Slashdot Mirror
Firefox Security Head Says Microsoft Obscures OS Holes
theranjan writes "When a Security Strategy Director at Microsoft decided to compare Internet Explorer security vulnerabilities with those of Mozilla Firefox, he may have forgotten that the Head Security Strategist of Mozilla was a former MS employee. In a rebuttal of the study, which finds IE more secure than Firefox, Mozilla said that the number of vulnerabilities publicly acknowledged was just a 'small subset' of all vulnerabilities fixed internally. The vulnerabilities found internally are fixed in service packs and major updates without public knowledge. 'For Microsoft this makes sense because these fixes get the benefit of a full test pass which is much more robust for a service pack or major release than it is for a security update. Unfortunately for Microsoft's users this means they have to wait sometimes a year or more to get the benefit of this work. That's a lot of time for an attacker to identify the same issue and exploit it to hurt users.'"
I mean come on, if they said they had no security holes, nobody would believe them. If they released too many security holes, their stock would go down. So they have to find a happy medium.
Game, Set, Match... well, I think that's that argument well and truly settled... Microsoft will never dare to use that FUD again...
Donald 'Duck' Dunn: We had a band powerful enough to turn goat piss into gasoline.
...that the study in question was done in collaboration with the Texas Department of Science Education. The department was called in when MS had concerns over the factual rigor that the test would be subjected to.
I got a catholic block.
It's just me, or microsoft report (pdf available in the article) just says "Firefox fixes more problems than we do, so that must mean their software has more errors". That just a piece of crap. That only means that Firefox makes their vulnerabilities public or, worse for MS, that Mozilla team fixes things while MS just keeps IE vulnerable. Counting bugs means nothing. It's the overall quality and how fast those critical bugs get fixed what counts. And IMHO firefox still has a nice edge over MS.
Microsoft have frequently used biased methods for "security comparisons"...
They have compared the published vulnerabilities between windows and various linux distributions, when the same applies as discussed in this article - issues found internally may or may not be fixed, but are not disclosed to the public.
Also many linux distributions typically include a massively larger set of packages than windows does, a distribution such as debian or gentoo supports more packages than microsoft do across their entire product line.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
I'm surprised that Snyder ignored a crucial argument in the PDF: that Microsoft supports their products for a lot longer than Firefox. He didn't rebut that point, which was actually pretty reasonable. I'd be interested to see what he has to say about that. In this regard, Microsoft seems far ahead of Mozilla.
XML is like violence. If it doesn't solve the problem, use more.
... what a bunch of OS-holes.
Accept it from vulnerability-scanning company Qualys then.
Study: 'Huge jump' in Microsoft flaws since last year"We have seen a huge jump in the vulnerabilities in Microsoft Office products," said Amol Sawate, manager of Qualys's vulnerability-management lab. "These charts show growth of nearly 300 percent from 2006 to 2007 http://news.zdnet.com/2424-9595_22-178018.html
"I've got more toys than Teruhisa Kitahara."
Firefox is spyware. At least according to Microsoft. http://img405.imageshack.us/my.php?image=msasmfph6.gif
Remove it immediately to prevent harm to your computer and protect your privacy!
Well, thanks to the Internet, I'm now bored with sex.
Prior to MS, there were several flavors of DOS, preventing different brands of computer from talking. There were 10 or so major players in the word processing market, preventing organizations from sharing documents from one sector to another, not to mention different companies. They, and other companies, ripped of visi-calc and the desk-top graphical user interface, but none were compatible with other brands.
MS came along and everyone could talk, and thanks to IBM, run the same programs on any brand of computer.
I think MS modeled itself after McDonald's. Want a good hamburger go to a good restaurant. Want a hamburger that will satisfy your hunger, taste ok at best, but most important, be exactly the same all over the world, go to McDonald's.
So basically I have to be running Windows to get the full use of security holes? Why can't my "Free" OS be like Windows?
"Prior to MS, there were several flavors of DOS, preventing different brands of computer from talking."
.txt mode. Formatting was for when you printed the document, not for just reading it as it has become today.
No, there wasnt prior to MS. The several flavours came about after MS started selling DOS. Most of the other flavours was much better than MS Dos. NCR Dos 3.2 was the best DOS version of them all because of all the bughunt NCR did on it. MS-DOS was a dead dog in comparison, funny thing was all MS apps ran much better on other DOS versions than their own. Hence the need for artificially make win not work on any other DOS than MS-Dos wich sucked big from day one up until it was dropped.
Sharing documents was no problem, anything external was sent in
MS came along and anyone who had MS-DOS, Microsoft Word (the same version as the one communicating with had) could communicate. Thats not an improvement, its just a defacto standard.
Its a big insult to McDonalds to compare them with Microsoft. Should McDonalds be anything like MS i wouldnt dare to eat there ever. Actually McDonalds has very strict Q&A and an extremely well functioning organization.
HTTP/1.1 400
Central to any theory of efficient markets is the assumption that both consumers and producers can make informed decisions free of coercion. If the consumers do not have information, they cannot make an informed decision. Companies are not generally obliged to share all information about their products, but they are prohibited from intentionally deceiving customers. Cigarette makers were not sued because cigarettes cause cancers, but because they had determined internally that cigarettes caused cancers and they then made claims to the contrary. That is, they intentionally deceived both the consumer and the regularly agencies.
By analogy, Microsoft can say 'we build secure software' all day long. But if they claim, 'we develop more secure software than our competitors' they open themselves up for liability IF it is determined that they are making claims that they know to be false. In this case this seems to be hypothetical. But it is a testable hypothesis. And after reading the internal memos made public in Combs v. Microsoft, it is a quite plausible hypothesis.
Think global, act loco
The only solution is a truly free market economy without the FED and other allied stupidity.
Yes, as long as it is the Adam Smith variety of free market. Once you get monopolies, the invisible hand goes *poof* and you no longer have a free market.
I personally believe we could throw out 999 out of 1000 laws and regulations and have a happier healthier economy and society. For instance, I would throw out all business licenses and the associated regulation, such as health inspections for restaurants; that's how much I distrust regulation and how it distorts the free market.
But monopolies are just as bad on the business side as they are on the government side, and there has to be some way to prevent them and break them up. Rather than have a government monopoly to break up business monopolies, I would have some way for citizen lawsuits to do the trick. You have to prevent market domination via rackets like those practiced by Microsoft, or the old AT&T, Standard Oil, etc., or you no longer have a free market.
Infuriate left and right
How are we supposed to keep this all straight? Either the mods are on crack or the mods are geniuses of sardonic delayed humor or the mods... oh wait, I've got mod points!! d'oh!
man, I feel like mold.