Slashdot Mirror

← Back to Stories (view on slashdot.org)

Germany Warns Against Using Firefox

Posted by timothy on from the fuer-ihre-sicherheit dept.

jayme0227 writes "Due to the recent exploit in Firefox, Germany has warned against its use. This comes a couple months after Germany advised against using IE. Perhaps we should start taking odds as to which browser will be next." Note: the warning (from the Federal Office for Information Security) is provisional, and should be rendered moot by the release later this month of 3.6.2.

12 of 509 comments (clear)

  1. Free software in action by Statecraftsman · · Score: 4, Insightful

    As soon as I read about this on /. I realized Firefox is downloading an update to 3.6.2. This is why free software is our best tool against malware. Reaction time can scale with importance. And (shameless free software plug alert) it's why I wrote what's in my sig.

    1. Re:Free software in action by Zontar+The+Mindless · · Score: 3, Insightful

      I want software that was correctly written and had no exploits to begin with.

      And I want Anonymous Cowards to start making /. posts that are insightful, useful, and realistic.

      And WHERE'S MY PONY?!

      --
      Il n'y a pas de Planet B.
    2. Re:Free software in action by DNS-and-BIND · · Score: 5, Insightful

      A sad day on Slashdot when someone saying "programming correctly is the right response" and he's ridiculed by at least 4 replies and modded +3 Funny. What the hell happened to this place?

      --
      Shutting down free speech with violence isn't fighting fascism. It IS fascism!
    3. Re:Free software in action by selven · · Score: 5, Insightful

      Because "don't set this place on fire" is not a fire escape plan. Bugs and vulnerabilities will happen either way, and you still need a plan for dealing with them.

    4. Re:Free software in action by TheLink · · Score: 3, Insightful

      > OpenBSD seems to do just fine, with a bigger codebase, written in C.

      They just ship OpenBSD with most services disabled by default, and then claim it is safe by default.

      That's similar to Microsoft's shipping IE on their server O/S with most stuff disabled by default, and then claiming that IE is not vulnerable
      on their server O/Ses by default.

      Yes they are safe by default just like a car with its wheels, engine and battery "disabled" by default is safe from most carjackers.

      --
    5. Re:Free software in action by Aceticon · · Score: 3, Insightful

      Creating 100% secure software is like trying to prove an absolute statement (as in "All X have Y") - to prove it right, every single one of the subjects of your statement have to comform to it, while proving it wrong only takes one that does not.

      Or in more specific terms: no matter how good the team developing a piece of software is and how long they have to do it, all it takes is one of them doing a single mistake and the results is not 100% secure.

      It's reasonable to expect that all first order mistakes (i.e. the blindingly obvious) are caught, it is however not reasonable to expect that higher-order mistakes (for example: "unexpected interactions with a different version of a certain library installed in the same system in the 64 bit version of the OS") are caught, expecially those relating to external factors (which can change after the release is done).

      Also there are economic limits to the level of security in a piece of software: more specifically, time is money, getting only the top best professionals to do it is a lot of money and (suprise, suprise) people are not willing to pay the higher price that such a product would require to break-even.

    6. Re:Free software in action by Rockoon · · Score: 3, Insightful

      While its true that Mozilla got the fix out pretty fast once someone pointed right at it for them, it is often claimed that Open Source is more secure because there are thousands of eyes looking at the source code.

      None of those Mozilla-loving eyes found this bug, yet a researcher unaffiliated with Mozilla but certainly looking for exploits, found it. Now what about all the researchers looking for exploits in order to driveby firefox users.. that will just keep the damn thing a secret?

      Yeah.. they got the fix out fast. Bravo. Look at the real significance of these events, tho..

      ..exploit found
      ..went unpatched for a month
      ..only got patched because the person who discovered it pointed right at it.

      --
      "His name was James Damore."
  2. This just in by Rijnzael · · Score: 3, Insightful

    German government warns against use of the internet and software that has bugs.

    Software is inevitably going to have bugs in it and try as we might, it's something we'll always have to deal with. There are always mitigation strategies, such as running Firefox in a virtualized environment a la Sandboxie or a full virtual machine, but we'll never be privy to using only bug-free software day to day. I'm glad to see the German government taking an active approach to notifying people in regard to vulnerabilities in an attempt to mitigate them, but as TFA states, what's the point in suggesting users quit using Firefox when the alternatives are potentially just as vulnerable?

  3. Bah by tsotha · · Score: 3, Insightful

    The take-away from this is Germans are never happy.

    1. Re:Bah by beh · · Score: 3, Insightful

      So, what would you rather have?

      That they warn you about vulnerabilities in IE6, but ignore vulnerabilities in open source browsers?

      I think they've done the right thing - there was a security hole (in the 'current' 3.6), and they warned about it. Their warning DID include that it affected the 'current' 3.6 version and that it should be fixed in 3.6.2.

      That's fair comment, and it's their job to report it and not lull people into a false sense of security that the (then current 3.6) version of firefox was safe.

      If they had NOT warned, it might have damaged their reputation for NOT covering it, and it might also have helped MS lobbying efforts if they could have been shown to be biased by reporting on IE issues, but not Firefox ones...

  4. Re:3.6.2 released by Z00L00K · · Score: 3, Insightful

    And if you want to be really safe - use Lynx instead. No images, no Flash, no Javascript, No ability to view pr0n.

    --
    If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
  5. Re:3.6.2 released by gzipped_tar · · Score: 5, Insightful

    > No ability to view pr0n.

    I doubt that.

    --
    Colorless green Cthulhu waits dreaming furiously.