Slashdot Mirror
Experts Say To Switch Browsers In Light of IE Vulnerability
It appears that the exploit in IE briefly mentioned a few days ago is causing a serious reaction: SteveAU writes "Microsoft has begun flooding media outlets with information advising users to switch to an alternate browser while a serious security flaw is being patched. The flaw, which affects all versions of Microsoft Internet Explorer, is manifested via malware and has infected over 6,000 sites thus far. Microsoft states: 'The vulnerability exists as an invalid pointer reference in the data-binding function of Internet Explorer. When data binding is enabled (which is the default state), it is possible under certain conditions for an object to be released without updating the array length, leaving the potential to access the deleted object's memory space. This can cause Internet Explorer to exit unexpectedly, in a state that is exploitable.'" According to the BBC report, though, Microsoft itself is only asking that users be "vigilant while it investigated and prepared an emergency patch"; it's outside experts who say to dump IE (at least for now).
Update: 12/16 21:11 GMT by KD : Microsoft will issue an emergency critical update for IE tomorrow.
Update: 12/16 21:11 GMT by KD : Microsoft will issue an emergency critical update for IE tomorrow.
Water still wet.
Pope still Catholic.
...probably won't. Most uneducated users that read the article will probably be of the mindset "oh, it won't happen to me".
The only way to open iexplore.exe in my home computers is through the "run" tab. This is to prevent unfit users from not using one of the other browsae. I seldom format & install windows now, unlike before I took that measure.
The cost of that cleanup, of course, will be borne by taxpayers, not industry.
Just start over. The thing's a chunk of crap that doesn't render stuff properly and must be a nightmare to maintain.
Pick another rendering engine - WebKit or Gecko - and build a browser around it. Maybe provide IE classic for those poor schmucks who are at jobs with crappily coded intranet apps full of client side VBScript, but don't make it the default.
I used to spend all day on Slashdot and now I only check it occasionally.
I guess some good came out of it after all.
Personally I don't use IE for most things, but I don't use FireFox for reasons of security at all; just because the extensions rock.
To my mind, all browsers have more or less the same number of security problems; name me a single mainstream browser that's not had a vulnerability this year for example.
So in other words, we should find ways to seal off browsers from the normal desktop; lock it down in some low-rights, sandboxed safe environment planning that when it is hacked, it at least will be very limited in scope.
And that, ladies and gentlemen, is why if I had to choose my browser on purely default security scope, I'd go for IE7/Vista or some customised FireFox setup that nailed it to the floor.
Just a thought.
throw new NoSignatureException();
I don't see anywhere in TFA that Microsoft has advised people to use another browser. It's other experts. So this is a "dog bites man" story, not the other way around.
Now, if you don't mind, I'll go back to my nap.
"Who controls the past controls the future. Who controls the present controls the past." -- George Orwell
.. in fact I'm a diehard linux fanman (too old to be a fanboi!)
But even I'm getting sick of the hysterical anti MS reaction every single time some exploit appears for some or other program. Some people particularly media commentators need to get a sense of perspective and understand that no complex piece of software can really ever be bug free and these sorts of errors will creep in occasionally. Who hear who codes in C or C++ hasn't had a similar bug in their own code from time to time even though you were sure you'd debugged everything and the code passed through testing fine? Probably all of us. So look around you to spot the glass before you start chucking any stones!
RTFA.
Said Mr Ferguson: "If users can find an alternative browser, then that's good mitigation against the threat."
But Microsoft counselled against taking such action.
"I cannot recommend people switch due to this one flaw," said John Curran, head of Microsoft UK's Windows group.
Next week's news: "Microsoft experts" advise users to switch to temporarily switch to a different OS, as they prepare to roll out Windows 7... ... jokes aside I haven't been THAT peeved with Vista. The interface is awkward, file transfers are dramatically slower than Ubuntu, and downloading a file over the internet invokes a 20 second freeze in Firefox. Other than that, it seems more stable than XP, and is responsive enough on my recently upgraded desktop.
It has been relegated to a game console status though, at least for me.
Microsoft has begun flooding media outlets with information advising users to switch to an alternate browser while a serious security flaw is being patched.
FTA:
But Microsoft counselled against taking such action.
"I cannot recommend people switch due to this one flaw," said John Curran, head of Microsoft UK's Windows group.
Not trying to downplay the clear reasoning behind switching browsers, but the summary is just blatantly incorrect in this case.
Poor MS, what with Vista they have been having a bad time of it recently.
Poor Microsoft? You've gotta be kidding me. If your main products are crap, you get what you deserve. Anyone who thinks that Windows or IE are great obviously hasn't even tried anything else seriously.
At the Trenton Computer Fair earlier this year I was handed an Ubuntu disc. I've subsequently loaned this disc to others, made copies, etc., etc, and everyone that actually put it in their computer and tried it came back to me to tell me how amazing it was.
If given a viable alternative, PEOPLE WILL SWITCH, and move away from MS/IE/Windows, and it's associated legacy crud.
And yes, I own a PC running Windows (2000). But I also own an iMac, an EEE-pc, and various SGI and SUN boxen. And a machine running Ubuntu.
If telephones are outlawed, then only outlaws will have telephones.
My laptop has an older IE; version 5 I believe..... will this flaw affect that too, or is it just a flaw in the current version of IE?
FOX NEWS.com should be BANNED from television and internet. Have the Congress take it over and give us Truespeak.
Especially since it happens nearly every day. Oh noes!!!! Everybody panic!!! Another exploit in Windows/Office/Explorer. WOE is us!!!
Perhaps if we phrased it like a sponsored ad: "Todays exploit brought to you by yet another buffer overflow error!" "This morning's gaping security hole sponsored by Stormworm. Stormworm: The worm of choice for the discerning mailbot."
Help stamp out iliturcy.
Normally this is reserved for subscribers, so maybe it was a subliminal attempt to get you to subscribe ;)
Jumpstart the tartan drive.
And since then, they've also learned how to make anti-spyware apps that distinguish between real spyware and cookies that just track what websites you go to for advertising purposes.
Aaaah I didnt realise I was jumping forward in time before running anti-apyware after browsing with FF :)
This is especially strange news in light of an article from zdnet, http://blogs.zdnet.com/security/?p=2304, saying that firefox is the top bad example from a list of 12 programs with the worst security record. More interestingly, they don't even mention Internet Explorer as having bad security problems, despite news like this. Does Microsoft just pay journalists to write things like this on the day before they know they have bad news to release in hopes that people won't notice their security problems?
That does not sound practical. I mean obviously they will try it and sometimes it will work - but a company cannot just write away all liability for their goods in a contract, life does not work that way. And it rather depends on the local laws at point of use surely?
I am pretty sure that some risks cannot be written off in a contract and you are always liable.
But, INAL and I am sure that most of the people who browse this will know more than I do - so whats the real angle here?
Can MS simply add #17 to their EULA and expect all liability to vanish or are they being optimistic?
For all Slashdot's leanings toward open source and hatred of all things microsfot or proprietary, does anyone else find that Slashdot itself acts like a closed source company?
You mean like how they host the code that runs their site on a publicly available CVS server and FTP site? Open source means that you can modify the code however you want, not that other people will modify the code however you want.
http://www.mhall119.com
"In this case, hackers found the hole before Microsoft did," said Rick Ferguson, senior security advisor at Trend Micro. "This is never a good thing."
Then
Said Mr Ferguson: "If users can find an alternative browser, then that's good mitigation against the threat."
So NO, it's not Microsoft who recommends switching browsers, they even say
"I cannot recommend people switch due to this one flaw," said John Curran, head of Microsoft UK's Windows group.
I wanted to clarify it since the story wasn't that clear...
OK, is this whole red thing some kind of mass troll, or is a new format change about to be hoist on us all? Screenshots, or it never happened.
May the Maths Be with you!
Sure, but I think the more valid point (the one the parent was trying to make) is that ./ would do well to have some sort of Changelog page that also includes changes to come. This way, folks aren't "adjusting their television sets" when the feature de jour makes an appearance. They'll have a place to RTFM.
The internet is large. One out of every 5000 sites is a lot. Cut your losses and run while you can.
Well phishing doesn't depend on client side vulnerability anyway--it's a social hack.
As much as I'd like to push out firefox for my users, I have many users in a domain environment with mapped applications directory; firefox is simply unmanageable in this environment.
Of all the improvements they are making in firefox, they are ignoring a potentially very large audience by not including some way to manage the browser in a corporate environment.
Mod me down with all of your hatred and your journey towards the dark side will be complete!
Obama performs stupid /. changelog tricks with Ubuntu!
Frontpage material
Knowledge is power. Knowledge shared is power lost.
In BBC Radio 5 Live an MS representative was giving the suggested steps to protect Windows machines, the full 4 of them.
The newsreader and presenter, Anita Anand asked if it would not be easier just to switch to another browser.
The MS guy replied with the platitudes to be expected, the important point is that mainstream non technical media are getting the idea.
IANAL but write like a drunk one.
And then read the fallout where the readers debunk what the article says, including posts to problems with IE that for some reason were completely ignored when doing the compilation.
I will just point out that Firefox is #1 because they *patched* the most vulnerabilities.
Only in Bizarro Planet this would define the most unsafe application.
IANAL but write like a drunk one.
Never been Catholic.
It doesn't mean much now, it's built for the future.
A changelog would imply they're following some kind of "design" or "plan" when they're clearly not. They make changes to people using the "version 1 discussion system" obviously intended for users of the "version 2 discussion system", like the Users page. They randomly break things, then half-repair them. i.e. listing the wrong content (submitted articles), then 'fixing' it by showing the intended content (recently posted comments) wrongly (incorrect scores).
Oh, and they're owned by the company that runs SourceForge, the site that frequently looks like this: http://schend.net/images/screenshots/slashdot/sourceforge_blank_window.png or this: http://schend.net/images/screenshots/slashdot/sourceforge_wish_it_was_a_blank_window.png
Slashdot seems to be a classic DailyWTF-esque "Developmestuction" environment: http://thedailywtf.com/Articles/The_Developmestuction_Environment.aspx
There isn't anybody at the entire Sourceforge/Slashdot corporate entity I'd call a "web developer".
Comment of the year
I've been able to run Firefox to some extent in a corporate environment and keep it updated - I just create an MSI package whenever a new version of Firefox comes out (3.0.3, 3.0.4, etc) and then roll it out via group policy. Then I just let my users know they should use Firefox for all of their browsing, and use IE only for craptastic activex/VB intranet apps.
You're right though - they really need to make it easier. Keeping plugins, etc updated is impossible.
Just disrupt the deflector shield with a tachyon burst.
"Microsoft has begun flooding media outlets with information advising users to switch to an alternate browser while a serious security flaw is being patched."
Then
According to the BBC report, though, Microsoft itself is only asking that users be "vigilant while it investigated and prepared an emergency patch"; it's outside experts who say to dump IE (at least for now).
So, which is it?
It's bullshit editing like this that keeps slashdot and other sites like it from being taken seriously by anyone other than the fervent geeks that perpetuate it. Seriously.
When a title and a summary both contain conflicting statements, the article shouldn't even run.
--Toll_Free
I have nothing against "AJAX", I just have this thing against "ugly."
Slashdot had a huge competition to design a new look only a couple of years ago, and it actually looked pretty good for a long time. Then, relatively recently, they've decided they wanted to add dynamic features, and the look has gone into the crapper. The only recourse is to keep Slashdot set to "Classic" appearance, which is less vomit-inducing, but the "version 2" appearance keeps leaking in.
See, for example, these bugs:
https://sourceforge.net/tracker2/?func=detail&aid=2144813&group_id=4421&atid=104421
https://sourceforge.net/tracker2/?func=detail&aid=2159787&group_id=4421&atid=104421
https://sourceforge.net/tracker2/?func=detail&aid=2348173&group_id=4421&atid=104421
https://sourceforge.net/tracker2/?func=detail&aid=1939546&group_id=4421&atid=104421
https://sourceforge.net/tracker2/?func=detail&aid=1939531&group_id=4421&atid=104421
and probably a dozen others I've noticed but not bothered to submit. (BTW, if anybody at Slashdot tells you to submit your issue as a bug report to get it looked at, they're lying. They never look at bug reports.)
Comment of the year
The article linked in the text Microsoft has begun flooding media outlets with information advising users to switch to an alternate browser while quotes a Trend Micro spokesman advising users to switch and a Microsoft spokesman explicitly saying he can't advise users to switch over one flaw. This contradicts the summary text.
so it's not actually Microsoft that's suggesting that people switch browsers
Au contraire. "I cannot recommend people switch due to this one flaw". Translation: We've given you countless reasons to switch already. Here's one more.
IE users (and Windows users in general) remind me of the plight of the abused spouse, caught in the endless cyle of abuse. This is phase 2. A fix has been promised for tomorrow. That's phase 3. How many times is the average victim victimized before they leave? Way too many.
db
I am literally 3000 tokens away from the chaotic crossbow --Stephen