Slashdot Mirror
Germany Warns Against Using Firefox
jayme0227 writes "Due to the recent exploit in Firefox, Germany has warned against its use. This comes a couple months after Germany advised against using IE. Perhaps we should start taking odds as to which browser will be next." Note: the warning (from the Federal Office for Information Security) is provisional, and should be rendered moot by the release later this month of 3.6.2.
Yup
3.6.2 is out.
Firefox 3.6.2 was released earlier tonight: http://www.mozilla.com/en-US/firefox/3.6.2/releasenotes/
You have violated Robot's Rules of Order and will be asked to leave the future immediately.
As soon as I read about this on /. I realized Firefox is downloading an update to 3.6.2. This is why free software is our best tool against malware. Reaction time can scale with importance. And (shameless free software plug alert) it's why I wrote what's in my sig.
The vulnerability *only* affects the current 3.6 branch. Patch is complete and will be pushed on the 30th of March.
Here is the Mozilla blog entry on the topic:
http://blog.mozilla.com/security/2010/03/18/update-on-secunia-advisory-sa38608
Here is the original bug report:
http://secunia.com/advisories/38608
Ps: can we please get security related articles with some content instead of *OMG, we are all going to die!!* ??
German government warns against use of the internet and software that has bugs.
Software is inevitably going to have bugs in it and try as we might, it's something we'll always have to deal with. There are always mitigation strategies, such as running Firefox in a virtualized environment a la Sandboxie or a full virtual machine, but we'll never be privy to using only bug-free software day to day. I'm glad to see the German government taking an active approach to notifying people in regard to vulnerabilities in an attempt to mitigate them, but as TFA states, what's the point in suggesting users quit using Firefox when the alternatives are potentially just as vulnerable?
The take-away from this is Germans are never happy.
The German government seems to be being quite responsible here. There is an issue with Firefox, and most users probably don't know about it because they don't regularly read tech news sites.
The government is simply trying to keep people informed about this rather important topic, and has done so in a reasonable and proportional way. Not every warning put out is a damning condemnation of flawed security that mandates switching to Lynx you know.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
First they came for IE, and I didn't speak up because I didn't use IE.
Then they came for Firefox, and I didn't speak up because I didn't use Firefox.
* against the use of Opera!
* against the use of Chrome!
* against the use of internets!
o hai
Well they warned against IE and Firefox. On Windows that narrows it down to Chrome and Opera. I'm just waiting for one more announcement so I'll know which one is the winner.
(btw please don't show off your knowledge of esoteric browsers by listing them here. those are the four biggest ones by far)
Negative moral value of force outweighs the positive value of good intentions.
mod parent TROLL...
Have you looked at the BSI page and linked mozilla blog page?
The mozilla blog entry was dated March 18th (giving March 30th as the release date for 3.6.2). The BSI advisory was dated March 19th (4 days before the story broke on slashdot; and 4 days before the actual release of 3.6.2).
So, you're saying, it was retaliation by BSI against Firefox, for publishing a release date the firefox crew themselves published the day before?
On March 19th - with the projected release date 11 days away, it seems it was perfectly in order for BSI to recommend use of an alternative for those 11 days:
"empfiehlt das Bürger-CERT die Nutzung alternativer Browser, bis die Mozilla Firefox Version 3.6.2
veröffentlicht ist."
This has nothing to do with fear-mongering - but simply that during a potential danger period, people might want to watch out. Their article clearly stated it only affected 3.6, and their article stated that their advisory is temporary 'until 3.6.2 is released'.
How is that retaliation?
Opera 10.51 Changelog
"Security
Fixed
Fixed an issue where the HTTP Content-Length header could be used to execute arbitrary code; see our advisory (http://www.opera.com/support/search/view/948/).
Fixed an issue where XSLT could be used to retrieve random contents of unrelated documents, as discovered by crazypops; see our advisory (http://www.opera.com/support/search/view/949/)."
OH SNAP SON! So much for those skilled contractors and their superior skills.
Don't take life so seriously. No one makes it out alive.
A WOFF font is a Web Open Font Format font.
http://hacks.mozilla.org/2009/10/woff/
It's basically an extension of the @font-face rule with it's own compression and meta tagging. Please don't tell my designers about it.
Opera. As any fule kno, Germans are really keen on opera. They have some that go on for weeks.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
> That's true, as long as you turn off Google as the default search, disable cookies
And don't forget about LSO cookies (Flash directory), that do NOT get deleted by FF's cookie deletion on exit. Extra add-on is needed (BetterPrivacy) to do so.
Oh...and MozDevs...please restore the 'Clear History on Exit' window on browser exit. Thanx!
I'm undoubtedly missing something, but why is installing a program in my personal folder a bad idea? It allows non-elevated installs, has no access to files outside of the user dir unless granted, allows each user to have a totally separate installation so fucking one up doesn't fuck up everyone else's, no registry entries aside from ones to HKCU, uninstalls don't mess everyone else's life up, no reboots on uninstall... I don't get it?
Keep on knockin'
https://robbiecrash.me
Rule 34a (or similar numbering).
No such system exists whereby Pr0n cannot be discerned. Bertrand Russell and and Alfred North Whitehead became very upset when Kurt Godel figured that out.
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
The difference is that Firefox has vulnerabilities like any normal application... Internet Explorer on the other hand has been the forefront infection vector for botnets of hundreds of thousands of machines for the past decade.
Yeah, but Safari is made by Apple, Chrome is made by Google, they use the same rendering engine, and so if I need to swear loyalty to one of those companies, I'd rather it be Google than Apple.
Let q be a radix > 1. I am in ur base-q, killing 10 d00ds.
The BSI is not the government. It is a federal agency. BSI = Bundesamt für Sicherheit in der Informationstechnik (engl. Federal Agency for safety and security in Information Technology). They are more something like CERT. Even though the US government thinks the BSI is some sort of NSA, because the NSA also does security in information technology (e.g. seLinux). However, the BSI does not spy on people. This is done by another agency. And the BSI is so much the government as it is the police or judges.
..and if you have actually used it on Windows, you know that its really bad.
Unresponsive, with a non-conforming UI, and the installer carries a payload of other apple software.
"His name was James Damore."
Germany warns against using internet.
-- QED