Is The Firefox Honeymoon Over? 560
prostoalex writes "With Firefox market share reaching a substantial level, is the popular Internet browser becoming a security nightmare for IT administrators? George Ou takes a look at the hard numbers. From the article: 'From March 2005 to September 2005 10 vulnerabilities were published for Microsoft Internet Explorer, 40 for Mozilla Firefox. In April-September timespan there were 6 exploits for MSIE, 11 for Firefox. Conclusion? As you can see, the facade that Firefox is the cure to the Internet Explorer security blues is quickly fading. It just goes to prove that any popular software worth hacking that has security vulnerabilities will eventually have to deal with live working exploits. Firefox mostly managed to stay under the radar from hackers before April of 2005.'"
Re: Is the Firefox Honemoon Over? (Score:5, Insightful)
But the submitter is right. Though code security is important, the number of users is also a huge factor.
Cue someone to mention Apache.
Yes, Apache is everywhere, exploit-free. So are lots and lots of other binaries. It's only when you compare Apache to IIS 4/5 that it's really such a perfect example. Compare it to WinAMP, or Bash, or Finder, and its no more, no less secure.
Quality not Quantity (Score:5, Insightful)
1) The number of vulnerabilities reported has almost nothing to do with the number in the code. At most it dictates a minimum number that exist. Perhaps the firefox community is much more active at searching for bugs in the much newer firefox code.
3) How effective are the fixes? MS seems to have the same recurring problems because they only do triage. They don't fix the bigger problem (VERY poor browser design). The firefox team appears to address the bigger problem, not just stop the current bleeding.
2) How critical are these vulnerabilities. The article makes no mention of any ranking. He lumps everything into the same category. MANY of the IE bugs over the last 5 years have been SUPER critical, allowing remote access with little or no user intervention and no settings work around. Are the fire fox bugs the same?
3) Different organizations handle the vulnerabilities: MS and the Mozilla Foundation. MS is known to sit on bugs as long as possible. Perhaps the Firefox team is just being more responsive to the people looking for them.
Remember 99% of people that have cancer have eaten pickles. That doesn't tell you squat about the relationship of pickles and cancer.
IAAITG (I am a IT guy)
Apples to Apples (Score:5, Insightful)
As well, how many of these vulnerabilities/exploits were "critical" and how severely did they expose your computer to running unauthorized code vs. the MS ones? How much effort did it take to repair them? The last vulnerability I recall patching required making a minor change to my Firefox config by hand rather than patching or upgrading.
Because IE is so tied in not only to the OS, but to various Visual Studio API's, were Microsoft's vulnerabilities more far-reaching?
I'm no MS apologist, but I'm also not a Linux or OSS zealot. I like to use what works best for my needs and habits, which ends up being a mix of Closed Source and Open Source products. I don't want to be biased on one side or another, but I'd like to be sure that comparisons like this are apples to apples.
- Greg
Security isn't the only reason (Score:5, Insightful)
Slash Troll Alert (Score:5, Insightful)
These numbers (Score:4, Insightful)
What happens when IE Vista goes mainstream? (Score:3, Insightful)
Software Bugs (Score:0, Insightful)
Choice... (Score:5, Insightful)
If the Firefox web browser sucks, the average Joe can uninstall that web browser from a Windows box....
if IE sucks...
Re: Is the Firefox Honemoon Over? (Score:3, Insightful)
Short and simple (Score:5, Insightful)
2. How fast where patches/new versions deployed
3. How many days was the browser open to the exploit
And Finally
4. Total number of days browser was exploitable - IE vs Firefox
I bet you will find issues in IE that are not even patched yet, turnaround for more Firefox issues however? In most cases a solution within hours a patch within days.
How do I moderate the Orignial Poster (-5 Troll) (Score:2, Insightful)
What about the time to fix? (Score:2, Insightful)
Re:Quality not Quantity (Score:4, Insightful)
4) How many unfixed vulnerabilities are there. The one that comes to mind is ActiveX
Firefox's facade is still looking pretty good (Score:5, Insightful)
They should have separated vulnerabilities into classes then also taken into account the average time between discovery and fix and ease of patching. Anyone one of such a study?
Causality vs. Correlation (Score:5, Insightful)
AMEN! Your pickles example is a good reminder of the confusion many Americans have over causality vs. correlation.
Damned Lies and Statistics by Joel Best is an excellent primer in the dangers of poorly used and cited statistics. It's a must read:
http://www.amazon.com/exec/obidos/tg/detail/-/052
I seem to recall... (Score:1, Insightful)
Re: Is the Firefox Honemoon Over? (Score:5, Insightful)
Attacker is also better off with the open code (Score:2, Insightful)
Precisely. But why do you assume that once the bug is found, it will be fixed? If the bug is found by a malicisous pair of eyes, an exploit will be written instead.
Open source helps both the attackers and defenders, and thereore does not have an inherent advantage in security, in my opinion. Now, the formerly closed code that has leaked is indeed more vulnerable after the leak.
misleading (Score:3, Insightful)
Re:Quality not Quantity (Score:3, Insightful)
And perhaps not.
And perhaps MS IE is exposed to more scrutiny because it's #1 browser? And perhaps not.
As we can't tell for sure, it's best to ignore such speculations.
>3 (sic)) How effective are the fixes? MS seems to have the same recurring problems because they only do triage. They don't fix the bigger problem (VERY poor browser design). The firefox team appears to address the bigger problem, not just stop the current bleeding.
Gee!
And look at the most recent Firefox fix - it's a temp fix which only disables the insecure feature.
Not to mention that update alerts actually start blinking in your browser many days late.
I'm not defending MS IE, I'm just trying to point out that FF is pretty much the same. I use it a lot and it's got a bunch of problems - daily crashes, daily hangups with PDF files, frequent security problems and so on.
Originally it seemed a lot better. I still use it, but it doesn't seem that way any more - it's time to take a realistic look at it.
Re:Quality not Quantity (Score:3, Insightful)
Re:No Software is Perfect (Score:2, Insightful)
But this bizarre notion that you can measure a software's quality by bug reports is ridiculous. It's a meaningless number until put into context. Microsoft is well known for sitting on flaws for great lengths of time, so though in some given period Firefox might have twice or thrice the number of reported problems, IE might have that many or more unreported flaws. It's the same old story; there are lies, damn lies and then there are statistics. Reporters, unfortunately, seem a pretty lazy lot who don't actually have much interest in educating themselves or others, so they do easy things like count the flaws and report. They pack in a lot of words, and give it a sexy title a bang-o, they get a cut a check for their discerning journalism.
Strange... (Score:5, Insightful)
Now, is Firefox more secure? In theory it should be. Are the exploits in Firefox less problematic? Well, until hackers care to exploit it, who the heck really knows? I remember when Firefox pop-up blocking worked. Now, there are known methods to circumvent the technology...go figure...the folks who care have found new methods because Firefox was eating their lunch.
Now, I heard someone say that Apache is a model...what about all those worms that have been attacking, and defeating, Apache for the last 3 years (slapper, scalper, etc.)? Apache's only grace is that the developers move FAST when a new exploit is found. However, most attacks are not day zero attacks, which means that the vast majority of attacks are based on known, patched or patchable flaws.
So, it is incumbent on any admin to keep their systems up-to-date AND recognize that patch management is one of the key hallmarks of a secure system.
What does this mean for Firefox? Same patch management must be implemented for Firefox as should be in place for Exploder. Moreover, perimeter firewalls and intrusion detection systems must be in place and up-to-date themselves. And even with this diligence, per the CSI FBI Computer Crime & Security Survey 2005, 95% of Enterprises experienced system penetration and 55% were attacked by worms or viri.
Guess what? Software development methodology is not a panacea anymore than anything else.
Diligence, not arrogance, will protect your computing assets.
Re: Is the Firefox Honemoon Over? (Score:5, Insightful)
I don't really believe in this, but arguing like that is arguing against Firefox.
My personal opinion on these things is: People care way too much about browser religion. Let people use IE, not that much wrong with it. Both IE and Firefox are huge complex applications processing huge amounts of diverse untrusted data. Sure it'd be great if they were secure, but it is just not happening that way yet.
There might be some hope on the horizon with low-rights IE7. It might be that it really does manage to remove the impact of the bugs, which is really the best case scenario as things stand. If so we will no doubt see similar approaches integrated in Linux desktops and see Firefox refactored to use the same approach.
Re:Quality not Quantity (Score:3, Insightful)
I still use firefox of course!
Re:Losing my mod points to say this but... (Score:5, Insightful)
Really; are you in imminent danger of being modded down on Slashdot because you posted something negative about Microsoft and positive about Firefox?
Are you also worried about being flamed because you compress your music with ogg?
Do you live in fear of being outed to the slashdot community for creating documents in Open Office?
You're such a rebel.
[smile]
Re:Open Source Security (Score:3, Insightful)
They have been at it over ten years, and still new bugs keep coming. With more cash than some countries, there is no excuse for any new exploits by your logic.
1) Firefox is newer, it's code is less mature.
2) The entire world is privy to the source code of Firefox, the more exploits initially is good for open source. That means their getting fixed faster too.
3) What these 'known exploits' are, is people reviewing that code finding faults and reporting them. Since the code is readily available this makes it easier and quicker. This is a good thing. Closed source makes it harder to find the bugs, they tend to be found out by exploit, more often than review.
4) All bugs are not the same, a bug in an option is not the same as a bug in something that can't be turned off. Severity of the bug was compared here, as has been pointed out numerous time this is dumb.
5) Money is a reason to hide exploits and fix them only when absolutely necessary. When you donate time and effort freely, pride in your work provides the opposite motivation.
6) You can uninstall firefox and use something else, try that with IE.p
"From March 2005 to September 2005" (Score:3, Insightful)
I could go on with this, but for me, even these questions are more important, by a magnitude, than how many exploits were discovered.
Firefox is harder to manage than IE (Score:5, Insightful)
Looking at the wrong statistics (Score:5, Insightful)
What can I say? I pity the administrator that need "proof" to realize this.
Straight to the "Security 101" class you go, as you should have before getting a job.
Or if not having one, thank god for that.
As you can see, the facade that Firefox is the cure to the Internet Explorer security blues is quickly fading.
Here's the hard facts according to Secunia...
IE 6: 19 of 85 unpatched issues, the most severe classed Highly Critical.
Firefox 1.x: 3 of 22 unpatched issues, the most severe classed Less Critical.
Opera 8.x: 0 of 7 unpatched issues.
I don't know about you, but as long as a product is auto-updating (which the Firefox 1.5 beta and onwards indeed is, like IE 6, and unlike Opera 8), what does it matter how many exploits are found? Isn't it how many issues you're affected by that matters?
Yes, this was a problem with Firefox before 1.5 as you can't excuse having to manually upgrade your browser while monitoring security sites (at least not from the audience Firefox is targeting), and that's why I recommend people to upgrade to 1.5 ASAP. The minor instabilities still present from being in beta isn't as bad as missing out security fixes.
Re:No Software is Perfect (Score:5, Insightful)
annoying as it may be, it's still less annoying than the alternative
Re: Is the Firefox Honemoon Over? (Score:3, Insightful)
Not all vulnerabilities are created equal. As you assert, there doesn't seem to be (m)any people actually getting their system compromised from Firefox issues. Contrast that with IE, where we have seen numerous exploits in the wild which install malware, simply from the user visiting a web site. In large part, I believe this is due to IE's integration with the base operating systm.
Re: Is the Firefox Honemoon Over? (Score:5, Insightful)
If this is so it just leads to the question: Why should people use Firefox now then? Lets wait until 2010 when it will actually be better and stick to IE which is better now.
Except then Firefox will not get developed to as high a level as IE has and will never reach that point. Note that this observer has the same problem as most observers who say, "It's better!" And that problem is that the numbers aren't exactly fairly proportioned. An IE hack that gives someone access to all your 'net data then wipes your entire hard drive is counted as one bug, as is a firefox flaw that gives someone access to your last ten sites viewed. That's a biased and unfounded example, but the reality stands regardless - THIS IS NOT A GOOD WAY TO DO A SECURITY STUDY.
I don't really believe in this, but arguing like that is arguing against Firefox.
It is arguing against the further development of Firefox, too. No users, no development.
My personal opinion on these things is: People care way too much about browser religion. Let people use IE, not that much wrong with it.
There's piles of things wrong with IE, they're just not user-visible all the time and that is a main portion of the problem's gestalt.
Both IE and Firefox are huge complex applications processing huge amounts of diverse untrusted data. Sure it'd be great if they were secure, but it is just not happening that way yet.
You can lock Firefox down if you want. Won't be able to see EVERYTHING, but it will definitely be secure. Not quite anywhere near as true with IE.
There might be some hope on the horizon with low-rights IE7. It might be that it really does manage to remove the impact of the bugs, which is really the best case scenario as things stand.
You can do this in linux. Natively. Just make yourself a different user with no rights to do certain things. Try that in Windows and see if it works for you. As to the, "Microsoft will solve everything in the end" mentality, well, I can't really argue with that.
If so we will no doubt see similar approaches integrated in Linux desktops and see Firefox refactored to use the same approach.
You're looking at it the wrong way. Microsoft is behind and has been so for a very long time. The stuff you want is part of the problem with their occasional 'buy instead of implement' business model.
Proximo-what? (Score:4, Insightful)
Re:Quality not Quantity (Score:2, Insightful)
Red Herring Fish Sticks (Score:5, Insightful)
So they found more exploits to FF. FF is also newer. Does this mention the hundreds of IE exploits in the back catalog? Does this mention some of the fatal flaws that MS has not repaired since IE 5? I know because I have had to hack fixes for web apps in IE... never had to do it for Firefox. Read through MSDN and count all the bugs, then read through Bugzilla.
Any new product will have more flaws found per month than an existing product. This is common sense. The difference with FF is the turn around of the fixes. You could imply as much from the article. 40 down to 11. Notice how IE6 has the same amount still found (10 and 6 are alot closer than 40 and 11), and it is a product that has been on the market how long( 4 years [wikipedia.org])?
There is no news here, just FUD and a normal software lifecycle. This is perfectly normal.
Re: Is the Firefox Honemoon Over? (Score:2, Insightful)
Yes, IE pre-XPSP2 UI+security model of Yes by default and ActiveX definitely required vigilance; but today it's a function of user skill on both Firefox and IE to *not* be infected.
Someone here mentioned their users don't have problems with Firefox. Well, disabling ActiveX certainly helps. But if Firefox users visit RandomScreenSaver.tld and download with abandon (as many IE users do), compromising Firefox will be a piece of cake. And there is the gaping hole in Firefox's armor -- even many of its biggest boosters think nothing of installing unsigned extensions.
Btw, I'm not sure anyone who developed on Apache through the late 90s would call it 'exploit free' in the sense (say) vsftpd is exploit free. Apache's strength is cross-platform ubiquity and a rich plugin environment, not perf or security. I doubt any Apache dev would claim Apache to be unexploitable even today.
MOD ARTICLE REDUNDANT! (Score:3, Insightful)
I'd expect this kind of comments from a
In any case I already know the answer: "more bugs, but some less critical, and all patched in less time".
Or am I wrong?
Whaa...? (Score:3, Insightful)
missed the point... (Score:2, Insightful)
They totally miss the point.
First off, anybody who switched to firefox because they thought it (or any other browser) was "safer" than any IE is totally deluding themselves. The fact is the web is just a dangerous place to be, and no browser no matter how "bug-free" or "tested" can ever really protect you. If you are an idiot and go to phishing sites or places that give you spyware or whatever, you deserve what you get.
the reason to use firefox is because it is a BETTER browser. It's hard for me to overstate just how awesome tabbed browsing is, but that feature by itself convinced me. That, and it's 100% free.
what else do you really need?
so the bottom line is, all browsers are unsafe, pick the one that you can use most effectively.
For me, that's firefox.
misunderstood (Score:5, Insightful)
"the facade that Firefox is the cure to the Internet Explorer security blues [...]"
It's not a product specific issue. Diversity is the cure to monoculture security blues. The more mainstream a product becomes, the more malicious users will target it. And if it's the only game in town it might as well have a big bullseye pinned on it.
Re:Losing my mod points to say this but... (Score:3, Insightful)
J.
Re: Is the Firefox Honemoon Over? (Score:1, Insightful)
Except then Firefox will not get developed to as high a level as IE has and will never reach that point. Note that this observer has the same problem as most observers who say, "It's better!" And that problem is that the numbers aren't exactly fairly proportioned. An IE hack that gives someone access to all your 'net data then wipes your entire hard drive is counted as one bug, as is a firefox flaw that gives someone access to your last ten sites viewed. That's a biased and unfounded example, but the reality stands regardless - THIS IS NOT A GOOD WAY TO DO A SECURITY STUDY.
Right, I don't really buy this study either. I were just stating that if one says that Firefox is worse now one can't argue that people should switch. Also, sure, if people switch over in masses the development effort will go faster, but this was not really about what was best for Firefox, but what is best for the user now.
There's piles of things wrong with IE, they're just not user-visible all the time and that is a main portion of the problem's gestalt.
This is one that shows up over and over, that IE's basic design is flawed. Which is, as far as I can tell, unfounded. All the external interfaces and architecture seems clean and nice enough, and since I (and I would guess; you) have no way to look at the source I can't say that we have any reason to believe that the IE source is in a bad state.
You can lock Firefox down if you want. Won't be able to see EVERYTHING, but it will definitely be secure. Not quite anywhere near as true with IE.
This does not say anything meaningful, it is true that if one keeps removing things sooner or later one will have removed all bugs. The point is to have a working browser with as good security as possible.
You can do this in linux. Natively. Just make yourself a different user with no rights to do certain things. Try that in Windows and see if it works for you. As to the, "Microsoft will solve everything in the end" mentality, well, I can't really argue with that.
This one I am actually a bit tired of, but I'll go over what has impressed me with what Microsoft is doing for Vista and IE7:
This is not a process-level permission thing (which would wreck the way the application works, you need to be able to save files, change settings and so on for it to be a sane desktop application). Rather Microsoft is finally getting around leveraging and extending the rather advanced and fine-grained NT security model for something. The basic idea is that most of the application runs with very restricted permissions and can launch subcomponents like a download or settings panel that have a higher level of permission. This is set on a very fine-grained level. There is no need to have separate components, nor is it all-or-nothing, a component can have access to specific system calls according with specific parameters, they may change only some given parts of the registry and so on.
Now this is not new as such. It is however leveraging well-known and well-implemented security technology to make a desktop application simultaneously relativly locked down but still as usable as it would be running at full permissions in all parts. It is not limited to IE7 either but there is supposed to be new tools and libraries to make it easy to take advantage of for new applications. As I said, Linux will have this real quick if it works out nicely. There are better security models for Linux already implemented and running in specialized distributions, they would no doubt be brought into mainline is they appear useful.
You're looking at it the wrong way. Microsoft is behind and has been so for a very long time. The stuff you want is part of the problem with their occasional 'buy instead of implement' business model.
This I call bullshit, we don't know the actual state of the IE code but I can't say that I see any reason why it should be bad. What Microsoft did do
Something doesn't make sense (Score:4, Insightful)
There is no relationship between popularity and vulnerabilities in software. Period.
There may be a relationship between popularity and exploits in code (hackers targeting the biggest slice in the pie.) But this wasn't about exploits, it was about vulnerabilities.
More appropriately, there may be a relationship between the popularity of a codebase and the likelihood that any inherent vulnerabilities will be discovered. Whether this is good or bad for the users of the software depends entirely on whether any discovered vulnerabilities are fixed, or allowed to fester so that they can be exploited.
Re:Usability. (Score:3, Insightful)
Really? Firefox dramatically slows the de-hibernation procedure in my laptop if I happened to access the CNN page before sometime before hibernating.
Firefox Zealots are REALLY Sensitive! (Score:2, Insightful)
FF has problems, so does any software of any significant size. There's no need to be so defensive!
Firefox is definitely losing some momentum (Score:3, Insightful)
I think the real test will be to see what happens when the new version of Internet Explorer comes out in a few months. Is that going to steal back some of the lost market share or will firefox out-innovate it?
Re:Short and simple (Score:2, Insightful)
right, and the statistics are bad anyway (Score:5, Insightful)
exactly. and really, at the end of the day it's not just number of the exploits, is it? maybe firefox has 44 exploits, all of which are easily implemented by a supreme diety who speaks assembler like a native speakers, and which, once done, make the browser a little slower or the graphics render funny.
whereas there may be only 6 exploits for IE, but my dog can (and does) routinely use them, and every single one of the roots the box the browser's running on.
this is clearly exagerated a bit, but the simple *number* of exploits isn't too relevent
Re: Is the Firefox Honemoon Over? (Score:5, Insightful)
As for IE7, I haven't seen any features promised that Firefox doesn't already have. And I think Firefox is still more standards-compliant, which is a pretty big deal to me. Also, Microsoft's general attitude toward their web services has been contrary to the spirit of common standards with multiple implementations, and has almost always been some kind of maneuver to force a lock-in. They thought they had that with IE 4.0, which explains why they didn't really take the broswer any further until maybe now.
This presents a kind of moral argument for using Firefox over IE. It sounds ridiculous on the surface, and it would be in any kind of sane universe. But we have Microsoft.
Re: Is the Firefox Honemoon Over? (Score:5, Insightful)
Best for the user right now is probably Opera - noone is willing to pay for a browser so there aren't really that many people willing to mess around with writing viruses and crap for it. As to whether Firefox or IE is better, well... Hard to say. I'd have to sift through exactly what the holes found in Firefox were, but last time I read up in any detail on the security holes found in an Open Source project, I was pleasantly surprised to find that they were all holes in tertiary stuff... Linux server software (and this is not necessarily true of Firefox, I'm really going way out on a limb here, and it will take backup from someone who keeps completely on top of this to really help me out... hint hint...) has bugs and problems and security patches, yes, but they're for a minor exploit that crashes or allows someone in through highly obscure software. Microsoft, since it's all one big piece, ends up handing you the keys to the castle. Therefore, one Microsoft bug can be seen as an unequivocal disaster and twenty Linux bugs can be seen as a biteme.
This is one that shows up over and over, that IE's basic design is flawed. Which is, as far as I can tell, unfounded. All the external interfaces and architecture seems clean and nice enough, and since I (and I would guess; you) have no way to look at the source I can't say that we have any reason to believe that the IE source is in a bad state.
This is where I do have proof. All those security patches for IE? Yeah, design flaw. It's not an arms race to fight off the hackers at the gate because you wrote effective, stable software. It's an arms race to fight off the hackers at the gate because you wanted to lock Netscape and friends out of the browser industry by making ActiveX mildly attractive and highly proprietary / dangerous to work in due to its features which were promised but under-tested. Or badly designed. Take your pick.
This is not a process-level permission thing (which would wreck the way the application works, you need to be able to save files, change settings and so on for it to be a sane desktop application). Rather Microsoft is finally getting around leveraging and extending the rather advanced and fine-grained NT security model for something. The basic idea is that most of the application runs with very restricted permissions and can launch subcomponents like a download or settings panel that have a higher level of permission. This is set on a very fine-grained level. There is no need to have separate components, nor is it all-or-nothing, a component can have access to specific system calls according with specific parameters, they may change only some given parts of the registry and so on.
You mean like Unix? What an innovation!
This I call bullshit,
Microsoft has been behind in security design for over a decade. I was working in Unix, which is capable of doing the things you're calling revolutionary, when I was in junior high a full uhm.... Longer than I want to think about... ago. Everything is a file and files have - while not a perfect permissions system - at least something which is designed for multi-user and therefore easily modifiable to multi-permission. Call BS all you want, but M$ has a lot of spaghetti code in your computer....
I'm trying not to be biased here, but I obviously am very much so.
Re:What happens when IE Vista goes mainstream? (Score:2, Insightful)
Things like not giving services rediculous privileges is something that has been possible on *NIX for years. Also, sane defaults (ie, not creating everyone as an Administrator on setup) were also not just now discovered Microsoft. They just never were in Microsoft's interests (their customers didn't care) so they never bothered to implement them that way. Now that their home customers have realized that maybe security is a good idea, they are telling you everything you want to hear.
Re:Users or Superusers?? (Score:3, Insightful)
It's a matter of attitude matters most (Score:2, Insightful)
Re:No Software is Perfect (Score:2, Insightful)
Here's what you can do:
1. Upgrade to Firefox 1.5 Beta 1 (at least). Do a custom install and check the box for the "Quality Feedback Agent" (Talkback crash reporter).
2. If Firefox ever crashes, let Talkback send the crash reports to the server.
3. If you continue seeing lots of crashes, send me some Talkback IDs and I'll try to determine whether it's a known problem and whether there is a workaround by searching Bugzilla or examining the stack trace.
let's see... (Score:3, Insightful)
[Insert usual mantra of anyone being able to fix F/OSS but only MS being able to fix MSIE here] [Append snide remark about companies trying to hide rather than fix vulnerabilities here] [Insert random Zeeky Boogy Doog here]
I don't care what anyone says (Score:2, Insightful)
Re: Is the Firefox Honemoon Over? (Score:2, Insightful)
Congratulations - you've fitted your browser with a pair of rose-tinted glasses while it slept.
Doesn't this happen every couple months? (Score:3, Insightful)
I'm not going to reiterate the truth of the matter, because if you don't know it by now, you are probably one of the few who don't WANT to know.
Re: Is the Firefox Honemoon Over? (Score:3, Insightful)
Actually, at least one other [secunia.com] involves the possible exploitation of malicious code, although it requires active user input to do so.
But let's look at that one big famous doozie, the ActiveX [secunia.com] exploit. That was reported in August 2003 - that's over two years ago!! It requires no user intervention if ActiveX is enabled, can do just about anything it wants to and it affects any MS ActiveX enabled product that can read HTML. The only solution is to turn off ActiveX, or to get it to prompt the user before it installs anything (which is not guarantee of safety). This is far, far worse than any exploit Firefox has ever had!
But even if it wasn't so potentially disasterous, don't you think MS would have been interested in fixing something that involves their pride-and-joy, ActiveX?? How could anyone ever look at such incompetence and claim that IE is more secure?!
Does ActiveX support limited capabilities? (Score:3, Insightful)
Not everyone uses HTML as an interface to the masses - DHTML has proven itself to be a compelling application front end.
DHTML is scripted manipulation of the HTML DOM. It needs no custom ActiveX controls. AJAX as I know it is just DHTML + XMLHttpRequest.
I've been developing exclusively with IE & HTML & Binary Behaviours (a form of activex) with AJAX style architecture for more than six years because it's just so easy to turn out great looking apps.
Where were these apps deployed? On the Internet or on intranets? Unlike Java applets, ActiveX controls do not run in a sandbox by default, and they have full access to everything the user can read and write. Given that most users on Windows XP Home Edition still run as a user with administrative privileges, this can be and has been exploited as a major security hole for, say, adding spyware to a machine.
Given that the IE DOM is written in COM (something that Mozilla tipped their hat to with XPCom after the terrible architecture in netscape) does it not make sense to use activeX controls within IE? (ActiveX controls are COM components).
But does Mozilla Firefox allow random web pages to run arbitrary XPCOM controls with the user's full access rights?
Please explain why MIME types on file extensions are a bad idea?
Problem is that in certain circumstances, the Internet Explorer suite will ignore the Content-type provided by the server in favor of guessing a Content-type based on the last few characters of the URL. Not only does this behavior violate the RFCs that govern the Web and Internet e-mail, but authors of malicious programs for Windows have managed to exploit this misbehavior.