UK Gov't Says "No Evidence" IE Is Less Secure

aliebrah writes "Lord Avebury tabled a parliamentary question in the UK regarding the security of Internet Explorer and whether the UK government would reconsider its use. He got an answer from the UK Home Office that's unlikely to please most Slashdot readers. The UK government contends that 'there is no evidence that moving from the latest fully patched versions of Internet Explorer to other browsers will make users more secure.'"

Comments

Probably true, even.

[toQDuj]

That's very likely true, as the stupidity of the user remains the weakest factor in security.

Re:Probably true, even.

[MichaelSmith]

That's very likely true, as the stupidity of the user remains the weakest factor in security.

And this is a constant in the UK Government?

Re:Probably true, even.

[BikeHelmet]

But the trend of users getting infected seems to indicate IE is worse. User stupidity hurts, but so do unpatched remote code execution flaws.

Microsoft likes to tout how insecure other browsers and OS's are because they receive more security updates, but I'm not convinced. It's a poor measurement of security.

There's no way to know how many landmine exploits are in IE. I consider Firefox more secure, because as its market share goes up, the number of ITW exploits doesn't seem to be exploding.

Re:Probably true, even.

[abigsmurf]

Except there is no evidence that a fully patched version of IE could be exploited. The bug was there but it was impossible to exploit with the default security settings.

I notice Slashdot is quietly ignoring the IRC exploit currently in the wild for Firefox.

Re:Probably true, even.

[Anonymous Coward]

That's very likely true, as the stupidity of the user remains the weakest factor in security.

You sir, are wrong. If the stupidity of the user remains the weakest factor in security, then it is the weakest factor for each browser and not only for IE, which means we can eliminate it from the security equation if we want to compare browsers on their own merit in terms of security. Once we eliminate the stupidity of the user from the security equation, IE can be compared, with all of its known gaping security holes, to all the other browsers which have no such known security holes at this point in time. It is this comparison that shows IE is indeed less secure than any of the other browsers when known security holes and the security track records of all the browsers are taken into account. The UK government failed to acknowledge this fact for reasons best known to them, but we all know that their decision was not an objective one.

Re:Probably true, even.

[abigsmurf]

The majority of exploits nowadays attack plugins. Firefox is just as vulnerable to PDF exploits as IE is.

There are also plenty of Firefox vulnerabilities out there, they just don't get national headlines like IE does. Here's a current one.

Re:Probably true, even.

[Shisha]

I'm very happy that majority of users use IE. This makes it still the most attractive target for hackers. In turn that means that they have less time to work on exploits for the browser I'm using. "Security through obscurity" works in this case (though of course the phrase comes originally from open source vs. closed source).

Re:Probably true, even.

[Daengbo]

I might actually believe that a fully patched IE8 is on par with other browsers, but the UK gov't will undoubtedly take the Home Office's decision to mean that IE6 is OK, too. That's scary.

Re:Probably true, even.

[NoPane]

It really doesn't matter what browser they use, they will still copy unencrypted data onto CDs and then put them in the post, send unencrypted emails to each other, leave laptops and memory sticks on the train or if that fails, stand in front of photographers with confidential information showing. The 'Chinese' (or whoever) really don't need to bother with browser attacks.

Re:Probably true, even.

[toQDuj]

Still, the user would have to browse to a malicious site. Perhaps the users who "choose" IE (or not choose at all and end up with the default browser), are the type of users more likely to browse to particular types of sites. Changing them to choose another browser, therefore, would not prevent them from browsing to sites with malicious code. This malicious code can then still be executed if it's a vulnerability in a plug-in instead of the browser.

Now I think the browser should keep the plug-ins in check.. Sandboxing perhaps?

Re:Probably true, even.

[cl!p]

There are also plenty of Firefox vulnerabilities out there, they just don't get national headlines like IE does. Here's a current one.

This is not a exploit in firefox. This is a vurnabillity in some IRC servers. The Freenode people agree. They are moving to a new IRCd.

Re:Probably true, even.

[toQDuj]

I have no evidence for believing otherwise. OTOH, I do know there are (very) stupid people working in the government of the Netherlands, or so my friend working there indicates. IT savvy people perhaps don't try to get work at the UK government.

Re:Probably true, even.

[Anonymous Coward]

> That's very likely true, as the stupidity of the user remains the weakest factor in security.

As you put it well, "the stupidity of the user" is a "factor in security". Any system that does not address this is flawed, because it doesn not deal well enough with one of its factors.

This tendency to blame users shows incompetence; IMHO it contributes to worsen the already extremely bad security image M$ products like IE have.

As one admin I knew once told me: "If you don't understand it, don't mess with it".

M$ should stick with fields on which they're really good: hardware (in spite of somewhat high prices).

Re:Probably true, even.

[Anonymous Coward]

The majority of exploits nowadays attack plugins. Firefox is just as vulnerable to PDF exploits as IE is.

That most attacks come through plugins is exactly why Firefox is better than IE

Re:Probably true, even.

[toQDuj]

I have never seen anyone use a browser for IRC, so perhaps the impact of the bug is not very heavy.. But then again, I don't know what the current youth is into.

Re:Probably true, even.

[Geirzinho]

Users are the weakest link in the security chain. And the least trained users are normally those on the de facto standard of Windows with IE, which implies a higher infection rate on thos systems.

If we substitute eg. Firefox for IE as the default browser in Windows, unskilled users will still remain unskilled users. They will still follow any shady link they come over, some of which will undoubtedly manage to poke a hole in FF's security.

The challenge and solution to security in the current environment is to educate the "average person."

Re:Probably true, even.

[toQDuj]

But the study was on whether the implementation of other browsers beside IE would increase security. If the user is the weakest link, the choice of browser would not affect the level of security much. The user should be just as big a part of the security assessment as anything else, since testing the browser without the user will not give you a real-world risk level.

Re:Probably true, even.

[JackieBrown]

Then maybe the default settings should be more secure and allow for the "more trained" users to weaken the security.

Honestly, if we know that the user is the weakest link, why isn't MS setting the defaults to compensate for that?

Re:Probably true, even.

[abigsmurf]

It is ALSO an IRC server vuln. You can't tell me that starting up an IRC session without the user's knowledge is something that should be expected.

Re:Probably true, even.

[jegerjensen]

Its a universal constant of stupidity!

Re:Probably true, even.

[cl!p]

You can't tell me that starting up an IRC session without the user's knowledge is something that should be expected.

Thats not what is happening. Firefox is just running a post request to a IRC server. The Irc server happely ignores all the http protocol headers and iterprets the data in the post request as a irc protocol data. So the only thing firefox is doing "wrong" is allowing a post request to a non-standard port.

Re:Probably true, even.

[Anonymous Coward]

Security usually costs (its user's) convenience.

Re:Probably true, even.

[Anonymous Coward]

The challenge and solution to security in the current environment is to educate the "average person."

Let's assume for a second we've educated each and every single user and made them security conscious on the Internet. An educated user browses a site which contains an image that is constructed to exploit a security flaw in the browser without the user ever doing anything but viewing the image. Unknowingly the user's browser is compromised and in the hands of the attackers despite the fact that the user is well educated and security conscious, which means education alone is not the solution. Better software is the solution.

Normally to safely cross the street you only need to look left and right to check for traffic, you don't have to look up for falling objects, you don't have to check the road for mines, tripwires or other booby traps, you don't have to check for sniper fire, you don't have to check the stability of the road and the quality of the materials and the processes used to build the road like a civil engineer would, you just cross the street without giving any of that any thought. So why it that using a browser should be any different? Why should you be expected to take into account a million things just to be able to browse the contents of a site safely? It should be as simple as crossing the street and software needs to provide that simplicity with builtin security.

Re:Probably true, even.

[JoshDD]

Are you calling MS users stupid.? Isn't that racist or poligamous or anti american or sumpthing? That's it they are terrorists.

Re:Probably true, even.

[Anonymous Coward]

That's very likely true, as the stupidity of the user remains the weakest factor in security.

Yeah -- if the user is stupid enough to run MSIE you have security problem. Get over it.

Re:Probably true, even.

[Runaway1956]

This is the same UK government which thought that Windows for Subs was a good idea, right?

http://www.theregister.co.uk/2009/01/15/royal_navy_email_virus_outage/

Royal Navy warships lose email in virus infection

        * Alert
        * Print

Windows for Warships(TM) combat kit unaffected, says MoD

By Lewis Page Get more from this author

Posted in Malware, 15th January 2009 16:53 GMT

Free whitepaper - What Exchange can't do - and Dell can

The Ministry of Defence confirmed today that it has suffered virus infections which have shut down "a small number" of MoD systems, most notably including admin networks aboard Royal Navy warships.

The Navy computers infected are the NavyStar (N*) system, based on a server cabinet and cable-networked PCs on each warship and used for purposes such as storekeeping, email and similar support functions. N* ship nets connect to wider networks by shore connection when vessels are in harbour and using satcomms when at sea.

Re:Probably true, even.

[Anonymous Coward]

But the trend of users getting infected seems to indicate IE is worse.

And if you factor in market share? Meaning, all those computers that had ie installed on them and the folks who never switched to FF or even updated their ie.

Re:Probably true, even.

[toQDuj]

I'm just saying that your average government employee might not be the most savvy cookie in control of a browser.

Re:Probably true, even.

[palegray.net]

The fundamental issue here actually is "security through obscurity," although not in the context that you use it (instead, referring to the traditional context). With closed source software, you're at the mercy of the manufacturer when it comes to even getting an acknowledgment of security issues, let alone receiving fixes in a timely fashion or before damage is already done. Microsoft has a terrible track record in this department; more times than I can count I've become aware of a security issue they were alerted to weeks or months late.

With Firefox, there is generally a very high degree of transparency when it comes to security problems. Additionally, fixes are pushed out quickly. Although Firefox continues to gain market share, the actual damage caused by exploits continues to remain quite low. That's certainly not the case with IE, and as long as it's closed source that won't change.

Re:Probably true, even.

[Aldenissin]

"Security through obscurity" works in this case (though of course the phrase comes originally from open source vs. closed source).

I believe that you are referring to "Security through lack of interest for malicious intent due to popularity or rarity", while the meaning of the phrase "Security through obscurity" would be clearer with the word obfuscation instead. But hey, then it wouldn't rhyme or be as memorable either.

Re:Probably true, even.

[AftanGustur]

That's very likely true, as the stupidity of the user remains the weakest factor in security.

While that may be true, that is the right answer to a different question.

The original Question was:
To ask Her Majesty’s Government what discussions they have had with the governments of France and Germany about security risks of using Internet Explorer; and whether they will encourage public sector users to use another web browser. [HL1420]

The problem Google and others had was that they were not using "the latest and fully patched version of IE", but instead outdated but fully supported version from Microsoft, full of security holes. Even the UK governmaneprobably isn't using the "lastest and fully patched version of IE"

Also, MIcrosoft has a 6 months check cycle for patches, that simply doesn't correspond to today's security landscape where both criminal organisations and state governments have people on payroll searching for vulnerabilities to turn into money or somehthing more valuable, as soon as they are found.

Re:Probably true, even.

[roscocoltran]

I loled at this fake, then I type "windows for warships" in google... We are living in a strange world.

Re:Probably true, even.

[Geirzinho]

Let's assume for a second we've educated each and every single user and made them security conscious on the Internet. An educated user browses a site which contains an image that is constructed to exploit a security flaw in the browser without the user ever doing anything but viewing the image. Unknowingly the user's browser is compromised and in the hands of the attackers despite the fact that the user is well educated and security conscious, which means education alone is not the solution. Better software is the solution.

Absolutely. But what we stated was that, as of right now, users are the weakest link in the security chain. By educating users, you strengthen that link and make another link the weakest. Even so, you have by training improved the security of the system.

To get exploited in your scenario, assuming the user now sticks to "honest" sites and doesn't follow all email links) would require something like a web server exploit such a XSS. This is more difficult than simply tricking the user into executing a trojan.

Normally to safely cross the street you only need to look left and right to check for traffic, you don't have to look up for falling objects, you don't have to check the road for mines, tripwires or other booby traps, you don't have to check for sniper fire

We should not ignore software security just because the user is the weakest link. But to borrow your analogy: the problem today is that pedestrians don't look left and right before crossing the street. Training them to do this would save more lives than any piano transportation safety regulation.

Re:Probably true, even.

[Malc]

Of course, with its backwards monolithic architecture that has been so popular for almost two decades with Netscape and then Mozilla, it's now become almost unusable. I have to restart it every half day or so because its memory footprint creeps up to 1.5GB on all my computers (Windows and OS X), from 230MB when restarted. As soon as Chrome + Xmarks is available on my Mac, I'll be saying goodbye to FF.

Re:Probably true, even.

[Runaway1956]

"So why it that using a browser should be any different?"

Because, morally speaking, if your computer is made into part of a botnet that eventually steals billions of dollars, incidentally wiping out the savings of Ma and Pa Kettle - you are responsible.

Secure your system. The law may not come after you to get Ma and Pa Kettle's money back, but you're still a snake for helping to rip them off.

Re:Probably true, even.

[icebraining]

#30969440

Re:Probably true, even.

[abigsmurf]

Sending data over any port the malware creator chooses is a pretty major 'only'

Re:Probably true, even.

[jonbryce]

I don't know if they try to get work or not, but judging by the governments' computer systems, they certainly don't succeed.

Re:Probably true, even.

[EzInKy]

The problem Google and others had was that they were not using "the latest and fully patched version of IE", but instead outdated but fully supported version from Microsoft, full of security holes. Even the UK governmaneprobably isn't using the "lastest and fully patched version of IE" [guardian.co.uk]

The obvious answer to the problem then would make it a crime to use anything but the "latest and fully patched version of IE". Got to protect the people from themselves, right?

Re:Probably true, even.

[MrMr]

Let me give you the official microsoft reply:

It is a feature

If you ask for data to be transported via ftp, smb, irc, or whatever protocol you need, that's what firefox does. The fact that some IRC servers don't want large amounts of automatically generated data but still fail to block it is not a firefox bug.

Re:Probably true, even.

[Anonymous Coward]

Yes, this is the one that saw nothing wrong in posting 25 million records on 2 cds which went missing and when told they went missing posting the same data by the same method and not mentioning that the data had gone missing for a few months. They also lost Ministry of Defence data on laptops and USB sticks. If they say "'there is no evidence that moving from the latest fully patched versions of Internet Explorer to other browsers will make users more secure.'" well hen ... .

Re:Probably true, even.

[Anonymous Coward]

Government stupidity knows no bounds!

Re:Probably true, even.

[Anonymous Coward]

The majority of exploits nowadays attack plugins. Firefox is just as vulnerable to PDF exploits as IE is.

True. On the other hand, if the plugin exploit is not itself powerful enough to do real harm, but is powerful enough to then employ local browser security issues, IE is once again inferior. It is, after all, "An Integral Part of the Windows Operating System", per Microsoft's assertions at the anti-trust trials.

Re:Probably true, even.

[Trepidity]

But it's part of the HTTP spec that you should be able to POST form data to any port.

Re:Probably true, even.

[drinkypoo]

Please post a complete list of your installed extensions. I run some ten extensions and I do not have the problem you mention unless I leave open a tab with an incompetently-coded, javascript-heavy website, like Facebook.

Re:Probably true, even.

[tepples]

I have never seen anyone use a browser for IRC

True, you have probably never seen me use ChatZilla. But even if you don't intend to connect to an IRC network, cross-protocol POSTing on a malicious or compromised site can still attack an IRC server.

Re:Probably true, even.

[darthflo]

Bullshit. Being able to choose what port a request is directed to is covered by specifications, expected to work and built on in several real-world situations. Most commonly, configuration interfaces: If you're using some kind of shared hosting, chances are they might be running Plesk (defaults to alt-https, i.e. 8443) or ispCP (defaults to https on 81) or a similar project. Use webmin? The httpd that runs the config interface requires permissions you wouldn't want the http that serves your normal pages to have.
Going on, ever used CoralCDN? That's .nyud.net:8080 (alt-http) or 8070 for you. Maybe you'd like to configure an irc daemon or bouncer? Another non-standard port there. Most application servers don't run on port 80, either. The load balancer will, but you might want to get around it for testing purposes or some such.
What I'm saying: It's all expected behaviour. Throw in a PING Math.rand() from the server before actually throwing out those RAW001-4 and the spamming problem is instanty solved. Or, to make things even simpler: If you're an ircd, kill whatever starts it's requests with HTTP POST. Chances are, it's not an IRC client.

Re:Probably true, even.

[msclrhd]

What version of Firefox are you using?
What version of Mac are you running on?
What version of Windows are you running on?
What plugins are you using?
What websites are you visiting where you notice high footprint?
Are you visiting a lot of Flash-based websites (e.g. youtube)?
Are you constantly using javascript/ajax intensive websites (e.g. gmail or google docs)?
Are you visiting a lot of Silverlight-based websites?
Are you reading a lot of PDFs from the browser?

And please, file a bug with Firefox with a subject line along the lines of "Firefox consuming 1.5GB on Windows and Mac" so that the Firefox team can help track down and resolve the problem. Please include as much information as you can.

Re:Probably true, even.

[darthflo]

Opera runs pretty well on macs. With Opera Link, it'll synchronize your bookmarks to any of your other Opera installations (not to other browsers, though). Say goodbye to Fx and make the web a better place today! ;)

Re:Probably true, even.

[MadMaverick9]

Yeah well. If you're logged in as an admin user to your computer, while surfing the web, then it's your (!!!) own fault if your computer gets infected.

Do not blame the creator of the OS.

Inconvenience?? What inconvenience?? The only time you need to be admin, is when you install software and/or make changes to your OS. At all other times, admin privileges are not required.

Yes - I know. Some software out there still requires admin privileges to run. These should be banned and burned.

Re:Probably true, even.

[PopeRatzo]

And this is a constant in the UK Government?

And really, is this the kind of thing that the "Home Office" does in the UK?

Y'all be weird over there.

Re:Probably true, even.

[SimonTheSoundMan]

The MoD have sent me a letter three times stating they have lost personal data about me. One was a CD, another a pen drive, and a laptop was stolen from the premises.

Data that went missing was my name, address, passport number, national insurance number, photograph, medical history and criminal record. Obviously nothing important.

This data was unencrypted.

Re:Probably true, even.

[hedwards]

Well, there's a couple things going on there. Other vendors actually patch flaws rather than just adding them to the errata because they didn't feel like fixing them. Sure they don't fix all of them, but things which aren't fixed are far less likely to come back and bite the user or require changes to the code base which aren't reasonable on the current revision. But they do get fixed or some how addressed in future versions.

The other thing is that other vendors actually acknowledge when there's a vulnerability which they can't patch post haste which makes it seem like they've got more bugs since they don't have a secret list of unpatched vulnerabilities. Nor do many of them have the option of dong so. Sunshine is the best disinfectant after all.

Re:Probably true, even.

[hedwards]

Somebody else already posted about that, and it's not a Firefox exploit, it's an IRC server exploit. The only thing that Firefox is doing that's possibly wrong is allowing one to post to a weird port. The server failing to properly interpret the packets coming to it is really not something that the Firefox devs can reasonably be expected to fix.

Re:Probably true, even.

[Anonymous Coward]

I was going to post that this was a Trifecta but it being unencrypted ..... .

Re:Probably true, even.

[Anonymous Coward]

M$ should stick with fields on which they're really good: hardware (in spite of somewhat high prices).

Yeah, like the Xbox 360.

Wait a minute ...

Re:Probably true, even.

[xaxa]

The bit of government I work for (a non-departmental public body) still has Windows 2000 and IE6 on most desktops. Unfortunately, the budget for this organisation has remained static for over a decade -- if the next government is serious about increasing science spending (rather than just talking about it) then maybe the budget will be increased! But I doubt it.

Re:Probably true, even.

[Anonymous Coward]

That's very likely true, as the stupidity of the user remains the weakest factor in security.

And this is a constant in the UK Government?

Fuck no it isn't constant. Are you daft man? It's increasing at an exponential rate.

Re:Probably true, even.

[Pictish Prince]

Users are the weakest link in the security chain. And the least trained users are normally those on the de facto standard of Windows with IE, which implies a higher infection rate on thos systems.

If we substitute eg. Firefox for IE as the default browser in Windows, unskilled users will still remain unskilled users. They will still follow any shady link they come over, some of which will undoubtedly manage to poke a hole in FF's security.

The challenge and solution to security in the current environment is to educate the "average person."

Well! "Educate the average person"! It's so simple! I'll get on it as soon as I've developed my FTL drive and cured the common cold!

Re:Probably true, even.

[__aaqvdr516]

I deal with the type of user you're describing. One of the more recent "funnies" that I had was a guy showed me how bad the companies site filtering was by doing a Google search for a porn site at work. He said, "See? McAfee safesearch says it's ok!" He's smart enough to at least ask questions once in a while, but he's the exception to the rule.

I've got another guy who turned automatic updates off because he heard it was better that way. He didn't understand that the guy that said it was actually reading the patch notes to see what it affected before deciding whether or not to apply it. By the time he brought his PC in to me to clean it up from all the malware and viruses that infected his machine it was far too late for a cleanup.

How do you educate people on computer security when they don't want to learn? The only other option is rights restrictions across the board, but then it may become even more time consuming than just cleaning up the mess they make because they don't know what they're doing!

Re:Probably true, even.

[GIL_Dude]

Actually no - in the plugin space like Flash and PDF IE is superior due to its model of running different zones in different access levels. For example the "Internet Zone" runs with less privilege than a "standard user" account and cannot write to the file system outside of Temporary Internet Files and cannot write to the registry outside of a specific non-trusted area. This is with IE already running as standard user - even if the user is running as administrator. You can read up on it here http://msdn.microsoft.com/en-us/library/bb250462(VS.85).aspx. For well controlled (corporate) systems, users cannot willy-nilly add sites to the "Trusted Sites" zone which would enable those plugins to now run as standard user (basically move from the low integrity level to the medium level). Home users, of course, can often be tricked into raising the security level of a site - making integrity levels less effective in helping to prevent successful exploit, but even here it prevents most original "drive bys" and requires the user to take an action (indicating trust of the site) before anything bad could happen. Remember that most of these exploits that folks have recently been seeing a lot in the press are IE6 / Windows XP only. With Windows XP of course the whole integrity level and running sites as lower than standard user doesn't exist.

Re:Probably true, even.

[toQDuj]

>How do you educate people on computer security when they don't want to learn?

It's a good question. What I have done with my parents is to give them a Mac. There the "updates" show up every now and then and I've trained them to click on the "download and install" button, promising them that it doesn't break anything. All (apple) applications update through a single interface, simplifying matters greatly.

The alternative may be to require an "internet drivers license" (which they had in the Netherlands for a while, voluntarily), but that would restrict access and speech and thus be too obtrusive.

Option three is to accept things _as is_ for home users, but provide mandatory instruction courses at work. For everyone. One of my pet peeves is employee carelessness with data, they never back up until it is too late. IMO this is to be considered as data loss due to carelessness and this could be considered as a reason for firing employees.

I'm also thinking the iPad may actually provide a solution: a closed platform on which only _allowed_ applications can be run. As a user this sucks, but from an IT perspective I can understand it.

Re:Probably true, even.

[rich_r]

Home Office as in 'Office of Home Affairs'. A bit like 'Homeland Security'...

Re:Probably true, even.

[ibsteve2u]

I lollled when I thought of Microsoft's having started offshoring back in 2004; the thought of Indian programmers writing code for their old colonial master's warships is...amusing.

Of course, I also find the thought of having blind faith in the golden handcuffs of capitalism to be amusing.

Re:Probably true, even.

[zach_the_lizard]

The majority of exploits nowadays attack plugins. Firefox is just as vulnerable to PDF exploits as IE is.

Speaking of the PDF weaknesses, are those inherent to the spec, or are they vulnerabilities that only show up in Adobe's implementation?

Re:Probably true, even.

[Locutus]

there is ample evidence that flaws existed in MS IE for months, and sometimes years, and Microsoft knew about them and did not fix. That in itself throws out the idea that anyone outside of Microsoft has any clue as to how many flaws there have been or are. Hiding flaws does not mean they do not exist.

On another note, there should be plenty of evidence of flaws and exploits which were in IE but not in Firefox, Opera, or even Safari. Things where IE has intimate knowledge with stuff like ActiveX, COM, their JavaScript engine, and all the other tentacles going from IE into the Windows OS.

Therefore the comment that there is "no evidence" sounds too much like it came from Microsoft because it is really a question asking for technical proof and you are not going to get that in a parliamentary discussion. And notice he didn't say he's asking for proof, he stated there is "no evidence" so he seems to think he's some kind of expert in this area.

Proof of even one flaw due directly to unique ties between IE and the Windows OS is proof that it is less secure because the others do not have those ties. Counting security updates is invalidated by the facts that Microsoft withholds flaws and public information on flaws. So either Microsoft must open source IE to prove the flaw count issue or it must be declared less secure. IMO

LoB

Re:Probably true, even.

[Anonymous Coward]

Seen how they've run their economy into the ground lately, all they while stating that all the money they're pouring into the shitter was "economic stimulus that was going to save the country"? Never trust anything a politician says. Doesn't matter what country they're from.

Re:Probably true, even.

[jpmorgan]

More like a mix of DHS and the Justice Department.

Re:Probably true, even.

[Maxo-Texas]

You know... one reason for this has to be the acquisition procedures.

My company pays about $2,000 for desktops and laptops that I can buy at fry's for $490 to $700.

As a result, it can take 90 to 120 days to get a laptop which we could buy directly the same day. I have two projects waiting on hardware as a result.

Re:Probably true, even.

[mjwalshe]

and they do say latest fully patched versions of Internet Explorer and notIE6 which is where the main problem with IE

Re:Probably true, even.

[mjwalshe]

Its a constant everywhere !

Re:Probably true, even.

[pydev]

Any browser has to support sending requests to arbitrary ports; any browser that doesn't is broken.

The problem is with services that accept such requests as valid on ports that aren't intended to run http.

Re:Probably true, even.

[Maxo-Texas]

As the others have said, it's probably one or more of your plugins.

I had a severe performance problem after adding one plugin that cleared up as soon as I disabled it.
After running firefox for days, with 10 open tabs at this moment, the memory footprint is now: 166,500 K. (win7)

My plugins are:
Adblock
Noscript
WOT
BetterPrivacy
Cooliris
DownloadHelper
Skipscreen
TheCamelizer

Re:Probably true, even.

[drsmithy]

Proof of even one flaw due directly to unique ties between IE and the Windows OS is proof that it is less secure because the others do not have those ties.

What are these "unique ties" ?

Re:Probably true, even.

[dickens]

So true. and do you even have the bandwidth to install IE8 and stay up to date? Bottom-tier ADSL is barely enough.

Keeping IE up to date involves constantly clicking "ok", and "yes I remember you own my frigging computer" and "yeah sure go ahead whatever will get this to stop". Over and over again.

Staying up to date with Firefox means clicking "ok, install that update that is already downloaded and ready to install in 20 seconds without a reboot or other kinds of pain".

Of course you need to keep Windows and IE up to date anyway or your system will probably be vulnerable even if you never use IE deliberately and hide every icon that starts it.

Re:Probably true, even.

[dickens]

I have seen several instances of presumably trustworthy sites serving ads that contain drive-by attempts. The ad brokers will sell to anyone..

Re:Probably true, even.

[SkyLeach]

this isn't an exploit for your computer, it only affects IRC networks.

Re:Probably true, even.

[Anonymous Coward]

There is of course the view that Microsoft are reluctant to patch IE6 because patching would lead to a false sense of security which would encourage idiots (like HM Government?) to continue using it, rather than moving on to IE8 or Firefox.

Re:Probably true, even.

[Yvanhoe]

What's worse is that these virus were not tailored against the UK Navy. Now China has invested a lot of money into building tools to shut down military networks. Guess what will happen if something serious comes.

Re:Probably true, even.

[turbidostato]

"The only thing that Firefox is doing that's possibly wrong is allowing one to post to a weird port."

There's nothing wrong with POSTing to a weird port.

Re:Probably true, even.

[Korin43]

I agree with you, but the fact that it's IE is annoying from a developer's perspective. I'm getting less annoyed with IE with every release, but it still does weird things sometimes, and it would be nice if they moved faster on HTML5 (I know it's not "done" yet, but WHATWG suggests that some parts are done, like the canvas tag).

Re:Probably true, even.

[Mashdar]

Why didn't they just use the built-in M$ encryption? Oh wait.

Re:Probably true, even.

[Cl1mh4224rd]

With closed source software, you're at the mercy of the manufacturer when it comes to even getting an acknowledgment of security issues, let alone receiving fixes in a timely fashion or before damage is already done.

I have yet to see anyone explain to me how, for the average user, this is any different when it comes to open source projects like Firefox.

How is your mother significantly more protected by the open source nature of Firefox versus the closed source nature of Internet Explorer? Answer: She isn't.

In either browser there exists the possibility for black hats to discover and exploit a vulnerability before anyone else is even aware of it.

If a vulnerability is discovered in Firefox, your average user is at the mercy of the Firefox developers to acknowledge, research, and patch that vulnerability in a timely manner. It's exactly the same with Internet Explorer.

Sure, some independent developer could write a patch themselves and offer it up if Mozilla seems to be slacking off, but that certainly isn't going to help your average user. They won't even know about it, let alone know what to do with it if they somehow stumble upon its existence.

The only thing that separates the security of one project from that of another project is the discipline of its developers and the turnaround time in patching vulnerabilities. Neither of those ultimately have anything to do with the openness of the source code.

Re:Probably true, even.

[Anonymous Coward]

After running firefox for days, with 10 open tabs at this moment, the memory footprint is now: 166,500 K. (win7)

Running Opera 8.54 on Win2k. This browser session running ~ 4 days.

82 open tabs, currently. Easily 200 more tabs opened & closed up to now.

Current footprint: 96,764 KB.

Number of "plugins" needed: 0.

Mind you, I keep the dreaded JavaScript and hideous Flash turned off as much as possible.

Re:Probably true, even.

[Ant P.]

Yes there is.

Re:Probably true, even.

[Robert Zenz]

I might actually believe that a fully patched IE8 is on par with other browsers...

Ahm no, not really. Browser Comparison

Re:Probably true, even.

[Thinboy00]

There is a direct three-way correlation between use of IE, stupidity, and security.

Whether that is also a causation, and if so which way it runs, has yet to be established.

Re:Probably true, even.

[Thinboy00]

There is a direct three-way correlation between use of IE, stupidity, and security problems .

Whether that is also a causation, and if so which way it runs, has yet to be established.

Fixed that for me.

Re:Probably true, even.

[turbidostato]

"Yes there is."

No, there isn't. Read carefully the very document you link to.

There's a problem, instead, using server daemons that won't properly handle malformed content.

Re:Probably true, even.

[Hucko]

I do believe that Mozilla is not the only one auditing and compiling Firefox. I'm pretty sure that at least Debian audits, compiles and cross-checks code. A similar situation occurs re Chrome and Chromium (SRWare Iron) So we have a situation where there are at least two manufacturers of the essentially same product, using different production methods and conditions. I'm pretty sure that RH and Novel would do the same, and I'm positive that there are privacy and security pedantic individuals out there that can, and do, do the same on a myriad of systems including the venerable Windows systems.

We could perhaps argue that the NSA and China do that wrt IE, but both of those aren't well known for sharing secrets, unlike the former groups.

Open Source isn't infallible, and it does require a critical mass+ to have the advantages often claimed. But when the conditions are right++, then it has a higher probability of being better *security wise* for the average user than comparable other software. And it often relies on subjective factors for defining security.

+ I've never heard of this factor being defined.
++ This is a huge caveat.

Re:Probably true, even.

[that this is not und]

Sounds to me like the servers need to be armored against botnets. Not that so much finger pointing at regular users is needed.

If the open 'consensus' model of the Internet is broken, so be it. Don't blame the participants.

Re:Probably true, even.

[mjwx]

I loled at this fake, then I type "windows for warships" in google... We are living in a strange world.

Meanwhile, on a Royal Navy warship.

[Captain] Leftenant, time to impact.
[Officer] 15 seconds sir,
[Officer] 13 seconds to impact sir,
[Officer] 23 seconds sir,
[Officer] 2 minutes?

Re:Probably true, even.

[Culture20]

I lollled when I thought of Microsoft's having started offshoring back in 2004; the thought of Indian programmers writing code for their old colonial master's warships is...amusing.

Funnier than American programmers writing code for their old colonial master's warships?

Re:Probably true, even.

[Maxo-Texas]

That's good-- and neither is the memory hog that the parent post reports.

However, you are missing some functionality. Such as the ability to capture videos off of you-tube and WoT's warnings about bad sites before I browse to them in the first place.

It seems like having javascript all off/on could be risky. And having to manually set it when I return to a site I trust would be a hassle.

But to each their own.

Re:Probably true, even.

[initialE]

Oh, that's about as funny as a screen door on a battleship.

Re:Probably true, even.

[Meski]

Measuring stupidity? I think that calls for Big O notation. :)

Re:Probably true, even.

[Meski]

But it's been around a hell of a lot longer.

Re:Probably true, even.

[Anonymous Coward]

However, you are missing some functionality. Such as the ability to capture videos off of you-tube

Egad! Then how on earth did the 10 GB of youtube .flv and 20 GB of youtube .mp4 get on my darned machine? Divine intervention? Magic?! No! It must be evil spirits!!! This download drop-down box listing all available HD and SD formats just keeps appearing beside every darned youtibe video. I'm sure that it's not related to that 5 kB U"ser JavaScript" file I installed in about 3 seconds some time ago.

and WoT's warnings about bad sites before I browse to them in the first place.

You could call it "site-advisor". Except that's what Opera has called it since Opera 10.

It seems like having javascript all off/on could be risky.

You worry less about what sites to trust when your browser has the best security record of all for many years running. In 10 years or so of using Opera, during which I've visited innumerable eastern European sites (big music junkie), I've never had a single problem. Still, it never hurts to be careful, as you imply.

And having to manually set it when I return to a site I trust would be a hassle.

Yeah, in the old days it was tough. I had to hit F12, tick enable JavaScript and then hit F5 to refresh the page. And talk about a long wait! It would take at least 1/3 as long as Firefox to refresh a page [I always keep Firefox on my machine, too - guess which one I end up using all the time]. But I guess Opera felt our grief, which is why, as of Opera 9.5 iirc, you can enable (or disable) JavaScript on a site-specific basis.

Still, who would want to get a browser called Opera that has the best security record, bar none, and is the font of so many good ideas that Firefox and even IE implement a mere few years later? You'd have to be nuts.

I do worry about the fact that I'm not installing plugins developed by god-knows-who. It bothers me not to be forced to wonder if the old canard about thousands/millions of eyeballs has exceptions.

Anyhow, thanks for the reply. It's fun to shoot holes in falsely held beliefs.

Re:Probably true, even.

[Malc]

3.6 seems no better than 3.5. Submitting bugs like that is pointless. Unless something has changed since the early to mid 2000's, the Moz devs are prima donnas and /. is full of Moz apologists. My previous attempts at involvement were an exercise in frustration. It seems you need to debug the code to stand a chance of even getting somebody's attention. Well, no thanks - I do that for my job, and I want a life after that.

Who cares about Flash/Silverlight/JS laden websites? Other browsers aren't as bad. Perhaps that's because of the move to multi-process architectures. Moz people have never liked this approach - there are still some people hanging on to Sea Monkey for some bizarre reason. Oh the arguments I had nearly ten years ago with people who seemed to believe it is necessary for tight integration (more like a lack of software engineering and programming skills).

Tell me, are there any tools to debug memory usage? about:cache?device=memory is useless. Where are the real tools, preferably as a plug-in or extension.

Re:Probably true, even.

[Anonymous Coward]

Thank god for uac!

Re:Probably true, even.

[ibsteve2u]

Funnier than American programmers writing code for their old colonial master's warships?

Oh, far funnier. It only took we Americans a decade or so to shake off imperialism; the Indians suffered and fought for two centuries. Thus, I'm sure their sense of humor is more highly...developed.

Re:Probably true, even.

[mcgrew]

You're confusing ignorance with stupidity.

Re:Probably true, even.

[Maxo-Texas]

It's a shame you felt the need to be so sarcastic that you posted anonymously. Your post has useful information and might lead folks to actually try opera.

This is part of the reason linux has had trouble getting traction... instead of patiently explaining (probably for the dozenth time) they attacked anyone who didn't know about it already.

Opera is at .7% (and dropping) per http://arstechnica.com/microsoft/news/2009/04/march-2009-browser-stats-ie-and-opera-drop.ars.

It sounds like a nice browser. It may need some nicer users to grow.

Re:Probably true, even.

[AmiMoJo]

That puts you in a really bad position. If you sue the MOD when your ID gets stolen you will be taking money away from active troops. Let's hope that doesn't happen.

Re:Probably true, even.

[GameboyRMH]

Some software out there still requires admin privileges to run. These should be banned and burned.

You can pry nmap out of my cold dead hands!!!

Re:Probably true, even.

[Anonymous Coward]

Interesting that you take stats from almost a year ago when the stats from November peg it at 2.31%.

Re:Probably true, even.

[Maxo-Texas]

It was the first google result.

Looking for something current I get this:

http://www.w3schools.com/browsers/browsers_stats.asp

Opera actually shows a better number for March 2009 than Ars Technica: 2.3%.
And the result for December 2010 is: 2.3%.

It was also 2.3% for January 2009.

Re:Probably true, even.

[Maxo-Texas]

Okay w3schools didn't seem like the best source after I posted... so found this.
http://www.netmarketshare.com/browser-market-share.aspx?qprid=0&qptimeframe=M&qpsp=120&qpnp=13

It is quoted as a source in an article on Chrome's growth.
It has a cool date selection option...

So...Without further ado...
January 2009
Opera: 2.23%

January 2010
Opera: 2.38%

and you can use the date selection combined with the graph to look at the other browsers too.

The comparison between this and w3schools shows w3 gets a lot less IE browsers and more of the other types.

Re:Probably true, even.

[cbiltcliffe]

ActiveX.

You don't need Internet Explorer to run an ActiveX control, as they're supported natively by the system. Without UAC on Vista/7, ActiveX controls in IE run at the same privilege level as any other user process, because they actually DO run natively on the system.

Re:Probably true, even.

[drsmithy]

You don't need Internet Explorer to run an ActiveX control, as they're supported natively by the system. Without UAC on Vista/7, ActiveX controls in IE run at the same privilege level as any other user process, because they actually DO run natively on the system.

And that's "unique" how, exactly ? Are you suggesting other browsers don't run plugins or third party code at the same privilege level as other user processes ?

Re:Probably true, even.

[cbiltcliffe]

There's a difference between running third party plugins, and running operating system components.

Internet Explorer can run any ActiveX control. Many Microsoft-signed controls get run automatically when requested, even with security settings set to disable automatic running of ActiveX.

The Windows OS comes with hundreds of ActiveX controls, all of which can have security problems, and can affect any file on the system, given appropriate access rights.

This is all in a default Windows install.

Other browsers and third party plugins aren't even in the same league.

Re:Probably true, even.

[drsmithy]

There's a difference between running third party plugins, and running operating system components.

ActiveX controls are not "operating system components" in way other than being included by default. Like, say, 'rm' on any Linux machine.

Internet Explorer can run any ActiveX control. Many Microsoft-signed controls get run automatically when requested, even with security settings set to disable automatic running of ActiveX.

For example ?

The Windows OS comes with hundreds of ActiveX controls, all of which can have security problems, and can affect any file on the system, given appropriate access rights.

Yes. Just like on any other platform that comes with $FUNCTIONALITY.

Other browsers and third party plugins aren't even in the same league.

They're in exactly the same league. You haven't described anything "unique" about how IE works compared to its equivalents on other platforms.

Re:Probably true, even.

[cbiltcliffe]

Internet Explorer can run any ActiveX control. Many Microsoft-signed controls get run automatically when requested, even with security settings set to disable automatic running of ActiveX.

For example ?

Take a look in the addin configuration for Internet Explorer 7 or 8.

There's a specific list of addins that run without requiring permission.

Goatboy

[Anonymous Coward]

I think the late great Bill Hicks would have said this best "Suckers of Satans cock, every last one of 'em"

Re:Goatboy

[Anonymous Coward]

How did he find out? It was supposed to be confidential!

In agreement

[Anonymous Coward]

Couldn't agree more. Show me some evidence man!

Guess we going to have to provide "evidence"

[Anonymous Coward]

Someone... quick... grab the evidence!

"latest fully patched"

[Doviende]

Sorry, how many users are actually using the latest fully patched version of IE? Google is still trying desperately to phase out IE 6, of which there are still many users. Perhaps as a "neutral" gesture to throw MS a bone, they could make an announcement saying "Upgrade to the latest IE8, or to another browser such as Firefox, Chrome, etc. Your current version of IE is probably ass^H^H^Hinsecure".

Re:"latest fully patched"

[Anonymous Coward]

More drastic solution: show the user a page which kindly tells them to upgrade their browser (there browser isn't suited for the web page anymore). Don't allow them to access your services unless they upgraded. Then write your webpages in such a way that they *crash* IE6. This should take care of the matter.

Re:"latest fully patched"

[Anonymous Coward]

Yes Minister.
They answered a different question to what was asked.
No evidence for latest+patched IE - well yes, that changes weekly, so yes, there can be no comparisons, and statement is technically true.

Based on everything known, it would be better to move to something else - they have forgotten the 'standard' environment is a huge huge risk. So they got rid of this factor by adding 'users'. The implication being .gov firewalls and IDS's and the like back up a brittle, insecure product.

Re:"latest fully patched"

[thetoadwarrior]

Microsoft is fine to go ahead and do things behind the users back but they won't force IE updates on people. If they would do this (and quit worrying about if they've pirated Windows before allowing them to get IE updates) then we would have fewer problems. For once can't they abuse their monopoly in a way that helps society?

Re:"latest fully patched"

[Synkronos]

I'm assuming that they will be running AD domains, with a local MS SUS server (and Automatic Updates setup correctly). This is, I realise, not necessarily the case. If the network admin is any good at all, he will approve (and set a deadline) on all security updates. This should keep everything up to date. Again, I realise this isn't always the case, but on a properly set up, properly maintained network, it's relatively easy to make sure that everyone is running the latest MS products and updates.

Re:"latest fully patched"

[Runaway1956]

And, this should have been done as much as 6 years ago - and not less than 4 years ago.

I simply do not give a rat's arse for those who "depend" on IE6. Use a standards compliant browser, or stay off the intartubez. Try driving a ratheap rustbucket junker down the interstate highways, and see how far you get. The cops WILL be along shortly to impound the damned thing for the safety of more responsible people who also use the interstate.

Re:"latest fully patched"

[destroyer661]

Facebook does exactly this.

*No* evidence?

[henrypijames]

It's one thing to say there is insufficient evidence, but *no* evidence?!

Re:*No* evidence?

[MrMr]

If you've personally handled the evidence I can see a way in which you could truthfully claim that.
But I'm a cynic.

Re:*No* evidence?

[Thad Zurich]

Apparently Lord Avebury neglected to point out that the reverse is also true. The only way to have evidence either way would be to audit the source code of IE against competing browsers. Since the industry has conspired to make this impossible, the only possible security rating for IE is NULL, as opposed to something quantifiable for open source competitors.

Re:*No* evidence?

[Anonymous Coward]

It's the new standard weasel answer of this government.

It means "we cannot be arsed to check" and so "we have no evidence" is technically true. And it works for far more serious issues too!. Good old Jack Straw uses it quite a bit (why with him being Secretary for Justice and all). There is probably a Cabinet memo about it.

Please consider

[Anonymous Coward]

that parliamentary questions aren't meant to please, especially politicians. It's more of a time for the civil service to cover their asses in front of politicians.

Governments will say and do anything....

[Anonymous Coward]

...when large corporations are stuffing their pockets.

Lord Avebury.....

[oldmeddler]

... is an idiot.

Re:Lord Avebury.....

[Anonymous Coward]

... is an idiot with m$ money in his backpocket.

Fixed it for you.

Re:Lord Avebury.....

[Eunuchswear]

Uh, why?

He asked a reasonable question.

It was the Home Office that gave the reply some people don't like, even if it is probably true.

Re:Lord Avebury.....

[Anonymous Coward]

The idiot here is the one who couldn't even understand the first two lines of the summary.

Re:Lord Avebury.....

[jimicus]

It was the Home Office that gave the reply some people don't like, even if it is probably true.

Only on a technicality.

Technically, at this moment in time there are precisely no publicly known exploits for a fully patched up to date copy of IE, a fully patched up to date copy of Firefox or a fully patched up to date copy of Opera.

The fact that history has shown us that exploits for IE tend to show up more frequently, are often nastier than exploits for Firefox or Opera and are almost never dealt with in an out-of-cycle patch (and so will be exploitable for that much longer) is neither here nor there. This is absolutely typical of any UK government department (and probably the same in many Western countries) - when you're asked a question which you don't necessarily like, interpret it in a fashion which allows you to give an answer which you do like.

Admitting that IE may be more dangerous isn't in and of itself a huge problem but it may well invite a lot more questions like "How many internal government systems only work with IE?" - and I bet you anything you like the answer is not "Zero".

Re:Lord Avebury.....

[Svartalf]

Admitting that IE may be more dangerous isn't in and of itself a huge problem but it may well invite a lot more questions like "How many internal government systems only work with IE?" - and I bet you anything you like the answer is not "Zero".

I do believe that the aforementioned quote is likely to be the source of the response from the Home Office there. The answer is probably going to be closer to "Most of them". That's not an answer people would like to hear at all- probably less than we want to hear the weasel wording from the Home Office there.

Re:Lord Avebury.....

[symbolset]

I think this is a question we should all ask of our goverments - loudly - until we get an answer.

in case any other Americans are confused

[Trepidity]

In UK governmental English, "to table" apparently means something like "to propose" or "to bring up for consideration", almost exactly the opposite of the U.S. meaning, which is "to withdraw from further consideration".

I guess there's some international disagreement over whether this mythical table is where you put things to be considered, or where you put things to die. Perhaps to Britons, putting things on a table is officially proposing them, whereas to Americans, if it's on the table it's inert, and if you want it proposed, you had better have it in your hand waving it in someone's face.

Re:in case any other Americans are confused

[twisting_department]

Think about King Arthur and the Knights of The Round Table. Obviously questions were brought to the table, asked, answered and debated. Nothing "inert" about it. I guess any part of the history of our ancestors prior to the discovery of America is not taught over there very much.

Re:in case any other Americans are confused

[Tim C]

Perhaps to Britons, putting things on a table is officially proposing them

Well I don't know for sure, but I'd always assumed that it was from "to bring something to the table", which is a fairly common expression here in the UK. (Think meeting room table, and bringing something with you for consideration (or perhaps even a dining table))

Re:in case any other Americans are confused

[gigne]

Yes, indeed you are correct.

UK: To place an item on the agenda for discussion.
US: To remove the item from consideration.

In the UK we shelve discussion items when they are removed from consideration.

Re:in case any other Americans are confused

[Trepidity]

Yeah, oddly, "to bring something to the table" is the same in US English. But "to table" something is the opposite--- to take it off the table, so to speak.

Re:in case any other Americans are confused

[Aldenissin]

Think of "to table" something as setting it down in US English, as opposed to putting it up on the table in the UK. Context clues help to make it clear, and I have heard it used the "UK" way in the US. E.G. "Alright, lets table that, what else have you got?" - Lets set it down and move on; "Good idea Frank! However keep in mind if we (put this on the) table this now, we wont have time for your other presentation." - What are we about to look at or talk about?

Re:in case any other Americans are confused

[Stuart Gibson]

Because we're tidier?

Re:in case any other Americans are confused

[TheRaven64]

Until we run out of shelves, then we table them until the table is cluttered, and then we floor them.

Re:in case any other Americans are confused

[Anonymous Coward]

Other countries don't play poker, apparently -- but even in that game winning is accomplished by putting card on the table and demonstrating which card one has.

I think American English use is misguided.

But then, I'm biased, I think the entire English language is braindamaged.

Re:in case any other Americans are confused

[Anonymous Coward]

Probably Americans meant "to staple" but most didn't know their own language well enough so they thought it meant "to table" :-P

Re:in case any other Americans are confused

[Anonymous Coward]

In UK governmental English, "to table" apparently means something like "to propose" or "to bring up for consideration", almost exactly the opposite of the U.S. meaning, which is "to withdraw from further consideration".

I guess there's some international disagreement over whether this mythical table is where you put things to be considered, or where you put things to die. Perhaps to Britons, putting things on a table is officially proposing them, whereas to Americans, if it's on the table it's inert, and if you want it proposed, you had better have it in your hand waving it in someone's face.

There are actually 2 tables for Americans. One of them is the meeting room table, where you "bring something to the table" and thus propose/bring it up. The other one is the table in the back of the room where they put your Christmas present for your boss (see: National Lampoon's Family Christmas). Thus, "to table."

Re:in case any other Americans are confused

[TheLink]

"to table" something? Don't give that guy in Redmond any more ideas.

"to chair a meeting" has already started to have other connotations.

Re:in case any other Americans are confused

[Aldenissin]

Get out of my way, before I pick you up and chair you out of my way!

Re:in case any other Americans are confused

[Anonymous Coward]

Damn! I've had so many discussions recently I have run out of floor space! Is it alright to box some and put them in the loft?

Re:in case any other Americans are confused

[zippthorne]

You're including, as part of "british history," a French fantasy novel?

Re:in case any other Americans are confused

[Anonymous Coward]

The first black swane kills the assert that All swanes are white.

Expect crackers to prove them wrong.

Re:in case any other Americans are confused

[twisting_department]

Yes, and a lot of other European stuff. It's all inter-related.

Re:in case any other Americans are confused

[shani]

The problem is that this is a shorthand phrase. in the US people mean 'take it off the table', where presumably it is already being considered. In her majesty's islands people mean 'put it on the table for future consideration'. The real problem is that verbing weirds language.

Re:in case any other Americans are confused

[Brett Buck]

Yes, and a lot of other European stuff. It's all inter-related.

        The word you are searching for is "inbred".

Re:in case any other Americans are confused

[TechyImmigrant]

'To table' has colloquial meaning that might change from place to place. However in both the US and UK, when you are operating under Roberts Rules or a variant of it, an item (e.g. motion) is 'on the floor' when its being discussed. Passing a motion 'To table' it is to figuratively take it from the floor (where people on the floor are discussing it) and place it on the table (so we don't forget it). A motion to take it from the table is a motion to bring it back to the floor for discussion. Sometimes the 'table' is literal and bits of paper are used to record the motion that is tabled.

The procedural difference between anything else you might do to defer work is that in a motion to table you can't say "let's table this until 3.30pm", you can only table it. To take it from the table requires a new motion to take it from the table.

UK and US parliamentary procedural rules and Robert's rules of order (used in formal meetings everywhere) are all in the same family of rule sets.

It's quite possible that in UK parlimentary rules you could table a motion so that it's up for future discussion, without it ever having been on the floor, but I don't know the specifics of the UK rules. However in either case, being 'tabled' means it's not being formally considered, it's just on the table waiting to be picked up for future discussion.

Re:in case any other Americans are confused

[Sir_Lewk]

We should also probably be teaching Tolkien fantasy in history class too huh? Discussion of king arthur in schools would take place in english/literature classes, and frankly there are many far more important pieces of literature that should be taught instead. We actually briefly touched on king arthur in my english class my senior year in highschool, as part of a series of lessons on the history of early england, and the development of the english language. Origins of the phrase "to bring to the table" would have been far out of scope.

But hey, why pass by a chance to knock the american public schooling system?

Re:in case any other Americans are confused

[Anonymous Coward]

Yes, indeed you are correct.

UK: To place an item on the agenda for discussion.
US: To remove the item from consideration.

In the UK we shelve discussion items when they are removed from consideration.

Really? I'm from New York and I always used it the 'UK' way.

Re:in case any other Americans are confused

[jbengt]

I believe it might have to do with the US Congress.
If you bring up an item for vote, it might well be passed. But if you can table an item, putting it aside for further debate, you may be able to kill it by effectively preventing it from being considered for a vote before that session of Congress ends.

Re:in case any other Americans are confused

[gbjbaanb]

in America shelving also means to remove it from current consideration - hence all the source-control systems use 'shelving' to mean 'store it away somewhere and I'll come back to it later'.

I think the Americans are using 'to table' as a shorthand colliquary term for 'take it off the table'.

Re:in case any other Americans are confused

[The Wild Norseman]

Until we run out of shelves, then we table them until the table is cluttered, and then we floor them.

And back when I had a 21" CRT on my desk, I also had a place to monitor documents as well.

Assuming they are actually using IE8.

[Anonymous Coward]

To a certain extent, other browsers benefit from their low levels of use. IE is SO common that pretty much all sophisticated attacks target it. Given that a targeted attack on the uk gov't will target whatever browser they use, switching browser doesn't make all that much sense. And these aren't the days of IE6 anymore.

Re:Assuming they are actually using IE8.

[Synkronos]

Except that, by using a not-most-popular browser, they dodge all generic attacks not specifically aimed at them. Which is, oh, most of them. As you say, a crafted attack will exploit a known bug in a known used system, and so doesn't matter which (since they all have exploits at various points in their lifecycle), but removing yourself from the random crossfire can't be bad.

Bullshit

[YA_Python_dev]

Thanks to the China exploit most IE versions out there execute arbitrary code just by visiting a web site. I don't think this is true for any other browser: e.g. when new vulnerabilities are discovered in Firefox they are patched quickly (Microsoft sits on bugs for months or years) and most user actually upgrade to the latest Fx version because they don't have to fear that a security upgrade will cripple their computer.

Re:Bullshit

[abigsmurf]

Most people aren't running IE6. The exploit does not work on IE7+ unless you disable security settings that few people would.

It's true for every single browser that runs an adobe or java plugin. Failing that, there are no shortages of Firefox exploits in the wild. It's a myth that firefox can't get malware through regular browsing.

Re:Bullshit

[Runaway1956]

You get your IT news from the register? Coool!

More seriously - you link to that page, with words that seem to indicate there are a LOT of Firefox exploits in the wild. Care to name some? The IRC exploit only counts as one.

One more time, I'll point up Firefox's main advantage over IE: Vulnerabilities are made public, and people actually address the vulnerabilities as quickly as possible. Firefox exploits aren't hidden under a mountain of shit by some corporate boss, so that he hopes they can go away.

IMHO, Firefox is just about as safe as a browser can be, today, based on current knowledge. It ranks right up there with Chrome and Opera, and Safari, and Konqueror.

IMHO, Internet Explorer MIGHT be almost as secure - if and when people finally upgrade from IE6 to at least 7, and preferably 8. MIGHT BE. You'll notice that MS didn't publicize this newest vulnerability, until Google and others had already done so.

Re:Bullshit

[pizzap]

He is talking about this vulnerability: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0249

Which works up to win7 with ie8.

Re:Bullshit

[icebraining]

That's NOT a Firefox exploit. That's Firefox send a normal HTTP request to a non-standard port (6667), and the IRC server *wrongly* interprets it as IRC protocol.

The only thing they say Firefox does "wrong" is actually connecting to a non-standard port, which I dispute: there are plenty of reasons to run webservers in non-standard ports, and I want to be able to connect to them.

Re:Bullshit

[Anonymous Coward]

Much of the British Government is still running IE6. I weep.

Re:Bullshit

[Anonymous Coward]

That's not an exploit, that's idiots running a HTML form without CAPTCHA or anything and complaining that they get spammed and instead of fixing the real issue banning people based on IP.
Yes, it's a complete security FAIL, but not by Firefox.

Re:Bullshit

[abigsmurf]

http://www.google.co.uk/search?q=firefox+exploit

5 seconds of searching returns what looks like 3 seperate examples of unpatched bugs being exploited in the last year just on the first page.

Re:Bullshit

[Runaway1956]

3 exploits. 3 in the past year. Oh-kay - now - how many exploits in IE in the same time period? And, how many have been fixed in each browser?

"No shortage" of exploits suggests a lot more than three, LMAO

Re:Bullshit

[inode_buddha]

I think its more important to realize that Firefox isn't tied to the underlying OS as much as IE is. That alone can make a huge difference. Combine that with Mozilla's relative transparency, and Firefox seems to be the better choice overall, despite plugin vulns. And I'm pretty sure that the plugin vulns could be contained by Firefox if the plugin vendors won't fix their stuff.

Re:Bullshit

[Xest]

To be fair I think his point was partially valid.

You're right that Firefox core has the advantage of public vulnerabilities, but the issue is that Firefox allows for non-sandboxed extensions, which are often proprietary (i.e. Flash) and so effectively leaves Firefox with the same issue.

Firefox certainly isn't as safe as any browser can be, simply because of the fact extensions are vulnerable in this manner.

I think what the UK gov is getting at is quite valid- not that IE has the same or less security flaws per-se, I think they probably accept that it does, but that no other browser really is built with a truly secure architecture either, such that even if you switch away from IE, whilst Firefox itself may be secure, many users will end up with extensions that aren't and so will remain vulnerable to something or other regardless.

Re:Bullshit

[Anonymous Coward]

Firefox 3.5x - 48 vulnerabilities

IE 8 - 30 vulnerabilities

http://secunia.com/advisories/product/21625/?task=advisories

http://secunia.com/advisories/product/25800/?task=statistics

Re:Bullshit

[BZ]

That linked-to article gets one thing wrong: IE has the same exact behavior. As did Netscape. It's a well-known aspect of how HTML forms work, and the real issue is an IRC server that for some reason decided that ignoring leading garbage in the IRC command stream was a good idea.

Re:Bullshit

[Philip_the_physicist]

No, that's people using protocols that can interpret a particular HTTP post as a valid message, and then treating it correctly. It is a rather neat abuse of the two standards, but it was bloody annoying since the attack (or freenode admins fighting it) caused continual netsplits for hours.

Firefox implemented the HTTP standard correctly, and Freenode's ircd handled IRC correctly, the problem was that the protocol's designers did not anticipate that this would happen, or expected that ops would set +nj n their channels.

This is eveidence for something else...

[Mojo66]

This is evidence for the fact that nowadays, decisions aren't made by politicians anymore, but by lobbyists. Politicians are just the muppets who stand in front of the camera. Best example is my country, Germany, where the FDP is doing this openly, it is called "clientel politics" here.

Re:This is eveidence for something else...

[atomic777]

I saw an idea somewhere that politicians these days should require NASCAR/Formula-1 style sponsor patches to be worn on their suits at all times, to indicate which corporations are funding their campaigns.

Then when someone says there is no evidence of IE being less secure, we can Look for the logo

Re:This is eveidence for something else...

[maxume]

That would be an actual good use for augmented reality.

Extremists could even overlay content that made their opposites actually look like monsters.

Good times a' comin'.

Re:This is eveidence for something else...

[KwKSilver]

Brilliant! Love it.

Re:This is eveidence for something else...

[Arthur Grumbine]

Truly inspired! Also we could have the size of the patches be proportional to what percentage of total campaign funding came from that source - then it'd really stick out which ones were completely bought, and by whom.

Re:This is eveidence for something else...

[Oddscurity]

Or be required to change their surname to indicate their sponsor. Speaker: "We will now hear from Pete Microsoft."

IE (on Windows) is safer than Firefox

[Manip]

A fully patched IE8 running on either Vista or Windows 7 is far safer than Firefox. Why?
  - Low privileged mode. IE8 runs with lower rights than the logged in user, Firefox doesn't...
  - DEP is turned on for IE8 by default. Firefox has to be added (or the "all applications" option).
  - IE8 patches can be deployed from the Domain very easily. Firefox on a corporate network is a pain in the butt...

Now I entirely grant that this is Microsoft's browser running on Microsoft's OS and thus it gains unfair advantages but that doesn't change the facts or reality of the situation.

Re:IE (on Windows) is safer than Firefox

[Anonymous Coward]

There are currently 23 unpatched advisories for IE 6.x http://secunia.com/advisories/product/11/
There are currently 10 unpatched advisories for IE 7.x http://secunia.com/advisories/product/11/
There are currently 3 unpatched advisories for IE 8.x http://secunia.com/advisories/product/11/

Advisories often contain multiple vulnerabilities. Doing a little quick math, that comes out to around 59 vulnerabilities (not an exact number, just a ballpark estimate) for those 3 versions of IE

This is compared to 0 unpatched advisories for the 3.x line (19 months old, now) and 3 unpatched advisories for the 2.x line. http://secunia.com/advisories/vendor/18/

Mozilla also generally gets their patches out faster than Microsoft.

Re:IE (on Windows) is safer than Firefox

[selven]

IE doesn't have Noscript. That's a pretty big one in terms of security.

Re:IE (on Windows) is safer than Firefox

[TheRealGrogan]

That's just typical FUD propaganda - IE, in low privileged mode, can still compromise the system (All it takes is a malicious codec download for one example and a stupid user for another). Besides, the protected mode only works if User Account Control is on and if it is on, then no app is running as an administrator anyway and it's a moot point. (The user's privileges ARE low, until elevated through the nags. If a user isn't in the administrators group, then they can't even allow the nags without entering an administrator password, which they wouldn't have) - DEP... so what? That just prevents a specific type of exploit. It can cause problems too... like when there's absolutely nothing wrong on the system and some stupid Windows component gets shut down because DEP throws an exception. (and if a process was headed for a crash, and that's the exception that gets triggered because something got relocated to data pages it's misleading) - Firefox is pretty easy to update (without it breaking itself) and only a Microsoft stooge could spin that into something difficult. No, it's not the Microsoft way, but that doesn't mean it's difficult. Internet Explorer is, and will ever remain, shitware. It's still got much of the old code base... they just keep sewing more arms onto the octopus. Here's one example. To this day, that piece of shit can't download files larger than 4 Gb. What other gotchas are lurking in that mess of proprietary code that's been the base of it since the 90's?

Re:IE (on Windows) is safer than Firefox

[trifish]

IE has something better. Learn something about Trusted Sites and the myriads of settings you can apply to them (like enabling scripting).

You can argue about easy of use, but that's not what you talked about. You talked about security. And blocking scripts on per-site basis (using lists) IS possible already in IE6.

Re:IE (on Windows) is safer than Firefox

[10101001 10101001]

A fully patched IE8 running on either Vista or Windows 7 is far safer than Firefox. Why?

- Low privileged mode. IE8 runs with lower rights than the logged in user, Firefox doesn't...

And how many people (or corporations) are running Vista/Windows 7? Yes, it's a great feature if it's available, but once you start adding such caveats, one might as well point out running Firefox under SELinux/Apparmor in Linux is pretty much as secure. Now, if you mean as for the general public having recently (ie, the last few years) bought a computer, you're probably right; they're likely to be using a proper version of Windows and have auto updates set to have the latest patched IE8. Still, the fact that so many people are using XP really should result in at least a marginally more nuanced statement instead of making statements based on one or more grand presumptions.

- DEP is turned on for IE8 by default. Firefox has to be added (or the "all applications" option).

"By default", IE8 isn't even installed on XP or Vista and in all cases there's a need for patching. Truthfully, I'm not certain, but Firefox might be compiled with stack protection anyways, so I'm not even sure if DEP is really necessary for Firefox. If DEP is necessary, then yes, for many home users this is an issue because users might be oblivious to the need to enable DEP. But on corporate networks, at least, it would be par the course of configuration that DEP would be enabled.

- IE8 patches can be deployed from the Domain very easily. Firefox on a corporate network is a pain in the butt...

Why would you need to patch a fully patched IE8? :) Seriously, though, I've heard this complaint, and it seems a valid one. However, if you do run a corporate network, I'm pretty sure the "pain in the butt" nature of deployment isn't going to stop you from choosing Firefox over IE8. Why? Because the risk increase of dealing with infected networks is probably a greater "pain in the butt". But, odds are good that the IT staff have no real say in what's used anyways (consider the repeated statements of IE6 still being used because of corporate intranet applications), so all in all it's a moot point.

Re:IE (on Windows) is safer than Firefox

[Anonymous Coward]

IE doesn't have Noscript. That's a pretty big one in terms of security.

And neither does any corporate / educational roll-out of firefox I have ever seen.

Suppose you give your employees two options, one browser where everything just works, and another where basic browsing is non-functional because they don't see the little "S" in the bottom right is crossed out, which option do you think they'd pick.

Sure you could block IE and force Firefox + noscript down the throats of luddites, but be prepared to staff your support desk with more employees than combined rest of the company. The vast majority of the people in the world have enough problems remembering how to log in to their computers in the morning.

Re:IE (on Windows) is safer than Firefox

[auLucifer]

And most common firefox users wouldn't have it either. What's your point?

Re:IE (on Windows) is safer than Firefox

[Anonymous Coward]

Noscript is big in terms of security, but its an inconvenience, and breaks compatibility with many sites. It isn't something that I'd personally recommend to most of the population, and especially not to those who grew up without computers (such as politicians). I personally only use adblock.

Regardless, I don't believe that unofficial addons which aren't included with the browsers (or not even recommended on first run) should be included in such a study anyway. Because in real world usage, the settings out of the box have been shown to matter the most (since ordinary humans don't change them). That's why Microsoft highly recommended in Windows XP Sp2 that the firewall was enabled and warned users by default!

Re:IE (on Windows) is safer than Firefox

[KwKSilver]

Interesting. How do you suppose that will work out for people who can't figure out how to change their homepage? (But do click on e-mail links entitled, "Naked Pictures of ... Whoever")

Re:IE (on Windows) is safer than Firefox

[Anonymous Coward]

While your points are valid, they don't mean that IE is any safer because those feature merely offer a security backup should a hole be present, and only for a certain category of bugs. It doesn't mean that there's no holes and does not guarantee that any potential hole is covered.

If IE had an arbitrary "read arbitrary window content and cookies" javascript operation, neither would kick in.

Case in point, Aurora.

Re:IE (on Windows) is safer than Firefox

[Anonymous Coward]

Whilst your other two points are very valid, are you sure about DEP?

Process Explorer shows Firefox, Opera and IE8 are all running with DEP on my XP SP3 machine in opt-in mode ("DEP Permanent" as Process Explorer lists describes it)

Re:IE (on Windows) is safer than Firefox

[Anonymous Coward]

A fully patched IE8 running on either Vista or Windows 7 is far safer than Firefox. Why?

  - Low privileged mode. IE8 runs with lower rights than the logged in user, Firefox doesn't...

It's just low priviledged enough to flash my bios with byte code LOLOLOLOLPWNED. Very helpful.

Re:IE (on Windows) is safer than Firefox

[SanityInAnarchy]

Firefox (and Chrome) can autoupdate themselves. Chrome also runs in a low privileged mode, at least on Linux. According to other posters, DEP isn't unique to IE.

Now that that's out of the way, does IE do the same multiprocess trick Chrome does? (I think so.) And especially, how quickly are IE bugs patched versus other browsers?

Re:IE (on Windows) is safer than Firefox

[selven]

Ease of use is a VERY important consideration in security. Security does not operate in a theoretical environment with an all-knowing IT chief and robots who follow all of his commands. Security operates in the real world, where users are human beings. If security is not easy to use, in the real world it might as well not be there at all, since people will not bother to use it or circumvent it if it's not easy to use.

Re:IE (on Windows) is safer than Firefox

[drsmithy]

Now I entirely grant that this is Microsoft's browser running on Microsoft's OS and thus it gains unfair advantages [...]

Why ? Which of your 3 piece of of functionality is/are not available for any software to use ?

Re:IE (on Windows) is safer than Firefox

[Anonymous Coward]

What you are describing is known as blacklisting and it is a very insecure way to approach security. Firefox on the other hand has an add-on known as NoScript which provides whitelisting. All scripting from all sites are blocked globally until you specifically allow them. For example, if you visit your bank or gmail you could allow it, and anything else you won't. This nips almost everything in the butt.

Re:IE (on Windows) is safer than Firefox

[VON-MAN]

Yes, I needed to get in those myriad of options last week. To simply show some Visio files over the network in the Microsoft Visio viewer (it's a bloody Explorer plugin). And it really isn't something I would like to learn about, unless I was mortally interested in Microsoft's view of the Internet. For a corporate environment I think I prefer a firewall and proxy, and for personal use those myriad of options are what makes it pretty useless. Now I'm sure Microsoft could greatly improve the thing by simply rearanging the options, but right now I wasn't greatly impressed with the thing.

Something you said: are you implying that you can run Explorer with blacklists? To me it looked like whitelisting might be practical, if you would like to configure stuff like that in Explorer.

Re:IE (on Windows) is safer than Firefox

[rliden]

It will work out the same, because if they can't figure out how to change their homepage or deal with trusted sites they aren't likely to have any more success configuring site scripting options in no script. Are they going to understand the XSS messages they see? Are they going to understand which domain scripts to allow and which third party scripts to deny? My guess is they aren't. I have to help just as many inexperienced or non-savvy users with NoScript as I do IE8. A better solution for the non-technical user is a robust third party security solution that monitors these things for you.

Re:IE (on Windows) is safer than Firefox

[Anonymous Coward]

What you are describing is known as blacklisting and it is a very insecure way to approach security.

No, idiot.

It is both whitelist and blacklist depending how you decide to use it.

You can manually put a site on Trusted Sites lists and let all other sites be on the default list, for which you can for example disable scripts. You can also do it vice versa. Put all sites on trusted and manually put the bad ones to black lists (I wouldn't do that).

So Firefox isn't more secure because of noscript (which is by the way convicted spyware, for changing AdBlock settings without user's consent and adware).

Re:IE (on Windows) is safer than Firefox

[Anonymous Coward]

It's also something that no one does.

follow up questions should be asked

[Anonymous Coward]

While user stupidity remains a large factor in security breaches, Microsoft's products are the products which allow for the most user stupidity - and everything which is supposed to prevent that, is broken by design.

So, question remains: why is the UK government still using software which is broken by design?

Re:follow up questions should be asked

[JoshDD]

Because they don't want any one to have a secure browsing experience.

Same source that said Saddam Hussein has WMD?

[Anonymous Coward]

It's the UK government. It's very likely that whatever they say, the opposite is true.

Lack of evidence shouldn't be a problem

[noidentity]

They just need grow suspicious of IE harboring WMDs. Then the lack of evidence wouldn't be a problem at all.

Re:Lack of evidence shouldn't be a problem

[alx5000]

It's a shame that this comment is modded '+5 Funny', since, IMHO, it should be '+5 Sadly and painfully insightful'.

Re:Lack of evidence shouldn't be a problem

[Kavli]

WMD? Like in "Windows of Mass Destruction" then?

Ah, UK and the big corps.

[Anonymous Coward]

They just love 'em, dont they? Monsanto, Microsoft, mmmm.

(More on topic -- of course each browser has its weaknesses. It's not as much technical as it is process, I think)

Internet Explorer is safe for them...

[AHuxley]

What would the cubicle spooks at the UK Government Communications Headquarters do without MS?
They would have to learn to hack real operating systems and would have messy logs to correct everytime.
No more UFO hunters with perl scripts.
Forward intelligence teams and community policing with their 'sneak and peek' anti gang, eco and domestic terrorist operations.
All the ex spooks selling back MS cracks, ip loggers, websites, tools with polished gui's at dreamy consulting fees.
Then you have the bureaucrat with a rolodex who wants to get into the private sector. First rule, dont burn the US monopolies.
Add to that the 30 something point and click MS tech clones advising the MP's.
MS has many friends around the world who love sloppy networked computing.
Never believe anything until it's been officially denied.

There IS no evidence!

[guyminuslife]

The latest patched version of Internet Explorer fixed the bugs that Microsoft found. The latest patched version of other browsers fixed the bugs that other browser-manufacturers found. Ergo, there is no evidence that the latest patched version of Internet Explorer are less secure, since the officially "known" security features have been fixed.

In fact, there's no evidence that there are any bugs at all in the latest patched versions of any software ever written, unless the manufacturers have explicitly stated that there are. In which case, in order for policymakers to accept such a report, they would need to prove that this is the case, by lobbying the government to the effect that their software is inferior.

Re:There IS no evidence!

[Anonymous Coward]

Please forgive me if I'm wrong but I was under the impression Microsoft had know about this latest flaw for several months, but had deemed it not important enough to fix, so there IS evidence that they do not immediately fix all know security holes.

Re:There IS no evidence!

[guyminuslife]

I have no idea, I was going for "Funny" but somehow got "Insightful."

Re:There IS no evidence!

[cenc]

That all depends on your favorite epistemological definition of "to know" is. MS seems to have a different one from the rest of the Joe's on the street, as in "if we don't fix, it must not exist ".

Re:There IS no evidence!

[pgn674]

Ergo, there is no evidence that the latest patched version of Internet Explorer are less secure, since the officially "known" security features have been fixed.

What about this unpatched, known vulnerability: Internet Explorer Charset Inheritance Cross-Site Scripting Vulnerability - Secunia Advisories - Vulnerability Information - Secunia.com?

Re:There IS no evidence!

[Anonymous Coward]

Microsoft was made aware of the latest "major" bug in Sept '09, it was finally patched in Jan '10. It sat on the bug report until Google made a fuss. And this isn't the first time that Microsoft has done this. Mozilla on the other hand typically has a much smaller window between bug report and fix.

http://blogs.zdnet.com/security/?p=2786

Sure whatever they say.

[JoshDD]

and shit tastes good.

Re:Sure whatever they say.

[Anonymous Coward]

Shit sandwich, yum yum! :D

No, WRONG

[omb]

1. This is the POLITICAL part of government and is as easily bought as ISO, maybe easier.

2. Look at the record of UK Government IT projects.

3. It is not IE that makes Windoze insecure, it is the OS and the design philosophy

-- COM is a security disaster

-- executing any vaguely executable rubbish based on its extension is a disaster

4. Backward compatibility, and a zillion features that assume an essentially insecure and trusted
world are a disaster. M$ has no way out.

Re:No, WRONG

[0ld_d0g]

It is not IE that makes Windoze insecure, it is the OS and the design philosophy

Not sure if you're joking here. Microsoft employees thousands of programmers. They aren't "programmed" to use any philosophy when they get hired. Do you have any specific criticism of the NT design?

-- COM is a security disaster

COM has nothing to do with security. Using COM allows code written in different languages to interoperate at the binary level without taking heavy dependencies (well, except the interface). Hell even Mozilla uses a similar tech - XPCOM.

-- executing any vaguely executable rubbish based on its extension is a disaster

And on some other operating systems you can mark them as executable and run them. Nobody is going to stop you. If you can't change permissions on the file, but you have read permissions, you can read the file and write it to your home directory and then set the +x permission.

4. Backward compatibility, and a zillion features that assume an essentially insecure and trusted
world are a disaster. M$ has no way out.

You can believe that if you want to. If you want others to believe it you have to provide some level of evidence. ;)

Re:No, WRONG

[cbiltcliffe]

4. Backward compatibility, and a zillion features that assume an essentially insecure and trusted
world are a disaster. M$ has no way out.

You can believe that if you want to. If you want others to believe it you have to provide some level of evidence. ;)

http://www.esecurityplanet.com/features/article.php/3860131/article.htm

Re:No, WRONG

[0ld_d0g]

Oh wow, a privilege escalation bug in an operating system. That completely invalidates all my points. If you know anything about OS security you'd know that there exist and have existed and will exist privilege escalation bugs for all popular operating systems.

Its Not Like Linux Doesn't Have Any

Those are all from 2009 BTW. Anyway the point isn't to bash Linux or Windows for that matter, but I'll be impressed when someone can actually provide a valid critique of NT design. Maybe too much to ask for in a comment, but w/e...

Re:No, WRONG

[cbiltcliffe]

You asked for a security problem that resulted from providing backwards compatibility.

I provided you with one.

Now you say it doesn't meet your requirements, due to similar exploits which do not result from backwards compatibility requirements.

Way to move the goalposts after the ball's been kicked.
You should go into politics.

Re:No, WRONG

[0ld_d0g]

You asked for a security problem that resulted from providing backwards compatibility.

Re-read what I was replying to. OP was claiming that Backward compatibility and a zillion features amounted to "disaster". I was challenging that specific claim. There is not a shred of evidence that suggests the bug resulted *because* MS was trying to preserve backwards compatibility.

You have to take into account that operating system code once written & proved to be working is almost never touched unless it serves a specific purpose (fixing bugs, features, etc) and as a result a bug thats introduced in version 1.0 will carry forward to the next version and the next unless there is a need to change that. As it happens, there was no development done on that specific component and thus a bug in the version 1.0 got carried forwarded to Version 6.0. This is *not* because of backwards compatibility. Its because there was no need to modify existing working (well atleast the bug was unknown) code.

Anyway, most of the backwards compat stuff is encapsulated in a shim/wrapper and is only executed when running specific buggy programs (that are in the app. compat. database) that rely on undocumented or buggy behavior of previous operating systems. This does not affect other programs.

You should go into politics.

You should go back to school :P

Re:No, WRONG

[cbiltcliffe]

There is not a shred of evidence that suggests the bug resulted *because* MS was trying to preserve backwards compatibility.

As it happens, there was no development done on that specific component and thus a bug in the version 1.0 got carried forwarded to Version 6.0. This is *not* because of backwards compatibility.

Excuse me?

A security bug in the DOS VM isn't due to backwards compatibility requirements?

The need for the DOS virtual machine to exist AT ALL, is due to the requirement for backwards compatibility.

Maybe you should think before you type.

Re:No, WRONG

[0ld_d0g]

You have no idea what you're talking about. The bug is in the Virtual 8086 mode monitor, not the DOS VM. This exists in most operating systems. Google for /sys/vm86.h

Maybe you already know this and are just wasting my time. Anyway this is the last reply. Goodbye.

This just in...

[Anonymous Coward]

UK Gov't Says "No Evidence" condoms lower the risk of pregnancy and STD transmission

"Not please" Slashdot readers?

[Jane Q. Public]

I don't know why it would "not please" Slashdot readers. I am very pleased. That is the funniest thing I've read all week.

Nothing like a good laugh to start your morning.

Re:"Not please" Slashdot readers?

[Anonymous Coward]

Hold on a minute. You are a Slashdot reader. That means that you... but... Bollocks. I can't be bothered.

Re:"Not please" Slashdot readers?

[Dumnezeu]

Funny? Wake up, this is sad!

Re:"Not please" Slashdot readers?

[ignavus]

I don't know why it would "not please" Slashdot readers. I am very pleased. That is the funniest thing I've read all week.

Nothing like a good laugh to start your morning.

I am amused. But I am not pleased. There is a distinction.

Reread your post.

[Anonymous Coward]

Reread your post.

You say

"But the study was on whether the implementation of other browsers beside IE would increase security"

Then go to say that user error is why this wouldn't change IE's state. Then you go and say:

"the choice of browser would not affect the level of security much."

So which is it? Is it that it doesn't change security or it does change security?

You can't have both.

Re:Reread your post.

[Anne Thwacks]

You can't have both.

You cant
I cant
The British government can!

Are these the same people....

[Joce640k]

Are these the same people who said IRAQ was full of WMDs and terrorists?

Re:Are these the same people....

[Anonymous Coward]

the difference is that they actually believe this . . .

Re:Are these the same people....

[Anonymous Coward]

George Bush isn't politics anymore.

This is why...

[lattyware]

I fucking hate our government. Seriously. They just all appear compeltely incompetent.

Re:This is why...

[malkavian]

Probably because they are.
By "insufficient evidence" they usually mean "we've not heard enough to convince us". Which means "Someone was telling us stuff, but we don't really understand the field that they were trying to explain about. Instead of trying to understand the stuff we don't understand, we prefer to play nice with the money, because that tells us it's all good.".
The prime qualifications in Labour are history, classics, and a few Lawyers, advertising and marketing. Not really anyone with any solid scientific skills.
So, rather than work out the hard stuff, and make scientific dispassionate decisions which will make the country stronger and genuinely safer, they prefer to use rhetoric and assume that things work by fiat (we say the world works that way, ergo it does, because we say, which is why it lost pretty much the core of its drugs advisory group because the scientific advice of some highly qualified and internationally renowned people was completely ignored, and the opposite decision was made as policy, AND the politician hounded the scientist for not backing him up and twisting scientific results to fit into what he wanted things to be like).
I don't trust 'em as far as I can spit 'em. They need to understand scientific method, not empty rhetoric.

Re:This is why...

[Hurricane78]

Probably because they are.

I think that’s what they want you to think, to get their agenda trough.

But we can check this: Look at who profits from this. Follow the money. And then look at their tie-ins with those “in power”.

Re:This is why...

[Anonymous Coward]

I fucking hate our government. Seriously. They just all appear compeltely incompetent.

...says the person who cannot proof a post before sending misspelled words....

Re:This is why...

[takowl]

Trouble is, it's not just about the politicians. We have to, you know, vote for them. A substantial proportion of the public don't know about or don't trust science either, so politicians who tell stories (which may be true or not) stand a much better chance than if they tried to discuss all that dull evidence. The media also plays a part: political coverage tends to focus on tiny soundbites and fact-lets, which again favours politicians who can give you a story in a single sentence.

You appear to single out Labour. I haven't seen the numbers (so, in fact, I have "No Evidence"), but I very much doubt that the situation is any better amongst the Tories.

Possibly related to this...

[gilgongo]

... maybe:

http://www.computerweekly.com/Articles/2009/05/11/235953/Is-the-Microsoft-public-sector-deal-good-value-for-Britain.htm

UK Gov isn't running Vista or 7, nor IE8

[Anonymous Coward]

UK Gov isn't running Vista or 7, nor IE8. In fact almost nobody is using that combination (and note that you are still vulnerable to several attacks under both because you can't run flash or acrobat web plugin with execution privileges turned off and that change doesn't fix Vista completely either).

So in very many ways, your point is wrong. Might as well say running FF on a VM image of Linux which would be even MORE secure.

Nobody does that, but it would be.

Re:UK Gov isn't running Vista or 7, nor IE8

[Anonymous Coward]

UK Gov isn't running Vista or 7, nor IE8. In fact almost nobody is using that combination

If you consider ~20% of people to be "almost nobody" then we might agree.

Re:UK Gov isn't running Vista or 7, nor IE8

[Anne Thwacks]

If you consider ~20% of people to be "almost nobody" then we might agree.

Maybe in your country. I very much doubt 20% of the UK population has even seen Vista or Win7.
In all probability IE6 usage in the UK exceeds Vista usage, and in Government institutions, IE6 usage probably exceeds all other browsers. Win2k is still widely used, and XP still being installed.

Let's face it

[Anonymous Coward]

Let's face it, the only fact that makes IE less secure vs Firefox et al, and Windows less secure than OS X et al., is the market share (which makes them bigger targets).

Re:Let's face it

[M-RES]

No, the supporting factor is the likelihood of being able to engineer a user to do something stupid, as that tends to be the most common point of entry for an attack. The target size makes no difference, it's the average 'stupidity' (or naivety) of that target that makes the returns worthwhile for the effort expended in attacking it.

Re:Let's face it

[xyph0r]

While market share might be a factor (infact almost definitely IS a factor) in the security of Windows vs OS X/Linux, IE vs Firefox, etc, it's more likely the architecture.

The architecture of Unix systems (running as root, user permissions, etc) makes/made it very hard for malware to be written for it. At least, to cause any significant damage.

Though in the case of Firefox vs IE, I'm not so sure. I know little about either browser's architecture. But it might not be just market share that's the reason for the huge number of sploits for IE as opposed to firefox.

Re:Let's face it

[Anonymous Coward]

The architecture of Unix systems (running as root, user permissions, etc) makes/made it very hard for malware to be written for it. At least, to cause any significant damage. - by xyph0r (1153429) on Sunday January 31, @09:08AM (#30970058) Homepage

Is that why the architecture of UNIX was the first one exploited by the Robert Morris Worm http://en.wikipedia.org/wiki/Morris_worm , which in fact was the very first known worm?

Forget all other arguments!

[Aldenissin]

Whether anything is more secure when both often need patches can be argued all day. What should matter and is scientific, is the percentages or users who have been compromised. If you want to be a nitpicky, then compare the same demographics, most preferably the highest risk and or biggest selection. (Perhaps more IT centered people do not use I.E. and can skew the results for an example, but I would take that as a sign myself if that were the case...)

  This approach centers on "real" and verifiable end result solutions and ignores time wasting arguments. In other words, what really matters will be assessed and highest yield of success suggestions given.

Missing the point

[sparky81]

"The reason for this statement by the UK government is very simple - it has intranet and business systems in virtually every government department which work only with IE. They frequently ridiculously old versions at that - IE6 take a bow - giving the lie to the "latest, fully patched" comment anyway. There is no way that the UK government is going to incur the conversion costs for these systems at this moment given the state of its books at the moment. Stating that IE was insecure would create an inexorable pressure to do exactly that. This statement has nothing to with security, and everything to do with internal government politics.

Re:Missing the point

[M-RES]

I was going to mention this very issue and you beat me to it. I know people who work in local government, both as 'users' of the in-house systems and 'sysadmins' on those same systems, and they all tell me how outdated their setups are. They're by and large using IE6 across the board, because the browser-based apps they use work in IE6 and if there's the slightest glitch in updating the browser they won't touch it - they just don't have the budget to deal with the issue and test it rolled out across such huge networks.

If it doesn't work someone would have to take the blame and we all know how civil servants do everything they can to avoid having any responsibility whatsoever for any decisions, hence the 'committee'. The committee provides plausible deniability wherein any single member can say "I didn't agree with the decision, but the committee decided...".

Welcome to the cosy sheltered world of civil service. People who work there genuinely couldn't survive in the 'real world' of private business/industry!

Re:Missing the point

[jc42]

The committee provides plausible deniability wherein any single member can say "I didn't agree with the decision, but the committee decided...".

Welcome to the cosy sheltered world of civil service. People who work there genuinely couldn't survive in the 'real world' of private business/industry!

Oh, I dunno about that. I've worked in private industry for a few decades, doing software development, and I've heard exactly this line of reasoning repeatedly. I doubt that it has anything to do with government, industry, or whatever; it's just the natural behavior of humans in groups. It's not at all unusual for a group of humans to make a decision that's contrary to the interests of every member of the group. The processes that cause this are pretty well understood. It's the common CYA scenario, in which no individual can be blamed for the group's poor decision.

There's an old saying to the effect that, when faced with alternatives, the wise leader is the one who can avoid choosing the worst. I've read variants of this from a number of different "cultures". It may be that the best that humans working in groups are capable of is choosing the second-worst.

In this story, various replies seem to imply that the UK government hasn't even managed this much, since it appears that there are large parts of that government that have "standardized" on IE6. Again, this isn't just government; I could name (but won't out of pity for the workers) a number of US corporations that have exactly the same "standard". My wife works for a major medical corporation that has done this. She runs XP (virtualized on her home iMac ;-), and its browser is IE6, because that's what her employer requires all employees to use. They also now require their IT workers to work at home about half time, so they have to have XP+IE6 on both their office and home machines. I use her machine occasionally to do web testing against IE6 because that's what a lot of my clients' customers use.

Yes, things really are that bad.

Re:Missing the point

[mikael]

Take a flight through Stansted airport some time - they are still using dot-matrix printers from the 1980's. You can tell because the printers have acquired a "sun-tan" - they seem to have aged in the same way that paper does.

Is not talking about home user

[DaveGod]

The quote bears no reflection of any opinion on the security or quality of IE in general. The "user" being referred to in the quote is UK government staff, using UK government IT, and his response is wholly within that context. As is very often the case on Slashdot (and, to be fair, much of the media), the summary shifts the context slightly and then omits significant information and thus infers something other than what was communicated at the time.

Immediately after the quoted text, unmissable except by the most... Let's give the benefit of the doubt and say hurried of submitters and editors, is the following: (my emphasis added for the most hurried of Slashdot readers)

26 Jan 2010 : Column WA317

Microsoft issued a patch to fix the recent Internet Explorer vulnerability on 21 January. Prior to this, government departments had been issued with a GovCertUK alert on how to deal with this particular incident and to mitigate vulnerabilities in relation to particular versions of IE.

A government user, operating on government systems, such as the Government Secure Intranet (GSi), will benefit from additional security measures, unlikely to be available to the average home computer user. These include tools which actively monitor for evidence of any malicious attacks.

Re:Is not talking about home user

[drinkypoo]

A government user, operating on government systems, such as the Government Secure Intranet (GSi), will benefit from additional security measures, unlikely to be available to the average home computer user.

False. Home users have access to firewalls and IDS (windows defender? spybot's live component? avira's live component?) just as users sitting on the GSi do; both are vulnerable if they visit external sites.

They're not using the correct research data

[bl8n8r]

only need to google it for chrissakes:
    IE ~ 1200: http://www.google.com/#hl=en&q="internet+explorer"+site%3Awww.us-cert.gov
    Firefox ~ 800: http://www.google.com/#hl=en&q="firefox"+site%3Awww.us-cert.gov

Firefox leaks

[tepples]

I can think of two reasons that Firefox would have to use a lot of memory: DOM caching and plug-in leaks. DOM caching stores information about pages you have recently visited so that the back button, undo close tab (Cmd-Shift-T), and undo close window (Cmd-Shift-W) work quickly. As for plug-in leaks, use Flashblock and they will be less noticeable, which should hold you over until Firefox implements Chrome-style multiprocessing.

No wonder IE has no issues.

[cvtan]

Evidence was gathered on a Tuesday.

It's not up to Microsoft ...

[MadMaverick9]

It's not up to Microsoft how Windows is installed on a computer delivered to an end-user. It's companies like Dell, HP and computer shops who actually install Windows.

They (Dell, HP and computer shops) need to learn to install Windows properly: ntfs, no automatic login to admin user, least-privileged account, etc, etc, etc.

And power-users don't use pre-installed OSes anyway, correct? So the main problem is with users who use computers with a pre-installed OS.

UK government is crawling with Microsoft advisors

[Anonymous Coward]

The combination of computer illiterate politicians and Microsoft consultant advisers is as near corruption as you can get without it necessarily being illegal (and I am not discounting the latter possibility either).

follow up questions? follow the $$

[KwKSilver]

Follow the money.... who gets what from who?

not all fully patched...

[Anonymous Coward]

I know that RBS, the new financial wing of the govt, uses IE6 mostly. I would hazard a guess that, like most institutions, windows 7 is not installed in all govt depts. Therefore this bleat of "fully patched IE8 blah, blah" is obfuscation and circumvents the point... like most "information" our govt pumps out.

In other news, British Govt insists the nose on your face is not plain.

No evidence, huh?

[Anonymous Coward]

This is what happens when you go to monkeys for advice instead IT security professionals.
The UK government needs to stop consulting with people who claim to know what the hell they are advising on and actually go to professionals for advice.

You want evidence, even though the UK tax payers have paid you to do the research, which you haven't and probably didn't for an in ordinate fee, which you took for your "Opinion," Which isn't worth squat Lord Avebury. You absolute joke.

Here, for free is evidence and I think it's high time Lord Avebury looked for a new job.

Microsoft Internet Explorer :
http://secunia.com/advisories/product/21625/?task=statistics
Unpatched 38% (3 of 8 Secunia advisories)

Mozilla Firefox 3.6 :
http://secunia.com/advisories/product/28698/
Unpatched 0% (0 of 0 Secunia advisories)

Google Chrome 4.x :
http://secunia.com/advisories/product/28713/
Unpatched 100% (1 of 1 Secunia advisories)

Opera 10.x :
http://secunia.com/advisories/product/26745/
Unpatched 0% (0 of 3 Secunia advisories)

Once again, we are faced with a situation where someone who is not a professional, is asked for their "Opinion" in a serious policy making decision.

It is like the blind leading the blind and it MUST stop now.

Re:No evidence, huh?

[dotwaffle]

I think you ought to do some research first. Lord Avebury asked the question, he did not make up the response.

Also, Lord Avebury is one of the few peers you *want* in the House of Lords, he's a genuinely honest and trustworthy man, who also does a lot of work defending Human Rights in places like Turkey.

Than what?

[Anonymous Coward]

"Less secure" than what? Older versions of IE ?

I could believe that

[RobertLTux]

"there is no evidence that moving from the latest fully patched versions of Internet Explorer to other browsers will make users more secure."

So if you have Windows 7 with all patches and MSIE 8 with all patches
INCLUDING NONPUBLIC MICROSOFT INTERNAL PATCHES (to fix bugs not patched for yet)
then yes you could be just as safe as if you had another browser.

But what are the chances that somebody will be able to get all the patches without getting tagged?

How did they hear the question?

[Anonymous Coward]

I'm surprised they could hear anyone asking questions given the difficulty in hearing things through sand.

I guess its hard to see/tell the truth

[nurb432]

Thru all those dollar bills that were used to buy them off with.

Re:I guess its hard to see/tell the truth

[colinrichardday]

Dollar bills? Wouldn't they be pound notes or euros?

Re:I guess its hard to see/tell the truth

[mjwx]

Thru all those dollar bills that were used to buy them off with.

Now that is slander good sir, no British politician would accept money from a US corporation...

Until it has been converted into proper British Pounds.

Of course it will make people more secure

[DrXym]

In a monoculture the attack surface is large since everyone is using the same code and therefore vulnerable to the same bugs. Just moving users onto a mix of other browsers lowers the attack surface even if each individual browser has its own fair share of bugs.

Re:Is not necessarily about government user either

[AxeTheMax]

The "user" being referred to in the quote is UK government staff, using UK government IT, and his response is wholly within that context.

The Slashdot story may have 'shifted the context', but this may be less significant than the shift in the original answer. The question by Lord Avebury was about 'public sector' users. The answer however was restricted to government staff. In much normal usage, public sector does not equal goverment. "Public sector" includes health service, local goverment, quangos, et.c. The term "goverment" may or may not include these, though it does usually exclude quangos. In any case, the public sector group includes a variety of IT management methods and it is quite likely that some of these have less adequately managed IT than others.

Track record

[MindlessAutomata]

Isn't it better to go by track record than direct evidence for "current safety" simply because exploits are discovered and not readily known? If IE has a bad track record and Firefox doesn't, it might indicate that Firefox is still secure as there may be undiscovered or undisclosed exploits in IE due to shitty security programming that the UK gov't simply doesn't know about. Additionally, future updates could introduce more bugs.

Re:Track record

[MindlessAutomata]

I mean, no evidence that the current latest fully patched IE is less secure is much less impressive when you realize that it's pretty damn easy to not yet have evidence of security holes in the latest patch when there's likely not enough time for people to have discovered them.

Re:Track record

[6031769]

Trust me, mentioning anything about "track record" is absolutely the last thing the current British government wants to do, especially when it comes to IT systems.

Can't "fully patch" IE...

[argent]

You can't "fully patch" IE because Microsoft has never released a patch that completely turns off the biggest security hole in IE... the tight integration with the desktop and the irreparably flawed "security zones" model.

Microsoft says "No Evidence" UK Gov't Received Pay

[smd75]

In other news tonight, Microsoft says there is no evidence that the UK received any payment in the claim that the UK Gov't says there is no evidence showing IE is less secure.

It might be true, it might not. But why do we need to governments to tell us what is secure and isn't?

IE or "the latest fully patched versions" of IE?

[jc42]

What I notice is that the headline and most of the discussion here talk about the security of "IE", while the Home Office said "the latest fully patched versions of Internet Explorer". There seems to be little understanding that these aren't synonyms.

But does anyone here work for an organization of any sort (government, industry, academia, whatever) that requires that everyone use "the latest fully patched versions of Internet Explorer"?

In all the cases that I know of, when there's such standardization, it's for releases that existed shortly before the standard was established. It's now years later, and the standard is still in place (though often violated by workers who want better security or more features).

A number of people have written about organizations that are still standardized on IE6 and don't permit upgrades to IE8. Is there any data available on how widespread this might be? In my experience, such data is hard to come by, since both governments and private corporations tend to be secretive about their inner workings.

So could the Home Office be pushing for upgrades to W7+IE8? Nah; I thought not.

Eppur Si Muove

[gmuslera]

We need a Galileo to try to convince them of the evident, even if they want to believe/understand our proofs.

Re:Eppur Si Muove

[mjwx]

We need a Galileo to try to convince them of the evident, even if they want to believe/understand our proofs.

Even if we had another Galileo or Newton or Einstein they wouldn't survive the society dedicated to worshipping mediocrity. The reality TV worshipping masses would have them burned at the stake on American Witchhunt or So You Think You Can Crucify.

The problem isn't that there are no good scientists, the problem is that society has been trained to reject, outcast and ostracise anyone who shows above average intelligence. We need to fix our anti-intellectual society.

Well excuse me. but i trust germans over brits in

[unity100]

matters like these. with their paranoid attention to detail, psychopathic inclination to procedure, and ungodly patience with working on intricate technical details, any word from germans in that area would trample any word from britain at any point for me.

the fact that u.k. government has been shitting and screwing up in every other field for the last 10 years does not help either.

a tautology

[Anonymous Coward]

It's a logical truth -- there is no evidence that the latest patched IE is less safe than any other browser. By definition the latest patched IE should have all known security bugs (excluding the user) patched.

There's no _evidence_ that a single extra security problem exists in IE today. However, we all know the next one is just around the corner.

Congratulations Microsoft

[George Bentovich]

Congratulations Microsoft for once again proving the robustness of its systems.The approval of the UK government shows the world that softwares that undergo serious engineering processes are far superior than "free" softwares developed by uncoordinated undertrained teams. Microsoft had already proven its pioneerism when it was the first company to release a 64 Bits Browser, thus ensuring more security and protection against malwares while surfing the web. It's only fair that Bill Gates is a billionaire, after all, he created the company that allowed the pervasive computing we see today that is the very own foundation of the Internet.

Eheh, and the conservatives are better?

[SmallFurryCreature]

Or have you forgotten the proof against Mad Cow disease being to feed your kid beef?

Labour got elected because the entire country was fed up with the sleaze of the conservatives. Watch all 30+ seasons of Have I Got News For You. It is amazing to see the transformation over the years. Blair was a hero, simply for not being the conservatives. The problem, he was.

This is what happens in a democracy when people vote for their wallet, not the country as whole, or their own long term future (the real one, not the one where you will hire Bill Gates as a butler).

Take the railroads (and american readers, please remember that in the denser populated areas, trains make more sense, and in old cities like london, public transport is the only solution, no space for millions of SUV drivers), the conservatives want low taxes and railroads are very very expensive. They provide a lot, but it is oh so tempting to cut down on maintenance just a bit. And then another bit. And a bit more. And then a big "accident" happens and the entire country grinds to a halt and for what? Lower taxes? No... for the promise of lower taxes but actually tax increases. Because everytime a tax seems to be lowered it comes down DOUBLE in some other form AND then afterwards you got to pay for the mess that the cost cutting measure cost. Such as fixing all the railroads in a hurry and months of disrupted service.

But Blair couldn't do anything about it. Left/Right european governments are basically about one spending to fix the cost cutting of the other side BUT neither side getting the full effect because then the populations gets fed up with the effects and switches their votes around.

Left wing build railroads, but raise taxes for it. People get fed up. Right wing cut spending, the railroads decline, people get fed up, long before any real tax cuts could be realized. And so on, back and forth.

It is the reason dictatorships "work". Consistent long term policy. Dubai and such places seem to make things happen because one person says "make it so" and nobody can turn it around in two years time.

In some ways, the left in England and America, should have just called it quits. Obama should have just said, "later rednecks" and watch the republicans ruin the entire country. Now he is being blamed for not being able to fix eight years of mis-management. Sometimes the top-job really isn't worth having.

And samething roughly happened in the UK. Blair got in, but with what? A labour party twisted between old and new labour. A economy down the drain, decades of cost cutting having put the country on the edge of disaster and a party that had no experience in leading with many of the people who did have a clue as "corrupted" as the conservatives by being in cosy jobs for to long.

People now are voting conservative again the UK. Right... that is going to solve things. These were the same people you threw out before. Think they changed their ways?

People often say that democracy is the worsed form of government, bar everything else. Perhaps that is true, but I think democracy also has a shelf life. Have it for to long and it start to rot.

The guy I am responding to says government needs to understand the scientific method. How can they? The voter doesn't, and they still are the ones who elect the guy in charge. The moment the voter can vote for a leader with bad teeth who doesn't smooth talk and isn't all that likeable but gets the boring accounting job that is government done, then we can move forward.

Exactly WHAT is Obama, or Blair, or any modern leader good at, except making speeches? And yet, we expect these people to turn our country around.

There are people who can do that. The kind of people who are hired to handle banktupt companies or turn companies around from the brink of disaster. They are very grey, very quiet, often downright ugly, little men who read papers a lot and don't attract much attention at all. And they tend to stay the hell away from anything to do with politics because NO solid leadership can ever be based on a popularity vote.

This is the same home office ...

[Anonymous Coward]

that was sure there were WMDs in Iraq

Who else is going to do it?

[SmallFurryCreature]

We can't trust companies because they have obvious profit motives. Leaves only one thing.

We use governments to test the water, the food, the air, the cars, everything pretty much which is essential to our lives but we do not have individually the resources to test.

The government doesn't test my cooking (that is what kids are for) because I have means to test that myself (if the milk still comes out of the carton, it is fresh enough for guests) but I do not have the means to test a can of Coke I buy on the street, so I expect/need someone else to check that these things are not made by just putting any old sugar and water and rust together, but only properly tested sugar, water and rust.

I would reason that computers have become such a common part of our lives and that we can get into so much trouble if we get it wrong, that government warning us about unsafe products, is the right thing to do.

Or wouldn't you want forced warnings and recalls if the brakes on your car turn out to be faulty? Guess who does that? You car maker? Think again, goverment regulators, my those guys just seem to be everywhere don't they.

Re:Who else is going to do it?

[smd75]

Right on,
Then lets have the government set up an agency with the authority to make such claims or set one up ourselves as a nonprofit.

The FDA tests consumables, the National Highway Institute governs our transportation infrastructure, the EPA tests our environment.

Except the Insurance Institute of Highway Safety is actually a nonprofit. Which as an expert organization in its field, im sure it receives funding from the government.

Ah the insight

[horai]

Isn't this the very same government who said there were weapons of mass destruction. It's a little like the blind leading the blind.

Yes, and there's no evidence aboutWin-only viruses

[alukin]

What broser could be secure on Windows? Almost any brouser is OK on Linux but no one on Windows. Vulnerability of OS and availability ob billions viruses, troyans makes useless any broser and whole computer on Windows.

WMD (Not Windows Media Decoder)

[starglider29a]

...and yet they had evidence of WMDs in Iraq.

Proof Positive

[hduff]

That the UK government does not read Slashdot. Fools!

Define "prove"

[CAIMLAS]

The level/degree of proof the UK government seems to be requiring for this is the 'scientific' type. For most things in life, statistical analysis tends to be enough.

What this guy said is akin to saying that North Korea has the strongest army in the world, because there's no proof to the contrary.

Pick any of these:

1) Lackluster/no security features.
2) Lack of improvement over the years. One of the cardinal rules for security is continual improvement.
3) Repeated exploit of said piece of crap.
4) Microsoft itself more-or-less admitting it's insecure and unrepairable - they effectively abandoned it years ago.
5) Anecdotal evidence from tens of thousands of computer repair types; I guarantee you IE is the vector for 9 out of 10 malware infections, and most of those are probably IE.

I'd wager they've been paid off. Anyone with even the slightest amount of intellect can look at the information available and determine that IE6 is rubbish. It's a hell of a lot less proof than most governmental bodies act - often, said bodies act in direct contradiction to the facts for the purpose of special interests money.

Re:IE or "the latest fully patched versions" of IE

[INT_QRK]

Re: "does anyone here work for an organization of any sort (government, industry, academia, whatever) that requires that everyone use "the latest fully patched versions of Internet Explorer"? Answer is yes. See http://nvd.nist.gov/fdcc/index.cfm

Alas, the UK is hopelessly in thrall to Microsoft

[echtertyp]

As someone who has worked in the U.S., the U.K. and continental Europe, I have to say that both public and private sectors in the UK have an unparalleled blind allegiance to Microsoft. It's like nothing I've ever seen.

I recall seeing a timeline of the Internet's development at a display in London, and the first two dots were the 1973 launch of DARPAnet and then, incredibly, the founding of Microsoft in 1979. There was no dot for anything from Britain's own Tim Berners-Lee, for the development of DNS by Mockapetris, or other real milestones.

Honestly, it's sad to see what has happened to the land of Francis Bacon, Newton, Babbage and Turing. The UK today seems run by men without an original thought in their entire being, who slavishly follow fads from American business schools and figure one is always right if you tie your fortunes to those of Microsoft. This doesn't bode well for the future of that island nation, is all I can say. You can't rely forever on frothy financial instruments to fund purchases of food, energy and all technology from someone else.

So security through wishful thinking is better?

[Anonymous Brave Guy]

With closed source software, you're at the mercy of the manufacturer when it comes to even getting an acknowledgment of security issues, let alone receiving fixes in a timely fashion or before damage is already done.

This argument endlessly amuses me. Do you really think the exact same thing is not true of OSS-based browsers such as Firefox and Chrome?

Hint #1: If you have not personally evaluated the source code of the browser you are using, nor employed a skilled specialist to do so for you, then you are just as dependent on other parties over whom you have no direct control to identify and patch security issues before the bad guys exploit them. The theoretical possibility that you can examine the source code is just security theatre unless you actually spend the time and resources to do it.

Hint #2: Which OSS browser do you think has a public bug database listing all known vulnerabilities, whether or not they have yet been patched, and keeps that database updated immediately every time a new vulnerability is reported?

With Firefox, there is generally a very high degree of transparency when it comes to security problems.

Unless you are one of the select few with access to the full security issue process, you don't know that.

Additionally, fixes are pushed out quickly.

Or that.

Although Firefox continues to gain market share, the actual damage caused by exploits continues to remain quite low. That's certainly not the case with IE, and as long as it's closed source that won't change.

Or any of that.

If you really don't see the blind spot you're exhibiting here, try answering these simple questions (and be honest with yourself):

• When you bashed IE above, how many exploited vulnerabilities in the latest version of IE did you actually know about?
• How many confirmed cases could you name where damage had been caused as a result of one of the exploits you just listed (if there were any)?
• Did you know whether those vulnerabilities (if you could actually name any) had been patched, and if so, how quickly?
• How would you answer the same questions for the latest versions of the major OSS-based browsers?

If you can't immediately answer those questions, and provide yourself with objective, factual data to support your claims above, then please consider that you may just be projecting your own prejudices based on IE6 from many years ago onto the IE8 of today, while letting your own faith in OSS onto other browsers convince you that they are more secure even though you don't have access to all the facts.

Re:So security through wishful thinking is better?

[turbidostato]

" The theoretical possibility that you can examine the source code is just security theatre unless you actually spend the time and resources to do it."

Except that both thory and History disproved that. Read about Bentham's panopticon.

Re:So security through wishful thinking is better?

[BikeHelmet]

Hint #2: Which OSS browser do you think has a public bug database listing all known vulnerabilities, whether or not they have yet been patched, and keeps that database updated immediately every time a new vulnerability is reported?

Better a public DB available to all than one only available to criminals!

(Exploit trading is big $$$)

Re:So security through wishful thinking is better?

[palegray.net]

Hint #1: If you have not personally evaluated the source code of the browser you are using, nor employed a skilled specialist to do so for you, then you are just as dependent on other parties over whom you have no direct control to identify and patch security issues before the bad guys exploit them.

Speaking of tired old arguments, you lost all credibility right there. Thankfully, it was in the opening statement of your "rebuttal," so I don't feel too compelled to slog through a more lengthy reply.

Suffice it to say there are a lot of eyes on Firefox, for both the code itself and for evaluating and testing exploits. This process occurs transparently; anyone can (and a crapload of people do) participate. This is absolutely the opposite of Microsoft's model, and no amount of denial or hand-waving on your part is going to change that.

Re:So security through wishful thinking is better?

[Anonymous Brave Guy]

Speaking of tired old arguments, you lost all credibility right there.

By doing what, expressing a sentiment that is not popular around here?

Suffice it to say there are a lot of eyes on Firefox, for both the code itself and for evaluating and testing exploits.

You are making my point for me: that claim does not suffice.

Either you are personally one of those people and you personally check all of the code you rely on, or you are trusting that other people are doing it. Whether those other people are Firefox developers employed by Mozilla, or a community of OSS contributors, it's no different to trusting that people at Microsoft check IE: all you see is what those people choose to share with you, and you have no way to know how good a job they are really doing.

Re:So security through wishful thinking is better?

[Anonymous Brave Guy]

Sorry, perhaps you missed my point: the database of security bugs for Firefox is not public. When you file a security bug report, using a special e-mail address, the details do not immediately and automatically get disclosed, any more than they do if you report a bug in IE.

Re:So security through wishful thinking is better?

[Anonymous Brave Guy]

I'm not quite sure what the panopticon idea has to do with this, unless you are arguing that people are less likely to try to insert security flaws maliciously knowing that there is an open review process. It's not really those I'm worried about, it's the inadvertent flaws that slip through and no-one notices until the exploit is out in the wild.

Re:So security through wishful thinking is better?

[BikeHelmet]

It's a good idea to give someone time to go over it before disclosing it. If they did it right away, criminals would be combing bugzilla for ideas. :P

Full immediate disclosure is nice, but it's nice for everyone. That's the problem. ;)

Re:So security through wishful thinking is better?

[palegray.net]

By doing what, expressing a sentiment that is not popular around here?

No. You're expressing a sentiment that is patently wrong; it isn't a matter of opinion. I don't need to personally babysit the codebase for Firefox, as there is a ton of transparent, active development on it. Security issues are reported by both the community and third party vendors, and they're handled rapidly. On the other hand, I have absolutely no assurance that Microsoft will either (1) be aware of security issues, or (2) responsibly handle them. How many times do we have to get stung by holes that were reported to Microsoft months ago, when they only get forced into doing something about it due to a widespread and very nasty exploit? That's no way to run an I.T. platform.

I've got 20 years of combined public sector, private sector, and military experience that says I'm right. Again, hand waving isn't going to negate that.

Re:So security through wishful thinking is better?

[Anonymous Brave Guy]

Oh, I understand completely why they run their security issue process the way they do. Pretty much everyone does it that way, for the same reasons.

I'm just saying that these facts undermine any argument that an OSS project is more secure than a CSS project just because it has a relatively low number of disclosed vulnerabilities. The typical OSS process for security bugs is not more transparent than the typical CSS one in the way that matters most: knowing how many security issues are being raised, and how severe is the risk of each.

Re:So security through wishful thinking is better?

[Anonymous Brave Guy]

Security issues are reported by both the community and third party vendors, and they're handled rapidly.

As I observed two posts ago, unless you are one of the select few with access to the full security issue process, you don't know that.

On the other hand, I have absolutely no assurance that Microsoft will either (1) be aware of security issues, or (2) responsibly handle them.

To all intents and purposes, the security issue policy for Firefox and IE is exactly the same. In neither case do you or I have any idea how many security vulnerabilities have been reported but remain unpatched at any given time (unless we happen to be a suitably senior member of the development team). In neither case is there any guarantee that any given security bug will be noticed and reported.

How many times do we have to get stung by holes that were reported to Microsoft months ago, when they only get forced into doing something about it due to a widespread and very nasty exploit?

This is where I have to wonder how my universe is so different to yours. I've got my own machine here running Windows. I've worked at small businesses running Windows. I've worked for some of the largest businesses in the world with massive corporate IT departments running Windows. And yet I've never once seen anyone suffering from these disastrous IE exploits that are apparently out there waiting to eat all our babies. Of course, that's not to say they don't exist, but let's not exaggerate the reality, OK?

I've got 20 years of combined public sector, private sector, and military experience that says I'm right.

Are you sure you haven't just built up 20 years of prejudice? You certainly don't have 20 years of experience comparing the security policies of Microsoft's IE8 team and the Firefox project, do you? Or even 20 years of experience of how major OSS projects fare generally in the security stakes, given that they have only become a significant part of the software landscape much more recently.

Re:So security through wishful thinking is better?

[Anonymous Coward]

> while letting your own faith in OSS onto other browsers convince you that they are more secure even though you don't have access to all the facts.

I know a lot of things from observing Nature -- and yet I don't know all the facts.

Your answer is an exercise in twisted logic. All that hot air won't stop the public perception that the emperor is naked.

And if you try to convince everyone that only smart people can see the clothes... well, that won't work with the boy -- exactly because he's naïve.

I hope you have something to gain from all this. It would be a shame to do it just for the kicks...

Re:So security through wishful thinking is better?

[Anonymous Brave Guy]

I'm sorry to break this to you, but I don't think the public has much perception of OSS at all, for the most part. They look to experts (or self-proclaimed experts with loud voices) for advice, and form opinions based on that. This is why it is important that any official statements from government departments do reflect reality, as demonstrated by things like facts and logic.

As for twisting logic, how exactly am I doing that? All I'm doing is pointing out that as a matter of fact, all of the major OSS-based browsers have private systems with limited access for dealing with security bugs, just like their closed source competitors. The post to which I originally replied was claiming inherent superiority for OSS because of greater transparency, faster response, and the like. A typical user of an OSS-based browser cannot possibly know those things to be true any more than he can know the corresponding things about a closed source browser. No logical deduction is required, this is purely observation of publicly available information (or rather, publicly available policies stating that the relevant information will not be made public).

Re:So security through wishful thinking is better?

[joemck]

With closed source software, you're at the mercy of the manufacturer when it comes to even getting an acknowledgment of security issues, let alone receiving fixes in a timely fashion or before damage is already done.

This argument endlessly amuses me. Do you really think the exact same thing is not true of OSS-based browsers such as Firefox and Chrome?

Hint #1: If you have not personally evaluated the source code of the browser you are using, nor employed a skilled specialist to do so for you, then you are just as dependent on other parties over whom you have no direct control to identify and patch security issues before the bad guys exploit them. The theoretical possibility that you can examine the source code is just security theatre unless you actually spend the time and resources to do it.

Very true. However, I tend to have more faith in a large community of security-conscious geeks than I do in the Ballmer Bunch.

Re:So security through wishful thinking is better?

[Anonymous Coward]

US CERT has approximately 250 vulnerabilities listed against all version of IE from 2003 until today. It also has 140 or so against all versions of Firefox over this time period (including some caused by Microsoft authored plugins).

I think this is probably as good a practical metric as you will get; the numbers speak for themselves.

Re:So security through wishful thinking is better?

[tbannist]

Well, this is not particularly true. The social cohesiveness of an open source project's security team is likely to be less than that of a comparable closed source team. Without a management team bent on reducing costs and maximizing revenue with the stick of firing the developer if he doesn't work on exactly what the management team tells him, you end up with two effects, one it's harder to stifle complaints about the project "sitting on" vulnerabilities and two you can't stop developers who are interested in security from working on even if management considers security to be merely an expense.

What it means is that any sufficiently large open source project has a higher minimum threshold of focus on security than a comparable closed source project. Now some closed source projects may be more secure than comparable open source projects but that's only if the closed source project has a on-going and continual focus on security.

That is not the case for Internet Explorer. Over time we have witnessed again and again how Microsoft sits on critical vulnerability reports for months or years until they become publicly revealed by a third party and then rushes a patch for the problem through the development team. It is clear that security for Internet Explorer is treated much like airport security.

In other words Microsoft only cares about appearing to be secure to the most ignorant of spectators.

Don't trust it

[Anonymous Coward]

I will listen to what the UK government has to say about security when they stop losing people's confidential information.

I agree 100%

[Anonymous Coward]

If you ignore the evidence there is no evidence. Arent rose colored glasses great?

Re:Well excuse me. but i trust germans over brits

[mjwalshe]

um not in my experiance having had to do a lot of consultacy sorting websites out if its a german company I know that it will be shody and to be blunt not up to the standard I would expect for a US or UK company of the eqivelent size Trouble is all the realy clever Enginners in germany want to work for Audi - I suspect that this siphons off bright kids who would do IT as a carear - also as IT as a carear is less structured and there are cultural issues that make IT less appealing - no office with Herr Dr xxx on a brass plaque for example. Even Audi - the No1 employer for techies in Germany has problems executing a cohearant webpresence and rember which major company got banned from google for a few days (BMW)

Answers you won't listen to

[Anonymous Coward]

Answers you won't listen to:

When 20 other people have gone through a door and come back out again, I will assume that it's safe to walk through the door. Likewise though I may not have read all the code in Firefox, if there were any big problems, someone WOULD have seen it: Microsoft do not have half the world's web browser writers,

How many people HAVE the latest version of IE? Now how many NEVER use flash or Adobe plugins? Because they require you turn off the security and then IE8 becomes vulnerable again. Did you know that?

Google would have got dinged. Likewise, please do the same about Firefox. You've narrowed the window so small there's nothing left of the hole.

And how would YOU answer?

IE8 today has many or most of the downsides that IE6 has. Unless you lock it down so much you can't use it.

But FF 3.5 when locked down as much is still usable. Putting it under LIDS makes it much safer. Adding RBAC from NSA makes it yet more secure.

And still usable.

You cannot say the same of IE and Windows.

Re:Answers you won't listen to

[Anonymous Brave Guy]

I don't mind reading your "answers", but no, I don't think they have much merit. Your arguments are just as based on contradictory logic or outright faith as those I was criticising before. For example:

Likewise though I may not have read all the code in Firefox, if there were any big problems, someone WOULD have seen it:

So presumably there will be no serious security bugs reported in any existing Firefox version in the future? But wait...

But FF 3.5 when locked down as much is still usable. Putting it under LIDS makes it much safer. Adding RBAC from NSA makes it yet more secure.

Hang on, why do I still need to make FF "much safer" and then "yet more secure" if any bugs would surely already have been identified?

In any case, if we're comparing against IE we are presumably talking about browsers running on Windows rather than Linux, so what is the relevance of things like LIDS?

Even then, isn't comparing the security of IE8 (after turning down the default settings to cope with broken third-party plug-ins) to the security of FF (after installing custom third party security software that most Firefox users will never even have heard of, and ignoring any potential vulnerabilities caused by Firefox's own plug-in system) not so much apples vs. oranges as rotten apples vs. gourmet cuisine?

Re:Answers you won't listen to

[Cl1mh4224rd]

How many people HAVE the latest version of IE?

How many have the latest version of Firefox? One of the websites I maintain is showing traffic from 66 versions of Firefox over the past 30 days. The oldest version? 0.9.2. Ouch.

But FF 3.5 when locked down as much is still usable.

Not really. Not for your average user.

Putting it under LIDS makes it much safer. Adding RBAC from NSA makes it yet more secure.

Do you expect your average user to pull this off? Or are you offering your services in locking down the world's web browsers?

Re:Answers you won't listen to

[Cl1mh4224rd]

How many have the latest version of Firefox? One of the websites I maintain is showing traffic from 66 versions of Firefox over the past 30 days. The oldest version? 0.9.2. Ouch.

I just wanted to add the following, from the site I mentioned above:

Firefox (top 5 of 66)
3.5.7 : 45.29%
3.5.6 : 15.55%
3.0.17 : 14.19%
3.0.16 : 6.97%
3.5.5 : 2.66%

Internet Explorer (top 5 of 6)
8.0 : 46.29%
7.0 : 36.44%
6.0 : 17.25%
5.5 : 0.01%
5.23 : 0.00%

Check the links again

[Anonymous Coward]

Check the links again. FF3.5 vulns are less severe. FF vulns include all known vulnerabilities whereas IE8 is unavailable for perusal.

Re:Check the links again

[Anonymous Coward]

Check the links again. FF3.5 vulns are less severe

Are you a security expert? Your opinion about severity is worthless otherwise.

whereas IE8 is unavailable for perusal.

Untrue. Here is what happens for FF and IE.

1> Bug gets found

2> Bug may get fixed

3> Patch is released

Steps 1 & 2 are hidden & 3 is public in *both* cases. Mozilla doesn't allow random people to look at unpatched vulnerabilities just so they can exploit users.

Petition to warn about IE

[Anonymous Coward]

For people living in the UK, someone has created petition on the Number 10 website:
http://petitions.number10.gov.uk/Firefox/

Who else has a managed solution?

[TheRedDuke]

Answer: no one. Microsoft has the only browser that can be centrally managed by an organization trying to remove the weak link of the end-user out of the equation. I'm not trying to say that IE on its own is safer than Firefox or Chrome or the rest. I'm also not saying that Joe Everyman has an enterprise backend managing his IE hotfixes. But if you're a business running Windows on workstations, there's no reason not to manage your IE hotfixes with WSUS and/or GPO's. At the very least, I'd argue that it's safer for the business/government/academic world, where AD dominates the backend.

Monoculture

[RoboProg]

I was wondering when somebody was going to mention the MonsantoSoft monoculture aspect of all this. As convenient as it may be for brain dead powers that be to all do the exact same thing, it's a bad idea for socient from a safety / engineering-redundancy (reliability) aspect.

Diversity is good for software, plants and animals in the long run.

There's a easy explanation...

[Anonymous Coward]

I think is a collateral effect due to the actual EU president which stupidity it's very contagious. It's the spanish 'Mr. Bean'... and his effects are spreading...
Haa,ha,ha,ha...

An spaniard (sick of politics) said.

Translation

[Anonymous Coward]

In the context of the UK government, "There is no Evidence" often means "We haven't actually looked for evidence yet".

Easy answer..

[Anonymous Coward]

The answer is on the Microsoft pages themselves. I'm just singling out one simple example (check where he worked before he joined MS) but it would be unfair on the guy to claim he's the only one: MS employs people from the sectors they want to sell into.
If you have influence in a sector and are planning to leave, MS will pay for your network. It's not unusual - happens everywhere - but I must admit it has worked spectacularly well with New Labour.

It's a sort of reverse McKinsey where leavers get an exit bonus so they'll ring their pals if they need any consulting done.

Shareholders protecting their Micro$oft shares...

[YankDownUnder]

Duh. The importance of protecting profit overrides the importance of admitting software is insecure (anything Micro$oft). Vacca, vacca, vacca, feoda vacca.

Orly? Well this is how it'll roll!

[Jagjr]

My school uses IE, and i dont care how many computer tech guys say "it's flawless" " we have a firewall" " i program so im safe". WTF!! Windows = Fail!! Get linux or ubuntu on theese machines and youll never go wrong.. Stupid Government being sucked in by the microshit networks

If A = B, then B = A

[Psaakyrn]

What I take from this is that IE7 and IE8 is just as insecure (or even less secure) as IE6.

UK government

[TigerTails]

Well, yet another failure by our.. crap.. government. I'm suprised more people haven't noticed the crappy decisions it makes. As many of you know, a few months ago the drugs adviser for sacked for doing his job. He advised people that cannabis is not as harmful or addictive as alcohol and tobacco, things most of us already know. And he got sacked. Gordon brown is more than half blind, which explains why he can't see the REAL WORLD. Have any of the labour MPs ever used the internet, or even used a computer? It seems none of them have any idea how it works, you just plug in the magic box and magic happens. At least, next general elections, labour will be gone. That there is no doubt of. They're all bloody useless.

So?

[KlausBreuer]

This is a government saying this. A government. A bunch of bureaucrats with a complete loss of contact to the world.
Do you think them capable of tying their own shoelaces, let along find useful information?

Re:Well excuse me. but i trust germans over brits

[Anonymous Coward]

matters like these. with their paranoid attention to detail, psychopathic inclination to procedure, and ungodly patience with working on intricate technical details, any word from germans in that area would trample any word from britain at any point for me.

the fact that u.k. government has been shitting and screwing up in every other field for the last 10 years does not help either.

So what you really mean is that you just don't like Brits and this just confirms your opinion?

Re:Well excuse me. but i trust germans over brits

[unity100]

if i didnt like brits, i would just outright say it here out loud. i dont have any hesitations. if you noticed, im not posting anonymous either.

Here is the Missing Evidence

[lcreech]

A reply from Walter Snow

"Apple's issued a update to fix a security hole in the fundamental Internet SSL/TSL protocol. There is a SERIOUS problem in the TLS (Transport Layer Security) part of this protocol. The problem is NOT an implementation issue, but a TSL protocol DEFINITION issue.

This SSL/TSL protocol definition issue allows a hacker to become a "man-in-the-middle" who can view and modify all SSL communications between a secure browser client and a secure server. Everyone using the Internet is going to have to address this problem, because all internet financial transactions use the SSL protocol, and the protocol itself must be changed to prevent something called "TLS renegotiation" or else no financial transaction on the Internet is secure or safe. Every software vendor will have to supply a "no-renegotiation" patch for their implementation of SSL, every user browser will also have to be patched, and every business will have to apply the appropriate patch all their servers. Until this is done, any attempt to buy, sell, or move money on the Internet is not secure - and therefore not safe.

This SSL/TSL protocol security gap has been public knowledge ever since 11/05/2009, when it leaked out to the press in the wake of the Iranian government's hack of Twitter, though it had been known to Carnegie Mellon and the Federal US-CERT even earlier (August of 2009). The problem is reported on the Carnegie Mellon CERT and Federal Cybersecurity US-CERT web sites as VU#120541.Software vendors were officially notified of the problem by US-CERT on 11/05/2009.

More of this here: http://www.phonefactor.com/sslgap/ and here http://www.phonefactor.com/blog/implications-twitter-attack-ssl-gap.php by the group that first discovered it last August. Or Google VU#120541 and read the posts.

But here is the kicker - even though it has been known publicly since 11/05/2009, and many responsible vendors like Apple have provided patches for their software, MICROSOFT HAS APPARENTLY NEVER ACKNOWLEDGED THAT THIS VULNERABILITY EVEN EXISTS IN THEIR SOFTWARE. They have not provided a patch, nor have they indicated they are even working on a patch. I found nothing about the problem on the MSDN website except a few user questions about it on community bulletin boards that were NOT responded to (by Microsoft). I found is nothing on Microsoft TechNet either. And of course nothing in any Microsoft Security Bulletins."