Slashdot Mirror
Mozilla Launches Security Metrics Project
Earthweb passes along a ZDNet article which notes,
"In partnership with indie security consultant Rich Mogull, Mozilla has launched a valuable Security Metrics Project that — we can only hope — could help to put an end to the silly notion that patch-counting helps to determine a product's security posture. The idea is to develop a metrics model that goes beyond simple bug counts to reflect accurately the effectiveness of secure development efforts and the relative risk to users over time. Mogull has released a spreadsheet (.xls) with a preliminary version of the model and Mozilla's Window Snyder is actively seeking feedback to make the project open and meaningful."
Where's the fix for the suspiciously-timed Firefox 3 (and 2) code execution bug? That would boost security.
Looks like they're depending a lot on feedback. From paid consultants?
I wish they'd pick a different name. Everytime I look at it, I think of Security Metrics (one of the we'll run Nessus against your site for a fee providers).
If Mozilla is so committed to open standards, then why didn't they ask Mogull to publish an ODF version of the spreadsheet, even if only alongside the Microsoft Office binary file?
So, we don't like the current stats because they make us look bad; so lets try to create a new "standard" which will make us look better? A standard that can only really be applied to open source, because you can't see the bug count in closed source?
Wow. That really smells.
Ok i agree that patch counting is maybe not the best way to evaluate the security of software but gives an idea. What does this means? That hey can't keep it low and are seeking alternatives ways to measure and keep the "We are safe slogan"? Yes that's why I stopped from using it since quite a while. Ahh and wasn't at risk during the download day. Jesus they continued with the "download day" even knowing that they had a vulnerability in the browser within hours. That means to me that in order to break the Guiness they are willing to put in risk their users. Yes well you got your record but it has a cost and it costed the security of users. I would have stopped. Good luck Fox and to your users. I'll see you again when you begin to write software and not furniture. Since you became big you are a little microsoft copy. Maybe their cakes are contagious :P Ahh and remember to cache better, you fail to cache with chunked transfer encoding even big stuff. Remember that you are making the web slower with that and that is not only affecting your users but others that decide to use better browsers or some of us that have to pay for the bandwidth sucking your thing is doing. Hey servers bandwidth costs. Remember that when you write a line of code.
The silence from the Mozilla project is deafening. That tells us what they really think about security in a way that no Mozilla public relations exercise will ever be able to fix.
'open' will be a very important condition.
Hackers have long memories. It works both ways.
Noted Inventor Benjamin Franklyn was once asked how best to rank 2 products. The response went something like, "Create a column of the all benefits of both products. For each product, attach another column. Go through the list and place a check mark in the corresponding box. The product with most checks is the better product."
I can see where applying this to Safari, Opera, and IE, would be a good thing. But I also think that making it public would start a trend that would be very constructive from a users point of view. Other browsers are known for being products that set themselves apart from the IE folks. This "matrix" looks to be like a simple spread sheet. It should not be hard to apply any Browser to it in the future. It will be interesting when in August, IE 6,7, and 8 could be added to this matrix. From my point of view, it is a great way to show "Pride In Craftsmanship".
Just because its Microsoft everyone cries like little babies. Hello everyone, Open Office/Star Office reads XLS files so whats the dam problem? Is there a reason it needs to be 'open format'? I bet $100 if It was released as PDF no one would say anything. Typical /. childish behavior.
Get a life!