Slashdot Mirror
Microsoft Says Google Chrome Frame Makes IE Less Secure
Mark writes "The release of Google Chrome Frame, a new open source plugin that injects Chrome's renderer and JavaScript engine into Microsoft's browser, earlier this week had many web developers happily dancing long through the night. Finally, someone had found a way to get Internet Explorer users up to speed on the Web. Microsoft, on the other hand, is warning IE users that it does not recommend installing the plugin. What does the company have against the plugin? It makes Internet Explorer less secure. 'With Internet Explorer 8, we made significant advancements and updates to make the browser safer for our customers,' a Microsoft spokesperson told Ars. 'Given the security issues with plugins in general and Google Chrome in particular, Google Chrome Frame running as a plugin has doubled the attack area for malware and malicious scripts. This is not a risk we would recommend our friends and families take.'"
stones/glasshouses
Friends don't let friends use Internet Explorer anyway.
Ofcourse it makes it less secure, it lets you run Javascript faster, so that all those drive-by malware installers can execute faster!
It pays to be obvious, especially if you have a reputation for being subtle.
What do you expect; "This is great now our customers can access standards-compliant sites and have a faster, smoother web experience"?
Dear Microsoft:
Citation please. Evidence. Facts. Or retract.
'k thanks,
Google
"I disapprove of what you say, but I will defend to the death your right to say it." - historian Evelyn Beatrice Hall
. . . which is why one should run Firefox, konqueror, Mozilla, or Opera on Linux, Solaris, or BSD instead.
The Christian Right is Neither (Christian nor right). See: Matthew 23, Matthew 25, Ezekiel 16:48-50
I'm not Microsoft's friend or family.
Of course it doubles the attack rate of malicious scripts... It makes Javascript run twice as fast.
In other news, Microsoft has said that Moores Law is a security risk, because viruses can install themselves twice as fast every 18 months.
You just made one of the most important arguments against Silverlight official.
"Given the security issues with plugins in general and Google Chrome in particular"
O RLY?
I'm happy to believe that IE8 actually has a good security model. I'm happy to believe that Chrome is not without flaws. But, really, Google have gone through fairly considerable pain and implemented quite strict sandboxing techniques for Chrome, to contain any problems in the renderer. It's pretty solid. Maybe it's better than IE8, maybe not. But just hand waving and going "Oh yes, *especially* Chrome" as if it's common knowledge that it's insecure is simply FUD.
The point about increasing the attack surface area seems more valid, perhaps, though it really depends on how this plugin works. If there are really twice as many places available at once then yes, that is a worry. If you'd have to get through Chrome's security and then through IE8's security, that actually sounds quite good. Possibly the biggest security worry I see is in encouraging users to think that installing a large, scary plugin that basically replaces the guts of their browser is a normal occurrence that will make their internet experience better.
So... forcing the .NET plug-in on Firefox users was OK, but a voluntary add-on from Google is a security risk? Good to know.
This is not a risk we would recommend our friends and families take.
Especially the children. Think of the children!
He should have used "mortal danger" instead of simply "risk". Also, change "would recommend" for "let". And add some exclamations, for god's sake, this is serious.
Thus, the closing sentence should be:
"This is not a mortal danger we let our children take!"
However, once you've decided to push factless crap with fear mongering, at least do it with style.
I recommend:
"If you allow your children to install the google demon, your entire family will suffer an eternity of pain, in HELL!"
"This is not a risk we would recommend our friends and families take." The Microsoft representative further stated that "Allowing your children to use the Google Chrome Frame plugin is tantamount to child abuse. In fact, we're not so sure that anyone installing this is truly capable of feeling love. What kind of heartless monster would willingly install this on their loved ones' browser?"
I heard about this but I wasn't going to install it yet. I don't use a lot of I.E. stuff, but what I do is Javascript intensive, so now that I know that your don't like it at Microsoft I have now installed it. Thanks for the heads up... since you don't like it there must be a reason to give it a look.
..is scared.
So Microsoft, how does it feel? How does it feel to have a big bad company with a near monopoly in one market (Google in search) threaten your stake in a different market (browsers)?
FAQs are evil.
By running this plugin, you would be exposing yourself to not only Possible IE exploits, but possible Chrome Exploits as well. It would be much safer to run the Chrome browser standalone since it reduces the attack surface. It would probably be faster standalone too.
In Soviet Russia, Trojan exploits YOU!