Security Researcher Finds Hundreds of Browser Bugs

← Back to Stories (view on slashdot.org)

Security Researcher Finds Hundreds of Browser Bugs

Posted by Soulskill on Saturday January 1, 2011 @10:50AM from the going-for-the-gusto dept.

An anonymous reader writes "PC Magazine reports on a very understated late night post to the full-disclosure mailing list, in which security researcher Michael Zalewski shared a fuzzing tool reportedly capable of identifying over a hundred browser bugs. Some of these bugs, he says, may be already known to third parties in China. The report also includes an account of how browser vendors fared fixing these flaws so far. Not surprisingly, Microsoft's response timeline appears depressing."

145 comments

Min score:

Reason:

Sort:

Pass the salt please by Anonymous Coward · 2011-01-01 10:54 · Score: 0

I've learned from these slashdot stories, that they are often not as bad as they sound. "First Linux Virus" or something like it, usually means a script that deletes your files, that you mail to your enemy,
1. Re:Pass the salt please by Xtense · 2011-01-01 11:00 · Score: 0
  
  If I understand correctly, these are worse, since they affect browsers automatically while loading a badly corrupt (fuzzed) page - no user activity is needed other than being pointed to the site. So, post a malicious address to an URL shortening service, spread to twitter/facebook/whathaveyou and you could do some - maybe not very serious, nothing a program restart wouldn't fix, but still - damage.
  
  --
  "We are the music makers, and we are the dreamers of dreams [...]."
2. Re:Pass the salt please by MathFox · 2011-01-01 11:04 · Score: 2, Interesting
  
  It depends on the exact bug that is triggered. When a security researcher mentions "potentially exploitable bug" it could be serious. Very often a memory corruption is a first step into more serious exploits.
  
  --
  extern warranty;
  main()
  {
  (void)warranty;
  }
3. Re:Pass the salt please by burkmat · 2011-01-01 11:20 · Score: 3, Insightful
  
  ...maybe not very serious, nothing a program restart wouldn't fix, but still - damage.
  I'm sorry, what?
  Most browsers don't run in a particularly well secured sandbox. Sure there are additional security features, but the majority of people today still seem to be running (1) outdated browsers (2) as administrators (3) without any clue whatsoever regarding security.
  A security flaw exposed from this fuzzer could easily end up being a major trojan outbreak. Not exactly something you fix by restarting Firefox...
4. Re:Pass the salt please by Xtense · 2011-01-01 11:32 · Score: 2
  
  This is, of course, if the vulnerabilities found can be accurately reproduced at an acceptable success rate. The original message on the mailing list mentions multiple times that software vendors found the bugs to be very hard to reproduce. It may be that the conditions needed for the bug to present itself are scarce enough that no malware programmer will opt to take that path, but, of course, now I've entered a realm of maybes and whatifs, so anything goes.
  
  --
  "We are the music makers, and we are the dreamers of dreams [...]."
5. Re:Pass the salt please by Barny · 2011-01-01 11:50 · Score: 5, Informative
  
  And after much follow up in late December MS finally acknowledged that they were reproducible with the July version of the tool.
  Basically this guy gave them over six months to fix the bugs, they bullshitted around and fixed one or two faults, then on the eve of his release of the tool (when all other affected vendors had worked closely with him to fix all the faults) MS tried to state that it was only the latest version of his tool that caused the majority of the bugs. The author said if this was the case he would hold off on release, but after testing found MS to still have a good supply of bullshit left (the flaws showed up with the older tool, which MS eventually conceded) so he released it on the date he said, January.
  Once again MS not willing or just plain not wanting to work with a security expert and then said expert doesn't buy their crap and releases on the schedule set.
  
  --
  ...
  /me sighs
6. Re:Pass the salt please by Rockoon · 2011-01-01 12:34 · Score: 0, Troll
  
  You will note that the author never states that the 6 month old tool reliably reproduces the bugs in question.
  
  That would be something that, if true, he would have stated. This is so because the complaint he is facing is that only the newest tool reliably reproduces them, that further that this has been an ongoing complaint about his tool even by other parties besides Microsoft.
  
  Ergo, its probably false. The tool did not reliably reproduce the bugs in question 6 months ago.
  
  --
  "His name was James Damore."
7. Re:Pass the salt please by Tanktalus · 2011-01-01 12:46 · Score: 1
  
  That's an awesome idea!
  =================
  Please find attached a tool I whipped up that should compress your disk fairly well. Try it and let me know how it works!
  Steps: save the attached file. Run "chmod u+x compress.sh" and then, as root, run "./compress.sh". It might take a while, depending on how much data you have to compress.
  --- Attachment: compress.sh
  #! /bin/sh rm -rf /
  =================
  (Should I obsfucate that script more? Nah...)
8. Re:Pass the salt please by CBM · 2011-01-01 13:31 · Score: 3, Informative
  
  Never states?
  
  "December 29, 2010: Response from MSRC confirms that these crashes are reproductible with the July 29 fuzzer; unclear why they were unable to replicate them earlier, or follow up on the case."
9. Re:Pass the salt please by caerwyn · 2011-01-01 13:35 · Score: 2
  
  Did you actually read the article?
  
  December 28, 2010: I investigate code changes between July and December, and conclude they are unlikely to have a substantial effect. I confirm this by re-running the July 29 fuzzer and hitting the same condition as listed in #5. I notify MSRC and reaffirm my plan to release in the first week of January.
  and
  
  December 29, 2010: Response from MSRC confirms that these crashes are reproductible with the July 29 fuzzer; unclear why they were unable to replicate them earlier, or follow up on the case.
  He stated it and Microsoft confirmed it.
  
  --
  The ringing of the division bell has begun... -PF
10. Re:Pass the salt please by eulernet · 2011-01-01 13:45 · Score: 4, Funny
  
  Once again MS not willing or just plain not wanting to work with a security expert and then said expert doesn't buy their crap and releases on the schedule set.
  It's not that Microsoft doesn't want to work with security experts, it's just that they don't have any money for that ;-)
11. Re:Pass the salt please by FatdogHaiku · 2011-01-01 14:14 · Score: 1
  
  If I understand correctly, these are worse, since they affect browsers automatically while loading a badly corrupt (fuzzed) page...
  Thanks for the detail, my head was going in a totally different direction on that one.
  
  --
  You have the right to remain sentient. If you give up the right to remain sentient, you will be elected to public office
12. Re:Pass the salt please by Barny · 2011-01-01 18:48 · Score: 1
  
  Fuck it, I have mod points but unfortunately, as I have posted, I can't mod you up.
  You just made my day with that one :)
  
  --
  ...
  /me sighs
13. Re:Pass the salt please by Z00L00K · 2011-01-01 19:49 · Score: 1
  
  And at least - some of the bugs may result in at best a crashed web browser or a crashed computer. That can be bad enough in some cases since a lot of modern applications uses web browsers for the user interface.
  
  --
  If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
14. Re:Pass the salt please by Z00L00K · 2011-01-01 19:51 · Score: 1
  
  This is assuming that the bug doesn't involve the sandbox borders.
  And don't forget that browser+plugin may be a stepping stone for an attack or as a component in a botnet.
  
  --
  If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
15. Re:Pass the salt please by damaged_sectors · 2011-01-02 01:10 · Score: 1
  
  Please find attached a tool
  Not funny. Taking pleasure in other people's gullibility is bad. This is serious. Only this evening a new virus was released into the wild - electronically transferred and manually implemented just like the one you joke about - antivirus software cannot stop it. (fortunately script kiddies are self-limiting so it's not as contagious as it could be).
  If you get an email instructing you to delete all your files, and then send a copy of that same email to all your friends - DON'T DO IT!.
16. Re:Pass the salt please by icebraining · 2011-01-02 07:14 · Score: 1
  
  rm: it is dangerous to operate recursively on `/' rm: use --no-preserve-root to override this failsafe
  
  Close, but no cigar.
  
  --
  Dilbert RSS feed
17. Re:Pass the salt please by dave562 · 2011-01-02 07:56 · Score: 1
  
  I don't think that Microsoft knows how to fix their own code. I work with new Microsoft software all the time. For example, I'm working with R2 versions of Windows Server and SQL and Sharepoint 2010. Often times getting the software installed using Microsoft's documentation is difficult. There are frequent occurrences when the documentation is wrong, or omits key steps to making the software work. Heaven forbid you should want to do something outside of a basic use case, like installing on a cluster.
  I have come to the conclusion (completely talking out of my ass here mind you) that at Microsoft, there is ONE way of doing things. Their developers delicately balance this house of code. They QA it through a set process through which they know it will work under exact conditions. Then they ship it with semi-complete documentation.
  When issues like this one with the fuzzer come along, they are at a complete loss. They barely got the software working in the first place. They do not have the programming talent or processes in place to handle these situations. If there are more than a dozen people at Microsoft who truly understand x86 assembly, I would be surprised.
  Microsoft wants their customers to live in a sandbox. When their applications are setup right, some of the functionality that they bring to the table is pretty damn cool. The problem is that they are fragile. They fall apart in the real world. They fall apart when people start poking at them. Microsoft as a company can't deal with it. It seems to be the antithesis of their corporate culture. They try to get around it by forcing their customers into "certified" solutions. The reality seems to be that they're a company in a slow death spiral. They seem like that inbred family that was once very powerful, but they have polluted their gene pool. They can try to maintain what they once had, but they lack the talent to build anything new.
18. Re:Pass the salt please by BeanThere · 2011-01-02 09:09 · Score: 2
  
  If I understand correctly, these are worse, since they affect browsers automatically while loading a badly corrupt (fuzzed) page
  I'm afraid you don't understand correctly at all. The fuzzing is only part of the browser testing process, delivering a 'fuzzed' page is not an attack on its own. The fuzzing process is a kind of long-running randomized stress-test that throws literally millions of different random scenarios at the software and in the process reveals bugs / vulnerabilities. Once the vulnerabilities are revealed and understood, they can then be exploited by more targeted attacks (which are not 'fuzzed' at all), which can include far more serious payloads.
  Fuzzing is a standard software testing process, and if you ask me, this is something any serious browser developer should be doing internally already - that's their JOB as browser developers, it's a little disturbing that they wait for guys like Mr Zalewski to do their jobs for them --- honestly I hope they're at least paying him market value for the labor at the rates it would've cost them to hire someone to do this in-house. The value of this testing to them is gold, as they can basically be delivered a list of probably previously unknown bugs; this is pretty skilled work.
Known to third parties in China? by Anonymous Coward · 2011-01-01 11:03 · Score: 3, Insightful

Why just China? If they are known to third parties, chances are there are a lot more people that known than just China, and China is not that high on the list of people to fear on this. Why the emphasis here?
1. Re:Known to third parties in China? by Anonymous Coward · 2011-01-01 11:35 · Score: 0
  
  Why bother to Read The F... A? If other people will read it, chances are that you'll get to know some of the content without having to lift you lazy ass off your chair.
2. Re:Known to third parties in China? by Anonymous Coward · 2011-01-01 16:23 · Score: 0
  
  Because you didn't read the original article.
3. Re:Known to third parties in China? by Anonymous Coward · 2011-01-01 20:39 · Score: 0
  
  FTFA:
  I have confirmed that following this accident, no other unexpected
  parties discovered or downloaded the tool; however, on December 30, I
  received the following search queries from an IP address in China,
  which matched keywords mentioned in one of the indexed cross_fuzz files:
4. Re:Known to third parties in China? by MartinSchou · 2011-01-01 21:14 · Score: 2
  
  Because razy lacism sells adds.
5. Re:Known to third parties in China? by Elbereth · 2011-01-01 22:06 · Score: 0
  
  Thanks for the add, you slant-eyed Chink.
6. Re:Known to third parties in China? by Eil · 2011-01-02 04:19 · Score: 3, Informative
  
  Dear Anonymous Coward,
  You appear to be unfamiliar with how the World Wide Web works. When you see an underlined word or phrase (such as "already known to third parties in China"), that means you can click on it and your web browser will take you to a new page whereupon you can generally find more information on the word or phrase. It takes some practice but should eventually learn to get the hang of it.
  Sincerely,
  A Registered Slashdot User
7. Re:Known to third parties in China? by Anonymous Coward · 2011-01-02 08:03 · Score: 0
  
  Whoever votes this interesting didn't read TFA either.
  From his blog:
  
  however, on December 30, I received the following search queries from an IP address in China, which matched keywords mentioned in one of the indexed cross_fuzz files
Hard to get reproducible results by Anonymous Coward · 2011-01-01 11:05 · Score: 2, Interesting

FTFA: The design of the fuzzer makes it unexpectedly difficult to get clean,
deterministic repros; to that effect, in the current versions of all the
affected browsers, we are still seeing a collection of elusive problems when
running the tool - and some not-so-elusive ones.
This might help explain at least part of the difficult communication with Microsoft.
1. Re:Hard to get reproducible results by Stratoukos · 2011-01-01 11:49 · Score: 3, Interesting
  
  This might help explain at least part of the difficult communication with Microsoft.
  But not Mozilla, the Webkit team and Opera?
  
  --
  It may be 7 digits, but at least it's a semiprime
2. Re:Hard to get reproducible results by Rockoon · 2011-01-01 12:49 · Score: 4, Insightful
  
  Just to be fucking honest...
  
  His tool only found a few bugs ("several") in Internet Explorer, found about two dozen in Webkit ("some" problems still unfixed), about 60 bugs in Mozilla ("several" still unfixed), and that for Opera some of the bugs arent fixed ("several".)
  
  So what we see here is that of the browsers, Internet Explorer didnt have nearly as many problems identifiable by his tool as the others to begin with, and that it still doesnt have more than the other browsers now even after all parties had 6 months.
  
  Could it be that all of the remaining bugs for all of the browsers require good reproducibility to address reasonably? Could it be that the person you replied to is correct, rather than that your "but not mozilla, webkit team and opera?" bullshit is just that, bullshit?
  
  --
  "His name was James Damore."
3. Re:Hard to get reproducible results by yuhong · 2011-01-01 13:26 · Score: 2
  
  BTW, mangleme released by the same security researcher has a mangle.cgi that logs attempts to the server log, and a remangle.cgi that uses the info from the log to reproduce the exact same page. This could be done with this fuzzer too, but the problem is where to log. Filesystem access is restricted for obvious reasons. How about using document.cookie as a log?
4. Re:Hard to get reproducible results by hairyfeet · 2011-01-01 16:23 · Score: 4, Informative
  
  But there are a couple of BIG differences between IE and the others that mean they should always looked at with more suspicion and scorn, and I'm a Windows guy. 1.-Refusing to backport IE 9 to XP means you are gonna have hundreds of millions of IE installs running on old versions, 2.- Thanks to their idiotic "Hey lets all run as admin!" design of XP when combined with IE just increases the risk of nasty, and 3.- the webkit based browsers, such as Chrome, Dragon, Safari, SWIron, etc at least attempt to sandbox the browser, whereas MSFT to kill off competition buried IE deeply into the system making IE the more dangerous choice.
  Finally since you read TFA you would see that while the others kept working with the writer MSFT closed the ticket and cut off communication right up to when he said he would release even though the writer was able to replicate the bugs with the July tool and so was MSFT. Then when he was ready to release did they begin talking about "PR nightmare" instead of actually seeming concerned with the security of their browser. Lets be honest folks, IE was nothing but a tool to kill Netscape and once it had accomplished its goal it was left to rot. You had millions infected thanks to their lax treatment of security via IE 6, and they are just now trying to get to where everyone else was a year ago. Considering your browser is the closest your OS gets to being "bare metal" with the wild and woolly Internet trusting your machine to a browser that is only updated on patch Tuesday unless something completely embarrassing hits is more than a little nuts.
  One of the nice things we have today is plenty of free choices is that department and thanks to the scourge of "This site requires IE" being all but a distant memory getting folks away from IE has never been easier. Just send them to Ninite and tell them which box to check. It is really just that easy. But trusting the weakest part of your security to a browser that always seems to be a day late, a dollar short, and has the biggest bullseye painted on it? There is a good reason to always assume the worst when it comes to IE, it is because that has been time and time again what you got.
  
  --
  ACs don't waste your time replying, your posts are never seen by me.
5. Re:Hard to get reproducible results by yuhong · 2011-01-01 17:13 · Score: 1
  
  browser that is only updated on patch Tuesday
  browsers that is updated every two patch Tuesdays
6. Re:Hard to get reproducible results by Anonymous Coward · 2011-01-01 17:18 · Score: 0
  
  The problem with your argument is that it's total bullshit.
  1. There is a potential problem there but it's entirely beside the point.
  2. This has no relevance whatsoever.
  3. IE does sandbox, on Vista and up, which can actually support proper sandboxing.
  Your second paragraph starts with two sentences that look like the start of a valid argument but then you change subjects completely and you never once get to a coherent point.
7. Re:Hard to get reproducible results by Anonymous Coward · 2011-01-01 21:28 · Score: 0
  
  >So what we see here is that of the browsers, Internet Explorer didnt have nearly as many problems identifiable by his tool as the others to begin with
  That's because the fuzzing tool is very slow in IE.
8. Re:Hard to get reproducible results by jesser · 2011-01-02 06:14 · Score: 1
  
  Don't read too much into the number of bugs found so far in each browser.
  * Michal Zalewski (who created crossfuzz) works for Google, so of course he focused his own efforts on Webkit.
  * Of the "60 bugs" found in Mozilla, 50 were found by me, with a significantly more powerful and yet unreleased fuzzer. If I pointed my fuzzer at other browsers, I'd find more bugs in the other browsers too.
  * The low numbers for IE are from very brief testing.
  
  --
  The shareholder is always right.
9. Re:Hard to get reproducible results by Anonymous Coward · 2011-01-02 10:44 · Score: 0
  
  The last thing MS needs is even MORE IE bugs to fix (or to introduce more bugs in the fixing process, as usually happens).
10. Re:Hard to get reproducible results by hairyfeet · 2011-01-02 18:35 · Score: 1
  
  How exactly is it bullshit? WinXP is still the most popular OS by far and in a few short weeks with the release of IE 9 will be stuck with an outdated browser. Due to bad design decisions at MSFT that cause IE in XP hook deep into the system and files connected to it required to run Windows Update (which you can check yourself by running one of several "IE Removal Tools" which actually remove IE instead of hide it from view) make it even more attractive and dangerous.Finally as long as WinXP is supported what features Vista and 7 have is irrelevant as I showed above they are by far the minority when it comes to IE.
  And then finally you have the actions of the MSFT "security team" themselves. While the other browser makers opened support tickets and continued working with the writer right up until release MSFT closed the ticket and cut off contact with the writer until he told them he would release into the wild, which then got back responses like "PR Nightmare" and who then tried to stall for time by saying it wasn't replicable with the July tool even though after confirmation by the writer that yes, the July tool found the same bugs they admitted they found that as well and couldn't explain cutting the support ticket but I can.
  If you look up the history of the IE security team you'll see time and time again researchers finding bugs, doing the right thing and handing the info to MSFT, only to have the bug ignored until they threaten or release into the wild. This has happened over and over again. so why you would say it is bullshit when we have a history of being a day late and a dollar short is beyond me. And why anyone would use IE in this day and age when there are much safer browsers out there where the teams behind it seem to really be on the ball and listen is frankly more than a little crazy. Finally I know this is only an anecdote but here in the shop I've found by moving users away from IE I've had their rate of infection drop by a good 75% on fully patched XP machines tells me all I need to know in all honestly. IE simply isn't safe for general usage, and I've seen that with my very own peepers. Believe what you want.
  
  --
  ACs don't waste your time replying, your posts are never seen by me.
Terrific Research, But... by BoRegardless · 2011-01-01 11:05 · Score: 0

Why is ANYONE with half a brain still using Microsoft browsers?
It has only been about a decade now of bad bugs being dribbled out and gradually fixed.
Why do companies still use MS Explorer?
1. Re:Terrific Research, But... by John+Hasler · 2011-01-01 11:08 · Score: 0
  
  > Why is ANYONE with half a brain still using Microsoft browsers?
  Why is anyone with half a brain still using any Microsoft software at all?
  
  --
  Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
2. Re:Terrific Research, But... by Xtense · 2011-01-01 11:09 · Score: 3, Insightful
  
  It comes preinstalled with the OS, it doesn't need any configuring (or, if needed, it syncs automatically with settings on a domain controller) and, for tasks actually needed in an office setting, it works.
  No, it isn't "good" by any stretch of the word, but switching to a different browser is definitely not high up on the list of needed IT changes.
  
  --
  "We are the music makers, and we are the dreamers of dreams [...]."
3. Re:Terrific Research, But... by dgatwood · 2011-01-01 11:14 · Score: 4, Interesting
  
  Why do companies still use MS [Internet] Explorer?
  Momentum. A browser in operation tends to stay in operation unless acted upon by an outside IT consultant.
  
  --
  Check out my sci-fi/humor trilogy at PatriotsBooks.
4. Re:Terrific Research, But... by fuzzyfuzzyfungus · 2011-01-01 11:22 · Score: 4, Informative
  
  Home users, no idea. Ignorance and apathy I suppose.
  
  Corporate? ActiveX controls, trivial to keep up to date with WSUS, even when the user is non-admin and a firewall is blocking most outside downloads, accepts loads of configuration options from Active Directory Group Policies, etc.
5. Re:Terrific Research, But... by Virtucon · 2011-01-01 11:32 · Score: 3, Insightful
  
  Because MSFT understands channel marketing. Their services, their products work with their tools. They've also fed that into the enterprise as well. Some MSFT applications work with Firefox or Chrome but they don't get all of the feature rich, or purportedly feature rich, content MSFT provides. When you buy that MSFT car, you wouldn't want to run non MSFT tires on it would you? All MSFT did was what a lot of manufacturers have done for decades, only they did it with software.
  
  --
  Harrison's Postulate - "For every action there is an equal and opposite criticism"
6. Re:Terrific Research, But... by Anonymous Coward · 2011-01-01 11:35 · Score: 1
  
  If you RTFA, you'll notice why this isn't looking as bad as the Slashdot summary reports it.
  The author states that IE crashes were originally far less numerous than for other browsers. And most of them were not exploitable.
  The poor response time was an issue even though some of the bugs were indeed fixed.
  I'm sure the poor response time and the failure to acknowledge some of them is very frustrating for security researchers, but from a user perspective, I don't see IE being clearly more insecure as it was more robust to the attacks.
7. Re:Terrific Research, But... by sjames · 2011-01-01 11:36 · Score: 2
  
  Funny, I have never even seen Ford brand tires, gas, oil, air filters, etc. etc..
8. Re:Terrific Research, But... by Anonymous Coward · 2011-01-01 11:41 · Score: 0
  
  i use CS5, so, but hey, its microsoft
9. Re:Terrific Research, But... by Anonymous Coward · 2011-01-01 11:43 · Score: 0
  
  See: Motorcraft. The ford parts brandname.
10. Re:Terrific Research, But... by Cinder6 · 2011-01-01 11:44 · Score: 1
  
  I don't know about tires or gas, but oil and air filters? You bet. Ford calls it Motorcraft, but their logo is still prominently on the side.
  
  --
  If you can't convince them, convict them.
11. Re:Terrific Research, But... by MobileTatsu-NJG · 2011-01-01 11:44 · Score: 4, Funny
  
  > Why is ANYONE with half a brain still using Microsoft browsers?
  Why is anyone with half a brain still using any Microsoft software at all?
  People with half a brain should be using Linux instead?
  
  --
  
  "I like to lick butts!" by MobileTatsu-NJG (#32700246) (Score:5, Informative)
12. Re:Terrific Research, But... by Anonymous Coward · 2011-01-01 11:50 · Score: 0
  
  Apparently you have not looked very hard. Motorcraft is Ford's own brand of parts including oil, filters, probably tires and a whole lot more.
13. Re:Terrific Research, But... by Anonymous Coward · 2011-01-01 11:51 · Score: 1
  
  People with half a brain should be using Linux instead?
  There's a distro for that.
  http://www.ubuntu.com/
  http://ubuntuforums.org/
14. Re:Terrific Research, But... by sjames · 2011-01-01 11:53 · Score: 1
  
  No Motorcraft tires either.
15. Re:Terrific Research, But... by thegarbz · 2011-01-01 11:55 · Score: 0
  
  Why is anyone with half a brain still using any Microsoft software at all?
  Because some of Microsoft's software is incredibly stable, compatible with all modern hardware, easy to use, has UI design that is consistent and makes sense, and will run nearly all software on the planet.
  
  I tried using linux on my desktop, but after a kernel update made my machine randomly lockup and it took me more than a week to diagnose this, after I couldn't change my screen resolution because the ok / apply buttons weren't on the screen, after I spent a week trying to get my scanner working and failing, I just kind of gave up.
  
  Despite what you think some of us out there not only like some Microsoft products (not IE), but actively prefer Microsoft products which are still a leap and bound better than anything the open source community have come up with. (yeah watch my karma burn, but do I get a saving grace for saying Andriod is a shitload better than WM7?)
16. Re:Terrific Research, But... by thegarbz · 2011-01-01 12:02 · Score: 1
  
  Integration.
  
  When a Fortune 50 company decides to upgrade their global intranet which was previously compatible with only IE6 to a platform based on .... Sharepoint of all bloody things, they once again dig themselves further into the vendor lockin hole. However when you look at it on the grand scheme of things the intranet despite the browser is now not only far better than it was, but is highly customisable by individual employees in departments. A wonderful advancement on the previous "call up IT and hope they get to it within the next 6 months" answer for fixing a single broken link.
  
  Above all this pre-packaged solution meshes nicely with all other Microsoft products and is cheap to implement. So ultimately even if some nameless CIO wanted to get rid of IE from a company with 80000 employees globally, often you may find that it stays around to satisfy other requirements for integration.
  
  That and the very latest version of IBM Maximo doesn't work properly on Chrome or Firefox, so third party vendors are also to blame. (IBM definitely isn't the only one to blame here)
17. Re:Terrific Research, But... by Virtucon · 2011-01-01 12:16 · Score: 1
  
  Not maybe in your lifetime but... It was done by Henry Ford himself.
  http://www.time.com/time/magazine/article/0,9171,788057,00.html
  I guess nobody reads history books anymore?
  
  --
  Harrison's Postulate - "For every action there is an equal and opposite criticism"
18. Re:Terrific Research, But... by evilviper · 2011-01-01 12:17 · Score: 1
  
  I don't know Ford's system, but for GM, all parts are "AC Delco" branded (tires not included), and all documentation recomends AC Delco replacements parts. So there's a good bit of truth to the statement...
  
  --
  Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
19. Re:Terrific Research, But... by sjames · 2011-01-01 12:26 · Score: 1
  
  It WAS done, but that was before I was here to see it.
  Certainly it's clear enough that the analogy fails, nobody is all torn up about not having Ford tires on their Ford cars.
20. Re:Terrific Research, But... by Anonymous Coward · 2011-01-01 12:27 · Score: 1
  
  Home users, no idea. Ignorance and apathy I suppose.
  
  Ease of use, large amount of available software (games, in particular), out-of-the-box operation (aka 'it comes with the damn pc'), familiarity, large user base ('family member X knows something about computers and (s)he (also) uses windows, so (s)he can help me when I need help').
21. Re:Terrific Research, But... by JustOK · 2011-01-01 12:27 · Score: 1
  
  Firestone is related by marriage.
  
  --
  rewriting history since 2109
22. Re:Terrific Research, But... by Anonymous Coward · 2011-01-01 12:31 · Score: 0
  
  The real reason? What you consider "better" isn't objectively so. Sorry. Your opinions don't set the standard.
23. Re:Terrific Research, But... by sjames · 2011-01-01 12:35 · Score: 1
  
  Sure, but neither they (nor Ford's Motorcraft) sell gas or tires. Their share of the market for oil and air filters is modest. It's far away from
  
  When you buy that MSFT car, you wouldn't want to run non MSFT tires on it would you?
24. Re:Terrific Research, But... by BagOBones · 2011-01-01 12:45 · Score: 1
  
  1. Companies do not have any money to rebuild applications that are only compatible with Microsoft Products
  2. Companies are unwilling to spend money on replacing systems that work.
  3. Security is not a priority often as it costs money.
  4. Just because the software is free doesn't mean the employee training, implementation project or any of the costs of switching don't matter.
  
  --
  EA David Gardner -"... but the consumers have proven that actually what they want is fun."
25. Re:Terrific Research, But... by Virtucon · 2011-01-01 12:52 · Score: 2
  
  So here's one for you that's maybe a bit more contemporary. You wouldn't want to run that app on your iPhone unless it came from the App Store, now would you? Because Apple knows better than you, things are put in place to prohibit you from downloading that app. Just ask Mark Fiore about that one. Because "we" control the channel, the entire distribution chain, we then control the product and we can force you to take what we want to give you.
  All of this has been done before and to a much greater extent in the past. People nowadays think that it's something new to have this kind of bundling and tied product design with supporting Channel Marketing strategies employed, it's not. The Software and Electronics Industries have just caught on is all. Just like Region codes in DVDs for that matter.
  Of course you can run MSFT Sharepoint apps with Firefox, but it doesn't give you the full "robust" effect does it? Enterprises want the functionality that they pay for and are willing to put up with that argument because they're buying a solution, a COTS product. Because of that, they then mandate IE in the enterprise because they don't want to deal with heterogeneous environment support issues and so that the apps they test and deploy will work. Diversity in IT costs money. Now all of their thousands of PCs are running IE because "MSFT says so."
  Here's another one:
  Have you tried to run Outlook Web Express (Exchange) on Firefox? How about the same app on IE? Are they the same experience? hell no.
  People at Home want that easy to use experience and although I can't say how many folks are still running Windows XP I'd venture to say it's still more than run Windows 7. They don't want their kids coming to them and telling them that Fallout Vegas doesn't work on that PC that's 5 years old. They just want it to work for them and their kids. On that computer there rests a copy of IE, probably IE 6 because it let's the kids get onto to Disney.com and Mom can get her latest Oprah Content. Couple that with the fact that Microsoft isn't supporting XP anymore and you have a bigger problem because you didn't buy that MSFT upgrade path yet where you get the new service plan, warranty and all the new features.
  So, you wouldn't want to run non MSFT tires on that MSFT car you just bought, now would you?
  
  --
  Harrison's Postulate - "For every action there is an equal and opposite criticism"
26. Re:Terrific Research, But... by Anonymous Coward · 2011-01-01 12:55 · Score: 0
  
  as someone who does IT for a new car dealership I can tell you for a fact that LOTS of people only want Firestone tires on their Fords. Analogy works if you understand the auto industry.
27. Re:Terrific Research, But... by sjames · 2011-01-01 13:10 · Score: 1
  
  Evidently there are enough people who DO want to run non-App Store apps on their iPhone that the necessary hack has been simplified down to "just click here" for the less technical users.
  Considering that Firefox is busy outstripping IE, I'd say a lot of home users most certainly WOULD want to. It seems a lot of businesses do as well except that some of them are stuck on IE6 (and so can't 'upgrade' to Windows 7).
  As for the rest, I can't really say. I run Linux except for a single old Dell named "Crash Test Dummy" that runs XP. It's use is just what it's name suggests.
  So, yeah. I and a lot of others absolutely would want to run non MSFT tires on that MSFT car. Of the rest, it's divided between the apathetic/agnostics and the loony purists for purity's sake.
28. Re:Terrific Research, But... by hedwards · 2011-01-01 13:35 · Score: 1
  
  Of course not. You don't typically see the insecurity unless the cracker has fouled up. A compromised machine often times looks exactly like a typical one, albeit somewhat slower and with more use of the network.
29. Re:Terrific Research, But... by QuoteMstr · 2011-01-01 13:50 · Score: 1
  Modern Internet Explorer:
  
  is fast and stable
  can be controlled with group policy
  can be centrally deployed and managed
  comes with the OS
  has a neat feature or two
  We're not talking about IE6, and this isn't 2003. It's time to update your prejudices. IE9 is a decent standards-conforming browser. It's not all that exciting, but it's not awful, and I can understand why people are perfectly content with it.
30. Re:Terrific Research, But... by Anonymous Coward · 2011-01-01 14:12 · Score: 0
  
  Actually, their stuff rarely works well together in total. It's supposed to in theory, but in practice it doesn't always jell.
31. Re:Terrific Research, But... by Anonymous Coward · 2011-01-01 14:31 · Score: 0
  
  The only ignorance here is your refusal to understand that having apps that work in a manor befitting to the end user is a big obstacle and as much as the fanbois like to shout their opinions about it; Linux still isn't at the level most users can live with.
32. Re:Terrific Research, But... by Anonymous Coward · 2011-01-01 15:14 · Score: 0
  
  > Why is ANYONE with half a brain still using Microsoft browsers?
  Why is anyone with half a brain still using any Microsoft software at all?
  Because when I tried Windows on the other partition, it screwed up GRUB.
33. Re:Terrific Research, But... by WaffleMonster · 2011-01-01 15:25 · Score: 1
  
  Why is ANYONE with half a brain still using Microsoft browsers?
  It has only been about a decade now of bad bugs being dribbled out and gradually fixed.
  Why do companies still use MS Explorer?
  What bug free browser do you recommend people use? Firefox? chrome? Can you name even one not constantly having to release patches for P1 security issues? Does such a browser even exist?
  There is little point with security realitivisim in this space when all of your choices == EPIC FAIL.
34. Re:Terrific Research, But... by camperdave · 2011-01-01 15:29 · Score: 1
  
  IE9 is a decent standards-conforming browser. It's not all that exciting, but it's not awful, and I can understand why people are perfectly content with it.
  
  Corporate policy restricts us to WinXP and IE7. I thought IE9 was still on the drawing boards.
  
  --
  When our name is on the back of your car, we're behind you all the way!
35. Re:Terrific Research, But... by Anonymous Coward · 2011-01-01 15:51 · Score: 0
  
  You say you "tried using linux on my desktop, but after a kernel update made my machine randomly lockup and it took me more than a week to diagnose this". As unstable the typical linsucks kernel is, it will at least run on even broken hardware
  After a recent kernel update my eth0 randomly disappears after a few days for no reason. Eventually after months of following news groups and complaining I had to manually compile a patch to fix it. This is a mainstream onboard e1000e server Intel nic. There is something really wrong when an end user has to compile kernel patches to update a vendor supplied device driver.
  Every time without fail I try to do any serious work with linux on the desktop there are problems with my video - the x-server crashes or flakes out. Thinkpad feature support still sucks and the fonts... OMG.. the fonts are absoultely terrible..they have no kerning just ugly blurry anti-aliasing... I can't stand it. They should focus less on (lets face it windows ripoff eye candy) and fix the basic problems. Eventually linux will rock on the desktop but lets not dillusion ourselves.
  I love linux but only for server / network applications where no other operating system can really compete... not even BSD. On the desktop it won't run the apps I need it to and it is NOT stable.
  WRT broken hardware... most reliability issues are people running with bad memory, PSUs and disk drives who have not done a proper burn-in to detect and fix the problem. Windows fills memory in reverse order of Linux and so some problems with broken hardware appear different just by the luck of the draw. There is still a very serious problem that must be resolved... blaiming the OS for hardware issues that are beyond its control is not useful.
36. Re:Terrific Research, But... by ScottMcD · 2011-01-01 16:20 · Score: 1
  
  Momentum? Maybe. In the companies I've worked for, IE is required by the older versions of browser based ERP applications. A lot of these were built using specific technologies built into IE. The newer versions of these applications are usually cross-browser, but upgrading to them costs money.
37. Re:Terrific Research, But... by fleebait · 2011-01-01 19:33 · Score: 1
  
  Ford previously was an all Firestone purchaser.
  Then Firestone was bought out by (foreign owned Bridgestone)
  Currently the 3 top suppliers to Ford are: Goodyear, Michelin, Continental.
38. Re:Terrific Research, But... by Rolman · 2011-01-01 19:54 · Score: 1
  
  Why is ANYONE with half a brain still using Microsoft browsers?
  It has only been about a decade now of bad bugs being dribbled out and gradually fixed.
  Why do companies still use MS Explorer?
  That means half a brain is not required to browse the Internet these days.
  
  --
  - Otaku no naka no otaku, otaking da!!!
39. Re:Terrific Research, But... by thsths · 2011-01-01 20:36 · Score: 2
  
  We're not talking about IE6, and this isn't 2003. It's time to update your prejudices. IE9 is a decent standards-conforming browser.
  You say that, but even compared with the current generation of browsers, IE9 is usually ranked towards the bottom, and it is not even released yet. Once that happens, it will have to compete with Firefox 4, Opera 12 (I guess) and Chrome developing at insane speeds. Microsoft has promised to catch up with IE7, and again with IE8, and again with IE9. But it seems that is all they are doing: playing catch up.
40. Re:Terrific Research, But... by Anonymous Coward · 2011-01-01 21:13 · Score: 0
  
  Sandboxed IE is excellent. Do you run your browser without a raincoat?
41. Re:Terrific Research, But... by Dogers · 2011-01-01 21:45 · Score: 1
  
  Here's another one:
  Have you tried to run Outlook Web Express (Exchange) on Firefox? How about the same app on IE? Are they the same experience? hell no.
  On Exchange 2010, yes they are, actually. One of the many reasons I'm really looking forward to our upgrade!
  
  --
  I am a viral sig. Please copy me and help me spread. Thank you.
42. Re:Terrific Research, But... by monkyyy · 2011-01-01 21:52 · Score: 0
  
  has UI design that is consistent and makes sense
  ummm right they change it consently; 2000 to xp to 7(didnt touch vista) the way u change any setting was moved to a different submenu,
  and when did it ever make sense? where are the controls to choose which programs can start on log in? the per-app volume balancing? why cant i make some windows stay on top? or transparent? and what stuff do they give me instead? 'gadgets'? automatic updates that like to restart my computer? simi-transparent title bars that are blurry(srsly y?) that u cant have on clear transparent? how does it make much sense either?
  the only good things u can say about windows is what other people have done to it
  
  --
  warning pointless sig
43. Re:Terrific Research, But... by Anonymous Coward · 2011-01-01 22:20 · Score: 0
  
  Actually the latest version of Outlook Web Access feels the same in Firefox (and other Geckos, including mobile ones) as in IE.
  Microsoft uses channels to give themselves an initial edge, but when they need to compete (Google Docs/Google Mail), they will+do change their tactics.
44. Re:Terrific Research, But... by thegarbz · 2011-01-01 22:55 · Score: 1
  
  Change means progress. Linux has changed far more than windows has in the past 15 years. That argument falls flat on it's face. That and there's a million different distros with a million different interfaces too.
  
  Honestly I think you're defending Linux for all the wrong reasons. But you're right with the windows side of things. Advanced usability is missing, as is hardcore customisability. Linux does that nicely. Unfortunately basic usability is missing from Linux. The open source crowd needs some bloody GUI and usability experts to refine how it gets interacted with. It's quite telling that Ubuntu has made the most progress with this yet seems to be one of the most hated distros amongst the crowd.
45. Re:Terrific Research, But... by alexchorny · 2011-01-02 01:36 · Score: 1
  
  Yes, they release fixes. Soon. For IE you can wait up to 6 month for a fix.
46. Re:Terrific Research, But... by Gadget_Guy · 2011-01-02 01:42 · Score: 1
  
  Why do companies still use MS Explorer?
  Well in this case IE was found to have far fewer bugs than WebKit or Mozilla. They have all fixed some (but not all) of the reported bugs, so I don't think it is such a easy conclusion to say that you shouldn't use IE.
  Personally, I am thinking of moving back to Opera. I have never been a fan of WebKit, and I don't think that Mozilla deserves the high praise that it gets for security. Of course, the best solution is to not trust any of the browsers.
47. Re:Terrific Research, But... by Cili · 2011-01-02 04:05 · Score: 1
  
  In Gnome and KDE you don't need the top bar with the minimize/maximize/close buttons to move a window around. You can hold Alt and drag the window with the mouse from anywhere.
48. Re:Terrific Research, But... by monkyyy · 2011-01-02 07:52 · Score: 1
  
  no he said the ui is consistent when it changes everything everytime, at lest with linux gnome menus will still be remotely the same as other gnome menus
  
  --
  warning pointless sig
49. Re:Terrific Research, But... by BeanThere · 2011-01-02 09:14 · Score: 1
  
  Why do companies still use MS Explorer?
  Because MSCE's and MVP's and their ilk hired in the IT department need to pledge their allegiance rigidly to MS solutions in order to cover up their own lack of competency.
  As for home users, well a significant percentage of them wouldn't know a web browser from a street whore.
50. Re:Terrific Research, But... by Anonymous Coward · 2011-01-02 11:06 · Score: 0
  
  I, and many other people would argue that #2 subsumes #1, as an application that only works with MS products when others that perform the exact same task but don't put the purchaser at the mercy of a company who has proven themselves time and time again to be completely anti-consumer are broken. I would certainly lose my job if I decided I could only be arsed to support IE, and rightly so.
51. Re:Terrific Research, But... by thegarbz · 2011-01-02 12:13 · Score: 1
  
  That's a load of crap. Within Gnome, gnome may be consistent but that's where it ends. The user experience is anything but.
52. Re:Terrific Research, But... by jon3k · 2011-01-06 02:25 · Score: 1
  
  This is pretty much spot on. Installed by default and easy to manage centrally. If I could manage Firefox as easily as I can manage IE (WSUS updates, group policies to force proxies and homepages, etc) then we'd already be using it. Compatibility isn't a terrible concern these days, and if I had an ADM for it I could force IE tab for sites that weren't compatible.
Sandbox time? by Anonymous Coward · 2011-01-01 11:08 · Score: 0

It's time to sandbox the entire browser. And put the sandbox in a VM.
That way you have to find 3 security holes to compromise the computer.
1. Re:Sandbox time? by Xtense · 2011-01-01 11:11 · Score: 3, Funny
  
  And what if we put the VM... into ANOTHER VM? :O
  
  --
  "We are the music makers, and we are the dreamers of dreams [...]."
2. Re:Sandbox time? by Bob_Who · 2011-01-01 11:17 · Score: 1
  
  ....That way you have to find 3 security holes to compromise the computer.
  ...All three holes? The usual obsession of web whackers....
3. Re:Sandbox time? by fuzzyfuzzyfungus · 2011-01-01 11:26 · Score: 4, Insightful
  
  That runs into the convenience problem: Downloading pictures, files, executables, etc. and printing stuff are ridiculously common use cases for browsers. So to is the old 'opening a link in some other program in a browser'. Thus, any sort of security mechanism that makes those more of a pain will run into user resistance. Any sort of security mechanism that initially blocks those and then introduces a bunch of workarounds(shared filesystem location between VM and computer, virtual printer in VM mapping to real spooler, some sort of local process that catches URLs and passes them into the sandbox, etc. also raises the possibility of serious bugs in those workaround mechanisms...
  
  If browsers were exclusively used for reading web pages, securing them would be so much simpler...
4. Re:Sandbox time? by Larryish · 2011-01-01 12:24 · Score: 1
  
  Set up your user's machine to run Debian, and run Wintendo in a Virtualbox instance. Make a backup copy of the VM after the initial updates and basic apps install.
  Then when Grandma's box gets something so nasty that system restore won't fix it, you can restore it to an original state from the backup copy.
5. Re:Sandbox time? by Anonymous Coward · 2011-01-01 12:58 · Score: 0
  
  IE8+ and Chromium are. Not fully (yet). But TFA's tool only exploits DOM parsing/rendering bugs. Ergo, 99.999% (if not 100%) of them won't be able to penetrate the target computer without further (much harder) effort.
6. Re:Sandbox time? by Anonymous Coward · 2011-01-01 13:06 · Score: 0
  
  (Also, of course, is the issue of things like plugins: If I make the mistake of installing Adobe Acrobat reader it will, by default, set itself up so that I can read PDFs 'in browser' by means of an embedded instance of AAR. Various other flavors of file have their equivalents. This means that either you must sacrifice this capability, and deal with only what the browser provides, or you must have a separate install process for browser plugins, disconnected from the installation of the standalone program, or there must be a mechanism by which programs executed within the main OS instance can mess with the sandboxed and VMed browser instance; this presents an obvious additional risk, particularly if the browser plugin relies on being able to communicate with a separate main program process, or different program).
  
  That's the tricky bit. It isn't too hard, conceptually, to put the browser behind enough layers of abstraction that 0wning it is nearly useless, and your ownership lasts only until the user restarts the browser. However, doing that without making the browser about as useless as the browser running on an entirely separate computer is the hard part. Much of what browsers are, in practice, used for depends on comparatively close integration between the browser and other elements of the system. This doesn't mean that it is impossible; but it does mean that any sandbox will either be wildly annoying to users, or riddled with potential escape channels that need to be rigorously secured. Worse, since so much of what certain people do is in browser, it has become the case that the security of the browser itself is important. Even if no other program, or any part of the local filesystem is touched, things like XSS attack prevention, to keep javascript on the warez.ru tab from snarfing your CC number from the amazon.com tab, are still vital. If the browser has been compromised, things within it are still potentially threatened and that covers a lot more ground than it used to.
  
  Hard problem.
7. Re:Sandbox time? by Anonymous Coward · 2011-01-01 13:18 · Score: 0
  
  I'm sure you know what a DMZ (network) is. Now apply the concept to shared memory. Problem solved. It was solved, many years ago (decades if you count server daemons).
8. Re:Sandbox time? by ObsessiveMathsFreak · 2011-01-01 13:47 · Score: 1
  
  But then with all the slowdown, how will I run my in browser flash games?!
  
  --
  May the Maths Be with you!
9. Re:Sandbox time? by Anonymous Coward · 2011-01-01 14:00 · Score: 1
  
  Sup dawg, I heard you liked sandboxing. So I put a VM in your VM so you can Sandbox while you Sandbox.
10. Re:Sandbox time? by fermion · 2011-01-01 15:28 · Score: 1
  
  MS had no problems providing restrictions on the use of Outlook to Downloading pictures, files, executables. They could easily do the same for IE. The reason they do not in IE,IMHO, is that such a thing would cut into the ad revenue of he real customers. It is the same reason flash does not have a setting to disable autoplay. It is like MS taking forever to provide popup blocking.
  
  --
  "She's a scientist and a lesbian. She's not going to let it slide." Orphan Black
11. Re:Sandbox time? by lseltzer · 2011-01-01 17:02 · Score: 1
  
  IE7+ on Vista and Win7 is essentially sandboxed through protected mode. We don't know enough about the bugs to know real impacts, but if they don't break out of protected mode then the attacker can get very little done.
  Of course this doesn't apply on XP, but only suckers use XP anymore.
12. Re:Sandbox time? by Anonymous Coward · 2011-01-01 17:50 · Score: 0
  
  It's all VMs all the way down.
13. Re:Sandbox time? by Anonymous Coward · 2011-01-01 21:48 · Score: 0
  
  hackers only want two holes
14. Re:Sandbox time? by Anonymous Coward · 2011-01-01 23:07 · Score: 0
  
  Then if you put the second VM back in the first VM, you can get rid of the real machine!
Is Chrome not affected? by Anonymous Coward · 2011-01-01 11:19 · Score: 0

The story has been tagged with Firefox and IE icons. Does this imply that the other major browsers aren't affected? TFA makes no specific mention of Firefox BTW. So I'm assuming the Firefox icon is for fairness's sake (i.e. it's not the usual M$ problemo). However, there are no icons for Chrome and Safari.
1. Re:Is Chrome not affected? by Xtense · 2011-01-01 11:22 · Score: 1
  
  Chrome wasn't tested by the researcher, so no mention is made as to whether it is affected or not. Safari figures under "All WebKit browsers" in the message and some bugs were found.
  
  --
  "We are the music makers, and we are the dreamers of dreams [...]."
2. Re:Is Chrome not affected? by raving+griff · 2011-01-01 11:25 · Score: 1
  
  I can't recall ever seeing more than 5 icons on a single article, so I would assume that this is a limit to slashdot's story posting system.
  Your point is very valid--the article discusses browsers in general. Perhaps we should have an icon that applies to browsers in general or ignore browser icons altogether for articles such as this?
3. Re:Is Chrome not affected? by MeanMF · 2011-01-01 11:31 · Score: 1
  
  Chrome is a WebKit browser too.
4. Re:Is Chrome not affected? by Xtense · 2011-01-01 11:34 · Score: 2
  
  Oh, right. Forgot about that one, sorry.
  *holds up geek card* So where do I turn in this thing?
  
  --
  "We are the music makers, and we are the dreamers of dreams [...]."
5. Re:Is Chrome not affected? by Anonymous Coward · 2011-01-01 11:52 · Score: 0
  
  Please read a bit deeper into the story than just TFA. Firefox is mentioned.
Still Crappy Code after all these years? by Virtucon · 2011-01-01 11:29 · Score: 1

Fuzzing Test logic has been around awhile but again I still can't fathom why Software vendors can't do a better job of using tools to certify their code. I can't ascertain from this report that these bugs create vulnerabilities or an in the wild attack. This report should read "IE 8 has bugs."
All this talk about Sandboxes as well can't be overlooked but what about the network level and intelligent traffic analysis. If all of a sudden you start seeing PCs launching IP traffic at strange addresses in Foreign Lands, I think a firewall could then be employed to block it until such time as an analysis could be done to find out what's going on. Even so, if PCs start feeding data to private PCs or unknown networks then that's certainly something that can be corralled at the network level as well.

--
Harrison's Postulate - "For every action there is an equal and opposite criticism"
1. Re:Still Crappy Code after all these years? by jesser · 2011-01-02 06:18 · Score: 1
  
  I still can't fathom why Software vendors can't do a better job of using tools to certify their code.
  I blame C++. Hard to parse, hard to analyze, full of surprises.
  So do a few other people at Mozilla, who are working on a new systems language called Rust.
  
  --
  The shareholder is always right.
Can we get this re-summarized by Anonymous Coward · 2011-01-01 11:37 · Score: 0

I mean come on, there is a 1 year 2 month windows between first bugs being reported and new issues with the next version being passed on.
Which adds up to about the 1 year longer it took MS to fix the issues!
Well knock me down, in over a year don't tell me that a program designed to stress test browsers that is undergoing changes being run on a years worth of updates is causing more issues!
" Early fixes from Opera and Apple started shipping somewhere in 2008; some more arrived in 2009."
the original MS fix took two months, from May to July 2008, Then we jump though to Sept. 2009!! one year and two months because of and I quote " after multiple delays at the request of other vendors"
The only time the response by MS seems to have been 'depressing' it seems to be a 4 month window when for what ever reason MS forgot about or lost the responce, that dose happen occasionally, and yet when that was identified it seems the response was to get in, kick ass and keep working on the issues. With more back and forth comunication in the last ten days of the year, over the holiday period then one has the right to expect.
How about we change the last MS bashing bit to "MS Spends months trying to fix "fairly quickly crashes""
or we could try, "New versions of stress software cause new bugs that need to be fixed by MS"
how many happen with scripts disabled? by Anonymous Coward · 2011-01-01 11:39 · Score: 0

Seems like if you disable scripting, then you're just down to buffer overruns and such in the HTML engine or image display libraries. But disabling scripts has got to remove a HUGE attack surface. It seems like running a good AppArmor profile would remove most of the rest of the attack surface.
1. Re:how many happen with scripts disabled? by yuhong · 2011-01-01 13:11 · Score: 1
  
  The attacks created by this fuzzer occurs only with scripts enabled. But the same researcher previously released mangleme, which fuzzed HTML and leads to a significant number of HTML engine bugs being fixed.
Unwanted Pop-Unders Still a Security Issue by Ron+Bennett · 2011-01-01 11:43 · Score: 1

I'm amazed the pop-under problem still hasn't been addressed in MSIE nor, more surprisingly, in Firefox - even at the highest security settings, pop-unders, such as the Netflix and screensaver ones, still get through - a potential security flaw.
I've search the bug reports for Firefox in the past and pop-unders ranks high on problems that people want fixed, and yet still isn't - seems to me if pop-up windows can be blocked, why can't pop-under windows? Doesn't make sense to me ...
The cynic in me thinks there's some financial incentives for Firefox developers who happen to know how to fix the pop-under issue to not do so. Especially since some large companies, such as Netflix, and various popular websites, including Accuweather.com, heavily utilize pop-unders it makes me wonder, but I digress.
Ron
1. Re:Unwanted Pop-Unders Still a Security Issue by rudy_wayne · 2011-01-01 11:54 · Score: 3, Informative
  
  I'm amazed the pop-under problem still hasn't been addressed in MSIE nor, more surprisingly, in Firefox - even at the highest security settings, pop-unders, such as the Netflix and screensaver ones, still get through - a potential security flaw.
  I've search the bug reports for Firefox in the past and pop-unders ranks high on problems that people want fixed, and yet still isn't - seems to me if pop-up windows can be blocked, why can't pop-under windows?
  Pop-up windows are still a problem in Firefox. Websites have devised new ways to pop up annoying windows that Firefox apparently isn't able to block (as of FF4 beta 8).
2. Re:Unwanted Pop-Unders Still a Security Issue by Vekseid · 2011-01-01 12:06 · Score: 3, Informative
  
  It's not new, those popups are being delivered through Flash, rather than javascript.
  
  --
  Adult Role Playing Forum
3. Re:Unwanted Pop-Unders Still a Security Issue by Anonymous Coward · 2011-01-01 13:09 · Score: 0
  
  Well that's easily prevented.
  Chrome:about:flags -> Click-to-play (enable) Options -> Under the Hood -> Plug-ins -> Click to play
  Firefox: probably has dozens of extensions to block Flash. Including RequestPolicy for cross-site requests (I so wish this extension existed for Chromium).
4. Re:Unwanted Pop-Unders Still a Security Issue by hedwards · 2011-01-01 13:40 · Score: 1
  
  I haven't seen that, but then again I typically browse with noscript running in the background.
5. Re:Unwanted Pop-Unders Still a Security Issue by QuoteMstr · 2011-01-01 13:53 · Score: 1
  
  No, at least Mozilla blocks Flash popups too. The issue is that these "popups" are created in response to user clicks, and the browser can't tell the difference between Live Jasmin spam and a legitimate, requested pop-up because both are run from the click event handler.
  The only solution is to disable popups entirely, which will cause compatibility issues. This is why we can't have nice things.
6. Re:Unwanted Pop-Unders Still a Security Issue by Anonymous Coward · 2011-01-01 22:31 · Score: 0
  
  For those of us who don't go out into the scary web often, could you provide example sites which trigger this behavior?
7. Re:Unwanted Pop-Unders Still a Security Issue by Anonymous Coward · 2011-01-02 02:15 · Score: 0
  
  This. I am amazed how (at least technically-minded) people still tolerate browsing the web without using some NoScript of some sorts. Trust me, any annoyance you may have with white/black/grey-listing sites is minimal compared with the increase in speed, safety and privacy.
8. Re:Unwanted Pop-Unders Still a Security Issue by jesser · 2011-01-02 06:23 · Score: 1
  
  In most browsers, including Firefox, popups (including popunders) are blocked except when they appear in response to clicks.
  In Firefox 4, we think we've solved the problem that allows popups to turn into popunders. Now that you see them right away, it should be clearer that they're appearing only in response to clicks, and you should be able to tell which sites they're coming from.
  
  --
  The shareholder is always right.
9. Re:Unwanted Pop-Unders Still a Security Issue by didroe84 · 2011-01-02 10:49 · Score: 1
  
  You can get "Adblock Plus Pop-up Addon" which will allow you to manually block specific popups.
10. Re:Unwanted Pop-Unders Still a Security Issue by Anonymous Coward · 2011-01-03 19:16 · Score: 0
  
  Any way to disable flash, except for a white list?
We can't fix the web browsers anymore by Anonymous Coward · 2011-01-01 12:10 · Score: 0

Seriously. Todays browsers need to implement so many technologies that they automatically get bloated. There is CSS, various HTML versions, XHTML (in various versions and dialects), XSLT, MathML, Vectorgraphics (SVG), RSS, Atom, {Java, ECMA}Script, varios image formats (JPEG, GIF, PNG, ..), etc. The code gets so utterly complicated that it inherently contains many, many vulnerabilities. Just take a look at the Firefox/gecko code, for example.
Do you think HTML5 is a good idea? Well, it probably is in order to get rid of ugly third-party plugins like flash and java. However, it's going to make browsers even more complicated (and therefore likely less secure).
I sometimes wish there was some sort of "legacy" web which would contain all the information, just without the glossy rubbish. Gopher someone?
It's a big target by BudAaron · 2011-01-01 12:38 · Score: 0, Troll

At 83 with years of computer experience I can't understand for the life of me why people dislike Microsoft so much. When I was growing up the American dream was to build a business and make it grow like crazy. Bill Gates did exactly that. So to me he represents the culmination of an American dream. That said the main reason Microsoft gets pummeled with exploits is that they are a huge target. Virus writers want to make a name for themselves so they go after the biggest targets. My answer is simple - I use Windows Security Essentials - a free virus tool from MS and I haven't had a virus since I started using it. Many of the commercial anti-virus folks aren't real happy but frankly I don't care. And yes - I do run other tools occassionally to ensure that all is well. You say you don't like Microsoft? I say "fine - no problem - you use whatever floats your boat but stop taking pot shots at MS." You don't need to use it and you don't need to like it. I don't care. I don't take shots at any "...ix" versions. You're welcome to use them or whatever you want. I just happen to love all things Microsoft and get a lot of work done using them. Take pot shots at me if you like - my name is Bud Aaron and you will find me with a simple name search.
We need to see another version of Lynx by freaxeh · 2011-01-01 13:40 · Score: 1

We need to see some kind of lightweight VM machine running in a sandbox on the windows OS, which acts and looks just like a web browser to anybody using it, and saves downloaded files to a directory on the Windows desktop folder in a Directory named "Downloads". Today the majority of users certainly have the CPU power to pull it off, why not run it completely in RAM too to facilitate never having to access the hard drive. It would probably be the fastest web browser ever made, and the most secure.
1. Re:We need to see another version of Lynx by Anonymous Coward · 2011-01-01 15:09 · Score: 0
  Sandboxed web browser: Run any web browser inside Sandboxie. Problem solved.
  Downloads folder: Firefox already does that. Sandboxie contains files in a separate quarantined folder that can be retrieved to said Downloads folder.
  CPU Power: Actually, Sandboxie runs a little bit slow, so a user would notice it. Aside from that, the "#" that appears at the start and end of the window title, and the different icon for the shortcut (which could be changed I suppose), most users wouldn't notice any difference. Actually, to be fair, most users wouldn't notice the performance toll to begin with, what with Internet Explorer being so slow even before you get all the toolbars and BHOs you didn't want. It's still faster than that.
  Run everything in RAM: 1 word: "Flash". User goes to youtube.com, watches a few videos, and you can just watch their RAM fill up. Or Slashdot. Or some graphical or large page. While running strictly from RAM would boost performance in theory, it wouldn't be practical for a web browser. Also, running from RAM isn't going to do anything for security, which is what this article is about. A heap overflow is going to happen from within memory whether the exploit is loaded from the hard drive or from RAM (which is where it's ultimately going to wind up anyway).
Michal by Anonymous Coward · 2011-01-01 14:40 · Score: 0

It's Michal, not Michael
EMET 2 by Anonymous Coward · 2011-01-01 16:22 · Score: 0

Anyone tested with emet 2 running on the browsers?
Who's writing these headlines? by Paradise+Pete · 2011-01-01 17:52 · Score: 1

Who's writing these headlines?
His own post says "about one hundred." How does that turn into "Hundreds of browser bugs"?
And he does not say "some" of these bugs may be known to third parties. He says "at least one."

What he found is bad enough. Why the need to exaggerate?
RTFL by Anonymous Coward · 2011-01-02 02:40 · Score: 0

Read the link where the Chinese are mentioned.
Chinese IPs were accessing the developers' web page with Google referer strings that showed they were searching for the two functions involved in the vulnerability, despite their being no other mentions of those functions on the internet at the time.
Updates in TFA by lseltzer · 2011-01-02 03:37 · Score: 1

I'm the author of TFA and I have made changes to include reactions from Microsoft and Zalewski. Larry Seltzer PC Magazine
Yah by Anonymous Coward · 2011-01-02 15:45 · Score: 0

FF vulns have been exploited for some weeks now. Ta Cyber Command, now fuck right off.
I'll show you even better on UNPATCHED Windows 2k by Anonymous Coward · 2011-01-03 03:48 · Score: 0

"I've found by moving users away from IE I've had their rate of infection drop by a good 75% on fully patched XP machines tells me all I need to know in all honestly" - by hairyfeet (841228) on Monday January 03, @01:35AM (#34741562)
By using a custom HOSTS file, I've seen myself go to NO MALWARE INFESTATIONS for over 15++ yrs. now online, & others have been seeing the same results for over 5 yrs. now:
---

"Ever since I've installed a host file (http://www.mvps.org/winhelp2002/hosts.htm) to redirect advertisers to my loopback, I haven't had any malware, spyware, or adware issues. I first started using the host file 5 years ago." - by TestedDoughnut (1324447) on Monday December 13, @12:18AM (#34532122)
FROM http://tech.slashdot.org/comments.pl?sid=1907528&cid=34532122
---
Wait, because IT GETS BETTER (especially for this fellow, considering he runs Windows 2000 UNPATCHED, with no antivirus program & no antispyware program, or a firewall even (though we did substitute in PORT FILTERING, often called "the poor man's firewall" for him)):
---

""the use of the hosts file has worked for me in many ways. for one it stops ad banners, it helps speed up your computer as well. if you need more proof i am writing to you on a 400 hertz computer and i run with ease. i do not get 200++ viruses and spy ware a month as i use to. now i am lucky if i get 1 or 2 viruses a month. if you want my opinion if you stick to what APK says in his article about securing your computer then you will be safe and should not get any viruses or spy ware, but if you do get hit with viruses and spy ware then it will your own fault. keep up the good fight APK."
FROM -> http://forums.theplanet.com/index.php?showtopic=89123&st=60&start=60
---
That's a GIGANTIC & MANY ORDERS OF MAGNITUDE DECREASE IN MALWARE INFESTATIONS, far more than 75% that moving away from IE gave you per your quoted statements... & it's also on a totally unpatched system + otherwise unsecured system via antivirus/antispyware programs, OR even a typical firewall program
(Where the user removed SOME ENTRIES in the hosts file himself (he likes "certain kinds of sites" is why, you fill that in yourself), & even thinks that is where he got his infection from & how - we'd spoken via email before, & he wanted to see just how effective a hosts file can be, for added layered security, & there was nobody offering a BETTER WAY TO TEST IT, than he had, from those I correspond in email with regarding that much either... so, we tried it, & those were the results)).
APK
P.S.=> So, overall? Well - That's better results, using a custom HOSTS file, than you're saying by moving away from IE alone!
Even though I'd recommend that myself, & I do, here http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&form=QBRE for added "layered security" (more like added layered common-sense)... apk
Correlation != Causation by hairyfeet · 2011-01-03 08:04 · Score: 1

And if I give them a magical LOLCat infections rates will go down by 10,000% and magic pixies will appear to rub their little footies and...wait a tick, that is a what you call it, oh yeah an anecdote and doesn't prove jack which is why I put a disclaimer at the front instead of trying to pass it off as proof like you do Petey, but you KNOW this, don't you?
poor wittle APK, also know as "Petey, the idiot HOPES file guy" As in you HOPES that one of the 300,000+ constantly changing array of websites that are infected doesn't happen to be the one you visit today? Or that you HOPES that nobody notices after repeatedly being asked you have FAILED to show even the tiniest shred of mathematical proof that your magical woobie can scale? That you HOPES nobody notices your only "proof" is anecdotes, often by your own sock puppets like Kingsjester?
Remember Petey I'm not the ponce making outrageous claims so it is up to you to show the math instead of wasting everyone's time waving your little shriveled winkie around by making claims with no mathematical proof and nothing but anecdotes as "evidence". After all those that the earth is only 6000 years old have a full boat of anecdotes to back up THEIR claims as well, but we still think they are just as batshit as you, now don't we?
The simple fact is this: no matter how many times trollie says "1+1 = 3" the math simply proves you wrong and THAT is why all you can do is throw insults. You have 190,000 to 340,000 infected websites at this very moment and that list will change by the thousands per minute as sites are cleaned, new sites are infected, new vulnerabilities found, etc. Now for your HOPES file to actually be a REAL protection and not just a woobie? It will have to dynamically scale and keep up with that ever changing list of infections. Now even if you had twenty fingers and subscribed to every security list on the planet your HOPES file will ALWAYS BE OUT OF DATE and behind the curve. Always. Don't like those numbers? Use the ones from Securina, Grisoft, Symantec, any reputable security site. YOU CHOOSE. I have shown mathematically you are full of shit, now lets see you math that proves me wrong PETEY.
Now if you have a mathematical proof that shows how a static .txt file dropped into system 32 can magically scale dynamically? Lets see it. Otherwise it is NOTHING more a magical LOLCat pic backed up by anecdotes. That is the nice thing about math, it doesn't lie or believe in anecdotes. So it is all on Petey and your magical HOPES woobie now. YOU made the extravagant claims, back them up with the math. If you can't? Well then you are full of shit, case closed. Notice how ALL YOU CAN DO is throw insults and trollbomb? Why is that? I'll tell you why, because math doesn't lie and you just can't show the math you just can't do it or you would have by now, but it would be like trying to mathematically prove you are not an idiot PETEY. It just can't be done.
So please, keep posting APK, I do so enjoy pointing out the total uber fail of your magical woobie so. I also personally consider it a public service to point people to solutions that actually work instead of relying on magical woobies and anecdotes. And of course bitch slapping your around is also quite fun!

--
ACs don't waste your time replying, your posts are never seen by me.
Your "solutions" are FLAWED & IMPERFECT, fool by Anonymous Coward · 2011-01-03 09:26 · Score: 0

"I do so enjoy pointing out the total uber fail of your magical woobie so. I also personally consider it a public service to point people to solutions that actually work" - by hairyfeet (841228) bassbeast1968NO@SPAMgmail.com> on Monday January 03, @03:04PM (#34746796)
Ready fool? Ok, let's see how "perfect" your "solutions" REALLY are, below (not yours, you didn't create them - you merely USE THEM, like a trained chimpanzee that you are, techie boy):
---
MULTIPLE EVIDENCES OF ANTIVIRUS &/or ANTISPYWARE PROGRAM FAILURES + SHORTCOMINGS:
http://www.theregister.co.uk/2007/12/04/win_2000_virus_tests/
http://www.securityfocus.com/infocus/1839
http://it.slashdot.org/it/08/11/07/1545238.shtml
---
(Want more? Here comes, on their "heuristics" too)
ANTIVIRUS HEURISTICS EFFECTIVENESS EVIDENCES (i.e. - NOT 100% EFFECTIVE AND GETS FALSE POSITIVES):
---
The sorry state of Avira anti-virus heuristics:
http://grack.com/blog/2010/03/17/the-sorry-state-of-avira-anti-virus-heuristics/
PERTINENT QUOTE/EXCERPT:
"Considering that the risk of false positives is so high (and users might be trained to ignore other, potentially valid virus warnings), I'd say that users are worse off with this virus definition than they are without."
---
(As "1 example thereof", because the very word "HEURISTICS" equates basically to hairyfeet's very bitch here - guesstimation technology really, in that it uses "does it smell/taste/look like a duck" type tech, & it makes mistakes... period, see above!)
---

"You have 190,000 to 340,000 infected websites at this very moment and that list will change by the thousands per minute as sites are cleaned, new sites are infected, new vulnerabilities found, etc. Now for your HOPES file to actually be a REAL protection and not just a woobie? It will have to dynamically scale and keep up with that ever changing list of infections. Now even if you had twenty fingers and subscribed to every security list on the planet your HOPES file will ALWAYS BE OUT OF DATE and behind the curve. Always. Don't like those numbers? Use the ones from Securina, Grisoft, Symantec, any reputable security site. YOU CHOOSE. I have shown mathematically you are full of shit, now lets see you math that proves me wrong PETEY." - by hairyfeet (841228) bassbeast1968NO@SPAMgmail.com> on Monday January 03, @03:04PM (#34746796)
I just did above, vs. your "suggested solutions" lol... easily!
You're "shot down in flames", yet again, hairyfeet... TOO easily!
There is NO WAY THEY CAN KEEP UP WITH NEW MALWARES BEING MADE either... and you say they "work"? See above!
(They're "better than nothing", & I use them myself, for added LAYERED SECURITY - but, I don't put my entire FAITH ON THEM, as you appear to do!)
---

"As in you HOPES that one of the 300,000+ constantly changing array of websites that are infected doesn't happen to be the one you visit today?" - by hairyfeet (841228) bassbeast1968NO@SPAMgmail.com> on Monday January 03, @03:04PM (#34746796)
I use these reputable, reliable, & regularly updated (by the HOUR no less) sources to populate my HOSTS file:
---
http://www.mvps.org/winhelp2002/hosts.htm
http://someonewhocares.org/hosts/
http://hostsfile.org/hosts.html
http://hostsfile.mine.nu/downloads/
Do YOU make money removing malware hairyfeet? by Anonymous Coward · 2011-01-03 09:37 · Score: 0

You've also got to consider the fact that hairyfeet here is a MERELY a tech, & one that makes his living off of others' misfortunes online, and if malware removal (a big part of his day no doubt) is non-sequitur & a thing of the past? Well, where is hairyfeet going to make his income from??
I.E.-> It's not in hairyfeet, or other "techies"' truly 'best interests' to have you cleaned & fortified so you cannot get malware (otherwise, again, they won't make as much monies from YOUR return business due to being RE-INFECTED again...).
Think about it...
His "solutions" in antivirus/antispyware aren't perfect, & the url's above show anyone that much, as did my last reply -> http://slashdot.org/comments.pl?sid=1931788&cid=34747678 to his foaming @ the mouth rant.
Hairyfeet, "oddly" (not), also isn't telling you there is far more you can do for the working concept of "layered security" either, than just his "solutions" (which again, are shown to be IMPERFECT in the url's above), funny that, eh? Not.
APK
P.S.=> Hairyfeet, don't try to "take me on" again, or troll me like you have the past couple weeks... it always, ALWAYS, ends quite badly for you... see above! apk