IE6 Was Unsafe 284 Days In 2006

An anonymous reader sends us to the Washington Post's Security Fix blog, where Brian Krebs has toted up the total vulnerability days for IE6 users in 2006. From the article: "For a total 284 days in 2006 (or more than nine months out of the year), exploit code for known, unpatched critical flaws in pre-IE7 versions of the browser was publicly available on the Internet. Likewise, there were at least 98 days last year in which no software fixes from Microsoft were available to fix IE flaws that criminals were actively using to steal personal and financial data from users... In contrast, Internet Explorer's closest competitor in terms of market share — Mozilla's Firefox browser — experienced a single period lasting just nine days last year in which exploit code for a serious security hole was posted online before Mozilla shipped a patch to remedy the problem."

Comments

I hope stuff like this makes the paper

[RiotXIX]

Then it might affect people who don't already know it.

Re:I hope stuff like this makes the paper

[solevita]

Well, it might make it, but only if the Foundation pays for another full page advert. Let's face it, this story won't really be counted as news in less computer-orientated places - the main stream press.

You can, of course, help however. Email this story to your friends and family. Of course, the story itself still probably won't interest people, but you can make it interesting: Your friends credit card details are at risk for using IE. Importantly, there are alternatives to IE.

Re:I hope stuff like this makes the paper

[Duds]

They won't do that because since there are unpatched critical flaws dating back to 2004 in Firefoix, it would be a simple matter to point out that FF was unsafe for a full 365 days. I expect that to rise to 366 by 2008.

Hazards of monoculture

[Kelson]

Consider that this would be less of an issue if IE weren't used by 70-90% (depending on where you look) of web surfers. Most-used and least-secure is a disastrous combination. This is why alternatives are important. If the space broke down at, say, 30% IE, 30% Gecko, 15% Safari, 15% Opera and 10% random, malware authors would have to go to a lot more effort to exploit the majority.

Re:Hazards of monoculture

[benhaha]

Where is the -10 humour impared moderation option when you need it?

Nothing to see here...

[Thansal]

you know the drill.

My bet is that the number that COUNTS is probably larger (also larger for FF), the number of days where there was a vulnerability that was known by malicious groups, just not publicly posted.

Re:Nothing to see here...

[UnknowingFool]

My bet is that the number that COUNTS is probably larger (also larger for FF), the number of days where there was a vulnerability that was known by malicious groups, just not publicly posted.

True, but this only makes Firefox look better. For the most part, vulnerabilities in open source are generally publicly disclosed in forums and the like. The details of the exploit usually remain secret. Who knows how many IE security bugs MS is not disclosing or acknowledging.

Re:Nothing to see here...

[Thansal]

Hey I got modded troll, nifty!

What I was actualy reffering to would be the knowledge in the hands of those that want to use it for evil (or atleast naughty) purposes.

Ok, so MS takes for ever to patch, we know this.

FF patches relatively quickly, we know this again.

But how long were vulnerabilities actualy LIVE (as in some one was tryign to exploit them) in the wild? That is much more interestign to me, everythign else is just sorta old hat.

Re:Nothing to see here...

[misleb]

Indeed, it is pretty safe to assume that malicious groups either know about exploits BEFORE they are publicly posted or they know about exploits that the vendor doesn't. I mean, there is no reason to believe that only the "good guys" are discovering flaws. If I were a Black Hat, I wouldn't publicly release the exploits I knew about. I would try to keep them underground as long as possible so as to maximize their useful life.

-matthew

Re:Nothing to see here...

[T-Ranger]

They live in the wild for as long as the product has been shipping, of course. Unfortunately, thats not a useful number. Products ship with bugs, known and unknown to their developers. A "secure" product may eventually become "insecure" because new techniques were developed. (Yes, differing companies/groups have different methodologies/standards/reputations for producing and shipping secure products, but thats a separate discussion all together)

A theoretically useful number would be the number of days from when an exploit was exploited until it was patched, except we would never know this first number. Sure, we may eventually track down through legal means when a petty criminal first used an exploit. But the real worry isn't the punks skimming for CC numbers, its the foreign powers, corporate espionage, SPECTRE agents and the like. And they get away with it without it ever being public. So you just can't get this number.

The only two possible numbers that we ("we" being "the good guys", or at least "the general public") can reasonably come up are the number of days that publicly-known problems are unresolved, and the number of days before a vendor is notified of a problem, before it is resolved. The later would be hard, if possible at all, to get with any level of reliability and consistency. "When were we notified? When the message was sent? When our systems received it? When our lawyers reviewed it? When a developer reviewed it? When the CAB came out with a recommendation?"

The only date measuring the beginning-of-badness that can be developed independently, and consistently, is the date of public notification.

Re:Nothing to see here...

[99BottlesOfBeerInMyF]

Who knows how many IE security bugs MS is not disclosing or acknowledging.

According to anecdotes from former MS employees, about 50-60% of all bugs with security implications are prioritized such that they are never announced publicly or fixed (across the company, not IE specific). Since they don't announce most of the ones they fix internally either, I'm guessing they have a ratio similar to most companies where you have about 1 publicly discovered bug for every 20 found internally. I'm guessing that means they were and probably still are vulnerable to at least one of them pretty much every day.

all a matter of perspective

[macadamia_harold]

IE6 Was Unsafe 284 Days In 2006

Of course the flip side of this story is that IE6 was safe for 81 days in 2006.

Obviously, the solution is to shorten the year to 81 days.

Re:all a matter of perspective

[endianx]

Maybe they meant 284 business days?

Re:all a matter of perspective

[LoudMusic]

IE6 Was Unsafe 284 Days In 2006

Of course the flip side of this story is that IE6 was safe for 81 days in 2006.

Obviously, the solution is to shorten the year to 81 days. Or only use IE during those 81 days. Use Firefox the rest of the time. Or all of the time - whichever makes you happy.

Re:all a matter of perspective

[peeg]

Hey now, that's almost 3 months of safety. That's like a record for IE.

Re:all a matter of perspective

[brsmith4]

There's a flip side: Yes, IE would be secure for a year, but be insecure for over two consecutive years. I doubt the marketing group would approve such a strategy.

There are three main factors for this

[Toreo asesino]

1. IE != OpenSource - many eyes are better than few for finding & fixing defects.

2. Desktop integration - across Windows 98, ME, 2000, XP and to a lesser extent Vista.

3. Application integration - there are tonnes of apps writen either embedded in IE, or using IE as a view-port to data, screens, etc.

All of the above (and more) make IE6 a bitch to keep updated quickly and easily. Breaking not just a browser, but OS shell, and tied-apps with a dodgy patch isn't an option for Microsoft and they know it (despite the odd rogue update that slips through the net).

Re:There are three main factors for this

[HappySqurriel]

In my opinion, one of the biggest problems Microsoft faces is that web-page structure and syntax is not handled the same way a C++ program's structure and sytax are (as an example); you can make hundreds of syntax and structural mistakes in HTML, CSS and Javascript and IE will still attempt to display your page. I could be wrong, but I heard a couple of years ago that the majority of code in web browsers was not dealing with displaying correct HTML but was dealing with correcting mistakes to display a page. If IE could simply not display incorrect HTML and CSS the code base should be far smaller, which in turn should make it easier to maintain and probably more secure.

Re:There are three main factors for this

[CastrTroy]

Yes, but then 99.9% of the pages on the internet would not display at all. That sure is one way to get everyone to switch to firefox, have IE stop displaying all the pages. People have become used to being able to put up any old slop and having the browser struggle through displaying it. You can't just expect people to go and recode all their webpages so that they don't have invalid HTML in there. The other thing is that most of the bugs are due to Javascript or ActiveX, and have nothing to do with non-standard coding but how the code that is written, according to spec is handled. Granted, They would have more time to work on security bugs if they didn't have to figure out how to read mangled webpages, but they can't just stop reading mangled pages.

Re:There are three main factors for this

[99BottlesOfBeerInMyF]

I think you're missing the main cause. Sure open source apps get more people reviewing them, but there are plenty of fairly secure closed source apps. The real problem is motivation. Microsoft has a monopoly on the desktop. Pretty much everyone buys Windows. When they buy Windows, some of that money pays IE developers. If a user decides to use Windows+Firefox, Microsoft does not lose any money. What is their motivation to make IE secure?

So long as MS is allowed to bundle products with and tie them to their Windows desktop OS, consumers in other markets like Web browsing, media players, servers, etc. will take it up the butt. This is exactly how anticompetitive abuse hurts consumers and the industry. If you want a secure IE or just secure Web browsers in general there is one simple step. Get the courts to enforce the law and stop MS from bundling it with Windows. Then, if they want to control the market for Web browsers they will have to compete, based upon quality. As a result they will improve quality and solve their security problems.

Re:There are three main factors for this

[arifirefox]

how would people download firefox from the internet without IE with Windows? Firefox is good. people know about it and are downloading it. I don't think we have to tell Microsoft what to do in order to give firefox a chance.

Re:There are three main factors for this

[dennypayne]

You can't just expect people to go and recode all their webpages so that they don't have invalid HTML in there. Why not? Why do we always reward mediocrity? Denny

Re:There are three main factors for this

[99BottlesOfBeerInMyF]

how would people download firefox from the internet without IE with Windows?

They would use whatever browser was included by the OEM that sold them their computer, which may very well already be Firefox. The law forbids MS to bundle or tie Windows to IE, not other companies from selling Windows+some browser+some hardware.

Firefox is good. people know about it and are downloading it.

Firefox has been better for 5 years, easily, and still it has under 25% of the market. People aren't downloading it. More importantly, Web developers don't know if a user will have Firefox but they do know a user will have IE, so instead of developing to standards they develop to IE and maybe to standards as well, resulting in the entire Web being used as a proprietary lock-in.

I don't think we have to tell Microsoft what to do in order to give firefox a chance.

When a free product, which is obviously superior to its competitor can remain vastly superior for years and still not take more than a small fraction of the market, what hope is there? The market is broken and needs to be returned to a free and open market, where the innovation brought by capitalism can again apply. It is pretty basic economics.

Re:There are three main factors for this

[arifirefox]

Firefox is making great progress. It's the browser of choice among the most web savvy, the blogosphere. And they are 90% Windows users. But Firefox's accepted superiority is just too recent to worry about its acceptance. Firefox 1.0 came out Nov 2004. Only a few years old.
IE achieved domination vs Netscape which was showing its age. Even most netscape loyalists agreed that netscape couldn't compete on technical merit. Mozilla Suite was too bloated, especially for those who used another email app.

Re:There are three main factors for this

[m50d]

how would people download firefox from the internet without IE with Windows?

With ftp.exe.

It's possible. I've done it when fixing really horribly spyware-infested systems.

Re:There are three main factors for this

[mstone]

Are you volunteering?

Why does "somebody should do something about this" always seem to mean "somebody not me"?

Re:There are three main factors for this

[dennypayne]

Sure, I'd volunteer to recode my webpage if it didn't display in a browser due to mediocre code. In fact I'd say my code probably is pretty sloppy, but I'm able to get away with it because the browser will still display the page. Why do I have to volunteer to do everyone else's?

You missed my point though. The OP basically said "you can't expect people to code correctly" and my response is an observation that our society in general seems to be trending to allow that mentality of pandering to the lowest common denominator. I think it is harmful to do that. If something is worth doing, it's worth doing right.

Denny

That's nothing

[hellfire]

My truck was unsafe 365 days. I could have been in an accident on any one of those days!

Re:That's nothing

[jbeaupre]

Loose nut behind the wheel?

This is why I used SetSAFER

[reh187]

Nothing like a quick Software Restriction Policy to "disallow" the use of IE :-)

I also have to admit, that since FireFox 2.0, I can trictly tell my browser which to sites to masquerade as IE.

Quite handy if I do say so myself...

Re:This is why I used SetSAFER

[TwoScoopsOfPig]

Opera's had this feature for quite awhile, with a combobox even! Select the site from the list or browse to it, Open the page properties, and set it to Opera/IE/FF and be done with it.

Re:This is why I used SetSAFER

[the dark hero]

I also have to admit, that since FireFox 2.0, I can trictly tell my browser which to sites to masquerade as IE.

Quite handy if I do say so myself...

i have to agree. some websites just dont function properly using firefox. a few people just dont bother testing the websites for multiple browsers.

Re:This is why I used SetSAFER

[geoffspear]

If they don't funciton properly using Firefox, how is changing what useragent Firefox claims to be going to have an effect?

If the sites actually do function just fine in Firefox but refuse to do so unless you trick them, you should probably notify the site's administrators or stop using the damn site.

Re:This is why I used SetSAFER

[Dunbal]

Can anyone state just 1 or more solid example(s) that would hold up in a court of law or just pass muster as police evidence and not hearsay?
Verifiable things like :
    names dates method of assasination,places ,unit names .
    Proof to positively show that this so called US Army caused it?
I don't particularly like US Army but I don't like anyone getting a bad rap for some hearsay stuff

      You know, civilians are being killed in Iraq too, right? Just proving a point.

      It's damned obvious that unpatched windows boxes are pwned within seconds of being connected to the internet. It's also obvious that security flaws in explorer, outlook, etc are exploited regularly, and have been for the past 10 years. I myself have had infections, trojans, dialers, spyware, etc. I don't anymore because I am more careful, and don't use explorer. At least I _think_ I don't (and that's the scary part).

      Which rock have you been hiding under all this time?

Re:This is why I used SetSAFER

[whitehatlurker]

And with a certain userscript you can even mimic some of the internals of the other browsers.

However, I'm finding that fewer sites seem to require me to do this. Things are improving on the W.W.W. for browsers. (Not just Opera, but it's nice that it's included as well.)

What does this mean?

[__aaclcg7560]

If IE6 was unsafe for nine months out of the year, what did it give birth to? Inquiring minds want to know...

Re:What does this mean?

[Aqua_boy17]

So THAT's where the Zune came from.

Re:What does this mean?

[Jarn_Firebrand]

IE7

Re:What does this mean?

[tokul]

If IE6 was unsafe for nine months out of the year, what did it give birth to? Inquiring minds want to know...

1. Botnets
2. Penny stock scams
3. Extra work hours for system admins that have to clean hosed system

Re:What does this mean?

[ozmanjusri]

So THAT's where the Zune came from.

Judging by the colour of the Zune - no, but close.

Re:I wonder

[ninja_assault_kitten]

Are you basing that on anything scientific? No. Just an uninformed opinion.

Moo

[Chacham]

For a total 284 days in 2006 (or more than nine months out of the year)

Yep, it took them nine months to get that baby.

Re:Imagine that..

[ubergenius]

While normally I'd agree with you, the article is from the Washington Post, and is very well supported. Not to mention that there is little "bashing" and much more statistical support.

I am by no means a Microsoft hater. I use many of their products (specifically Windows and Office) because they are simply better than the alternatives, even the free ones. However, I am also not a Microsoft zealot, and realize the company has it's flaws (not talking about business practices, just software) and IE is one of them. I have been with Firefox for several years now, and while that is not perfect either, it is far superior to IE. That isn't intended to be MS bashing, just the cold, hard truth.

Re:I wonder

[Anonymous Coward]

Are you basing that on anything scientific? No. Just an uninformed opinion.

Welcome to Slashdot. Try the ramen.

284?

[endianx]

Were there only 284 days in 2006? http://developers.slashdot.org/article.pl?sid=06/1 2/21/1836240/

Re:284?

[endianx]

Sorry. Just grabbed it from the location bar. Assumed it would work.

You know what happens when you assume?

This article is absurd

[acidrain]

I wonder what windows would add up too

IE and windows are really one big insecurity mash-up that is hard to see individually. Remember the Netscrape lawsuit over bundling IE? When M$ was arguing in court that taking something as insecure as a web browser and tightly integrating it into something that is supposed to be secure like an OS was required for their continued innovation.

Anyway, I think this is absurd. IE6 had a patch available. It was IE7. M$ released IE7 as a "high priority security update" via their built in update process. In the same way that the patch for Firefox was distributed as a later version of the browser through their built in update process. I fail to see the difference. I can see this ending up on slashdot, but the Washington Post really should know better.

The washington Post should know better. As

Re:This article is absurd

[acidrain]

Hmm, forget I posted that. I'm a Firefox user, and thought IE7 was out longer seeing as they started talking about it a year and a half ago.

Re:This article is absurd

[bluefoxlucid]

Amusingly, KDE takes something like a Web browser (Konqueror) and uses it to supply a desktop, file manager, and Web browser. Sound familiar?

Re:This article is absurd

[Bertie]

Completely different approach, though. It's not "integrated into the OS" as such, it's just a wrapper for other functionality which it calls upon as and when necessary. The effect is very similar from where the user's sitting, but underneath there's a clear separation between it and the components it provides an outlet for. Personally I think it's rather elegant.

Re:This article is absurd

[yagisencho]

I agree that the smart move for people satisfied with IE would be to move to IE7. I note with satisfaction though that my WinXP system hasn't suffered a single piece of malware since installing SP2.

Re:This article is absurd

[jrwr00]

my win98se box still has had no malware since i installed it, i use it as a BNC/Web Dev server

Re:This article is absurd

[BenoitRen]

In the same way that the patch for Firefox was distributed as a later version of the browser through their built in update process.

Those small security updates aren't really new versions.

Re:This article is absurd

[finity]

From what I've seen, IE wasn't all -that- integrated into the OS. The part of Windows that makes it Windows is pretty much what you see on top of it all, so from that standpoint, Windows is not much without IE. You can put on other things like Lightstep and Firefox to replace most of the functionality Explorer provided, but then the computer is hard to recognize as "Windows."

Re:This article is absurd

[jacksonj04]

Depends on the version of windows.

the 9x/ME series were relatively easy to belt about and replace bits. NT/2K/XP/Vista have the 'Windows' part much more closely tied into the basic operation of the system (In place of DOS), so although you can change the GUI and browser (Although completely eradicating IE is nigh on impossible) it is still very much visible as Windows after only a few minutes of use.

Re:This article is absurd

[aztracker1]

The fact is, the browser (IE) isn't tied into the desktop any more than Konqueror is tied into KDE... and yes, I think it is usefull... I think MS's biggest flaw is some of the security context rules in place. Which go beyond the browser itself.

Out of how many?

[OpenSourced]

Out of how many? Uh?

For IE?

[Anonymous Coward]

> But how long were vulnerabilities actually LIVE (as in some one was trying to exploit them) in the wild? That is much more interesting to me, everything else is just sorta old hat.

Most likely 365 days out of the year.

This was based on published exploit data only, not private exploits. The people that use those like to keep them quiet so that they remain useful for a longer period of time.

Re:Firefox... never safe in 2006?

[endianx]

Therefore, only applications using the Apple Java plugin is affected by this vulnerability.

Dealing with broken code

[Kelson]

If IE could simply not display incorrect HTML and CSS the code base should be far smaller, which in turn should make it easier to maintain and probably more secure.

True. Unfortunately, we've got a decade and a half worth of web pages that were built sloppily. Not all of them, but enough to be an issue, especially since many of them are effectively abandoned and don't have anyone to fix the errors. If it had been designed that way from the beginning, it would be feasible, but there's all that legacy data to deal with. Any HTML browser designed to run on the web, and not just on, say a local set of help pages, has to do something with those pages. Dave Hyatt (of Safari fame) made some interesting comments on the issue when discussing XML error handling in browsers -- basically, learning from the consequences of that decision to tolerate HTML errors without specifying how to recover from them.

Things are a bit better with CSS, as there are explicit rules for how to handle broken code (basically, ignore it and skip to the next line). The bigger problem there is handling code that was written to older, broken implementations -- the IE5 box model, for instance -- and trying to determine whether a page was built for the spec or for the broken implementation. This gets into quirks mode, and doctype sniffing, and things get kind of hairy.

(Then there's the fact that HTML and CSS are both designed with extensibility in mind... any unfamiliar tags or attributes in HTML are supposed to be ignored, so an HTML 3.2 browser can still do something useful with an HTML 4.0 page. But that's a slightly different issue.)

Lobbyist hat on

[greymond]

At MS it is our commitment to better our security on all our applications. In 2006 we spent over 284 days researching and developing a series of bug fixes for our IE product line. This gave us over 98 days where IE was impenetrable to attackers and didn't require the need for any patches. Mozilla would like to claim that there product is safer than ours, yet they admit themselves that they had a period of 9 days where their browser was highly vulnerable to hackers and exploits. IE offers a web experience unsurpassed by any other browsers, compatible with every major website online today. If you choose to use an alternative browser it will still have flaws, but MS Windows allows you to choose, and having choices is what MS is all about. Would you really not want to have a choice in web browsers? Would you really want to only have Firefox and that be the end all be all to browsers? People need to have a choice, that's part of why this great country of America was founded.

Re:Lobbyist hat on

[NTT]

Brilliant.

You should work for their PR firm.

Re:Show me the code

[Ricwot]

You amaze me, years are 365 days each, sometimes more.

I'M A WINDOWS GUY

[eno2001]

I use IE for everything and I've never once been hacked by these supposed security holes. I do all kinds of stuff like online banking, eTrade, eBay, online shopping, the works! And it's totally secure because it's all encrypted. Sure, I've had something like $24,000 worth of charges applied to my credit cards that weren't mine, but that wasn't because of IE. That was because I made the mistake of dealing with a few companies that use Linux or some Unix variant (heh, sounds like a disease we're talking about here instead of an OS) for their web portals and they probably got rooted. Open source software is just not safe. The hackers are all over it since it's all out in the open. Once they get a chance to look at how it works, they can easily make it do their bidding. At least Microsoft has the sense to keep stuff private. NO hackers in the entire world could figure any of that stuff out because there just isn't any single person as smart as Bill Gates and his crack team of developers. I wouldn't touch Firefox with a ten foot pole since it's open source. Although they only report the bugs they think they've found, there are probably billions more than MS has in IE because the hackers have a roadmap with open source. It says, "Here's the keys to the kingdom. Come hack me". I Trust MS products because MS is all about making great, innovative software that is secure and robust and stable.

NOTE: The above post is merely a parody of the Windows user who's "got religion". A reasonable Windows user knows better. A reasonable *nix user knows better. Let the games begin...

Re:I'M A WINDOWS GUY

[cyber-vandal]

The idea is you post it without the disclaimer and laugh at all the flames ;-)

Re:I'M A WINDOWS GUY

[Abcd1234]

You mean troll?

Re:I'M A WINDOWS GUY

[PieSquared]

Ah but you forget: karma is *not* like golf - getting marked troll and flamebait (as it turns out) is *not* the objective. Boy was I doing this wrong.

Of course, there is still "that guy" who always seems to find my posts first and give them "-1 overrated" before I get any positive mods... I have yet to find him and tell him about this recent revelation.

(And now of course comes the inevitable internal debate - post anonymously and (possibly) save karma or stop being a coward actually make use of positive karma.)

Re:Show me the code

[jonfelder]

I don't get it. You can't be this clueless, so it must be a joke. Could someone explain it to me?

No IE 7 for Windows 2000

[tepples]

Anyway, I think this is absurd. IE6 had a patch available. It was IE7

Replacing Microsoft Internet Explorer 6 Service Pack 1 with Windows Internet Explorer 7 requires replacing Microsoft Windows 2000 Professional with Microsoft Windows XP Professional. Not all users of Windows 2000 want to pay for the patch. Mozilla, on the other hand, plans to continue to make its products compatible with Windows 2000 even through the 3.0 series.

Lies, damn lies and statistics

[Luke O'Connell]

Hmm... all hail the Washington Post for very neutral reporting on this one. Although I am BY NO MEANS a defender of Microsoft I feel we have to put this in perspective. How much market share does Microsoft hold vz Mozilla? I would imagine that the people trying to find security exploits are for the most part looking at Internet Explorer... not only does it still hugely command market share, but it's also the choice for less savvy users. A little like a virus comparison between say Macs and PCs... its all a matter of statistics.

Re:Lies, damn lies and statistics

[oggiejnr]

"Statistics are like a ventriloquists dummy. If you stick your hand up it you can make them say whatever you want but the results are only suitable for children and journalists." -- BBC Radio 4, The Department

Re:Lies, damn lies and statistics

[BenoitRen]

Market share is not an issue here. It's M$ not patching known exploits quickly enough, which Mozilla does do quickly.

Re:Lies, damn lies and statistics

[Luke O'Connell]

Hmm... seem to be missing the point. If you look at individual issues and measure response time, I think you would find that about one week is an average response time per vulnerability for Microsoft. Mozilla's response time? 9 days... so about the same.

Re:Lies, damn lies and statistics

[Luke O'Connell]

Okay okay... a little quick off the mark maybe. Taking a look, I can see that on average Microsoft took 41.2 days per vulnerability (26 per critical vulnerability). The IE team did have to patch 12 vulnerabilities last year though, to Mozilla's one. My point still stands though, the bigger you are, the more of a target you become. Granted, Microsoft's response time IS unacceptable...

Re:Lies, damn lies and statistics

[Luke O'Connell]

... Okay okay... a little quick off the mark maybe. Taking a look, I can see that on average Microsoft took 41.2 days per vulnerability (26 per critical vulnerability). The IE team did have to patch 12 vulnerabilities last year though, to Mozilla's one. My point still stands though, the bigger you are, the more of a target you become. Granted, Microsoft's response time IS unacceptable......

Re:Lies, damn lies and statistics

[BenoitRen]

This article is about vulnerabilities with known exploits. If you look at the vulnerabilities that Mozilla had to fix as a whole, you'll find many more than just one.

Re:Lies, damn lies and statistics

[Luke O'Connell]

Actually the Washington Post article is based on raw data entitled 'Internet Explorer Vulnerabilities in 2006' and contains both known vulnerabilities and exploited vulnerabilities.

Let's not forget...

[Dracos]

That TFA can only document "safe" status regarding known vulnerabilities for IE or real browsers.

Someone needs to report that IE (6 and 7) has had craptastic standards support for 2195 days of this century (as of 4 Jan 2007).

Thanks for the money, folks

[spywhere]

I made thousands of dollars -- more than half my company's gross revenue -- cleaning up spyware in 2006. A lot of it, probably 30% or 40%, was on fully patched machines with current anti-virus software. Almost every time I read about exploit code becoming available for a zero-day vulnerability, my phone starts to ring.
I have one customer who gets hit three or four times a year. Each time, I get $75 to $150 for booting his system to Windows PE and cleaning off the pests. He's running McAfee Enterprise 8.0i (from his job) with all the "Unwanted Programs Policy" settings maxed out, and he still gets hit, and I still get paid. (I think it may be due to his Web surfing habits, but I don't ask and he doesn't tell).

If Microsoft ever delivers a really secure OS and browser, I may need to go get a job... after all the XP machines die off, that is. Since I still see Windows 98 and ME boxes running (some plugged directly into Comcast cable modems), I suspect that will be a few years yet.

Re:Thanks for the money, folks

[aztracker1]

The irony, with a browser besides IE, and windows networking disabled, win9x/me is probably safer than a stock 2000 or xp (pre sp2)

Only 284?

[tommyj1986]

I thought it was in the 360 range.

As Long As IE Runs ActiveX

[Master of Transhuman]

it's unsafe.

Which means it was unsafe for the last 365 days of last year.

I just did another five hour spyware cleaning last night (which still isn't complete). A fifteen-year-old kid managed to bring a Dell PC to its knees over just a few days of browsing the wrong sites.

The kid was visiting the client. The kid has an Apple at home - so he didn't know what he was doing was death to Windows...:-)

Re:So?

[Zonnald]

Try this.

Assuming firefox (2.0.0.1) is open, you are reading this post.
Check memory consumption (windows XP, currently FF consuming 37Mb)
Cntl-click on reply to this 21 times (giving 22 open tabs, 57Mb)
Open each tab, scroll on page.
Close each of 21 tabs (leaving 2, 45mb)
repeat (52mb)
repeat (58mb)
repeat (60mb)
Now I couldn't claim this as somehow exploitable, but it does highlight the behavior during browsing does have an effect on the memory usage. Especially when even a quality product has a memory leak.

Hazards of Non Free.

[Erris]

If the market was free, there would be no monoculture and IE share would be close to 0%. A market for lemons would assure some people would always use IE, but most people would chose the obviously superior offerings. That IE continues to enjoy significant market share is a good indicator of continued anti-competitive practices: threats to vendors, abuse of data formats, hostility to user preference and other abuse.

The real sting is that Microsoft continues to enjoy an OS majority share. They won't for long.

Comes as no surprise

[cppgenius]

The real surprise was that there actually days when the browser was safe. I would like to see what the stats on IE7 will be at the end of 2007 http://www.cybertopcops.com/

The news states wrong.

[vear]

The author must have forgotten that 2006 was 365 days long, not 284.

Duh.

[spywhere]

It's not my system, Anonymous Coward, it's his. I didn't build it, sell it to him, or install it. He does what he wants with it; I am paid only to fix it and make recommendations.
You must be an idiot, if you don't understand that.

Worth noting...

[petrus4]

Mozilla's Firefox browser -- experienced a single period lasting just nine days last year in which exploit code for a serious security hole was posted online before Mozilla shipped a patch to remedy the problem."

It's worth noting that I'm betting that nine days was only how long it took for Mozilla to ship the "official" patch to "official" places...I'll bet a number of distros had downstream patches available (at least for submission) within 24 hours.

For anyone doubting ESR's written claim about FOSS's superior ability to squash bugs, you only need to take note of examples like this to know that he was right. Given enough eyeballs, all bugs are indeed shallow.

*Dodges tomatoes headed in my direction with cries of "slavish, unquestioning fanboy!"* ;)

Re:Blame the NSCA, not Bill.

[dtfinch]

Spyglass wrote it. Spyglass licensed Mosaic from the NCSA, but Spyglass Mosaic was a from-scratch implementation. Spyglass then licensed their from-scratch implementation to Microsoft for a percentage of direct sales, which turned out to be a very unfair deal, since IE was never sold.

Re:So?

[nyet]

Its called a "cache"

Get the "CacheStatus" extension, and you can manage how much cache you want FF to use.

Guess what folks

[bberens]

Guess what folks! Connecting your computer to the internet was unsafe 365 days last year!

Firefox has zero-day vulnerability too

[Killer Koala]

Check this out: http://news.com.com/Hackers+claim+zero-day+flaw+in +Firefox/2100-1002_3-6121608.html I love this quote too: "The hackers claim they know of about 30 unpatched Firefox flaws. They don't plan to disclose them, instead holding onto the bugs."

Re:Nobody Gives a Rat's Ass

[skidoo2]

Flamebait? Predictable. Pfftph. LMAO @ koh for making me his virtual foe.

Phew!!!!!!!!!

[Viceroy Potatohead]

Thank god it wasn't a leap year!