Slashdot Mirror
Microsoft Says Google Chrome Frame Makes IE Less Secure
Mark writes "The release of Google Chrome Frame, a new open source plugin that injects Chrome's renderer and JavaScript engine into Microsoft's browser, earlier this week had many web developers happily dancing long through the night. Finally, someone had found a way to get Internet Explorer users up to speed on the Web. Microsoft, on the other hand, is warning IE users that it does not recommend installing the plugin. What does the company have against the plugin? It makes Internet Explorer less secure. 'With Internet Explorer 8, we made significant advancements and updates to make the browser safer for our customers,' a Microsoft spokesperson told Ars. 'Given the security issues with plugins in general and Google Chrome in particular, Google Chrome Frame running as a plugin has doubled the attack area for malware and malicious scripts. This is not a risk we would recommend our friends and families take.'"
stones/glasshouses
Friends don't let friends use Internet Explorer anyway.
Ofcourse it makes it less secure, it lets you run Javascript faster, so that all those drive-by malware installers can execute faster!
It pays to be obvious, especially if you have a reputation for being subtle.
What do you expect; "This is great now our customers can access standards-compliant sites and have a faster, smoother web experience"?
Dear Microsoft:
Citation please. Evidence. Facts. Or retract.
'k thanks,
Google
"I disapprove of what you say, but I will defend to the death your right to say it." - historian Evelyn Beatrice Hall
. . . which is why one should run Firefox, konqueror, Mozilla, or Opera on Linux, Solaris, or BSD instead.
The Christian Right is Neither (Christian nor right). See: Matthew 23, Matthew 25, Ezekiel 16:48-50
I'm not Microsoft's friend or family.
Of course it doubles the attack rate of malicious scripts... It makes Javascript run twice as fast.
In other news, Microsoft has said that Moores Law is a security risk, because viruses can install themselves twice as fast every 18 months.
You just made one of the most important arguments against Silverlight official.
"Given the security issues with plugins in general and Google Chrome in particular"
O RLY?
I'm happy to believe that IE8 actually has a good security model. I'm happy to believe that Chrome is not without flaws. But, really, Google have gone through fairly considerable pain and implemented quite strict sandboxing techniques for Chrome, to contain any problems in the renderer. It's pretty solid. Maybe it's better than IE8, maybe not. But just hand waving and going "Oh yes, *especially* Chrome" as if it's common knowledge that it's insecure is simply FUD.
The point about increasing the attack surface area seems more valid, perhaps, though it really depends on how this plugin works. If there are really twice as many places available at once then yes, that is a worry. If you'd have to get through Chrome's security and then through IE8's security, that actually sounds quite good. Possibly the biggest security worry I see is in encouraging users to think that installing a large, scary plugin that basically replaces the guts of their browser is a normal occurrence that will make their internet experience better.
So... forcing the .NET plug-in on Firefox users was OK, but a voluntary add-on from Google is a security risk? Good to know.
a new open source plugin that injects Chrome's renderer and JavaScript engine into Microsoft's browser, earlier this week had many web developers happily dancing long through the night.
Dancing Developers?? Get back to developing webs, like you're supposed to be doing! Didn't anybody tell you that you are no good at dancing?
... and then they built the supercollider.
Sweet Shimmer Glitter Lube. In juicy apple, boysenberry, pink champagne or pina colada.
... we should ban flash, acrobat reader, quicktime, and dozens of other plugins that all have regularly reported vulnerabilities.
Microsoft is not a risk we would recommend our friends and families take.
This is not a risk we would recommend our friends and families take.
Especially the children. Think of the children!
He should have used "mortal danger" instead of simply "risk". Also, change "would recommend" for "let". And add some exclamations, for god's sake, this is serious.
Thus, the closing sentence should be:
"This is not a mortal danger we let our children take!"
However, once you've decided to push factless crap with fear mongering, at least do it with style.
I recommend:
"If you allow your children to install the google demon, your entire family will suffer an eternity of pain, in HELL!"
"This is not a risk we would recommend our friends and families take." The Microsoft representative further stated that "Allowing your children to use the Google Chrome Frame plugin is tantamount to child abuse. In fact, we're not so sure that anyone installing this is truly capable of feeling love. What kind of heartless monster would willingly install this on their loved ones' browser?"
".... has doubled the attack area for malware and malicious scripts."
Can't the same thing be said about the Flash Player Plugin?
Because people still using IE6 are really worried about their browser security...
I heard about this but I wasn't going to install it yet. I don't use a lot of I.E. stuff, but what I do is Javascript intensive, so now that I know that your don't like it at Microsoft I have now installed it. Thanks for the heads up... since you don't like it there must be a reason to give it a look.
..is scared.
So Microsoft, how does it feel? How does it feel to have a big bad company with a near monopoly in one market (Google in search) threaten your stake in a different market (browsers)?
FAQs are evil.
But I doubt that even they could make IE less secure than it already is.
Slow down, cowboy! It has been 4 hours since you last posted. You must wait another few hours.
applying the same crazy MS thoughts, then Silverlight make IE less secure
Well of course Microsoft "doesn't recommend" their friends and family use the Chrome plugin. If they did, next thing you know their friends and family are down at the T-Mobile shop eying Android phones, or over at the Apple Store snapping up an iPhone. As long as those friends and family are only exposed to Microsoft products, they'll never realize that the grass, indeed, really is greener on the other side of that fence - because those other guys actually feed and water their lawn!
#DeleteChrome
By running this plugin, you would be exposing yourself to not only Possible IE exploits, but possible Chrome Exploits as well. It would be much safer to run the Chrome browser standalone since it reduces the attack surface. It would probably be faster standalone too.
In Soviet Russia, Trojan exploits YOU!
You should check out Privoxy as an AdBlock replacement, it runs as a daemon / service, so it'll work with _any_ browser you use.
Google is not in the business of providing searches. Google is in the business of selling ads. It just happens that having the best search gives you more eyeballs on your ads. They leverage that advantage to gain share in other markets. It does sound like another company I've heard about.
But you're on target here, this is obviously not comfortable for Microsoft. Five years ago they wouldn't have even bothered to issue a response. This is the kind of press release that is pure fear.
Someone has made a plug-in for your browser that makes it 8X faster.
It's something I said a long long long time ago. What can kill Microsoft? Something free.