of posthumus accolade, because they wouldn't be there to experience the reward.
Rather, I believe that people are able to rationally select a greater good, even if it brings personal harm. I'm not saying that most people actually do this on a regular basis, but the capability is there. On the other hand, I meet more and more people who meet the clinical definition of sociopaths, who truly are incapable of considering anything beyonds themselves, and they are scary people.
People with integrity can't run big businesses. If a person with integrity starts a business and runs it ethically it will never get past the small to medium business range. Untethical people will always outcompete you because there is so much profit in sleaze.
Oh, I don't think that is true at all. Ask people about Bill Hewlett, and they'll tell you he was a great engineer who was fanaticaly about treating his employees with respect. Although ethics issues have arisen in some of Berkshire Hathaway's insurance subsidiaries, nobody has anything but stellar things to say about Warren Buffet's personal integrity and of course business acumen.
The thing is, these guys are are rare combinations of technical genius, organizational ability, and personal insight -- what they call these days "emotional intelligence". Most entrepreneurs fall short in one or more areas, and so bluster, pretense, and faking of results is common. With a bit of luck a sense of timing, these guys may achieve a measure of success. Nonetheless, while you can never predict how chance may affect the outcome of the best laid plans, in a one to one contest of entrepreneurship, I'd put my money on Warren Buffet against a guy who's main qualification is that he's willing to lie and cheat.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.