Firefox Most Vulnerable Browser, Safari Close

An anonymous reader writes "Cenzic released its report revealing the most prominent types of Web application vulnerabilities for the first half of 2009. The report identified over 3,100 total vulnerabilities, which is a 10 percent increase in Web application vulnerabilities compared to the second half of 2008. Among Web browsers, Mozilla Firefox had the largest percentage of Web vulnerabilities, followed by Apple Safari, whose browser showed a vast increase in exploits, due to vulnerabilities reported in the Safari iPhone browser." It seems a bit surprising to me that this study shows that only 15% of vulnerabilities are in IE.

Comments

I wonder

[somersault]

How many of these vulnerabilities were due to Firefox itself, and how many due to plugins?

Re:I wonder

[Shatrat]

Haven't RTFA yet but I bet they are using patch notes as their source of vulnerabilities.
If that's the case then obviously well-documented and frequently-patched browsers will be over-represented.

Re:I wonder

[Anonymous Coward]

Doesn't matter. If the browser cannot protect itself from its own add-ons then it is still the browser at fault.

Glad I don't use Firefox, Safari or IE.

Re:I wonder

[qoncept]

I get your point, but in the end, what is the difference? Many people are die hard users of the plugins (I use firefox and I'll never understand the hype) that they insist they could never go without them, and in many cases it's the primary force in their decision to use firefox.

Anyway, allowing plugins to run that may have vulnerabilities is a vulnerability in itself.

Re:I wonder

[dkleinsc]

So in other words, this isn't a count of how many vulnerabilities there are, it's a count of how many vulnerabilities are found and fixed.

Something tells me their methodology is a bit flawed. Of course, that's by design, given Cenzic's financial ties to Microsoft.

Re:I wonder

[PNutts]

I haven't read your post yet but you're wrong.

Re:I wonder

[rudy_wayne]

I get your point, but in the end, what is the difference? Many people are die hard users of the plugins (I use firefox and I'll never understand the hype) that they insist they could never go without them, and in many cases it's the primary force in their decision to use firefox.

You're confusing plugins with extensions.

Re:I wonder

[MozeeToby]

Even if their information is accurate, which I don't see how it could possibly be, it is meaningless. Number of flaws is a horrible way to measure system security since it doesn't take into account severity, ease of attack, unreported flaws, or un-acknowledged flaws. When you get down to it, there really isn't any good way to measure security, but I would bet hours spent in code reviews would correlate much better than number of reported flaws.

Re:I wonder

[LBArrettAnderson]

"Haven't RTFA..." -Shatrat
I guess that's enough for dkleinsc (and most anti-MS slashdotters (slightly redundant, yes)) to jump to conclusions.

Re:I wonder

[Teflonatron]

I didn't see anything in the actual report that explained how their results were arrived at. For that reason alone, this report is worthless. It's just a marketing document for use in selling their own security products.

However, it did make reference to the numbers being representative of "reported vulnerabilities", which we all know is going to make Firefox look worse that IE. This is verified by realizing Opera (also closed source) scored less than IE.

Re:I wonder

[Sandbags]

Worse, patch SEVERITY was not accounted for in these results, nor was the fact that many patches were for unexploited vulnerabilitys, and others were to close ITW threats...

FF and Safari rank bad in this article, but when looking at the raw data, patch severity, and explited patch footprint, IE is the worst, even though not patched very often.

I'd also note that a single patch may include fixes for numerous bugs, and this is additionally not covered in the scope of this article. A single patch in IE recently fixed more than 10 vulnerabilties...

Re:I wonder

[Shatrat]

lol, touche.
Still, do you really have to read it?
It seems like one of these bootlicking/astro-turfing 'studies' from some consulting agency or 'solution' vendor comes along about every 6 months in the Slashdot headlines.
Upon reading TFA, this one seems no more credible than any other.

Re:I wonder

[Mage Powers]

I Read TFA and all i saw was one stinkin pie chart. The rest of the pdf is focused on servers.

Re:I wonder

[bangthegong]

a much more credible report, IMO because they are at least honest about their methodology and the weaknesses or strengths of how to look at different data: http://www-935.ibm.com/services/us/iss/xforce/trendreports/xforce-2008-annual-report.pdf

Re:I wonder

[TheGreatOrangePeel]

Still. You gotta' wonder how *exactly* they're counting. There's, "Ha! I made Firefox crash" vulnerabilities and then there's "Ha. I just executed arbitrary code on your computer."

Re:I wonder

[ircmaxell]

What about IE vulnerabilities that are inherent from its close tie to the OS? I'll bet that they didn't count vulnerabilities like today's http://tech.slashdot.org/story/09/11/11/0053244/Microsoft-Plugs-Drive-By-and-14-Other-Holes since it wasn't a flaw in IE itself. It was just attackable through IE....

Re:I wonder

[noidentity]

Wow, so if I merely released my own binary-only build of Firefox and never mentioned any fixed vulnerabilities in release notes, this study would have found it with far fewer vulnerabilities than Firefox? I think I found a vulnerability in this study...

Re:I wonder

[SQLGuru]

And there's the "I had an issue, but updated to the latest version which closed that hole" vs "What's an update?". It doesn't matter how many vulnerabilities there are -- it only takes one to exploit a system.

Re:I wonder

[calidoscope]

The Register's article on the Cenzic report also speculated the the report was based on published vulnerabilities. They made some rude noises about Cenzic's focus on the number of the vulnerabilities as opposed to the severity of vulnerabilities.

Re:I wonder

[Anonymous Coward]

Hypocrisy? He didn't say anything about the article. All he said was that the previous two posters made conclusions based on absolutely nothing.

Re:I wonder

[Jay Clay]

There's plenty of questions that the article raises without answering (well, at least with the article and report itself, I didn't go hunting their web site for them):

• is the amount of vulnerabilities just a count or did they give some more weight than others? I hope they don't equate an SSL download injection of malware to the ability for some bad javascript to bypass popup blockers.
• are they reported issues in documented bug fixes are are they independent issues? I can think of at least one occasion MS has squelched a bug report.
• do they make them unique to the browser itself or are they universal attacks that the browser doesn't stop?

Did anyone with more patience than me go perusing their site to find how they came up with their numbers?

Re:I wonder

[Actually, I do RTFA]

Haven't RTFA yet but I bet they are using patch notes as their source of vulnerabilities.

I did RTFA, and I bet you're wrong.

Re:I wonder

[Actually, I do RTFA]

So in other words, this isn't a count of how many vulnerabilities there are, it's a count of how many vulnerabilities are found and fixed. Something tells me their methodology is a bit flawed. Of course, that's by design, given Cenzic's financial ties to Microsoft.

Actually, in other words, the GP was making shit up. But since it conformed to your worldview, you agreed with it and based an entire post on it even though he said he didn't RTFA. Somehow it then got modded to +5.

In reality, the vulnerabilities were culled from a variety of 1st and 3rd party sources.

Re:I wonder

[natehoy]

Have read the article, and the attached PDF, and they only state the conclusions. No mention is made of how they counted vulnerabilities, only that Firefox had 44% of them, and that they represented "Web Vulnerabilities by Major Type". Adding to the confusion was that they also talked about applications and servers and alternated back and forth between the three with little warning.

Also interesting was that "ActiveX" was listed as a technology separate from Web Browsers, the one time it was mentioned. In other words, their vulnerability percentage, which is already vague, may not include ActiveX vulnerabilities within IE. Or they may. All we know is that they claim IE has 15%.

Nowhere is there mention of what constitutes a reportable vulnerability, what versions of each browser were counted, how they were classified or even what the classifications were, what sorts of reports were included by browser (did plugins or addons get included in Firefox? ActiveX for IE? For multiplatform browsers like Opera, Firefox, and Safari, were vulnerabilities mitigated by only being exploitable on some platforms and not others, or reported multiple times - once for each vulnerable platform?)

The PDF was severely [citation needed], but remarkably honest in that it expressed surprise that Firefox was the most vulnerable web browser when compared IE, Safari, and Opera, and comprised almost half the identified vulnerabilities among the four browsers.

If this is like most reports of the same type, they are using vendor-reported bugs. Firefox would, by definition, have the largest bug list by any stretch in such a report. They are the only web browser development team that allows (and encourages) access to the same bug-tracking database that their developers use. Safari, IE, and Opera only report vulnerabilities when (a) they have been fixed, or (b) when so many reports have come out that they finally have to 'fess up.

Re:I wonder

[hrimhari]

In fact, it would find your browser to be the safest on Earth. I sure would ditch my Firefox to use it in a blink!

Re:I wonder

[gregmac]

IE is the worst, even though not patched very often.

maybe... s/even though/because it is/ ?

Re:I wonder

[roc97007]

What makes this particularly bad is that vendors can improve their scores by neglecting to patch their browsers. The less responsible they are, the better their marketing numbers.

Re:I wonder

[Galestar]

The PDF in the article is mostly marketing, and does not do much in the way of explaining how they arrived at those numbers other than; "Cenzic analyzed all reported vulnerability information from sources including NIST, MITRE, SANS, US-CERT, OSVDB as well as other third party databases for Web application security issues reported during the first half of 2009." We can therefore conclude that those numbers are based upon reported vulnerabilities, regardless of whether or not they were fixed. From my experience Firefox has a good habit of quickly patching security vulnerabilities. For example, there is the SSL spoof vulnerability discovered late July that Firefox fixed in 5 days and IE/Safari/Chrome still haven't fixed in over 3 months AFAIK) So there is nothing to indicate that Firefox is necessarily a less secure browser.

Re:I wonder

[tuxgeek]

.. given Cenzic's financial ties to Microsoft.

That was my first thought as well
Another reliable survey sponsored by M$

Re:I wonder

[Lennie]

Only if the update software was disabled. A browser that doesn't need updates, it's obviously the most secure.

Re:I wonder

[Nikker]

I actually RTFA and the vulnerabilities it accounts for are

• SQL Injection 25%
• XSS 17%
• Web Server 2%
• Buffer Errors 12%
• Web Browser 8%
• Authentication / Authorization 14%

Plus a few under 10%. The funny thing is that the article seems to blame the browser for SQL Injection, Web Server, Information Leak / Disclosure? WTF?

Information Leaks could be the result of any attack, SQL Injection has nothing at all to do with any browser and "Web Server"? There is no real information other than a nice shaded 3D pie chart so what this guy is trying to prove is beyond me. It also includes Path Traversal which is server side as well, code injection well injection into what? The browser, the server ... what?

Popular vendors including Sun, IBM, and Apache continue to be among the top 10 most vulnerable Web applications named.

Even if some agrees that these companies are actual web applications and not software companies, you would have to agree that there really are only about 10 commonly used web servers in total so Sun, IBM and Apache will be on this list regardless of the exploit.

Looking at the real report all of the exploits blamed on the browsers are based on SQL Injections and propagating malicious code from the originator of the web site so how could one browser handle this more effectively then another? This doesn't really make a lot of sense so anyone gifted with more ability then myself please reply below.

Re:I wonder

[thejynxed]

Either way, the result is the same.

Re:I wonder

[Mister Whirly]

How is that hypocrisy? Unless you think he jumped to a conclusion about the previous poster jumping to a conclusion (which would be a stretch considering the previous poster admitted to have not read the article). He didn't claim they were wrong, only that they were making assumptions because they hadn't read TFA.

Re:I wonder

[fredjh]

I was wondering that myself... how is SQL injection a fault of the browser? I mean... I suppose a plugin could try SQL injections when submitting forms, but I don't see how that could be any worse on any other browser, AND it doesn't compromise the browser or the client's system.

Re:I wonder

[tuxgeek]

bootlicking/astro-turfing 'studies' from some consulting agency or 'solution' vendor comes along about every 6 months

TFA gives NO details on the OS platform. I would assume FF on M$ would be more exploitable than FF on *nix, given the nature and track record of M$
Even more ridiculous is the slam of Apache as the top 10% most vulnerable. That is pure bullshit!

Re:I wonder

[Bloody Peasant]

So in other words, this isn't a count of how many vulnerabilities there are, it's a count of how many vulnerabilities are found and fixed.

I read the report. It is a marketing document, with one person (Mandeep Khera, Chief Marketing Officer) identified in it as both project lead and executive editor.

Also, despite the fact that the report itself downplays browser vulnerabilities (8% vs. 90% web apps, 2% web servers), they still put in a single token page which just seems out of place. Nowhere does it say what their methodology is for determining what comprises a "vulnerability". Another poster already pointed out the google search results on the CERT site (~367 for IE, ~61 for Firefox; that's over 6 times more vulnerability reports on the CERT site for IE versus those for Firefox; oops, was I shouting?).

I suspect the authors' methodology is simply to count something like the number of patches. Given Microsoft's monthly bundling of their security patches, and the Mozilla Firefox project's immediate release of more frequent version updates in response to vulnerability reports and discoveries, such methodology leads to a systematic undersampling of those for IE. A better approach would be to count verified CVE candidates.

Pure speculation: were they paid by anyone to put that browser breakdown in (it really doesn't seem to belong in my opinion), or was it ignorance or lack of thinking? Without an honest clarification from the company we'll probably never know.

Re:I wonder

[Kratisto]

No one said anything about RTFR; you're getting off-topic.

Re:I wonder

[http]

Pardon my ignorance, but how exactly is Cenzic tied financially to Microsoft again? Google's got nothing (and bing has less).

Re:I wonder

[w0mprat]

I don't even bother posting I use a form.

-- Slashdot posting form --
...
[ ] RTFA
[ ] In soviet russia ____ YOU!
[ ] Obligatory XKCD
[ ] _____ you insensitive clod.
[ ] Get off my lawn
[x] I don't even bother posting I use a form.
...

Re:I wonder

[rochberg]

Also, note that the parent's quote comes from the section on Web applications (i.e., server-side). The section on Web browsers does not provide even a hint as to their sources.

Re:I wonder

[wealthychef]

I wonder what difference it makes that there are more or less vulnerabilities reported. What actually matters is the total exposure, which I would define, for each browser, as
the sum over all vulnerabilities of:
(number of browsers with vulnerability) x (damage possible if vulnerability is exploited) x (chance of actually exploiting the vulnerability).

Re:I wonder

[fluffy99]

If a vulnerability isn't found, that what's the problem? By that notion, both browsers have undiscovered issues. I do wonder if they were double or triple counting Firefox vulnerabilities as it is supported on more platforms.

Another, probably more reliable source would be secunia.com. Counting Firefox 3.0.x and 3.5.x, there were a total 18 issues in 2009 (13 and 5 respectively). Counting IE6, IE7, and IE8 there is a total of 18 vulnerabilities (6,6, and 4 respectively). Looks like pretty comparable numbers and severity to me.

Re:I wonder

[SharpFang]

ActiveX is listed separately? Yay, that explains why MSIE fares so well.

MSIE is a rather simple GUI built around the ActiveX HTML Browser control ("Trident" engine). So the exploits that affect all browsers that use it (IE, FF+IE Frame, Netscape, Maxthon, and a bunch of others) are simply listed as ActiveX exploits.Only exploits that are dependent on MSIE GUI layer are counted as MSIE ones.

It's like they counted only XUL interface exploits for Firefox, treating Gecko rendering engine as a separate system with its own list, not affecting Firefox.

Re:I wonder

[WinterSolstice]

I was going to point this out as well - there was nothing really backing up the browser diagram at all. They didn't even really go into how they determined these vulnerabilities existed, even though they did go into how web apps break down (reasonably enough).

Just another BS FUD report

Re:I wonder

[Sarten-X]

According to another article, a lot of them are from plugins.

Re:I wonder

[Antiocheian]

Same question here. Anyone with a more thorough knowledge on the data behind this pie ?

Re:I wonder

[Youngbull]

Let's say there are 500 different vulnerabilities in FF, and 1 in IE, but the 500 vulnerabilities of FF is just variations of the same and would just make for a denial of service, however the vulnerability in IE destroys the computer who is subject of it. Maybe the vulnerabilities in FF in addition is very rear and involves user agreement, and the one in IE is common to every website... This is not a good measurement of web browser security...

Re:I wonder

[Eil]

How many of these vulnerabilities were due to Firefox itself, and how many due to plugins?

Well, the Slashdot article, the "research," and most of the comments here are misleading.

This is a count of how many vulnerabilities were fixed, not how vulnerable in general the software was. It's impossible to concretely quantify how buggy any sufficiently complex body of code is.

Re:I wonder

[RiotingPacifist]

These percentages are based on reported vulnerabilities for commercial and open
source software. The actual vulnerabilities for all the proprietary or in-house built
applications can be totally different as highlighted in the last section of this report under
ClickToSecure, Cenzic’s managed service/SaaS findings.

It's a shame because it's quite a detailed report about web app vulnerabilities but slashdot make the 1 page with no centext into the title yet left out most of the web app info:
25% SQL injection
17% XSS
14% authentication (what sort of authentication flaws?)
8% path traversal
8% browser ? (What does that mean?)
7% code injection (injection into where?) ...

Re:I wonder

[leonbloy]

The funny thing is that the article seems to blame the browser for SQL Injection...

...all of the exploits blamed on the browsers are based on SQL Injections and propagating malicious code from the originator of the web..

No. "Vulnerabities in web aplications" is the total set, of which just 8% correspond to web browsers. (From that 8%, the 44% goes to Firefox) The remaining 92% are problems due to web servers and applications (phpMyAdmin, and so); SQL Injections among them. I agree with many other posters, though, in that the report is bullshit, just some graphs and no information about how the data was obtained.

Re:I wonder

[natehoy]

Right, but in this case they aren't even really stating clearly what metric they are using. Maybe they picked four guys and had them each dress up as their favorite browser, then threw sunflower seeds at them and treated each one that stuck to their costumes as a "bug" for the report. It just means the Firefox dude made his out of duct tape and left the sticky bit exposed.

Seriously, without some indication of how the raw data was collected and how it was collated, this might as well be a made-up number, and any discussion of what it means is useless because we don't even know what it's SUPPOSED to mean, much less if it's rigorously derived and based on unbiased data.

Maybe it's a good conclusion based on real data and Firefox really is a piece of crap.

If so, every other study I've seen that is based on real-world vulnerability/exposure (as opposed to bug counts, which aren't even possible to compare in a meaningful way) is wrong and these guys are freaking geniuses.

Re:I wonder

[natehoy]

No, sorry, I never said that. I said that their summary listed ActiveX as a separate technology from web browsers. Based on that, they may or may not be including ActiveX vulnerabilities as part of IE.

And I'm not even sure if that would be valid, either way. ActiveX is separate, though it cannot to my knowledge be separatED, from Internet Explorer. You can also add ActiveX to Firefox.

However, I cannot conjecture as to their ACTUAL testing/validating/summarizing methodology because they did not see fit to disclose it in the paper.

So the ActiveX thing is just me pointing out additional uncertainties introduced by their summary, over and above the fact that they didn't provide any supporting data, or even any idea where they got their data, or how they compiled it.

About the only thing I can tell for sure from that paper is their contact information on the last page if I want to buy crap from them.

This is an executive summary designed to lead up to a sales presentation. And the executive summary may be based on real data. Or it may not.

Re:I wonder

[TheJodster]

I hate boot lickers.

I don't know why, but that tickled the shit out of me. Thank you for that Shatrat.

Re:I wonder

[aix tom]

But... But... But... It's _shiney_. It has colourful _pie charts_

*Blackholes the server on the proxy before a manager reads it*

Re:I wonder

[icebike]

Haven't RTFA yet but I bet they are using patch notes as their source of vulnerabilities.
If that's the case then obviously well-documented and frequently-patched browsers will be over-represented.

My house is falling apart and the roof leaks.

You can tell because of all the nails it has and all those shingle on top.

Re:I wonder

[commodore64_love]

The thing noticed is that the "most vulnerable" browsers were open-source (Firefox, Safari) and the least vulnerable were closed-source (Explorer, Opera) with a huge gap in between these two types.

Could it be that closed-source aps simply don't publish their vulnerabilities, so that makes them look better?

Re:I wonder

[Hal_Porter]

I like the way Opera is doubly secure. Firstly it's a minority platform, secondly Opera are quick at patching vulnerabilities.

Opera kicks the ass of both Firefox and IE in my subjective 'elegance' benchmark too.

The only thing I wish they'd do is to run the Opera process in a low privilege protected mode on Windows like IE7+ uses on Vista and later. That would make it hard for any exploit to get from the browser process into your system.

It's not foolproof of course - see here (this exploit was fixed in Vista SP1)

http://www.uninformed.org/?v=8&a=6&t=pdf

Still nothing is foolproof. Defence in depth is still it good principle. Mozilla are considering it in FF too

http://mozillalabs.com/blog/2006/08/labs-ideas-to-investigate-survey-results/

Re:I wonder

[commodore64_love]

>>>Just another BS FUD report

You may be right but I still am fearful. I've been loyal to the Mosaic/Netscapee/Firefox line since the birth of the web, but now I'm uncertain. I'm beginning to doubt if Firefox is the browser for me. Maybe I should switch to Opera (least vulnerable) or Microsoft Explorer (a close second)???

Hmmm. K-meleon might also be a good choice

Re:I wonder

[Bilbo]

Unfortunately, this little factoid will be quoted by marketing droids and microsofties for years to come... :-(

Re:I wonder

[GumphMaster]

In what way is a Microsoft Certified Partner not financially tied to the maintenance of the Microsoft ecosystem in the face of encroaching offerings, particularly in the browser space?

A more cynical person might assert that a company peddling security assessment tools for web servers would actively promote less secure server systems that kept them in business. Spreading FUD about a browser is only peripheral to that but it does feed the "non-Microsoft is bad" or "open-source is bad" ethic of senior management and bean counters... keeping major systems on Microsoft platforms and Cenzic in business. As I say though, you'd have to cynical ;)

Re:I wonder

[RenderSeven]

If Bing has less info on Cenzic, it *proves* they are secretly allied with Microsoft!

Re:I wonder

[Bigjeff5]

Safari is not open-source, WebKit is. Prove me wrong by finding a copy of Safari 4's source code. Yeah, didn't think so. The vulnerabilities aren't necessarily related to the browser engine (though they certainly can be).

From what I understand the report was based on the number of vulnerabilities patched, not announced. for IE these are released every tuesday of every month, for FireFox I believe they are released whenever they are finished.

Vulnerabilities patched is a decent indicator, because for closed source you would not know about any unpatched vulnerabilities that were discovered internally (and there are a lot) before patching. Any serious vulnerability that MS knows about MUST be patched for IE, for if it is discovered they knew for any extended period about a serious vulnerability and did nothing, they risk losing the confidence of their business partners.

So despite the fact that some people, particularly open-source advocates, don't trust MS to patch vulnerabilities, it is certainly in their best interest to do so. The evidence is the speed and number of vulnerabilities they patch.

I don't think severity would help the metric in favor of Firefox or Safari because serious vulnerabilities get patched as quickly as possible on all sides (except maybe when Safari devs don't consider a severe vulnerability severe, heh), and a large portion of patches that MS releases for IE are less than critical.

With the most recent versions of IE Microsoft has really cleaned up its act in regards to security, and they have the ability to be the best at it if they choose to be.

Patched vulnerabilities may not be the best metric, but I think you'd be hard pressed to find a better one.

Re:I wonder

[Barny]

Possibility that if the majority of the document is on server level stuff, then did they maybe test IE with "enhanced protection" that comes with server? Effectively its like firefox with no-script but has none of the user-friendliness of no-script.

Re:I wonder

[Anonymous Coward]

As are IBM, Oracle, Sun and the majority of the IT world. hell even a lot of open source companies are. being a Microsoft certified partner is hardly being financially tied to MS.

Re:I wonder

[eulernet]

If we continue Cenzic's approach, we can prove that IE6 is the most secure browser, since there are no more patches for it.

Re:I wonder

[rgviza]

you can use telnet client to exploit sql injection. No browser necessary, just a socket connection and some type of terminal connected to port 80

telnet www.host.com 80
and type some request headers ; )

Re:I wonder

[Runaway1956]

Ditto what Mage Powers said. There's zero information in TFA, and little more in PDF. FUD, for certain.

If the talking chimps care to publish meaningful information, I'll be happy to read it. At this point in time, there is nothing to agree or to disagree with.

Sensationalist headlines, nothing more, and nothing less. Wonder how much Microsoft paid them for this "story"?

Re:I wonder

[rgviza]

NICE! So Cenzic is a FUD machine and it's not even competent FUD at that.

Typical...

Re:I wonder

[Bigjeff5]

So I'm assuming you don't trust surveys sponsored by rivals of MS either, right?

Right?

No?

I thought so. You just don't like the results. If the methodology truly is flawed, Firefox and Safari can hire another company to do another survey. If the results are the complete opposite, then we know one or both surveys are complete bullshit, and we can't really trust either without a truly independant survey.

I don't know if you know this, but survey companies don't do this kind of work for free. They can't. If Mozilla and Apple aren't interested in a fair and balanced survey, but Microsoft is, MS has no choice but to foot the bill for it themselves. The opposite is also true, as is the inverse (if MS wants a manipulated survey, they have to pay for it). Regardless of who wants it done or how fairly and accurately it is done, Cenzic is not going to do it without money.

If you really want to cast doubt on the survey, why not attempt to verify their results? You're commiting a classic logical fallacy (circumstantial ad hominem) I see here on Slashdot a lot - especially regarding MS. That this company has done business with MS in the past does not make their claim false. No matter how much you wish that were so, it is not the case.

You've also fallen victim to the "poisoned well" fallacy - you believe the things you've heard about MS's motives, and therefore any information produced by MS must be false. This is foolishness. Be skeptical, but don't outright assume that because it came from MS it is wrong. You are doing yourself a great disservice by thinking this way.

With all that said, I can confidently say that I have absolutely no idea how valid this survey is. It seems pretty legitimate to me but I haven't exactly scruitinized it either.

Re:I wonder

[Yvanhoe]

I understand it as "44% of uses who exploited a flaw used firefox to do so". I think these statistics are completely irrelevant.

Re:I wonder

[Bigjeff5]

How many of these vulnerabilities were due to Firefox itself, and how many due to plugins?

Does it matter? If FF allows the plugins enough control over the browser to present a vulnerability in the browser, then that's a vulnerability in FF that they need to fix.

Saying "oh no, we don't have vulnerabilities ourselves, we just allow vulnerable plugins to run" doesn't speak much to the security of Fire Fox.

In other words, the cop-out doesn't fly. If FireFox is vulnerable to something another browser is not, it has one more vulnerability than that browser, period.

Re:I wonder

[tbannist]

Most of your analysis just seems completely wrong. Microsoft has left vulnerabilities unpatched for years after they were to disclosed before, I see no reason they wouldn't do it again. In theory their business partners might lose confidence, but let's be frank most of Microsoft's business partners are entirely reliant on Microsoft, it'd takes years for them to make any significant changes. Effectively Microsoft can do whatever it wants, and it has.

Vulnerabilities listed in patch notes are not a good metric for determine which browser is "most vulnerable" because patch notes can be easily gamed by a closed source company. Simply roll up a bunch of nominally related bugs into one patch and suddenly your browser is more secure than the competition. It relies on the all of the groups involved acting in good faith which is naive at best.

Yesterday Microsoft released a patch for IE that prevents a drive-by rooting of your computer on all versions of Windows (Except 7 and 2008 R2) and all versions of IE. Sure. And yet it's somehow supposedly to be more secure than Firefox?

We've heard the same tired refrain from Microsoft sponsored people every time they target a new company. They pay people to make up statistics and lie about the competition. I, for one, am tired of it.

Re:I wonder

[fj3k]

My personal favourite section is the 'HTTP Probes and Attacks Statistics'. It's just the way it's done.
"Microsoft fixed blah",
"Apple fixed blah, which would otherwise cause end-of-world",
"Problem found in Oracle which can cause end-of-world",
"Problem found in Microsoft, but it's been fixed so only dumb-dumbs affected".

Well, that's the gist anyway.

Re:I wonder

[Bigjeff5]

Bingo, all I see are logical fallacies attacking Cenzic because people don't like the results. You don't dispute bad results by saying the source of the information is evil, because that has absolutely no bearing on whether or not the results are factual.

Re:I wonder

[Bigjeff5]

Pfft, everybody knows Lynx is the most secure browser.

In truth I trust no browser, I read straight HTML. You would not believe how hard it is to get ASP pages to render...

Re:I wonder

[WinterSolstice]

Just use links :D

Never seen a real vulnerability in that.

Re:I wonder

[h4rm0ny]

Well what you give matters for overall security of the Internet. But obviously what matters for individuals choosing a browser (for themselves or others), is which browser is the most vulnerable which is what this article discusses.

And if you're making the sly argument that IE remains more damaging even if it has fewer vulnerabilities because of its popularity, then I'll point out that the logical response to this news, is to get more people using it. Although as it isn't mentioned in the summary, the best response would be to get people using Opera which has far less reported vulnerabilities than any of the other browsers by a wide margin. (No record of my favourites Konqueror and Links, however. ;)

Re:I wonder

[Bigjeff5]

If it's a flaw in how the OS handles a legitimate request from the browser, then it's a flaw in the OS.

OF COURSE you wouldn't count that. There have been similar flaws that were exploitable via ANY browser, and those would not be counted against the browsers either.

Another way to look at it, is did they have to fix IE to fix the problem? If no, it's obviously not a problem with IE. It's like saying code injection via a browser vulnerability is an exploit in your router - of course it isn't, it's an exploit in the browser. Same thing with this issue, it was a problem in the OS, not the browser.

Re:I wonder

[h4rm0ny]

Sensationalist headlines, nothing more, and nothing less. Wonder how much Microsoft paid them for this "story"?

If Microsoft paid them for this story then why is Opera light years ahead of IE ? Opera's success also undermines the statements of other posters elsewhere saying that IE earns its place due to its close-sourced nature.

Re:I wonder

[PrescriptionWarning]

so then that means the microsoft comparison is as follows:

My house is falling apart and the roof leaks.

You can't tell because there's a giant tarp made of proprietary cloth under the shingles that magically appears to absorb all the water. By the way have you noticed the bathroom tile is all moldy and it gets a bit drafty in here?

Re:I wonder

[Anonymous Coward]

Well it seems Opera are not too impressed with the report either, despite the fact they come first:
http://my.opera.com/haavard/blog/2009/11/10/cenzic-security

Which is interesting. Not often you see a company criticise a report that shows them in such a good light

Re:I wonder

[Bigjeff5]

Ummm... ActiveX is a separate technology from web browsers, I'm not sure of the objection here.

ActiveX is how pre-.Net Win32 applications primarily accessed .dll's. They were a response to the dll problem programmers had in the Win95/98 era (essentially version control, but other things as well), and while they made things better we still had DLL hell. .Net nearly solves this, and makes ActiveX .dlls unnecessary, though now specific versions of .Net are necessary. Overall it's better though, as you can have more than one version of .Net on your system at a time.

There is a HUGE difference between generic Win32 ActiveX, and web-based ActiveX. The latter is a small sub-set of the former, and has been considered for many years to be a very insecure way of handling the web. Thus, IE since IE6 has generally wanted you to jump through several steps before allowing ActiveX content in your browser.

Re:I wonder

[lazybeam]

Opera is European, and you just know that makes them better by default! :)

Re:I wonder

[h4rm0ny]

You surely don't believe that any browser producer would open themselves up to the vast negative publicity of leaving exploits in their browser for the sake of piddly stats in some minor survey, do you? Which headline would you rather see? IE 0.2% more vulnerable, or "IE still has well-known security hole X six months after it was discovered"?

Re:I wonder

[somersault]

Well, because you could choose to run without certain plugins to be safer. I'd think that a plugin should be able to do *anything* on the system? Once the plugin is running it can presumably present vulnerabilities without the browser itself having to be directly involved in the process. Say if you view a maliciously formed PDF. How can you possibly blame Firefox for Adobe's PDF reader having a bug? I think that situation did occur earlier this year.

Blaming Firefox for vulnerabilities in 3rd party plugins is like blaming MS for some third party drive partitioning software you just downloaded screwing up your system. I'm pretty sure you need to allow root access to install plugins at least in Ubuntu, so they really have the potential to do anything.

Re:I wonder

[roc97007]

We see the latter headline often enough. I'm saying that issues like this put pressure on a company to do the wrong thing. What actual effect this has depends on a variety of factors.

Re:I wonder

[somersault]

Yeah, there's a big difference between fixed vulnerability, unknown vulnerability, privately known vulnerability, publicly known vulnerability, and exploited vulnerability.. if they're not measuring everything apart from the unknown vulnerabilities, and not noting the actual potential damage and exploitability of each one, then trying to draw any useful conclusion is pretty difficult.

I knew it had to be a bunch of FUD. I'm open to the idea that FF could be more holey than IE, it may happen one day.. but I really wouldn't bet on it.

Re:I wonder

[DarkAxi0m]

you forgot space alignment factor and the dice roll.... *sigh*

(number of browsers with vulnerability) x (damage possible if vulnerability is exploited) x (chance of actually exploiting the vulnerability) / (the alignment of the moon and mars) + 2d6.

Re:I wonder

[Bigjeff5]

14% authentication (what sort of authentication flaws?)

Server X accepts client Y as authentic, but client Y is not authentic. It does not matter how you arrived at the mis-authentication if all you are doing is tallying the number of authentication failures.

8% browser ? (What does that mean?)

The browser itself has an exploitable vulnerability.

7% code injection (injection into where?)

Running memory on the OS, that's where all code injection goes.

To relate it to the SQL stat, SQL injection would be injecting SQL into a running database query.

Does that help?

Re:I wonder

[Bigjeff5]

You realize they actually do that when building houses, right?

Tar paper and Visqueen go all over the house before the outer shingles (or whatever roofing/siding material you use) go on. It creates a moisture barrier that keeps any leakage that may get through the shingles from actually entering the house. It takes a hole in BOTH layers to cause a leak. They like to call these "vapor barriors", as they go beyond preventing large droplets of water through and actually seal the house from vapor if properly applied. It's simple, cheap, and critical to preventing mildew problems later on.

In other words, geeks should really stay away from making construction analogies unless they are construction geeks, because you pretty much made the opposite point you were going for.

Re:I wonder

[timmarhy]

your tirade should be pointed at apple as well then. they are closed source AND had a shitload of vulnerabilities, as well as having a record of not rolling out patches quickly. whats your excuse for them?

maybe you should take a good hard look at OSS supposed security prowess, if you really were so confident firefox is more secure then IE, you wouldn't get so defensive.

Re:I wonder

[RiotingPacifist]

Server X accepts client Y as authentic, but client Y is not authentic. It does not matter how you arrived at the mis-authentication if all you are doing is tallying the number of authentication failures.

But are we talking failure of cookies, MITM attacks, replay attacks, authentication is too vague!

The browser itself has an exploitable vulnerability.

But how does that compromise a web app? XSS?

Running memory on the OS, that's where all code injection goes.

How do you get from webserver running as it should to ...code injection, that is the tricky part.

Re:I wonder

[Bigjeff5]

Telnet is also pretty much universally disabled on outward facing (web) servers, and nearly universally disabled on inward facing servers. Microsoft desktop and server products have disabled telnet by default since at least Windows XP, so catching someone who doesn't know better is even a long shot.

I wouldn't suggest you hinge your massive scheme to conquer the world on the ability to do anything at all with telnet.

Re:I wonder

[Bigjeff5]

I'm not sure I agree, Firefox should be vetting the plugins it allows to attach to it. Also, the plugins are tied to the browser, so any vulnerability that pops up is at least indirectly related to the way the browser handles the plugin.

In any case, if we are making a distinction between plugins and extensions (I assume we are), then IE has just as many plugins as Firefox, and that should not be the cause of the disparity unless there is a fundamental flaw in the way Firefox handles plugins. If we are including extensions, then I think it's very much Firefox's fault for allowing what should be low priority, sandboxed code to do damage to the system.

Re:I wonder

[supernova_hq]

Same time we stop making fun of Brittney. WHEN IT'S DEAD!

Re:I wonder

[markus o'farkus]

Disabling telnetd is not the same thing as "disabling telnet".

You are correct that telnetd is almost never enabled on servers. That just means a telnetd server that allows insecure login isn't running on port 23.

You can easily use the telnet client (even on Win XP) to connect to services on other ports, like port 80. Just as was suggested above.

When I admin or support mail systems, I use telnet all the time to connect to port 25 to simulate a SMTP session.

Re:I wonder

[kestasjk]

I'm a firefox user and I accept this study and that IE8 may well be more secure. They have made huge leaps in security since IE6, using sandboxing and whatnot to lessen the impacts of vulnerabilities found as well, and their security zone settings allow fine-grained choices regarding how secure you want to be vs what you need to run, and the integration with Active Directory allows security policy to be spread across enterprises easily.
Firefox is much more tuned to individual users, and needs extra plugins like NoScript to give rudimentary access level controls.

But Firefox supports the latest and greatest web standards, has a real community of users which make great plugins like NoScript and Adblock and Firebug, and is always trying new things like the awesome bar. If I wanted tin-foil-hat level security I'd use IE8 with a restrictive security policy, but realistically these days the difference between highly secure and pretty-damned-secure isn't that great; you're more likely to get a virus by being a dumbass and installing something you shouldn't than from an actual web-browser vulnerability.

I do think trying to find flaws in the study and questioning the motives when it doesn't look favorably on your favorite browser, as most people here are doing, is just narrow minded and petty.

Re:I wonder

[danielsfca2]

Telnet is not just port 23. Telnet lets you send and receive text to any port including those used for other protocols like HTTP. For example, on a UNIX machine you can do this:

$ telnet slashdot.org 80
Trying 216.34.181.45...
Connected to slashdot.org.
Escape character is '^]'.
Host: slashdot.org
GET / HTTP/1.1
... and press return twice, then the server will respond with the HTML page you requested.

The GP's point was, you could telnet to the HTTP port and post SQL injection. Not that using telnet on port 23 is common anymore.

Re:I wonder

[Bigjeff5]

But are we talking failure of cookies, MITM attacks, replay attacks, authentication is too vague!

I'm not sure why you think it's too vague, they are counting the number of authentication failures, which would include all of those.

But how does that compromise a web app? XSS?

It wouldn't compromise the app itself, it would compromise the client running the app - the end user attempting to use the application. If it were an ordinary software application, you would say the compromise happens at the keyboard interface, before it even hits the application. A rough analogy, but not too far off.

How do you get from webserver running as it should to ...code injection, that is the tricky part.

The first form of code injection was the buffer-overrun. A poorly written piece of software would occasionally get into a situation where it did not allocate enough address space in RAM to process the data it was working with. Often it could be forced into this situation by another program. This would cause a hard failure, but leave the address space available. At that point, a separate application could take ownership of that address space, and inject its own code with the credentials of the failed program. If it's a piece of software that has lower-level access than a normal application would, then the system has been compromised.

Buffer-overruns were fixed pretty quickly, and pretty much don't exist any more, but all code injection techniques try to exploit a situation that allows them to do the exact same thing - inject their own code into the memory space of another application, thereby bypassing whatever security measures would ordinarily prevent it from running that code in the first place. Modern operating systems have various ways to protect against this, but a vulnerability in the application itself could still present problems - and of course a vulnerability in the OS could as well.

Code injection is the oldest class of security vulnerability there is (aside from physical theft), it is ever evolving and it is probably never going to go away. Any time you hear of a vulnerability that allows "arbitrary code execution", you're dealing with code injection of some sort.

Re:I wonder

[awkay]

I don't wonder. It's unexplained statistics (which are just below "damn lies", if you'll remember). The fact is IE has a ton of unpatched vunerabilities...so if you are counting "patched vunerabilities", you'll get one distribution...if you count "unpatched vunerabilities", you'll see quite a different picture.

Re:I wonder

[quadelirus]

Doesn't matter if they are right or wrong, only matters if they have justification for their claims. For instance if you told me the earth revolved around the sun you would be right, but if your reason for believing it was that a guy in Omaha likes the sun and so keeps the earth revolving around it by use of his mind, I'd be crazy to believe that the earth revolved around the sun simply on your insane testimony. Similarly if people post comments right or wrong with a complete lack of justification, they aren't worth listening to. They are "right" by chance, but not by an actual argument/proof/reason.

Re:I wonder

[IgnoramusMaximus]

With all that said, I can confidently say that I have absolutely no idea how valid this survey is. It seems pretty legitimate to me but I haven't exactly scruitinized it either.

The "study" was conducted by methodology unknown, includes no references to raw data and goes completely against publicly available data (which many posters on this thread provided references to, such as the lists of CERT advisories and the like). This, combined with the fact that the company seems financially motivated to produce pro-Microsoft propaganda, leads sane observers to dismiss the thing out of hand.

So I'm assuming you don't trust surveys sponsored by rivals of MS either, right?

Why, yes! The value of a survey is in its methodology and 3rd-party verifiability, not in who produced the thing. Science and all that, no?

Re:I wonder

[initialE]

Just about anyone can be a Microsoft Certified Partner. All you have to do is make the sales quotas.

Re:I wonder

[webdog314]

Hmmm... You could measure (somehow) the number of people who were pissed off that their computer was infected/hacked/etc.. by their web browser. After all, it's the end result that matters, not so much the vulnerability itself. (Customer complaints perhaps?) Of course, that assumes that the average user would even be aware that they are infected/hacked/etc...

Re:I wonder

[cheeseboy001]

That's a dude's blog. As in, "The views stated herein are my own, and do not necessarily represent those of Opera Software."

Re:I wonder

[ae1294]

Same time we stop making fun of Brittney. WHEN IT'S DEAD!

Now now don't lie to the man as we will still be making fun well after both are dead.

Re:I wonder

[t_ban]

Google's got nothing (and bing has less).

Wow, negative information? Doesn't that somehow violate the second law of thermodynamics, or Shannon's theorems, or Hawking's postulates, or whatever?

Re:I wonder

[BitZtream]

Uhm, who ISN'T a Microsoft Certified Partner? Most businesses are simply because they are in business to make money and if you do just about any sort of sales you can be a MCP and get free benefits from MS including referrals for customers.

The only companies who are MCP are basically zealots who want to brag about not selling MS products, which to most sane people these days, bragging about what you don't sell while people are not spending money is rather retarded.

Our company is an MCP and we freaking HATE MS with a passion, but the reality of it is, we'd be cutting off the majority of our income if we didn't deal with MS software. We our proud to support several OSS projects in both financial and code contributions, we just no so stupid as to turn away money based on some silly irrational need to avoid MS.

Why didn't you go ahead and throw in the 'Symantic makes viruses for NAV to have something to detect!?@$!@$!%@5' ignorance too?

Re:I wonder

[BitZtream]

about every 6 months

I think you meant 6 hours, the current average rate for slashvertisements is about 1 per 6 hours.

Re:I wonder

[BitZtream]

You would be making an very ignorant assumption. Very few bugs are going to be OS specific.

FF running in proper setup from Win2k forward would be no more dangerous. By proper setup I mean running as a standard user without permission to modify parts of the system that aren't their own. I.E. no write permissions to various registry and fs paths outside of those that should be owned by the user.

Re:I wonder

[BitZtream]

IE is no closer tied to the OS than webkit is to OSX. Its not part of the 'core OS' or anything, its just a common set of code used by just about every app because MS embraced HTML and supports it in just about ever app.

It isn't tied to the OS and never has been, contrary to popular belief. Thats like claiming WebKit is tied to Linux because its used as a HTML renderer in a lot of KDE apps.

Re:I wonder

[BitZtream]

Uhm, both plugins and extensions can and do run native code. They are the same from a security perspective, if one is exploitable the whole browser is because of it.

Re:I wonder

[GumphMaster]

OK. <sarcasm>Symantic makes viruses for NAV to have something to detect!</sarcasm>

Your argument is that your company is an MCP because it makes financial sense to be, and that to not sell Microsoft product would be financially difficult. I'm not disagreeing with you, it is precisely my point: Cenzic rides the Microsoft gravy train, and to a degree needs that to survive. They are, to a degree, financially coupled to Microsoft's fortunes which is the question that was posed.

On another note. I'm not ignorant you insensitive clod.

Re:I wonder

[Alex Belits]

I'm not sure I agree, Firefox should be vetting the plugins it allows to attach to it.

And verify what, that they are not written by idiots?

Do you understand that you can't install a plugin remotely? That it's a program that a user has to install before it can do anything?

Also, the plugins are tied to the browser, so any vulnerability that pops up is at least indirectly related to the way the browser handles the plugin.

Actually now Mozilla plugins are used by all browsers that are not IE. Firefox EXTENSIONS are browser-specific, however they are rarely contain vulnerabilities unless they are full-blown trojans distributed in as extensions.

Re:I wonder

[mcrbids]

You on't agree that Microsoft is in the wrong. You are posting on Slashdot. Therefore, you are a Microsoft shill.

LEAVE, YOU HEATHEN!

Re:I wonder

[h4rm0ny]

We do see such headlines occasionally/i>. And the browser makers HATE them. A long-standing and public vulnerability earns Microsoft (a different standard is applied for Mozilla) a lot of bad publicity. Patching it would earn them (in this report) an extra 0.1% score (or something like that).

That Microsoft leave vulnerabilities due to error or inadequate resource allocation, I can believe. That they do so deliberately to game some minor survey - I can't find plausible.

Re:I wonder

[Serious Callers Only]

your tirade should be pointed at apple as well then. they are closed source AND had a shitload of vulnerabilities, as well as having a record of not rolling out patches quickly. whats your excuse for them?

Why should the grandparent have an excuse for Apple? What they are pointing out is that Microsoft have links to the article sponsors, who depend on Microsoft for a living, they have a history of this sort of FUD, and have recently seen a very serious drive-by vulnerability in all versions of IE. Any argument that IE is more secure than Safari or Firefox is laughable given the number of in the wild exploits for the relevant programs in the past, and the likely pattern of the future. I'm sure Microsoft will continue to churn out statistics showing that their software has always been more secure, and if you believe these made up statistics, more fool you - it's easy to massage the figures, and there's no way I'd trust a set of statistics from anyone with close links to a browser vendor, be that Apple, MS or Mozilla.

To pick a small problem with the statistics - this report covers two quarters in 2009, hardly enough to make any kind of meaningful comparison.

Also, Safari is not closed source in the way that IE is, almost all of it is open source.

maybe you should take a good hard look at OSS supposed security prowess, if you really were so confident firefox is more secure then IE, you wouldn't get so defensive.

Just like the article, this argument is content-free fluff.

Re:I wonder

[Serious Callers Only]

So I'm assuming you don't trust surveys sponsored by rivals of MS either, right? No? I thought so. You just don't like the results.

Do you often argue with yourself?

What makes you jump to the conclusion that someone who mistrusts this bullshit report wouldn't also mistrust bullshit reports from companies with ties to other browser vendors?

This study covers 2 quarters (a statistically meaningless sample), runs against all verifiable statistcs from the likes of CERT, gives no basis for its figures, and contains just one pie chart to back up its conclusions. It's patent nonsense.

You clearly haven't looked very closely at the survey, and are subject to the same happy ignorance you accuse the poster above of.

It seems pretty legitimate to me but I haven't exactly scruitinized it either.

QED

Re:I wonder

[CountBrass]

It also says nothing about the size of the vulnerability.

"Something in IE allows an attacker to take-over your machine" is somewhat different from "A flaw in the webkit api allows the setting of an invalid colour in 13pt Arial bold fonts". (Obviously I've made these up just to illustrate my point).

Re:I wonder

[MoeDumb]

" . . . for if it is discovered [MS] knew for any extended period about a serious vulnerability and did nothing, they risk losing the confidence of their business partners." --- Do MS business partners have confidence in MS? Or is it they simply have no choice one way or the other.

Re:I wonder

[Sean Hederman]

And I for one am tired of hysterically anti-Microsoft bigots. Microsoft USED to play the games you indicated around security issues and it got them smacked by security researchers and the public at large. Since then they have been remarkably forthright about security issues, and probably have one of the most open and transparent security disclosure policies of any browser company. Not as open as an OSS browser, sure, but LOT better than Apple as an example.

• Claim: MS is leaving major vulnerabilities unpatched.
  Reality: No evidence to back up your assertion. All major vulnerabilities discovered by the "outside" world are patched swiftly, and there appears to be no good motive to support such behaviour on the part of MS
• Claim: MS are fudging the patch notes.
  Reality: No evidence to back up your assertion. Do you think that if notes were being "gamed" in this way it would have remained unnoticed for so long? Conspiracy theory logic.
• Claim: A single recent vulnerability, swiftly patched proves that IE is overall more insecure than Firefox.
  Reality: Anecdotal evidence is not significant over large data sets. Do you also use magnets to remove pain? Cast horoscopes?
• Claim: Cenzic is being paid by Microsoft.
  Reality: No evidence to back up your assertion. Requires a reputable security company to put its reputation on the line for a potential tiny uptick in IE acceptance. Conspiracy theory logic.

The reality is that the "given enough eyeballs, all bugs are shallow" law is not totally true for security. Dedicated and trained people doing comprehensive end to end security analysis is required to make a truly secure product. This is tricky to arrange in OSS development, since security work is boring grunt work, developers do not relish it and rarely volunteer for it. Admittedly, such work is also normally not done in proprietary companies either, due to the cost implications. When it IS done however, we should expect that the proprietary product will be tend to be more secure than the OSS one, simply because of the dedicated focus that can be applied.

Microsoft has a lot of backlog to overcome in terms of security, so given that we should expect to see it's products become more and more secure until they begin to overtake the OSS competition. Assuming their focus remains, of course. This is precisely what we are seeing for browsers, and seeing the beginnings of with operating systems as well.

Do I use IE? Nope, hate it with a passion. I find it buggy, it renders poorly, and it's slow. But it appears I can no longer call it insecure, because the evidence suggests that it's not anymore.

Re:I wonder

[FormOfActionBanana]

You, too, may be an idiot:

"Of the Web vulnerabilities, Web Browser vulnerabilities comprised eight
percent of the total vulnerabilities found, and Web servers comprised two
percent. Vulnerabilities in the code of commercial Web applications was 90
percent of the total Web related vulnerabilities."

Re:I wonder

[TheThiefMaster]

Try this:
telnet www.google.com 80
GET /search?q=telnet+http HTTP/1.0
Host: www.google.com

(ending in a blank line)

You should get a html response from google, which begins like this:

HTTP/1.0 200 OK
Cache-Control: private, max-age=0
Date: ##
Expires: -1
Content-Type: text/html; charset=ISO-8859-1
Set-Cookie: SS=Q0=##; path=/search
Set-Cookie: PREF=ID=##:TM=##:LM=##:S=##; expires=##; path=/; domain=.google.com
Set-Cookie: NID=28=##-##-##; expires=##; path=/; domain=.google.com; HttpOnly
Server: gws
X-XSS-Protection: 0

...and is then followed by the html for the google search results page for telnet http. In other words, it's perfectly possible to make a request to a web server using telnet, including performing a query (in this case a google search). If that query was an SQL injection, someone would have an exploited database on their hands.

Re:I wonder

[paganizer]

It's safe for microsoft to give kudos to opera, because their is almost no chance that an IE user will switch to opera; disaffected IE users already switched to Firefox.
I think Opera gets the most of it's users from Diehard netscape fans and people who switched from macs.
Since TFA has essentially no details about how they did their study, I will continue to use Seamonkey and firefox, and continue to worry about which of my plugins is trying to kill me.

Re:I wonder

[TheThiefMaster]

Your GET request and your host header are the wrong way round. It's request first, then headers (including host).

Re:I wonder

[horace]

Compare this comment to Big Jeff's earlier work:

How many of these vulnerabilities were due to Firefox itself, and how many due to plugins? Does it matter? If FF allows the plugins enough control over the browser to present a vulnerability in the browser, then that's a vulnerability in FF that they need to fix. Saying "oh no, we don't have vulnerabilities ourselves, we just allow vulnerable plugins to run" doesn't speak much to the security of Fire Fox. In other words, the cop-out doesn't fly. If FireFox is vulnerable to something another browser is not, i t has one more vulnerability than that browser, period.

Big Jeff, you appear to put a lot of time in on Slashdot. Do you do it for a living?

Re:I wonder

[h4rm0ny]

t's safe for microsoft to give kudos to opera, because their is almost no chance that an IE user will switch to opera; disaffected IE users already switched to Firefox.

Opera is not a minority browser. It just isn't very well known in the USA. It's actually hugely popular in Easter Europe and ex-Soviet countries.

Re:I wonder

[indifferent children]

In theory their business partners might lose confidence, but let's be frank most of Microsoft's business partners are entirely reliant on Microsoft

Besides, Microsoft's business partners don't have any confidence in Microsoft, and haven't for years. They just can't stomach the cost and disruption of switching to a different platform.

Re:I wonder

[indifferent children]

Why would you compare perfectly honorable Heathens to Microsoft shills?

Re:I wonder

[V!NCENT]

Don't even bother asking. This article is one bug FUD and trolling... Everybody knows IE8 is the most vulnerable browser. Fucking period.

Re:I wonder

[indiechild]

Way to change the topic eh?

Re:I wonder

[indiechild]

Witness the rise of the Microsoft apologists on Slashdot. Your arguments are inconsistent and puzzling!

Re:I wonder

[cupantae]

Opera is closed-source

Re:I wonder

[hmar]

It might be interesting to see if the open source parts of Safari (webkit) had more vulnerabilities listed (reported) than the closed. Another thing to point out is that IE and Opera have only their own eyeballs on the code to find and fix vulnerabilities, whereas FF and (for parts of it) Apple have the eyes of anyone interested. I would think that this alone would make finding vulnerabilities a much faster process, no gaming even needed.

Re:I wonder

[hmar]

But it will be okay, because they will be shouted down by OSS and Apple fans, finally make use of the more embarassing members of those two communities.

Re:I wonder

[h4rm0ny]

Yes, that's what I said. Well done. ;)

Re:I wonder

[Eskarel]

That said, the CERT advisories aren't really all that accurate either since I think you'll find that a lot of them are for IE6 which even Microsoft will tell you is a steaming pile of shit.

IE8 is a hell of a lot better(though not enough to make me give up firefox, noscript and firebug), and Microsoft are really starting to get their act together for whatever reason. They've screwed up in the past(as have most companies that have been around that long, and they'll almost certainly screw up in the future, but they are getting better lately.

Re:I wonder

[Eskarel]

That might be true, but no one sells IE for cash, and all the alternative browsers in the world haven't made a dent in Windows sales.

Re:I wonder

[EndlessNameless]

Agreed. CVEs or it doesn't count. User vendor-supplied metrics of any kind (patch count, especially) is just begging for a chance to get it all wrong.

Since Cenzic *never* explains its methodology for enumerating vulnerabilities and then identifying which software is vulnerable, this article is of no merit whatsoever.

And if they're going to count vulnerabilities by browser, they should indicate which ones. They don't break it down by version or architecture, so the pie graph conveys no useful information. Who cares if the Firefox 2.x.x branch or IE7 was vulnerable in 2009---only the people still using them.

Cenzic needs to either explicitly state that this always counts only the latest version (didn't see this indicated), or else clarify which versions were assessed and update the breakdown accordingly.

This paper is an F. Convey useful information or at least put in some biker chicks.

Re:I wonder

[cupantae]

Well, how I interpreted the statement
"Opera's success also undermines the statements of other posters elsewhere saying that IE earns its place due to its close-sourced nature"

was
"Opera, being open source and receiving a good review here, refutes the idea that closed-source browsers are going to come off better since the rating is based on public patches."
...which wasn't what you meant, but is a valid way of reading it.

Re:I wonder

[Millennium]

Just like a browser is not the Internet, telnetd is not telnet.

As you say, telnetd -the daemon which lets you log in over telnet- is disabled on most machines, and for good reason. But this is not the only thing telnet can be used for. In fact, almost all standard Internet protocols -HTTP, NNTP, IRC, both POP and IMAP, SMTP, and so on- can be used through a telnet client, and this is by design: there's no way for the server to necessarily tell that you are using a telnet client as opposed to any other kind. This doesn't give you a shell login (though it may give you other kinds of logins, as defined by the protocol you're using) but it does let you use the protocols in the usual ways.

I could use telnet to access almost any Web server. Doing this is not necessarily convenient, but it makes for a great debugging tool. It can also, on occasion, be used for exploits in buggy servers.

Re:I wonder

[EndlessNameless]

//It seems pretty legitimate to me but I haven't exactly scruitinized it either.//

Then scrutinize it or STFU. Arguing about the legitimacy of a document you haven't examined must violate some rational principle.

The flaws are so glaringly apparent that you don't even need specialized knowledge of computers---general critical examination is entirely sufficient.

1. Undisclosed methodology (you'd need background to assess the methods but not to recognize the lack of disclosure)

2. Lack of clarity in conclusion (which versions of the software and on which OS/architecture)

In and of itself, point 1 is damning in any study or technical document. //Be skeptical, but don't outright assume that because it came from MS it is wrong.//

Being skeptical means refusing to accept proposed "facts" until there is a weight of evidence in their favor. The proper response to any document is to examine it for rational or technical flaws and to examine the motive of its proponent in publishing it.

Re:I wonder

[h4rm0ny]

I could have put it more clearly.

Regards,
H.

Re:I wonder

[Hatta]

From what I understand the report was based on the number of vulnerabilities patched, not announced

The pdf of the report is linked from the article. Browser vulnerabilities are mentioned on only one page, on which no methodology is discussed. Most of the article has to do with web applications. For the web applications, they repeatedly use the term "reported vulnerabilities", not patched. They do discuss that the number of actual vulnerabilities may be lower than reported vulnerabilities for proprietary web applications. I'd bet they're using reported vulnerabilities for browsers too. Here is the entire text of the section on Web Browser Vulnerabilities:

Vulnerabilities in Web browsers were concentrated among four popular technologies -
Internet Explorer, Mozilla Firefox, Opera, and Safari. The number of browser
vulnerabilities in first half of 2009 comprised about 8 percent of total Web vulnerabilities.
Mozilla Firefox had the largest percentage at 44 percent. What was surprising was that
the Safari browser had a lot more vulnerabilities at 35 percent this time around mainly
due to vulnerabilities reported in iPhone Safari. Internet Explorer was third at 15 percent
and Opera with six percent of total browser vulnerabilities.

So this report is entirely useless. They don't discuss their methodology, which is likely to be suspect. Ignore it.

Re:I wonder

[dcw3]

It's actually hugely popular in Easter Europe

Did the Vatican take over?

Re:I wonder

[danielsfca2]

Damn! I knew I had something wrong, because it actually wouldn't work, as soon as I added the host header. (and without the host header it just sent me a 301.)

Thanks for the correction.

Re:I wonder

[SharpFang]

But MSIE -IS- (or was until quite recently?) the generic Win32 ActiveX "Web Browser" control plus a wrapper GUI application (or if you prefer, a web browser application with the ActiveX "Web Browser" control at its core).

Who is to say the listing doesn't include all exploits that affect said one single generic ActiveX control from whichever wrapper/browser it was called under a common class "ActiveX" and lists MSIE only for exploits that are MSIE-specific?

I saw a Secuina list similar to today's the other day. It listed counts per browser and per browser subsystem. MSIE was the worst, with ActiveX exploits comprising some 80% of its count. The count [MSIE (whole)] and [MSIE(whole) minus (MSIE->ActiveX)] looked strikingly similar to this article's [MSIE + ActiveX] and [MSIE alone] respectively, here.

Re:I wonder

[DaVince21]

Chrome has add-ons too now, and every time you install one it warns you that it *might* make your system more vulnerable. Basically, same story as all other modern browsers supporting plugins (with the exception that Chrome uses seperate processes and yet has only a very small percentage of users, making it not so important to people with the wrong intentions).

Or are you using lynx or something?

Re:I wonder

[TENTH SHOW JAM]

Read the article and the attached PDF and there was no mention of their rationale of testing. These numbers could be based on tests and they could be based on the lower torso. I'm not saying they are shills for anyone, but this is "NOT NEWS" until they give us the rationale for coming to these conclusions.

Re:I wonder

[h4rm0ny]

Shhh... Don't tell Dan Brown! ;)

Re:I wonder

[Idiomatick]

How'd I get modded down for following through and doing research? ...

Re:I wonder

[supernova_hq]

I didn't say "immediately" after. Just that it most definitely won't be before :D

Huh?

[Anonymous Coward]

So just down the page on slashdot, this very day, there are warnings about a "Windows kernel vulnerability" that is exploited through IE. I'll take three cross-site scripting bugs any day over a kernel level compromise, thank you.

I know the world doesn't have a good objective measure of "impact" to assign to these things so that one could assess the total "probable inconvenience" of the presented security vulnerabilities, and that makes unbiased data gathering difficult, but this feels pretty absurd.

Re:Huh?

[Anonymous Coward]

So just down the page on slashdot, this very day, there are warnings about a "Windows kernel vulnerability" that is exploited through IE. I'll take three cross-site scripting bugs any day over a kernel level compromise, thank you.

I know the world doesn't have a good objective measure of "impact" to assign to these things so that one could assess the total "probable inconvenience" of the presented security vulnerabilities, and that makes unbiased data gathering difficult, but this feels pretty absurd.

The link for those too lazy to go find it:
http://tech.slashdot.org/story/09/11/11/0053244/Microsoft-Plugs-Drive-By-and-14-Other-Holes

Re:Huh?

[iPhr0stByt3]

It also states the vulnerability is not tied to IE, but IE provides a easy avenue of attack. Could firefox be tricked to exploiting the same OS vulnerability? yeah, with a little more work. Your argument is weak, even though I understand your frustration with the article.

Re:Huh?

[orzetto]

The link for those too lazy to copy and paste it into the address bar....

Certified

[rwv]

It seems a bit surprising to me that this study shows that only 15% of vulnerabilities are in IE.

There is an explanation for that.

Cenzic Recognized as a Microsoft Certified Partner, Experiences Substantial Momentum in Q2

Re:Certified

[MiniMike]

That makes sense, because if anyone had told me that Firefox had more vulnerabilities than all the other browsers I would think that they were certifiable...

Re:Certified

[captaindomon]

Eh, being a Microsoft Certified Partner means next to nothing. Almost all the development firms I have worked for (from five employees to tens of thousands) are certified partners, it just means you get a discount on MSDN purchases and a nice little glass trophy. It doesn't mean Microsoft is controlling you. (They may be controlling Cenzic, but you can't say that just because they are a certified partner).

Re:Certified

[xgr3gx]

Ha - I had a feeling there was some kind of connection.

Re:Certified

[cmeans]

And then there's this:

http://www.cenzic.com/pr_20061011/

Re:Certified

[random string of num]

anyone think the pie chart looks a bit like the windows symbol?

Re:Certified

[Anonymous Coward]

Eh, being a Microsoft Certified Partner means next to nothing. Almost all the development firms I have worked for (from five employees to tens of thousands) are certified partners, it just means you get a discount on MSDN purchases and a nice little glass trophy. It doesn't mean Microsoft is controlling you. (They may be controlling Cenzic, but you can't say that just because they are a certified partner).

Yea... not buying it.

Re:Certified

[PNutts]

Thank you. Looking at the website they actually have some credibility which is refreshing in the sensational knee-jerk world of IT security.

Re:Certified

[DJRumpy]

Yes, but it would have been much more believable had it been from an organization with no appearance of bias, or possibly a board of members made up of representatives from all the browsers being tested to ensure that there was no funny business.

Re:Certified

[Arthur Grumbine]

Of course not! The Windows logo colors go Blue, Red, Green, Yellow (moving clockwise). That chart is totally different!

Re:Certified

[adamchou]

You didn't mention how to become an MCP though. Its not just a matter of filling out a form and sending it to Microsoft. These companies go through a rigorous set of evaluations based specifically around Microsoft products in order to become MCP. So although Microsoft might not control them, their pocket books do and they sure as hell invested a lot of money to become MCP's.

Re:Certified

[harlows_monkeys]

Eh, being a Microsoft Certified Partner means next to nothing. Almost all the development firms I have worked for (from five employees to tens of thousands) are certified partners, it just means you get a discount on MSDN purchases and a nice little glass trophy

It means a lot if you ever sue Microsoft. I was involved in a lawsuit against Microsoft, and their lawyers made a big deal of the fact that we were "partners" with Microsoft. The painted a picture of Microsoft working in partnership with us to help us, and then we turned on them, and filed a lawsuit, rather than working it out like partners should.

We explained that it just meant we got MSDN from them, but I don't think the jury believed that. They are ordinary people--they don't think of the people they buy things from as "partners", and so are not going to think that's all being an MS partner means. I'm pretty sure they bought Microsoft's version, that partners have a special relationship with Microsoft, and what we were doing was a backstabbing.

Re:Certified

[tbg58]

So, let's see, they achieved their "Substantial Momentum in Q2" working on security problems in what section of the technosphere? Oh, they're a Microsoft partner. So whatever their report says they made most of their money as a security firm working on Microsoft systems? Follow the money.

Re:Certified

[BitZtream]

It really is as simple as filling out a form. You fill out your profile, agree to sell MS product, wait a few days for 'Approval' and boom your a MCP for a year, at the end of the year, you update your profile and you're renewed for a year.

There are plenty of things you can do to increase your level in the system, but becoming an MCP really is just a matter of filling out some forms.

I realize you didn't bother to look into it anymore once you saw the treeview in your browser, but this is slashdot and a halfassed look at a web page and ignorance has never stopped anyone from making a complete ass out of themselves so why should you be any different.

If you sell pretty much any number of products for Windows you should be a MCP and take advantage of the free crap you can get out of it. You can go be anti-MS and turn down sales potential all you want. Enjoy standing in line at the unemployment office.

Re:Certified

[adamchou]

It really is as simple as filling out a form. You fill out your profile, agree to sell MS product, wait a few days for 'Approval' and boom your a MCP for a year, at the end of the year, you update your profile and you're renewed for a year.

Oh sure, because all of us have established businesses that sell Microsoft products and services, sales histories, established customer bases, other MCP's to partner with, and federal tax id's to prove that we qualify for their requirements.

I realize you didn't bother to look into it anymore once you saw the treeview in your browser

Actually, my brother headed the project to get his company MCP certified and they sell RAID arrays. He went through a lot more than just filling out some forms. His hardware had to go through a lot of tests to get certified. So yes, I did look into it more than just seeing a treeview

but this is slashdot and a halfassed look at a web page and ignorance has never stopped anyone from making a complete ass out of themselves so why should you be any different

And this being slashdot, its not surprising that a pretentious ass like yourself would troll like this

You can go be anti-MS and turn down sales potential all you want. Enjoy standing in line at the unemployment office.

I never said I was anti-MS. In fact, I'm posting this from a computer running windows XP and I look forward to upgrading to Windows 7. But then again, this is slashdot so its not surprising to find people posting presumptuous stuff like this.

Anyone Got the List?

[eldavojohn]

In Cenzic's report that chart is entitled "Web Browser Vulnerabilities by Major Type" and web browsers are only given one page.

I looked through older reports and cannot find a list of "vulnerabilities by major type." Anyone know where to find that? Until you can point that to me, I'm not going to take much stock in a company which has an ad on the bottom of the article that reads:

Let us hack you before hackers do! The Cenzic website HealthCheck. FREE. Request yours now!

I'm sure one major category is "Win32 kernel exploits" while every piece of Gecko and Webkit qualifies as one major type.

Re:Anyone Got the List?

[polle404]

scanned the report quickly, it reads like a sales brochure, imho.

I did note a few things, though...

Key Findings: Sun Java, PHP, and Apache continue to be among the Top 10 vendors having the most severe vulnerabilities for the first half of 2009.

Top 10 Vulnerabilities of Q1-Q2 2009

1. phpMyAdmin Configuration File PHP Code Injection Vulnerability

Color me surprised... no mention of MS products and/or services?
on a list of "most severe vulnerabilities"?

who is cenzic?

[bl8n8r]

Just another consultant hired to slant reality if you ask me.

http://search.cert.org/search?q=advisory+internet+explorer
http://search.cert.org/search?q=advisory+firefox

Re:who is cenzic?

[Jaysyn]

Not hardly.

Firefox = Results 1 - 5 of about 61

IE = Results 1 - 10 of about 367

Re:who is cenzic?

[xgr3gx]

Missing this one, the lowest of all:
http://search.cert.org/search?q=advisory+opera

Re:who is cenzic?

[nangus]

Pfft, 18 is way to many try a real browser
advisory lynx

Re:who is cenzic?

[TrancePhreak]

It seems to count the same page multiple times if it's mentioned more than once, because there are only so many pags for each.

I was wrong, however. There are 5 pages for IE and 7 for Firefox. Have to click through more to see the end.

http://img26.imageshack.us/img26/8308/advisories.png

Re:who is cenzic?

[Silfax]

hits search

367 http://search.cert.org/search?q=advisory+internet+explorer
89 http://search.cert.org/search?q=advisory+netscape
61 http://search.cert.org/search?q=advisory+firefox
20 http://search.cert.org/search?q=advisory+safari
18 http://search.cert.org/search?q=advisory+opera
12 http://search.cert.org/search?q=advisory+lynx

clearly, the fewer number of letters in the name of your browser makes it more secure.

Re:who is cenzic?

[xgr3gx]

Ha - yeah I tried lynx in the search too, after I posted :)
Also did wget and curl.

Re:who is cenzic?

[selven]

Given that IE (and even the words "internet" and "explorer") can mean things that have nothing to do with the internet, I think that figure is way biased in IE's favor.

Re:who is cenzic?

[DaVince21]

It's all relative - he was using one result per page for Firefox searches and 200 results per page for IE searches.

Firefox IS getting infected in the wild

[improfane]

I have heard the case against Safari often.

I have definitely found infected Firefox installations on relative machines. It's not immune because it is open source.

What is the prevailing flaw that Firefox has? Are they like ActiveX scale flaws where they own the PC or are they more minor but still serious?

Re:Firefox IS getting infected in the wild

[TrancePhreak]

Well.... Firefox does not run its plugins in a sandbox, so they can run at whatever level FF was started at. Any plugin with a vulnerability would then give you as much access as you allow FF.

Re:Firefox IS getting infected in the wild

[Jaysyn]

What is the prevailing flaw that Firefox has? Are they like ActiveX scale flaws where they own the PC or are they more minor but still serious?

Javascript.

Re:Firefox IS getting infected in the wild

[Anonymous Coward]

Its plugins. Ive seen several machines recently infected, no files were showing as having been downloaded, but based on the temp files used to start the infection it appears that Adobe Reader is being used quite a lot as an avenue for infection

Re:Firefox IS getting infected in the wild

[1001011010110101]

Define "Infected Firefox installations"

Maybe you mean "PC with Firefox installed thats infected by a {virus|trojan|keylogger|spyware}" ?

Still, installing Firefox doesn't prevent you from catching something for running infected software or prevents someone from installing some crap that puts toolbars or BonziBuddy into your PC....

Re:Firefox IS getting infected in the wild

[natehoy]

Based on this article? Impossible to say. In fact, since there's no mention made of what data they used or how they compiled the raw data, I'd suggest that the number may be based on something meaningless. Or maybe not.

Firefox is certainly not invulnerable. But Firefox rarely remains vulnerable to any flaw for long, and by definition every bug that happens is reported. So that will tend to overestimate the "number of bugs" and underestimate the importance of how fast they went away.

Re:Firefox IS getting infected in the wild

[improfane]

A few researchers have claimed that it is actually easier for them to hack in terms of effort:
http://www.theregister.co.uk/2009/03/03/safari_at_pwn2own/ 2009
http://larholm.com/2007/06/12/safari-for-windows-0day-exploit-in-2-hours/
http://www.networkworld.com/news/2008/042208-mac-hack-contest-bug-had.html 2008

I have seen Zango, 180 solutions toolbars and shopping compare toolbars appdar in my relatives computers.
http://blog.johnath.com/2008/12/08/firefox-malware/

I did mean type or class of flaw, I apologise. I imagine that there IS a difference in what is more subsceptible to what.

The FUD seems accurate as some people have said the company has associationo with Microsoft.

Re:Firefox IS getting infected in the wild

[DaVince21]

In that case, aren't the plugins mostly in the wrong? IE, Opera and Safari would probably all have the same leak if a plugin could be pointed at as the culprit.

It seems a bit surprising

[tokul]

It seems a bit surprising but TFA is not about browser vulnerabilities. Most of it is focused in detailing web site vulnerabilities and has only two baseless pages with Firefox on top of web browser vulnerability list.

Hard to tell from the article

[xzvf]

The article has a pie chart and the link to the "detailed report" only has a pie chart. I guess we just have to trust Cenzic the internet security application provider. Doesn't even break it down by version number of browser or severity of exploit.

Re:I read the report

[earlymon]

Yes - interesting how we have web vulnerabilities irrespective of the web browser.

Of the Web vulnerabilities, 90 percent pertained to code in commercial Web applications, while Web browsers comprised about 8 percent and Web servers about 2 percent. Of the browser vulnerabilities, Firefox had 44 percent of the total, but perhaps the biggest surprise was Safari, which formed 35 percent of the browser vulnerabilities. Internet Explorer was third, with 15 percent, and Opera was at 6 percent.

I'm repeating the link here -

http://www.cenzic.com/downloads/Cenzic_AppSecTrends_Q1-Q2-2009.pdf

Nothing to see here

[El_Muerte_TDS]

From the report.

Popular vendors including Sun, IBM, and Apache continue to be among the top 10 most vulnerable Web applications named.

Wait... so vendors and now applications?
They continue to say that Java and PHP are very vulnerable, but it's actually applications written in Java and PHP, not the language+runtime itself. In that case you could say that C++ has the most vulnerabilities.

Re:Nothing to see here

[iPhr0stByt3]

Actually... no, the Java client has vulnerabilities that allow a server-side program (infected server) do more than they're supposed to with a client (such as infecting). The way to protect against malicious sites is not to fix the program (because the server is doing exactly what it's programmed to do), but to update the Java client. And yes C++ IS the most vulnerable language - thank goodness no browser I know of allows C++ code to run from the server.

Re:Cenzic is Loyalist

[east coast]

What does that say for a certain site owned by Geeknet, Inc?

How the results were compiled

[Anonymous Coward]

According to the report, as best I can determine, this is how they found their results:

"Cenzic analyzed all reported vulnerability information from sources including NIST, MITRE, SANS, US-CERT, OSVDB, as well as other third party databases"

It seems reasonable that any/all open source software would have a higher number of reports in these databases than proprietary software, simply because more people are able to publicly scan and report on vulnerabilities... by definition, open source software conducts it's business in public, while proprietary software does so behind it's private curtain.

Uh... huh...

[Hacker_PingWu]

The article link is only one short page and does not describe in detail how they came to their conclusions.

However, from the words they're using, they're implying common vulnerabilities exploited in corporate server-side applications. Not client-side.

SQL Injection and XXS Scripting are much bigger issues with implementation of web applications in web pages on the server side, use databases and scripting flaws in the code of the web apps to circumvent browser security.

They're talking about something that has little to do with the integrity of security of individual browsers, and more with the decisions webmasters make and what web applications they use.

Also, when they refer to Safari, they say they're referring to the iPhone Safari version: ...followed by Apple Safari, whose browser showed a vast increase in exploits, due to vulnerabilities reported in the Safari iPhone browser... Looks like they're pretty clearly full of shit, and they're trying to be ambiguous and obscure by explaining little and using jargon to discourage people from searching for what all the terms they're using means.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Firefox + NoScript?

[davidwr]

Firefox + NoScript + intelligent user who doesn't whitelist every page he visits

Just a guess, but I think this combo has very few vulnerabilities.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Too little info and more that a little misleading.

[sarkeizen]

So I'm reading this and these guys come across like goofs somewhat...

Pg. 4 - says: "The top 10 vulnerabilities for the first half of 2009, included familiar names such as Sun, IBM, SAP, PHP, and Apache." which is according to page 7 the ones they classified as "as the most severe." whatever that means.

But in page 6 they say: "Sun Java, PHP, and Apache continue to be among the Top 10 vendors having the most severe vulnerabilities for the first half of 2009."

However in the whole top 10 list there are only two mentions of PHP that I can see...and these are problems with phpMyAdmin - which is way outside what I would consider a reasonable interpretation as a problem with PHP being a "vendor" of a vulnerable product.

So either there's a bunch of missing information or these guys can't tell the difference between PHP and an application written in PHP, or ... something

The browser stuff seems too difficult to tell - if the actual question one is looking for is which is a safer experience. Were all vulnerabilities equally bad? Were they indexed with some information about usage? In other words do we look at the number of people using the vulnerable version and take that into account.

Like a lot of whitepapers the information isn't very helpful and the math is downright insulting.

Are they severe? Are they fixed?

[H0p313ss]

I did not read the whole report but there is absolutely no mention of severity in that press release... nor does it mention how they counted them. Are these defects that have been acknowledged and fixed? From what I can see it's entirely possible that they've counted the THOUSANDS of trivial defects that Firefox discloses and fixes as a matter of course while Microsoft will only disclose the severe ones.

"Reported" bugs?

[Bluemumba]

Isn't counting bugs released as part of press releases and change logs kind of like saying "All confirmed criminals are in jail?"

opera ftw

[JackSpratts]

been using it since the 90s and from long experience can say it's the safest by far. don't know why or care particularly. whether clever code or minuscule market penetration is academic from this user's pov. truth is the fat lady's song still keeps the bad guys away.

Re:opera ftw

[elcid73]

Me too. "Security" is an earned label that, for whatever the reason (coding, smaller market share, etc) Opera has earned. I don't particularly care that Firefox is more open with disclosing bugs than Opera may be, the bottom line is that since 2000 I've used Opera with nothing but confidence.

Re:opera ftw

[Rockoon]

/signed

Re:opera ftw

[Excelcior]

Same here, I've been running Opera for about 13 years, and I've never once had a vulnerability exploited through it. I can't tell you how many computers I've had to clean up that use FF exclusively. I've always been very pleased with the security and stability in Opera.
On another note, according to the article, IE is the second best... in the latest version, anyway. This isn't the first article which has said that either; it's time for all the OS fanboys to admit that sometimes OS applications aren't the best, but that they need to learn from others instead of simply believing they're the best because they're OS.

~just my $.02

Comment removed

[account_deleted]

Comment removed based on user account deletion

Does NoScript fix this?

[improfane]

I installed NoScript recently along with Request Policy. One protects from any request to a foreign domain and one blocks scripts until I allow them.

Have I reduced my exposure enough?

What I want to see is a community mediated system whereby the whitelists and blacklists are distributed amongst the community. A bit like ThreatNet, SpyNet, PrevX and all the other proprietary security systems. How the decision of whether or not to allow or disallow a request will be made but it needs to be made by a massive community. I generally experiment whitelisting a website until it works. If this information was made subscribable, people could browse with a bare minimum of exposure?

Sam

Re:Does NoScript fix this?

[Jaysyn]

There was a plugin for Firefox called Outfoxed that did something similar, but then the dev decided to monetize it & it went to crap. Also, with the massive botnets floating around these days, it'd probably be trivial to poison something like Outfoxed now.

Yet another deliberately lying bullshit story!

[Hurricane78]

Comparing openly known vulnerabilities, and calling it "all in all vulnerability".
As if they wouldn't know perfectly well, that Microsoft sends a cease and desist letter to anyone who is even talking about a vulnerability that is not official to MS.

I guess the old saying is true, that:

If you can't program, you teach.
If you can't teach, you administrate.
If you can't administrate, you report.
If you can't report, you criticize.

Re:Yet another deliberately lying bullshit story!

[FreelanceWizard]

That would explain why everyone on the Bugtraq and Full-Disclosure mailing lists are being hit with C&Ds from Microsoft if they opt not to report the vulnerability to Microsoft first, and why security researchers live in fear of the Giant from Redmond and its legal team.

Oh, wait, that's not actually happening. One inept C&D about a Bing vulnerability does not a pattern of behavior make. While Microsoft certainly prefers responsible disclosure -- as does essentially everyone -- they aren't running around threatening everyone who doesn't do it.

That said, this report is more than a little fishy, though I would say it's due to its notably missing methodology explanation over anything else.

Re:Yet another deliberately lying bullshit story!

[tool462]

And to draw the chain to its conclusion:

If you can't criticize, complain on Slashdot. :)

Re:Yet another deliberately lying bullshit story!

[LihTox]

If you can't program, you teach.

As an academic, let me say: if you can't program, please don't teach (programming). Because you will probably suck at it.

The saying "If you can't do, teach" is the reason mathematics education is so very very bad in this country: 11-12 years of math and college students can't solve 2x=6? It's because so many teachers teaching math in elementary schools hate and are scared of math. And they pass it along.

Re:Yet another deliberately lying bullshit story!

[laejoh]

If you can't slashdot, digg :)

25% Statistic Misquoted

[Engimonkey]

Just noticed they confused the "most common attack" types. SQL was listed as most common at 25%, but this is actually the Transverse Directories %. Clarification.

Pie charts

[Datamonstar]

Yeah, I've pretty much stopped trusting anything that has to include pie charts in order to describe what needs to be demonstrated. How about puttin' some numbers in there, chief? And not made up numbers or percentages.

Re:Too little info and more that a little misleadi

[kehren77]

I agree. They seem to throw out a lot of numbers without saying where any of their data is coming from and they don't seem to be ranking vulnerabilities at all.

Plus let's face it, this is a company whose job is to get people to hire them to check the security of their web apps. Sounds like they are trying to reel in some executives who don't know any better.

Ex MS employee on the "number of patches" metric

[AlgorithMan]

as Window Snyder (former MS employee who later worked for mozilla for some time) pointed out: Microsoft puts multiple fixes in one patch, so multiple IE holes are counted as just one... http://blog.mozilla.com/security/2007/11/30/critical-vulnerability-in-microsoft-metrics/

Shenanigans

[killmenow]

Study/article is misleading and useless.

Also: Chrome, Bitches!

I have experience here

[Effugas]

So, I'm posting as somebody who has gotten critical fixes pushed into both IE and Firefox. (Technically, Chrome and Opera too, but those were the pure crypto vulns.)

It's genuinely hard to write a secure web browser. Forget plugins -- you have a complex internal object model, subject to all sorts of very fine grained rules ("the filename on an input type=file form must not be settable from Javascript"), which can be made into a pile of moving parts under the control of an attacker. What's happened somewhat recently is a lot more people have gotten into bashing Firefox. You know those "many eyes" theories of open source, and how they're usually kind of full of it?

Well, "many eyes" are visiting it now, and Mozilla to their credit is doing a lot of very hard work to deal with the influx. Good on them.

Re:I have experience here

[ClosedSource]

You bring up a good point. Has there been any effort to evaluate web standards from a security perspective?

Re:What was their metric?

[Effugas]

A web site built on flat HTML pages is more likely to be secure than a web site built on PHP. The message is the medium.

Re:Maybe he is at fault?

[s1lverl0rd]

Am I the only one who thinks that a MitM is a little far-fetched?

Re:Maybe he is at fault?

[digitalsolo]

Right, because that's a logical path...

From the report...

[Anonymous Coward]

Here's the gist of Cenzic's _marketing_ report as it applies to browsers:

"
78 percent of the total reported vulnerabilities affected Web technologies, such as Web servers, applications, Web browsers. Plugins and ActiveX, which is a significant increase from earlier in the year.

Of the Web vulnerabilities, Web Browser vulnerabilities comprised (sic) eight percent of the total vulnerabilities found, and Web servers comprised two percent. Vulnerabilities in the code of commercial Web applications was 90 percent of the total Web related vulnerabilities. Looking at the various classes of vulnerabilities, we found that SQL Injection and Cross Site Scripting (XSS) vulnerabilities continued to dominate with 25 percent and 17 percent respectively. Authorization and Authentication vulnerabilities were higher at about 14 percent of total Web vulnerabilities followed by Directory Traversal at 12 percent.
"

Apparently they don't discriminate among versions of browsers, plugins, or web apps. Firefox 1 + 2 + 3 = Firefox.

Nor do they say how they identified browsers. (Presumably the ID came from each source that reported the results.)

They also don't report any specifics of browser vulnerabilities (kind, duration, patch, etc).

unstable == vulnerable

[pikine]

Every time your browser crashes, there is an opportunity to exploit that as a security vulnerability. There is no such thing as "my browser is the least vulnerable, but it crashes all the times."

Re:unstable == vulnerable

[andymadigan]

Using more memory and being killed by the OS's equivalent of the OOM-killer does not make it more vulnerable. Crashes are an indicator of POSSIBLE vulnerabilities. The OOM example is one of many I'm sure.

Re:unstable == vulnerable

[Bigjeff5]

Actually if the OS interceeds in a buffer-overrun situation (basically, out of memory and crash), you are not vulnerable to code injection into memory. Most operating systems today do exactly that for precisely that reason - to prevent code injection. In other words, your browser can crash all the time and you aren't necessarily vulnerable to code injection.

There are various other conditions that can leave you open to code injection though.

Re:unstable == vulnerable

[pikine]

Except most OSes are extremely obedient to memory requests, and rarely issues OOM kill. You'd notice a lot of thrashing before (for swapping out) and well after (for swapping in) OOM killer is triggered. It is extremely unlikely that your browser crashes as a result of using too much memory.

In other words, your counter-example has no practical importance.

Re:unstable == vulnerable

[pikine]

The OS intercedes not by issuing out of memory and crash. The OS intercedes by making the stack and heap memory non-executable, and the code section read-only. However, vulnerability does not limit itself to arbitrary code execution. A crash means there is an opportunity to corrupt memory, and memory corruption can bring you where your creativity flies. For example, if the program manages your bank account, memory corruption could mean setting your account balance to -2^31. This is still a security vulnerability.

Furthermore, in a web browser, executable code does not limit itself to native machine code that resides in read-only memory pages. It can come in the form of Javascript code in the heap. Memory corruption can still inject executable code, and that code can do cross-site scripting. I'm too busy to give you a proof of concept, but you can easily imagine this being possible.

Re:unstable == vulnerable

[andymadigan]

I've certainly had my browser killed by the OOM-killer. Firefox is a hog, and I often use a lot of tabs. Simply claiming that every crash = vulnerability is wrong. Plus, a plugin could probably crash the browser very easily with no vulnerability.

A good example of an OOM-Kill, this article includes vulnerabilities for the iPhone, how about the Android? My G1's browser crashed quite a bit when I tried to load a huge page, it was a pretty memory-limited system. My Droid has no such problems.

Lots of things that have nothing to do with vulnerabilities can cause crashes, and vulnerabilities won't necessarily cause a crash either.

While on the subject...

[T Murphy]

Every browser security article gets a few "I use adblock and noscript so doesn't apply to me" posts (not a complaint, just an observation- I do use both). I am assuming that proper use of these extensions avoids most of the vulnerabilities of concern here, but adblock and noscript are FF extensions- what is there for other browsers that is comparable? What is supported for cellphones?

The FF/AB/NS combo has often been stated as the best way to browse securely, but I only see other browsers rated based on their default settings. I guess what I'm getting at is, based on this article, every other browser can claim to be better than FF. Ignoring arguments over proper counting and documentation, FF users could claim they are more secure due to FF having AB/NS- is this a valid claim?

Basically the first question asks for information, the second asks for arguments. I could go try to research, but that would deprive some people of +5 informatives and +5 insightfuls (in addition to -1 trolls).

Anyone notice that the so called "study" is a...

[Em Ellel]

Anyone else notice that the so called "study" is actually a marketing material for some SaaS product? If you like that there are some great whitepapers out there... LOL.

its a joke - they just downloaded some bug reports, made some pretty graphs and called it a report. I will bet you the person putting it together could not explain what a "web browser vulnerability" is - other than something that should scare people to buy their product.

Anyone else notice the Chrome-coloured charts?

[Chris Daniel]

Glossy, primary colours, circles ... reminds of the Chrome logo.

Re:Ex MS employee on the "number of patches" metri

[WiiVault]

Interesting read. Obviously the point is clear that MS gets to hide what is really going on. OTOH the point of OSS is to shine a light on and fix any vulnerabilities that arise.

Fear Mongers

[supernatendo]

I'm sorry, but a security study who's report starts off comparing security vulnerabilities in software, to swine flu, a biological virus that kills people, loses all credibility with me right off the start. They even bring in a little politics by invoking the US president's name...

Brought to you by the fine folks in Marketing

[darthyoshiboy]

The project was both lead and edited by one Mandeep Khera, Chief Marketing Officer, Cenzic, Inc.
Put together more or less entirely by marketing people at a company that is trying to sell you web security.
I don't know about you guys but I've never known people in marketing to be anything less than the most fine and upstanding sort of the disgusting vile unmitigated cock sucking pustules that ever formed on the unwashed asses of pond scum.

blacklist Cenzic

[Onymous Coward]

Is there any way to provide some negative conditioning for misinformation spreaders?

Slashdotters: Remember Cenzic lies.

duration of vulnerability

[bfree]

Lots of comments mentioning the lack of taking into account of the severity of the bugs, but what about the duration of the vulnerabilities. Or to extend that train of thought, if IE has a current known exploit (or collection of them) there's not as much incentive to go finding another one if you know the one you have won't be closed for another few weeks/months anyway. I suspect with firefox any hole found will be fixed with a released patch far more quickly (and as others mentioned, possibly before any exploits are known of) so you have to keep finding new ones if you want to use firefox as a way in to a machine.

In summary, FUD off

Re:duration of vulnerability

[TrancePhreak]

http://secunia.com/advisories/15601/

Seven year old vulnerability reintroduced into Firefox.

Re:duration of vulnerability

[swillden]

Lots of comments mentioning the lack of taking into account of the severity of the bugs, but what about the duration of the vulnerabilities.

Agreed. The most accurate way to assess vulnerability based on reported security defects is to categorize them by severity and then total up days of vulnerability by category. Additional weight should be given to vulnerabilities with a released exploit.

Re:duration of vulnerability

[swillden]

http://secunia.com/advisories/15601/ Seven year old vulnerability reintroduced into Firefox.

If the biggest complaint you have is a vulnerability that was fixed in 2005 (even if it had previously occurred in 1998), then I don't think there's too much to worry about.

Details?

[Alerius]

So I *did* RTFA and found it was fluff. So I read the linked PDF report to try and find out some details on what these gaping security holes in my favourite browser actually were. I did not want to have to eat crow over my repeated recommendations to us Firefox over IE because it was more secure. Well, there's plenty of space dedicated to reporting server side vulnerabilities, plenty on web apps, lots of repetition of how surprised they were to find Firefox and Safari so vulnerable...but nothing on what vulnerabilities. No mention of types of vulnerability, frequency, core browser, plug-ins, add-ins, versions, ZIP!

The 29 page report has one page that is mostly taken up with a lovely colourlful exploded pie chart. There is more space dedicated to advertising the Cenzic products and services than there is referencing browser vulnerabilities.

This is isn't a report, it's a sales pitch.

Secunia is better

[jeanph01]

Secunia is better. Take a look here:

IE6 http://secunia.com/advisories/product/11/?task=advisories
IE7 http://secunia.com/advisories/product/12366/?task=advisories
IE8 http://secunia.com/advisories/product/21625/?task=advisories
Firefox2 http://secunia.com/advisories/product/12434/
Firefox3.0 http://secunia.com/advisories/product/19089/?task=advisories
Firefox3.5 http://secunia.com/advisories/product/25800/?task=advisories

Based on these, I would choose Firefox and not IE

An Afterthought

[Punkster812]

This doesn't make any sense. First of all, I have used Cenzic tools, they don't test the web browser, they test web apps. So they scan a website/webpages looking for fields and other data forms and do a bunch of test on those to check for XSS, SQL injection, potential overflows, etc.

So I am really confused on where they got the data for vulnerabilities of a browser and why they would mention this when they aren't testing it using their tool. If they are going solely based on what is released in update notes or anything like that, well then a browser who patches all it's problems will appear way more vulnerable than one that patches only the ones it feels like getting around to; not to mention the one that is now patched is less vulnerable then the one that did nothing.

I would like to see someone visit a malicious site (somewhere that installs malware and the like) in all these browsers, it won't be Firefox or Safari (or Opera for that mater) who get infected. And why wasn't Chrome included in this comparison? This comparison seems like an afterthought and probably shouldn't have been included in the write-up, I would take this as a grain of sand and would simply ignore it.

Right from their own website....

[Dare978Devil]

"Cenzic's acceptance to the SecureIT Alliance alongside our recent designation as a Microsoft Certified Partner highlights our expertise and experience in working with Microsoft technologies as well as a proven ability to meet customer needs," said Mandeep Khera, vice president of marketing for Cenzic. http://www.cenzic.com/pr_20061011/ So, this report on browser vulnerabilities must be "Fair and Balanced" given that they are a Microsoft Certified Partner.

SQL injection?

[rrohbeck]

The top vulnerability is SQL injection.
Can anybody explain how the browser is responsible for SQL injection vulns?

Re:SQL injection?

[rrohbeck]

I finally did. As I expected, there was no mention at all how the browser is related to SQL injections at all.
This is Microsoft sponsored FUD.

Not really surprising...

[DdJ]

It seems a bit surprising to me that this study shows that only 15% of vulnerabilities are in IE.

Well. Remember that "the front door is unlocked, the guard has been dosed with chloral hydrate, and there's a loaded shotgun just laying there on the credenza" could collectively be called one single vulnerability. Quantity doesn't trump quality!

Security Marketing -- Then the real world....

[westyvw]

Pander fear, but then what do they trust for their web site and blog?

Apache and Centos and Redhat. Nice.

Obama and Swine Flu

[gcatullus]

Well I actually looked at the pdf report. It starts off with "What do the swine flu and hackers have in common". That started to get a laugh, but then the executive summary says that web vulnerabilities are getting better because of Obama. How can anyone take this seriously??

Re:Hmmm

[fluffy99]

I hate product that include a local copy of Mozilla. You can't update it, and it's not easy to find or realize that it's even there. Same thing with using Apache just to display a gui.

Re:Ex MS employee on the "number of patches" metri

[fluffy99]

Yes, and you're claiming Mozilla doesn't roll up Firefox patches?

Being open and honest about bugs is a good thing

[syousef]

Haven't RTFA yet but I bet they are using patch notes as their source of vulnerabilities.

So the headline should have been "Firefox most transparent browser when it comes to vulnerabilities".

I'm no FF fanboi. I think they've gone off the rails in a lot of ways - especially by forcing users to accept changes that many changes they don't like such as AWFULBAR. However one thing they do right is they're transparent about bugs and vulnerabilities (at least once they're able to reproduce them). The whole article is a fucking troll.

Another metric not considered

[Culture20]

Window of time that a flaw is known and exploitable before getting patched.

Re:Chief Marketing Officer

[bradorsomething]

Dig a little deeper. Mandeep Khera, the Chief Marketing Officer for Cenzic, is Project Lead and Chief Editor for the paper. The only two other humans listed on the project are a "Erin Swanson, Sr. Director, Product and Strategic Marketing" and "Sameer Dixit, Cenzic ClickToSecure Service." If I found the right guy on Linkdn, Sameer is 3 years out of college.

How is anyone surprised by the resulting paper?

Fundamental flaw: "PUBLIC vulnerabilities"

[seifried]

The fundamental flaw of all these studies is that they are NBOT measuring vulnerabilities, they are measuring PUBLIC vulnerabilities. Two very different things.

sloppy

[mr.dreadful]

"Cenzic analyzed all reported vulnerability information from sources including NIST, MITRE, SANS, US-CERT, OSVDB, OWASP, as well as other third party databases for Web application security issues reported during the first half of 2009." Ah -- the old "count the number of bug reports" technique. I won't even bother ranting about that

Comment removed

[account_deleted]

Comment removed based on user account deletion

Comment removed

[account_deleted]

Comment removed based on user account deletion

Microsoft beats all in security tests!

[David Gerard]

Microsoft is reeling from the vicious and unwarranted slanders of security companies and the US government’s Computer Emergency Response Team that its Internet Explorer web browser has alleged “security holes” or is in any way less than the finest software known to mankind and excellent value for your money. "Cenzic proves it's Firefox! FIREFOX DID IT! Fuckers."

The festering paedophiles of CERT have gone so outrageously far as to make the ludicrous claim that just viewing a malicious webpage in IE could leave your computer open to being hacked and turned into a Russian Mafia spam server. “We don’t know what could have triggered such vindictiveness,” sobbed Microsoft marketing marketer’s marketer Steve Ballmer. “Do they hate free enterprise that much?”

There are things you can do to make your computing experience even more secure. Microsoft’s official suggestion — make sure your anti-virus software is up to date and using an entire CPU doing nothing much, click through five screens to run IE in “protected mode,” click through four screens to set zone security to “high,” click “JUST BLOODY DO IT WILL YOU” when the User Access Control asks if you really want to do this, enable automatic updates with the minor side-effect of installing Microsoft DRM on your system or Windows Genuine Advantage randomly turning your computer into a paperweight, and sacrifice a goat to Microsoft at midnight on a moonless night — is simple and straightforward. “It’s the quality you’re paying for.”

On no account should you consider that there might be other web browsers out there, as researchers have demonstrated that all of them automatically download the cover of Virgin Killer. “I saw a report,” said marketing marketer John Curran of Microsoft Completely Enderlependent Analysts, Inc., “that another browser had more vulnerabilities than ours! People would be very foolish indeed to move from the latest IE to Netscape 4.01.”

“These CERT wankers are Mactards and trolls,” said Guardian marketing marketer Jack Schofield. “They just want to take IE users out, brutally sodomise them, gas them in concentration camps and” [This comment has been removed by a Guardian moderator. Replies may also be deleted.]

Comment removed

[account_deleted]

Comment removed based on user account deletion

Pure FUD

[emandres]

From the "report" cited in the article:

What do the Swine flu and hacker attacks have in common?

Yeah, I'd say that's a good foot to start off on, especially when you're a security company fearmongering people into buying your product.

Most Vulnerabilities <> Most Vulnerable

[zizzybaloobah]

Regardless, I have yet to fix a friend's or family member's 'slow' or 'misbehaving' computer that had anything other than IE as the default web browser.

My experience doesn't agree with this

[Maxo-Texas]

I've had more than one friends with IE absolutely owned. None with firefox so far and the firefox crowd is bigger.

Re:Ex MS employee on the "number of patches" metri

[AlgorithMan]

Unlike Microsoft, Mozilla has a Bugtracker, which tells everybody about each and every fixed problem... the report doesn't say how firefox' vulnerabilities were counted, but why would they bother counting Patches (which they have to for IE), if Bugzilla tells them everything they need in just minutes of selecting the report criteria?

Re:open source means vulnerabilities found and fix

[ClosedSource]

I don't know but it doesn't matter since they're secret vulnerabilities so nobody can exploit them.

Re:Ex MS employee on the "number of patches" metri

[ClosedSource]

I don't think human nature is suspended just because a project is OSS. I'll bet that some vulnerabilities in OSS are fixed before being made public for CYA purposes.

Re:Who cares?

[ClosedSource]

It's news here to pay Slashdot's bills. By now it should be clear that these studies (no matter who wins) won't change anybody's mind around here.

OT: opengamepanel.org

[thePowerOfGrayskull]

So I went to check this out... and I couldn't find any helpful information! The web site had lots of good stuff about getting started, FAQ, etc... but nothing that told me what OGP actually is. Before I jump in and start installing it, maybe some information about what OGP is/does/solves might be good to put there on the front page, especially if you're shamelessly plugging it?

Re:OT: opengamepanel.org

[xgr3gx]

Ah - good point. :)
We used to have a news item with a basic description, but I must have set it to expire.
I'll have to put some text in an "About" section.
Anyway, OGP is a game server control panel. It uses a web interface that controls an agent running on the server hosting your games.
It is used to start/stop/monitor game server instances. More features like a config file editor are coming soon.
It allows users to administer a game server without having shell access.
Panel admins can lock down various features to users, like limit which IPs or ports can be used for each game.
Games can be assigned a specific cpu priority (with nice) and on multi cpu boxes, a game can be assigned to a specific CPU.
If the server is rebooted, the agent will restart the game servers that were running when the reboot occured.
Thanks for pointing out my foolish oversight of the most basic information :0 (duh on my part)
I hope you give it a try and find it useful

Re:OT: opengamepanel.org

[thePowerOfGrayskull]

Cool, thanks for the info. This is for any game, or is there a list of games it works with?

Re:OT: opengamepanel.org

[xgr3gx]

No problem.
Yes, the under the navigation pane on the left side there is a 'Supported Games' link

Re:OT: opengamepanel.org

[thePowerOfGrayskull]

Thanks again - what's your forum name? I'm pretty heavily involved in the server-side of Neverwinter Nights 2, and had some additional questions that might be better handled there than in a slashdot conversation :)

Re:OT: opengamepanel.org

[xgr3gx]

I'm xgregx in the forum - feel free to join post some questions!

Giving a fair value to this study

[Mr.RA]

I won't try to defend Firefox, as they have had a decent number of issues, but guys, given where this info comes from, I give this study a total value of 59 cents. Has anybody used their products ;) ? I would love to see a similar study which takes the following two things into account: - Severity of vulnerabilities - Number of days (weeks or even months) before the vendor released a fix Rob.

Re:Ex MS employee on the "number of patches" metri

[fluffy99]

Counting the bugs is a poor way of determining vulnerabilities. It's not easy to search for vulnerabilities in the Firefox Bugzilla, btw. Unless you know some magic search terms?

Searching on CVE or vulnerability doesn't show you everything. Lots of potential issues get cleaned up along the way as part of other patches and normal development, and are never acknowledged as vulnerabilities. Same thing happens on the Microsoft side of the fence. If a vulnerability is known, it's documented in the KB that issued the patch.

If you want to count known vulnerabilities, just look at 3rd party sites that collect that info like Secunia or Cert.

Disparaging Microsoft because you think they are quietly finding their own bugs and fixing them is backwards. You should be glad they are.

To me a better comparison to make is how long critical vulnerabilities exist before they are patched. Microsoft obviously loses that comparison as they like to adhere to the monthly patch cycle and often delay action for privately reporting issues. Given how much IE is interlaced with other products, Microsoft also has to be more careful about patches than Mozilla Firefox which is much more of a standalone product.

So Firefox fixes its vulnerabilities

[ignavus]

So Firefox fixes its vulnerabilities - and that is a bad thing?

And IE fixes fewer vulnerabilities, and that is a good thing?

Personally, I prefer to have all my browser vulnerabilities fixed, not half of them.

And by vulnerabilities we mean silly things like SQL injection?

Time to shoot the messenger, I think.

Re:open source means vulnerabilities found and fix

[goffster]

Secret to those who find them and don't post their results. Secret to those who have access to source control and leave....

I'm Reminded of that scene from "The Mummy"

[LifesABeach]

The crowd of ragged locals gather, all chanting in a low voice, "My Crow Soft, My Crow Soft, My Crow Soft". A Google search shows the following, The SecureIT Alliance enables leading security vendors to collaborate in order to improve the process of building and integrating Microsoft platform-friendly products. I can only think there's a Grinning Show Off hard at work at m$ saying to itself, "It's been a hard work day, but I earn my pay at m$"

It is just PR reply on Firfox success

[alukin]

Yes, nothing more, just pure dirty PR. Firefox is gaining success and quickly "eats" IE customers. So this news is just dirty PR response and standard FUD by MS paid company.
If you check that "vulnerabilities" of Firefox, most alredy patched. If you check vulnerabilities of IE, they still "work".

Re:It is just PR reply on Firfox success

[alukin]

Guys! This "news" are evein on popular Ukrainian TV "1+1". http://tsn.ua/nauka_it/eksperti-nazvali-firefox-naibilsh-vrazlivim-brauzerom.html

That means only one thing. Dirty world-wide PR.

From secunia.com:

[Undead NDR]

FF 3.0.x: advisories:21, vulnerabilities:133, unpatched:0% (0 of 21)
FF 3.5.x: advisories:5, vulnerabilities:37, unpatched:0% (0 of 5)
IE 8.x: advisories:5, vulnerabilities:16, unpatched:40% (2 of 5)

End of story, as far as I'm concerned.

Re:Obviously a Microsoft funded study

[0ld_d0g]

OK. So what study should we look at? Why don't you post the right one?

Also, Slashdot has convinced me that in the interest of fairness I should disregard any study that is funded by Microsoft or competitors of Microsoft.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Comment removed

[account_deleted]

Comment removed based on user account deletion

That makes sense

[improfane]

No problem, I couldn't remember where I had read it but a few researchers did claim or make it appear as if it took less effort. It's really annoying when you forget where you read something.

Sorry for the weird typos, my brain is between DVORAK and QWERTY and does not seem to be able to handle the changeovers that very well.

That definitely makes sense if they do develop products.

Re:Obviously a Microsoft funded study

[0ld_d0g]

Try the "common sense" study. I mean come on...any study that shows a huge slant in the direction of a company that is known to be vulnerable the majority of the time simply should be disregarded [period].

So there isn't a single study in the entire world that you trust or would recommend? Sounds like excessive paranoia to me. You position seems to be - Everything is biased, so lets ignore everything and use "common sense". I beg to differ. "common sense" only works for common things.

Analyzing which browser has a better security infrastructure is not common knowledge. I very much doubt average users spend time browsing seclists.org or the firefox bugtracker and other than such news articles, have no way of being informed about this topic. Wait, I take that back! Common users aren't even going to read this artcle. They wont even be on slashdot :p

Let me suggest a new approach.

0. Accept that any report will have some unmeasurable bias
1. Outline a threat model for browsers.
2. Pick a point system based on some vaguely objective metric.
3. Evaluate IE 8, FF 3.5.5, etc. based on that.

Find the results and conclude that for a specific threat model and a specific point system, Browser X fared better. Feel free to debate different points systems and why you think one is better over the other. Here is an example of such a report from IBM:

http://www.servicemanagementcenter.com/ExternalContent/IBMRBMS/SMRC/WHITEPAPER/68843/XFTR-H1-2009Final.pdf

I can make a pie chart show anything I want ...

I appreciate the exaggeration for effect, but, no, you cant. :)

I call bullshit

[intheshelter]

IE is not leader of the pack? What happened to security through obscurity? Safari shouldn't even be on the list. IE should have them all?

Somehow I doubt this "study" is worth the paper it's printed on (in Redmond).

Re:Obviously a Microsoft funded study

[0ld_d0g]

Its clear that Ceznic partnered with Microsoft before publishing this study.

Yeah and I paid my expensive college tuition's too, and they still gave me an B+ instead of an A a few semesters back :( What the hell ! I paid them ! :P

Hint: Just because people get paid for the study, doesn't mean the results are automatically flawed. You have to first demonstrate that the process was flawed and hence produced flawed results. So far you're just ranting about peripheral topics and haven't attempted to tackle the primary point. Why don't you come up with a better process or suggest a way of improving an existing process to measure browser security? Then lets pit the browsers against each other and see who comes up on top?

Technical common sense comes from years of Internet use and before that ARPANET. Did you work on the original ARPANET?

And why would I care what you did? I don't. Its laughable really, that you have to resort to argument-from-authority. This isn't about this particular story. My first post conveniently forked the discussion to a open discussion on the general issue of not having any optimal metric to gauge a vague topic as browser security. So far I'm seeing nothing but empty rhetoric and thinly veiled insults out of you. Maybe you're just a non-technical user that doesn't understand browser security and are using your "technical sense".

That study you linked too by IBM does not clarify the point you are trying to make, simply because IBM was also a backer of the Ceznic study.

Actually its a pretty good report from IBMs X-Force labs who produce as far as I know fairly credible reports. If you have any insight into flaws in their process let us know.

Doesn't make it true and certainly doesn't do anything for any reputation I might be trying to hold onto.

Wow ! You're on a roll ! Attacking me and stuff. How cute ! I helpfully pointed you to a study that in my view attempts to tackle this serious topic. Your reply indicates that you didn't even read the entire study. Seems like to point you to that piece of information was a mistake and simply served as a purpose of an unwelcome rant.

I would pit my common sense against any study you can find and my common sense will win every time.

Wow, your reply is getting more infantile by the minute. This isn't about you. It seems obvious to me now you're not interested in an honest discussion and are just looking for a nice flame war. I will not oblige.

What a waste of my time. Sigh !

Amanda Seyfried/Julianne Moore love scene? Check!

[Impy the Impiuos Imp]

> It seems a bit surprising to me that this study shows that only 15% of
> vulnerabilities are in IE.

This is because your theory is basically, "Microsoft evil and sloppy and lazy."

My theory, which I have literally been downmodded for, is that IE was targetted because it was far and away the most popular. Hence hackers, primarily people wanting to compromize your computer for spam or bot purposes, had the most to gain.

Now Firefox, if I recall, has just passed IE on the browser share market. Hence it's catching more and more attention.

So, as Dilbert might say, are you going to admit that you are wrong and bow to my intellectual superiority, or are you going to actively rewrite history in your mind and claim you thought this up all by yourself?

For you who equate vulnerability count to security

[mysidia]

Examine this program:

main(){system("/usr/bin/nc -l 1234 /bin/bash"));}

It demonstrably has exactly one vulnerability (no authentication required for remote access), and no patch is available.

No patch can be written without destroying its functionality.

Therefore, this program is demonstrably more secure than almost every Windows program ever written, including notepad.