Symantec Rethinks Firefox vs IE Vulnerabilities

imagine that by Anonymous Coward · 2006-03-12 01:39 · Score: 5, Funny

profit motive = incentive to lie

I'm SHOCKED!

Re:imagine that by nevernamed · 2006-03-12 02:25 · Score: 2, Insightful

I agree. How can you believe that firefox is less secure than IE? You're probably on crack if you think that.
Re:imagine that by Anonymous Coward · 2006-03-12 02:39 · Score: 3, Interesting

Of course, the two concepts are completely unrelated, when one realizes that lying doesn't occur because the lier decided that lying was NOT in his best interest. Lying occurs because the lier, at the time, decided it would benefit him somehow. In other words, in order to profit. (Profit doesn't have to be measured in raw dollars, but can take the form of anything which an individual considers to benefit him.) Therefore, all lying is an attempt to profit, just like all truth telling is an attempt to profit. (Why would someone tell the truth if they didn't believe it was in their best interest, i.e. for profit?) People do things because they believe, at least at that moment, that those things are in their best interest.

So there is no more connection between lying and profit than truth-telling and profit. D'oh!
Re:imagine that by causality · 2006-03-12 05:02 · Score: 5, Insightful

(Why would someone tell the truth if they didn't believe it was in their best interest, i.e. for profit?)

I know this might come as a surprise to some of you, but there's a few strange individuals who have integrity, who do really strange things like telling the truth even when it may not be in their best interests. I suppose that might not fit into your worldview ...

--
It is a miracle that curiosity survives formal education. - Einstein
Re:imagine that by DarkJC · 2006-03-12 05:25 · Score: 2, Insightful

If they tell the truth, then most likely they do get something out of it. Perhaps they think if they tell the truth in cases that it might not be in their best interest, they'll still earn and maintain the respect of people. People always tell the truth to benefit themselves, whether that's profit-wise or otherwise.
Re:imagine that by LouisZepher · 2006-03-12 06:03 · Score: 3, Insightful

What he means is that you'd be telling the truth in order to proft from that warm fuzzy feeling of having "done the right thing". In cases such as that however, I don't think it's a bad thing at all, even if society gets to the point where everyone is doing "the right thing" only to get that warm fuzzy feeling, it wouldn't change the fact that the right thing was getting done and everyone walks away happy.
Re:imagine that by tyme · 2006-03-12 06:34 · Score: 4, Insightful

some nitwit of an anonymouse coward wrote:
Human nature tells us that an individual can't possibly make a decision against what he sees as his best interests

Complete bullshit, people do all sorts of things that are completely irrational, because at the moment that they did them they couldn't think straight (due to emotion, intoxication, haste, etc.). In a moment of irrational exuberence (or panic) a persion is at least as likely to act against their own best interests (whether we are talking monetary, psychological or even physical) as they are not to. This is the sort of circumstance in which a person might jump into a freezing cold river to save a drowning person or run into a burning house to save a person calling for help, even though ration thought would tell them that they are far more likely to perish themselves than to effect a successful rescue.
While this sort of action might benefit the species or society or the geneome, it is clearly detrimental to the individual, and can't be reconciled with some naive notion of pure utility and self-interest. Simply put, the absurd notion that people always act in some manner to maximize some intelectual goal (profit, moral integrity, etc.) depends upon the notion that people always act rationally, since it is clear that people don't always act rationally (in fact, many people seem to act irrationally most of the time) the proposition fails on it's own premises.

--
just a ghost in the machine.
Re:imagine that by Peaceful_Patriot · 2006-03-12 06:52 · Score: 2, Interesting

I think there is a big difference between individual integrity and the lawyer and profit driven speak of companies. Of course there is personal honesty. Lots of people choose to tell the truth. Companies, however, tend to view honesty as a relative thing it is and highly subject to the influences of lawyers and shareholders.

--
There is nothing so powerful as an idea whose time has come.
Re:imagine that by killjoe · 2006-03-12 07:32 · Score: 4, Insightful

People with integrity can't run big businesses. If a person with integrity starts a business and runs it ethically it will never get past the small to medium business range. Untethical people will always outcompete you because there is so much profit in sleaze.

So really there are no people of integrity (in charge) in a company with more then a 100 employees.

--
evil is as evil does
Re:imagine that by Hosiah · 2006-03-12 08:05 · Score: 2, Insightful

Why would someone tell the truth if they didn't believe it was in their best interest, i.e. for profit?
Well, see, this story's example shows "the truth will always out." This is another one of those shifting paradigms you heard your PHB muttering about. In the present information age, with a battalion of bloggers on the job and snoopers ferreting to the very bottom of the data pile, it's damn near impossible to keep anything secret. So, you publicly deny that your product has *any* flaws, then get caught; you look bad in the long term. Or you frankly discuss the flaws up-front; you look bad in the short-term, but better in the long term, especially since you openly invite assistance from all concerned to find bugs and suggest ways to fix them, driving many of the flaws out anyway.
Conclusion: Free/Open Source Developers *are* telling the truth in their best interest; they're just thinking farther ahead.
Re:imagine that by Anonymous Coward · 2006-03-12 10:54 · Score: 3, Funny

Given that IE is a far more mature code base than Firefox (version 6 versus version 1.5) I would expect IE to be far more secure than Firefox. The fact that more people use IE causes more security flaws to be found anyway since more people look for flaws in it.

Plus, IE doesn't use the page renderer to handle the user interface like Firefox does - that's already bitten Firefox several times and doubtlessly will continue to as people find ways to jump from "unsafe" content to "chrome" content.
Re:imagine that by zippthorne · 2006-03-12 13:56 · Score: 2, Interesting

Wait.. are you using PR version numbers as your basis for comparison?

That's like saying windows 95 is more mature than [linux distro using kernel version 2.6.x] because as anyone can see, 95 > 2.6.

--
Can you be Even More Awesome?!
Re:imagine that by hey! · 2006-03-13 01:40 · Score: 3, Insightful

People with integrity can't run big businesses. If a person with integrity starts a business and runs it ethically it will never get past the small to medium business range. Untethical people will always outcompete you because there is so much profit in sleaze.

Oh, I don't think that is true at all. Ask people about Bill Hewlett, and they'll tell you he was a great engineer who was fanaticaly about treating his employees with respect. Although ethics issues have arisen in some of Berkshire Hathaway's insurance subsidiaries, nobody has anything but stellar things to say about Warren Buffet's personal integrity and of course business acumen.

The thing is, these guys are are rare combinations of technical genius, organizational ability, and personal insight -- what they call these days "emotional intelligence". Most entrepreneurs fall short in one or more areas, and so bluster, pretense, and faking of results is common. With a bit of luck a sense of timing, these guys may achieve a measure of success. Nonetheless, while you can never predict how chance may affect the outcome of the best laid plans, in a one to one contest of entrepreneurship, I'd put my money on Warren Buffet against a guy who's main qualification is that he's willing to lie and cheat.

--
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.

So Symantec hates microsoft now?? by nich37ways · 2006-03-12 01:42 · Score: 5, Funny

I guess the latest TCO Microsoft is great checks failed to appear this week....

--
37 - what does it stand for really...

It took them by colonslashslash · 2006-03-12 01:43 · Score: 4, Funny

Over 6 months to realise and admit that? Nice going ...

--
She's built like a steak house, but she handles like a bistro....

Re:It took them by who+am+i+anyway · 2006-03-12 02:41 · Score: 2, Funny

Half a year for admitting a mistake ain't that bad... compared to the catholic church.
Re:It took them by rbochan · 2006-03-12 06:30 · Score: 2, Funny

6 months! That's nothing compared to their virus/trojan detection updates!

--
...Rob
The American Dream isn't an SUV and a house in the suburbs; it's Don't Tread On Me.

Surely it's just about potential for harm. by 91degrees · 2006-03-12 01:44 · Score: 5, Insightful

Weakest point, and amount of possible damage.

If one browser allows an attacker to read arbitrary files, and another allows an attacker to delete arbitrary files, then the one that allows the deletion is surely worse however many ways there are to read files.

If one browser can be attacked in a generic manner, and the other needs some knowledge of the victim, then the one that can be attacked in a generic manner is less secure.

Now, exactly how an easy to implement low impact and a hard to implement high impact attack compare is still going to be subjective, but wherever you draw the line, it's going to be better than simply counting the nuber of critical bugs.

Re:Surely it's just about potential for harm. by syntaxglitch · 2006-03-12 02:04 · Score: 4, Insightful

If one browser allows an attacker to read arbitrary files, and another allows an attacker to delete arbitrary files, then the one that allows the deletion is surely worse however many ways there are to read files.

This isn't necessarily true. For instance, if the files that can be read include ones with, say, credit card information, wouldn't it be better to have those deleted (you can always re-enter the info to order online) than to have the information read without your knowledge and let someone else charge to your credit card?

The basic point you're making is quite correct, though.
Re:Surely it's just about potential for harm. by bubkus_jones · 2006-03-12 07:46 · Score: 2, Insightful

I guess it depends, as you said, on the type of data the file contains, and what purpose it serves. However, isn't manually deleting information like credit card numbers and other sensitive information yourself part of proper/secure browsing techniques?

OneCare by ROOK*CA · 2006-03-12 01:46 · Score: 5, Interesting

I wonder if Symantec's "rethinking" of it's position has anything to do with Microsoft Announcing a Competeing offering (OneCare Live), apparently Symantec will no longer just take Microsofts word whether a suspected flaw is actually a bug/vulnerability or not, Sorry Microsoft that ole "Naw, that's not a vulnerability, it's just an undocumented feature" doesn't look like it's going to fly anymore.

:D

Re:OneCare by brian0918 · 2006-03-12 01:53 · Score: 4, Insightful

Of course they're connected; there's no other possibility. Listening to Symantec's opinion on this would be like asking Philip Morris for an opinion on the link between cigarettes and lung cancer. So, how long until MS OneCare starts getting flagged as malicious spyware by Norton, or vice versa?
Re:OneCare by ROOK*CA · 2006-03-12 02:06 · Score: 4, Funny

So, how long until MS OneCare starts getting flagged as malicious spyware by Norton, or vice versa?

LOL, Great Point, I can see it now "Symantec Client Security Has Detected A Serious Vulnerability On Your Computer Click OK to Uninstall ..... Microsoft Office" :D

Great way to drive pay-per-incident Technical Support too.

"Personal Security Suite Wars 2006 Coming to a Windows PC Near You."
Re:OneCare by ntsucks · 2006-03-12 02:17 · Score: 4, Interesting

Perhaps the Symantec marketing trolls have embarked on a subtle campaign to undermind the general public's trust in Micro$oft's ability to deliver secure products. Basically a "Who do you trust?" positioning of themselves against OneCare Live. Strange as it may seem Joe Six Pack probably does not have the Slashdot crowd's contempt for Micro$oft's ability to deliver secure products, thus leaving some room for Symantec to discredit them.

--
Those who can do. Those who can't sue.
Re:OneCare by sqlrob · 2006-03-12 03:30 · Score: 4, Informative

vice versa happened a couple of weeks ago.
Re:OneCare by Dehumanizer · 2006-03-12 04:23 · Score: 3, Informative

Almost there.

Joe Sixpack believes all software is from Microsoft. In fact, they invented computers, ya know.

--
The Tlog - a technology blog
Re:OneCare by chill · 2006-03-12 05:12 · Score: 4, Funny

LOL, Great Point, I can see it now "Symantec Client Security Has Detected A Serious Vulnerability On Your Computer Click OK to Uninstall ..... Microsoft Office" :D

You were modded funny, only because "prophetic" isn't a legitimate mod. Actually, McAfee beat them to it. Their virus update sigs on Friday, March 10th classified MS Excel as a virus.

-Charles

--
Learning HOW to think is more important than learning WHAT to think.
Re:OneCare by burnin1965 · 2006-03-12 06:56 · Score: 3, Insightful

"Perhaps the Symantec marketing trolls have embarked on a subtle campaign to undermind the general public's trust in Micro$oft's ability to deliver secure products"

I suspect there is little public trust in the security of Microsoft's products that is worth undermining. Most people have been beaten into submission and have simply accepted their fate of dealing with the maladies which accompany Microsoft's products. At the same time everyone has also accepted that open source offerings are much more secure than Microsoft products but are beyond their technical skills.

It is more likely that the Symantec marketing trolls are merely attacking their new enemy, Microsoft. Before the enemy was open source because of its public perception as a secure solution that does not need Symantec services, now Microsoft is the enemy because they are competing directly with Symantec. By scaring people away from products which don't require Symantec's services by refuting wide spread beliefs they hoped to maintain their market of installed Microsoft products which require their service, but now their greatest risk is that of losing their market directly to Microsoft.

I'm with you in that Symantec's sudden change of heart concerning the security of IE verus Firefox appears rather disingenuous and loaded with ulterior motives, but I doubt there is a general feeling of trust between Microsoft and their customers which Symantec needs to break. Symantic is merely adding fuel to a long raging fire of mistrust of Microsoft and a perception of a need for protection against Microsoft's security failures. One could hardly say the negative perception of security in Microsoft's products is undeserving, to the contrary they made the mess they are in, but that doesn't mean that Symantec is suddenly devoid of malice towards Microsoft these days.

It is also possible that the people at Symantec are truely printing what they believe to be the truth, its always good to give people the benefit of the doubt, but it does seem rather suspicious considering the circumstances.

burnin

How can you trust them? by putko · 2006-03-12 01:51 · Score: 3, Insightful

How can you trust these guys with your security?

They make some b.s. statements that just aren't founded in logic, or in a reasonably cynical view of how people/companies behave. The result is that they suggest you do the ridiculous, with your security (not theirs). Then they (for whatever reason) say something else.

I'm not even suggesting that they "came to their senses", but perhaps, for one reason or another, decided that Microsoft was not their friend anymore (or maybe firefox is their friend now).

--
http://www.thebricktestament.com/the_law/when_to_s tone_your_children/dt21_18a.html

Re:How can you trust them? by spiritraveller · 2006-03-12 02:00 · Score: 4, Insightful

How can you trust these guys with your security?

No sane person would. By their own admission, it is clear that they gave a blank check to Microsoft. Whatever their motive for doing that, it shows a lack of devotion to the stated goal of their products.

If a company wants my money for securing my computers, they better show some integrity that doesn't shift depending on how their relationship with the bigger company is going that day.

A Scenario by BumpyCarrot · 2006-03-12 01:52 · Score: 5, Funny

Symantec: Internet Explorer feasted on my childs bones. Microsoft: We don't consider that critical.

--
Do you see what I did there?

But there's more... by ABoerma · 2006-03-12 01:53 · Score: 5, Interesting

I like the other part of TFA better:

"Windows XP Professional, said Symantec, stays safe just one hour and 12 seconds, while the Windows 2000 Server (with SP4) made it an hour and 17 minutes. An unpatched Windows Server 2003 system lasted somewhat longer.

In contrast, unpatched Linux installations of both Red Hat Enterprise Linux 3 and SuSE Linux 9 Desktop were never compromised during their month-and-a-half exposure to attackers."

Re:But there's more... by DanteLysin · 2006-03-12 02:10 · Score: 4, Insightful

So if you are a noob and don't patch your systems, you get by longer on Linux than Windows. No surprise there. My guess is that there are more Windows oriented viruses/worms circulating the Internet. The take home message is "patch your system". We Slashdotters know better, but does the regular home user?
Re:But there's more... by Tim+C · 2006-03-12 03:22 · Score: 2, Insightful

time consuming virus/spyware checks

My virus software performs a full scan daily at 8am. Weekdays at that time I'm on my way to work; weekends, I'm either still in bed or busy with something other than my PC. I rarely run full spyware scans, but when I do they take a few minutes and are always negative (other than the odd cookie).

Of course, I know what I'm doing, which is more than can be said for most PC users...

This is a well known point that MS has dismissed with the 'If linux was as popular...' FUD.

If Linux was as popular, you'd have just as many naive and clueless Linux users as you now have Windows users. They'd mostly either run as root, or happily type in the root password (or use sudo, or whatever) when prompted, and would still hose their systems by installing trojans.

The single biggest security threat to any system is the user. It doesn't matter how much you patch the OS if you never educate the user.

--
It's official. Most of you are morons.
Re:But there's more... by SeeMyNuts! · 2006-03-12 08:10 · Score: 2, Insightful

It is not unknown for updates to have new "features" and EULA clauses. It isn't just a matter of repairing the original product, it is a matter of transforming the original product into something new and not necessarily what the customer intended to purchase.

It would be a good thing for the IT industry, in the long term, for these things to get a good legal test. This would rein in the abusers, while clarifying the rules of business for the honest folk.

Not too surprising by enigma48 · 2006-03-12 01:53 · Score: 4, Interesting

My first thought was that this makes perfect sense - now that MS is a competitor of Symantec, they're going to discredit them as much as they can.

But Symantec has known for ages that MS is pushing into their space. Maybe they had a Netscape-esque agreement with Symantec and maybe Symantec found new evidence that convinced them partnering with MS isn't the best way to go?

It *could* be as simple as an upper-management type listening to the feedback the last report got, but I haven't seen an icy weather forecast for Hell today.

(For those who missed the MS Anti-trust days: it was 'alleged' that when MS decided that the 'net was not just a fad and MS needed to throw all their resources into making IE the dominant browser, MS offered not to compete in Mac-space if they left the Windows market quietly. Netscape refused, MS bundled IE with windows, and the rest is history)

Re:Not too surprising by nvrrobx · 2006-03-12 07:29 · Score: 2, Informative

Microsoft was a strategic partner of Symantec until the day OneCare was released. Note I said was.

Yes, I work for Symantec. Any opinions I express in a post are my own and not necessarily those of my employer.

Oi norton... by djsmiley · 2006-03-12 01:57 · Score: 4, Interesting

StartKeyLogger

another undocmented feature...

--
- http://www.milkme.co.uk

ooops, sorry by yagu · 2006-03-12 01:59 · Score: 2, Interesting

It seems almost disingenuous to "rethink" this so late. Of course it's more than a little irritating, it directly impacts the perceptions and usage levels of the competing browsers. It's kind of like yelling "fire" in a crowded theater, waiting until the resultant stampede kills many in the theater and then saying, "I'm rethinking this, and it looks as if there is no fire."

Number of bugs means... by plankrwf · 2006-03-12 02:09 · Score: 5, Insightful

I'm working in the IT industry myself, and one of the well-known problems with bug-counting is... well, counting bugs.
I have seen IT managers getting upset because there were 100's og bugs*.
Turned out all of them were because of ONE faulty thing.

I have seen bug reports of the form
1. pressing button A and then pressing button Y gets critical error.
2. pressing button B and then pressing button Y gets critical error.
3. pressing button C and then pressing button Y gets critical error.
etc etc

In other situations a manager was not upset, "there were only a few bugs*".
Later, this same manager became upset at a time that there were on the order of 50 or so "bugs*".
Turned out fixing those few bugs took more than o month, while those 50 were 'fixed' within a week.

So my professional view is that bug-counting doesn't count, the correct question is:
how sick did you get? (Compare getting bitten by a tsetse fly to getting bitten by a red ant...)

* To be honest: I am referring to a non-English term which is NOT equivalent to a bug, but more to 'a problem'.

Re:Number of bugs means... by mav[LAG] · 2006-03-12 09:48 · Score: 3, Interesting

This reminds me of a friend of mine who used to be a professional game tester for an EA dev team near where I live. Although somewhat looked down upon, testers are actually a terribly important part of the game dev process. If you're looking for budget to save, look somewhere else.

Nobody told that to the manager. For the next project my friend was given absolutely nothing to work with - no design docs, no resources, no source code, no debug version, no reporting sheets - zip. Just a crappy PC with - occasionally - the latest build on. All his requests for the basic tools to let him do his job properly went unheeded. So he started filing bug reports via email like this:

To: Developers
Subject: Game is broken - fix it

To: Developers
Subject: Game crashes - needs to be fixed

To: Developers
Subject: Game broken - needs fixing

He was quickly provided with the tools he needed :)

--
--- Hot Shot City is particularly good.
Re:Number of bugs means... by bogado · 2006-03-13 02:09 · Score: 2, Insightful

And you're not counting that the "re-engenier" step in the "PITA" bugs can sometimes render some of the bugs you spent time fixing earlier a waste, since you may have to rework entire portions of the code.

--
[]'s Victor Bogado da Silva Lins
^[:wq

Hi Symantec by babbling · 2006-03-12 02:09 · Score: 3, Insightful

Welcome to 2 years ago. This new Firefox browser is pretty cool, eh?

I wonder if anyone ever took Symantec seriously when they made this claim. Most computer illiterate users wouldn't have even heard about Symantec saying this, and those that did (eg. Slashdot readers) would already know better. It's as if Symantec is in their own little universe where it seems as thought everything incorrect is actually correct.

Re:Hi Symantec by babbling · 2006-03-12 04:25 · Score: 2, Interesting

True. I wonder if this latest admission from Symantec is a response to Microsoft's new (when Vista comes out...) virus/spyware scanner subscription service. Symantec are now competing with Microsoft.

Vendor acknowledged? by DarthChris · 2006-03-12 02:10 · Score: 2, Informative

FTFS:

"The key was vendor acknowledged critical vulnerabilities. Thus, if Microsoft (or the Mozilla Foundation) didn't agree it was critical, then it didn't get counted."

Mozilla has Bugzilla to keep track of it's issues, MS is notorious for claiming bugs are in fact features.

Also, IMHO any security issue is 'critical'. Someone once said that MS's 'critical vulnerabilities' are security flaws that should never have made it past design stage.

--
Don't you just hate it when people reply to your signature?

Symantec tests windows xp by Centurix · 2006-03-12 02:13 · Score: 5, Funny

"We have substatially tested Windows XP and have found the operating system to be completely bug free. Out tests were conducted in a time period of 1 minute, which contains 60 seconds. As all seconds are effectively the same, we can safely say that Windows XP will be safe for all future occurances of seconds."

--
Task Mangler

Rethinking Symantec by xianfox · 2006-03-12 02:22 · Score: 2

I guess I'll have to "rethink" my reliance on any Symantec security program.

This coming from symantec by saboola · 2006-03-12 02:25 · Score: 2, Insightful

Whose company products in all my years of computer maintenance have overall caused me more problems than all the malware/viruses they were supposed to be fighting. Thanks for the heads up!

Re:This coming from symantec by CRC'99 · 2006-03-12 05:28 · Score: 2, Interesting

Whose company products in all my years of computer maintenance have overall caused me more problems than all the malware/viruses they were supposed to be fighting. Thanks for the heads up!

You can say that again. Where I'm working now, "Are you using Norton Internet Security or Anti-Virus?" is about question number 2 on the process for troubleshooting email problem calls. The first one is "What is your email address?". It's a 50/50 decision on if I'd rather taken on the virus/trojan world.......

--
Sendmail is like emacs: A nice operating system, but missing an editor and a MTA.

Seriously? by user24 · 2006-03-12 02:32 · Score: 3, Insightful

You're seriously telling me that Symantec just added up the number of times a flaw was labelled "critical" by the owning company of the product, and based their 'report' on that - wtf?

I mean, *I* could have done that. When I hear that one of the leading security companies has issued a report on the security of two competing products, I assume that they've actually evaluated those products, rather than just spat back the company literature.

My already little faith in the company that brought us Norton has sunk lower still.

Re:Seriously? by ScrewMaster · 2006-03-12 04:46 · Score: 2, Insightful

That's not really fair to Peter Norton. The original Norton Utilities were a pretty decent package. I used them for years to help maintain a big Wildcat! BBS. Symantec eventually bought him out, but kept the Norton Utilities name for marketing purposes since it was about the best-known product of its kind at the time.

--
The higher the technology, the sharper that two-edged sword.

Re:Obvious by pla · 2006-03-12 02:36 · Score: 2, Insightful

With VISTA coming out, Symantec is going to obviously be pushing its own products for that platform.

I agree, so far - All companies will want in on Vista, even though just about anyone who has seen or used Vista already will stick with XP until at least the server version comes out...

However, expect them to do a 360 in six months again citing VISTA the most secure product ever, bar none.

Why?

Symantec makes software that improves your PC's safety against attacks. If they can point to a million and one critical flaws in Vista, it makes their product (or one like it) all the more necessary.

People will not, in general, flee to Linux just because Vista sucks (which it does, and hard). They might stick with XP (for which Symantec also makes the same set of products).

People also won't switch to a different AV suite for Vista. People use what they have always used, which largely means Norton/Symantec.

Damn by pHatidic · 2006-03-12 02:38 · Score: 5, Funny

Oh shit I'm going to have to switch back now! Do you have any idea how long it took to get IE running on Linux?

Re:Damn by psocccer · 2006-03-12 10:37 · Score: 3, Funny

Do you have any idea how long it took to get IE running on Linux?

About 10 minutes? I run ie5.5 and ie6 under wine setup by this installer script so I can check web stuff without having to fire up qemu. And yes I know you were just kidding :p

--
Free Online Woodworking Resources Directory

The obvious answer by ZakuSage · 2006-03-12 02:41 · Score: 2, Insightful

Just use Konqueror. I'm sure 99.9% of malicious hackers haven't even heard of it!

Maker of the worst antivirus software ... by Anonymous Coward · 2006-03-12 02:46 · Score: 2, Interesting

Symantec used to make top notch products. When I recently was exposed to their client software again assisting friends, I was shocked to see that they now make the worst security suite. It is just completely unsuable for customers. Their failure to even have their software work with Windows XP SP2 (and letting their customers take the problems such as all programs stop having internet connectivity but their own ...) is evidence that they with their "platform play" is becoming increasingly at odds with Microsoft. If they were able to understand that at least until recently Microsoft have only provided basic functionality to help protect customers (such as the basic firewall and a central place to see security status) and that there is considerable space in which to provide superior technology, I might have believed some of their comments.

The way it stands now, I cannot possibly recommend their products nor their "advice".

How about: Flaw + User Base = Risk by AngryNick · 2006-03-12 03:00 · Score: 2, Insightful

It seems to me that a 1:1 comparison of flaw counts is just going to show you how may potential problems there are...not your risk of getting hit through one of them.

Let's say that I wrote the world's most flawed web browser (Anger Browser 1.0), with several hidden RC function and a welcome mat for specially scripted spyware installers. Yes, it has 500 more flaws than IE, but I only have an installed user base of two. Does this mean that my browser presents a higher risk than a browser with 100,000,000 users and one flaw?

All things the same, a flaw in IE presents a higher weighted risk than a browser with a fraction of the user base. Combining that with the relative ignorance of the average IE user, I say that a flaw in IE presents a much higher return to the bad guys than any other browser out there.

evaluate relative security by impact by pikine · 2006-03-12 03:09 · Score: 2, Insightful

Since arguing the merits of one browser over another leads to no end, I hope this post would be somewhat refreshing to read.

Assuming a security measurement can sway users for switching from one browser to another, I propose the following measurement: multiply the number of vulnerabilities by market share, and call this the impact. At first glance, this is brutally unfair for IE, which continues to have the majority market share, but hear me explain.

Let's make another assumption. Suppose all competing browsers have vulnerabilities that lead to the same outcome, then the likelihood that script kiddies choose one browser over another to exploit is more or less determined by the browser's market share. Every vulnerability adds to this likelihood. Therefore, in the end, we end up summing a browser's market share a number of times that is the number of vulnerabilities for that browser. This is the same as multiplying number of vulnerabilities by market share. The result is a measurement of insecurity impact.

What happens if we adopt measuring impact for insecurity?

Since Firefox is a minority in browser market share, it can afford to have more bugs and be relatively secure. Its most critical vulnerabilities have lower impact than IE's equivalent. Suppose users then decide to switch to Firefox. The increase in Firefox market share means its vulnerabilities have higher impact. At one point, it becomes less secure than IE, and users start to switch back. We go back and forth and eventually reach an equilibrium. If users are perfectly "browser elastic" (have no resistence to switch browsers), then at the equilibrium, market share is inversely proportional to the number of vulnerabilities for all browsers. Of course, in the real life, things are never that simple, but let's keep things simple. It is good enough to point out that letting impact determine market share is more desirable than letting vulnerability count to determine market share.

How can the impact score improve current measurement of security?

We all know that some vendors like to play the optimist game by purposely reducing the severity of a vulnerability or even hiding it. If a certain highly popular browser vendor wants to manipulate the impact score, it has to to cheat a lot, and at one point this cheating will become painfully obvious. Hopefully, the risk of causing a scandal would limit the vendor's cheating to a degree that does not significantly variate the impact score.

--
I once had a signature.

The Secret to Success by burntsigil · 2006-03-12 03:21 · Score: 2, Funny

"Thus, if Microsoft (or the Mozilla Foundation) didn't agree it was critical, then it didn't get counted."

That's it! That's the secret to making bug-free software! Not fix anything then deny it's a bug! That's what I'm gonna do!

"Hey, this is a critical exploit!"
"No, it's not."
"Okay."

BRILLIANT!

That's not exactly correct. by khasim · 2006-03-12 03:29 · Score: 5, Insightful

My guess is that there are more Windows oriented viruses/worms circulating the Internet.

"More" is correct. But the implication being that that is why the Linux boxes were not cracked is incorrect.

On the Internet, it is possible to scan whole ranges of addresses looking for vulnerabilities. Automatically. 24/7. And exploit them automatically, 24/7.

What matters is whether the box has open ports or not.

The take home message is "patch your system". We Slashdotters know better, but does the regular home user?

The system's security should be configured to account for the home user's non-patching.

Apple has. Their boxes, by default, have no open ports.
Ubuntu has. Their default install has no open ports.

No matter how many worms and infected machines are out there, a default Ubuntu box will never be infected by them.

The first step in security is to reduce the avenues of attack.

Who would trust Symantec? by OrangeDoor · 2006-03-12 03:54 · Score: 2, Insightful

Symantec is hardly a trusted objective source of security information. For them it's all about fear factor. Now with the two articles combined they paint both browsers as being unsecure.

A trusted source would say:

Keep computer upto date.
Use Firefox as default browser.
Don't trust any ads, pop-ups, or unexpected e-mails.
Don't install every free screensaver you run across (or other stupid games/junk you might download)
Keep your A/V software upto date. (And use something better, cheaper, and faster than Norton/McAfee like AVG.

But if Symantec said do these 5 simple things, and make sure your kids can do these 5 simple things (or keep them off computer), then they'd be undermining the fear factor they count on to sell their bloated POS products (their corp. products don't seem that bad though.) Symantecs software will NOT keep a computer clean if the people using it don't use safe computing practices. At least Dell stopped bundling exclusively Symantec and McAfee products, should save people some grief from having their security software breaking their computers.

--
"Too lazy to fail." - Heinlein

Re:Why didn't you post the next paragraph... by MightyYar · 2006-03-12 04:27 · Score: 3, Insightful

It is important to point out how vulnerable an unpatched version is. I - like many other /.'ers - am my family's PC support. I also - like many /.'ers - have learned the hard way to keep the PC unplugged from the network until it is patched. This makes things very rough when I'm at a home with only one PC, but you apparently can mitigate your risk by killing most of the processes running on the machine before launching Windows Update.

In short, the "bashing" is justified. If I, a humble geek, can figure out on my own that killing all of these unnecessary services can make the unpatched machine safer, then why can't the smart geeks at Microsoft? Why does the thing ship with so many services enabled? The average user does not know that there are "services" or how to kill them. For the average user, it is impossible to install and patch Windows without getting infected - that is a pretty damning security situation.

--
W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.

Re:Obvious by despisethesun · 2006-03-12 04:30 · Score: 2, Insightful

They might stick with XP

Scratch that. They will stick with XP unless they buy a new computer with Vista already installed. You have no idea how many people I deal with on a given day that are still using Windows 98. I even come across people who think Windows 95 is the cat's meow. For most people, that shit is "good enough", so it's unlikely that people will jump en masse to Vista without some major incentive.

--
This poo is cold.

The tables have turned. by babbling · 2006-03-12 05:10 · Score: 5, Insightful

... and now the tables have turned, and Microsoft is competing with Symantec. (Windows OneCare)

All of a sudden Symantec retaliates by deciding that Internet Explorer does indeed have more "critical" flaws than Mozilla Firefox does.

Re:If you want "browser" safe, go get Opera by whitehatlurker · 2006-03-12 05:41 · Score: 2, Interesting

Well, if you want to compare with numbers from a rival company:
Opera 8.x had 13 flaws, 3 highly severe, 0 extremely severe;
Firefox 1.x had 27 flaws, 7 highly severe, 1 extremely severe;
MS IE 6.x had 77 flaws, 22 highly severe, 11 extremely severe.
It's still not apples to apples. (Time periods aren't the same, etc.)

I think the more important thing to note: all of the Opera flaws (to date) are fixed, there are still 2 open in FireFox, and 23 open in MS IE 6.x.

--
.. paranoid crackpot leftover from the days of Amiga.

I can believe I am going to reply to this but... by Lightzout · 2006-03-12 07:08 · Score: 3, Interesting

This has to be the best troll ever. I feel like I am the moth, there is the flame, gonna die, cant turn back now, going in anyway! I think this is funny for two reasons. One symantec has no interest in securing anything but profits and secondly the fact that symantec could make the "news" by publicly admitting something so obvious to most saavy consumers is all the proof I need that the joke is me. Expect Symantec to announce its Firefox browser bundle soon.

Handgrenades? by gstovall · 2006-03-12 08:25 · Score: 3, Insightful

I understand, and by and large agree with, your thesis that humans are self-absorbed, self-interested beings. However, how would you interpret those individuals who have thrown themselves on handgrenades to save their platoon buddies from death? Death was virtually certain for these individuals, and there was some opportunity to escape from the situation with only minor or moderate injury, yet they chose to sacrifice themselves for their comrades. By the self-interest theory, it was an inappropriate decision, even if they considered the possibility of posthumus accolade, because they wouldn't be there to experience the reward.

Rather, I believe that people are able to rationally select a greater good, even if it brings personal harm. I'm not saying that most people actually do this on a regular basis, but the capability is there. On the other hand, I meet more and more people who meet the clinical definition of sociopaths, who truly are incapable of considering anything beyonds themselves, and they are scary people.

In other news, on-line music theft disappears by surfingmarmot · 2006-03-12 15:17 · Score: 2, Funny

"The key was vendor acknowledged critical vulnerabilities. Thus, if Microsoft (or the Mozilla Foundation) didn't agree it was critical, then it didn't get counted."

When asked if downloading music via P2P is 'stealing', respondents uniformly replied that it wasn't, so their downloads ceased being counted in MPAA music theft figures. The MPAA in a separate announcment stated it had no legal standing in curent cases and withdrew all complaints and charges against all music 'sharers'.

See we can use corporate logic too!

Slashdot Mirror

Symantec Rethinks Firefox vs IE Vulnerabilities

68 of 214 comments (clear)