Slashdot Mirror
Microsoft Says Google Chrome Frame Makes IE Less Secure
Mark writes "The release of Google Chrome Frame, a new open source plugin that injects Chrome's renderer and JavaScript engine into Microsoft's browser, earlier this week had many web developers happily dancing long through the night. Finally, someone had found a way to get Internet Explorer users up to speed on the Web. Microsoft, on the other hand, is warning IE users that it does not recommend installing the plugin. What does the company have against the plugin? It makes Internet Explorer less secure. 'With Internet Explorer 8, we made significant advancements and updates to make the browser safer for our customers,' a Microsoft spokesperson told Ars. 'Given the security issues with plugins in general and Google Chrome in particular, Google Chrome Frame running as a plugin has doubled the attack area for malware and malicious scripts. This is not a risk we would recommend our friends and families take.'"
Dear Microsoft:
Citation please. Evidence. Facts. Or retract.
'k thanks,
Google
"I disapprove of what you say, but I will defend to the death your right to say it." - historian Evelyn Beatrice Hall
. . . which is why one should run Firefox, konqueror, Mozilla, or Opera on Linux, Solaris, or BSD instead.
The Christian Right is Neither (Christian nor right). See: Matthew 23, Matthew 25, Ezekiel 16:48-50
I know. Ho hum. Someone tell Microsoft to wake me up when they get around to actually making a decent browser. How many years has it been? 13 years?
XML is like violence. If it doesn't solve the problem, use more.
Of course it doubles the attack rate of malicious scripts... It makes Javascript run twice as fast.
In other news, Microsoft has said that Moores Law is a security risk, because viruses can install themselves twice as fast every 18 months.
You just made one of the most important arguments against Silverlight official.
So... forcing the .NET plug-in on Firefox users was OK, but a voluntary add-on from Google is a security risk? Good to know.
I'm happy to believe that IE8 actually has a good security model.
And I thought that included sandboxing plugins? How can any plugin be a serious security threat with MS went through such pains to make IE bulletproof?
Dewey, what part of this looks like authorities should be involved?
Perhaps you don't remember, but IE 5 was LIGHTYEARS ahead of Netscape.
Great, that happened *ten* years ago. What has happened since? They've been chasing the Fox for past *five* years.
We're all hypocrites. We all have hidden parts, it's the contrast between them that make us more a hypocrite than others
"Microsoft pretends IE could possibly be made less secure by changing anything about it."
..is scared.
So Microsoft, how does it feel? How does it feel to have a big bad company with a near monopoly in one market (Google in search) threaten your stake in a different market (browsers)?
FAQs are evil.
I thought plug-ins/add-ons ran as part of the host browsers CPU process, and thus if IE is sandboxed wouldn't Chrome also be sandboxed?
These comments are my personal opinions and do not necessarily reflect the opinions of the other voices in my head.
By running this plugin, you would be exposing yourself to not only Possible IE exploits, but possible Chrome Exploits as well. It would be much safer to run the Chrome browser standalone since it reduces the attack surface. It would probably be faster standalone too.
In Soviet Russia, Trojan exploits YOU!
Microsoft Says Google Chrome Frame Makes IE Less Secure
Of course they do! Disregard the fact that they provide no evidence at all, and that they use this:
Google Chrome Frame running as a plugin has doubled the attack area for malware and malicious scripts.
as an argument to prove their point (???), but really, this is Googles way of taking over the MS userbase as explained here, and MS knows it. If Google wave becomes a hit, people will remember this move as the first important joust won by Google. IE with its crippled javascript hopes to prevent the popularity of Google wave by using scorched earth policy.
I am the lawn!
you're one of the rarest groups of all the fish in the pond, so to speak, per-se.
Most of us like companies that patch vulnerabilities much faster/make browsers that are standards compliant, both from a legal perspective (meaning our employers are happier -not for me personally), and also from a safety/update perspective.
They make a valid point. IE has holes. Chrome has holes. IE with a Chrome plugin can be exploited by both vectors. There should be no debate over the fact that IE+Chrome is less secure than IE without Chrome. That is distracting from the real question, however, which is whether IE without Chrome is less secure than Chrome without IE.
I am TheRaven on Soylent News