Microsoft Blames Add-Ons For Browser Woes 307
darthcamaro writes "Running IE and been hacked? Don't blame Microsoft — at least that's what their security types are now arguing. 'One of the things we've seen in the last two years is that attackers aren't even going after the browser itself anymore,' Eric Lawrence, Security Program Manager on Microsoft's Internet Explorer team, said. 'The browser is becoming a harder target and there are many more browsers. So attackers are targeting add-ons.'
This kinda makes sense since whether you're running IE, Firefox, Safari or Chrome you could still be at risk if there is a vulnerability in Flash, PDF, QuickTime or another popular add-on. Or does it?"
Re:I've always said this. (Score:3, Informative)
I could make some analogy with sex and condoms, but I don't have the energy. So I'll just put it simply: technical problem -> technical solution. No excuses.
Re:I'll still blame you for everything else. (Score:5, Informative)
Re:Permissions (Score:3, Informative)
Somewhere along the line add-ons got way to much permissions. Why on earth does Adobe Flash have access to my webcam and harddrive?!?
Was there a time when plug-ins couldn't have access to the harddrive?
Re:Permissions (Score:5, Informative)
Konqueror runs flash elements and java applets in a separate process with low privileges and high niceness. When flash crashes, it does so by itself.
Re:Bullshit. Plain utter bullshit. (Score:2, Informative)
Many non-power-users don't use addons at all.
That's incorrect. Most of them install the add-ons without really knowing that they are doing, or don't unchecked the box that says "Install this tool bar you don't want" when installing software.
Re:Bullshit. Plain utter bullshit. (Score:3, Informative)
Yes, I'm still trying to figure out how to teach my Mom that she doesn't need EVERY toolbar in existence.
Re:Bullshit. Plain utter bullshit. (Score:3, Informative)
I think the article was not referring to addons in the sense that a geek thinks of them - adblock, firebug, noscript, etc.
Instead, they mean the biggies - acrobat, flash, quicktime. Most systems will have some or all of those installed.
Re:Permissions (Score:2, Informative)
Re:I've always said this. (Score:5, Informative)
This is bull. I'll make an analogy for you with sex and condoms, since you suggested it, and it is a fairly apt analogy.
Using the internet with a secure browser is like having sex with a condom. Using it with an insecure browser is like having sex without a condom. But in the end, condoms or no condoms, if you have sex with a person you know is carrying every kind of STD known to man (or is likely to be), you're the fool. And whether or not you use condoms, the best defense is being smart about your partners.
Of course you should use condoms, that's just prudence. But the first line of defense is knowing who you're having sex with.
And you'll note I said that the technical side of the issue shouldn't be ignored. The fact remains, though, that the most effective thing we can do is user training.
What about kde-gnash? (Score:5, Informative)
There are many sites that bring the whole system nearly to a halt when konqueror loads the page. Looking into the CPU usage with top shows that 99% of the CPU time is being used by kde-gnash. Doing a "killall kde-gnash" brings everything back to normal, with a grey square where the flash was.
You are right that konqueror does not crash the whole computer, but that's still very far from the desired result.
Re:Plugin model (Score:4, Informative)
Take a look at IE protected mode. Vista allows processes started by the user to run with different "integrity levels", effectively subdividing the user account into multiple ad-hoc roles while preserving the identity. IE protected mode is run in "low integrity" - where Vista on intrinsic level protects against modifications to the file system, registry, network access etc.
Every plugin is executed in the same process under the same restrictions. IE offers a standard broker process which can be requested when a file has been downloaded (into a protected cache) and needs to be moved to the user-selected download location. The browser process has very limited capabilities.
If a plugin needs more advanced access than what is provided by his broker process then it must install and invoke its own broker process, as the plugin itself runs under the restricted mode. Flash does this, circumventing the standard IE broker process. It was a bug in the Flash broker process (along with a Java vulnerability)which enabled a security researcher to execute a program on the Vista in the pwn2own contest.
Presumably Adobe will use the same approach on other browsers with a similar model such as Chrome. That is why the security researcher was adament that the Flash flaw could have been used against *any* of the OSes. Chrome actually *also* uses the Vista low integrity feature. Presumably Google will emulate this Vista feature by using separate accounts on other OS'es which do not have process integrity levels (or other role subdivisions of user accounts) as a standard feature. Chrome does use separate processes (in low-integrity mode) for each tab. That does not provide more security against a rouge process taking over the machine, but it does provide more robustness and protect the individual tabs against other tabs going rogue because of browser bugs.
First Hand Refutation (Score:2, Informative)
In any case, I didn't really care what sort of virus or malware or autodialer or rootkit or killprog or hypnotoad I picked up because it would steal my Fallout saved games and then be deleted along with the ntfs partition when I was done playing. However, out of curiosity I installed virus protection some days later and lo and behold within about four or five domains on a fully updated Vista and completely unmodified IE7 I had picked up something. Either a production install of Fallout gave me something, or it was IE. Sooo, no, MS. Go directly to jail, do not collect my license fee.
Re:Bullshit. Plain utter bullshit. (Score:3, Informative)
And there are plenty more who install the Yahoo and Google toolbars, plus whatever other crap comes up.
To be fair, those often get loaded by accident - as part of installing adobe reader, or java, or skype, or whatever, and of course its defaulted to install, so unless you read every page of the installation wizard, they get you.
Re:Permissions (Score:3, Informative)
>IE7 is set to run in sandbox mode by default.
I believe this is only on Vista.
Re:I'll still blame you for everything else. (Score:1, Informative)
no, IE remains bloated and sluggish compared to it's contemporaries. ie7 is slow compared to ff2. ie8 comes out and it's faster tha ff2 and things look promising. then ff3 comes out and is faster and quicker than ie8.
ff2 wasn't bloated and slow because at the time there was no better standard for comparison. in fact ff2 really was the standard.
ie is constantly behind the curve by almost a full lap. the little bit less than a full lap means that for a breif period each time around they look to be ahead, until the competition releases thier browser and then you realize that this newer ie release that was on top for a few months was really their equivalent to what everyone else had on the last generation (or maybe somewhere in between). but they are always behind the pack.
as to the interface...well i'm glad you have no troubles with it but my observations tell me you're in the minority. (let me fire up the ol' hp laptop for reference) the stop and refresh buttons being on the right side of the address bar irritates me. on occasion i'll type in example.co instead of example.com (or any typo really, you get the idea) now if the typo takes me to a typo squat domain there's a good chance i've got pop ups to fight while i'm madly moving the mouse pointer (with a touch pad) across the full width of my wide aspect ratio screen to hit the stop button and retry. plust once the bad url resolves it's entered into your browser history, which means i'ts forever in that drop down menu of suggestions you get when typing in a url. if i can stop the page load before it resolves by moving the pointer one inch to the left instead, things go a bit more easily.
this and not being able to close the last tab to close the browser. (opera doesn't do this either but you can at least close that last tab)
minor issues in and of themselves but when the otehr guys have them and you don't, and you haven't got anything they don't have it puts you behind the pack.
and alot of us are still bitter about how far back MS put all of browswer technology after winning the last browser war. imagine if these features were being conceived of and coded when machine resources were still an issue.
MS rarely puts out anything great. i understand they do have some excellent software products intended for production environments (never seen them but i've heard from people i beleive) but their browswer and OS, email client and that stuff aren't in that category. they're all anywhere from pretty good to total crap depending on the point of view and criteria forming the judgement.
you seem to find ie8 to be pretty good, not excellent i assume since you use opera mainly. which is cool. i find it to be pretty much crap because of the issues (minor to most i'm sure) i mentioned.
oh yeah, i really hate how the 'file edit view...' menu bar isn't there.
Re:Permissions (Score:4, Informative)
right because your typical business users would never say want to change the extention of some think like report.txt they get mailed to them from a host system to something like report.csv so they can open it in Excel. Stuff like the never happens....
Re:I'll still blame you for everything else. (Score:5, Informative)
IE7 is definately a standard-ignoring bastard. And assuming you're an FF advocate, remember it didnt pass Acid2 until FF3. And IE8 is shipping in a standard-complaint mode by default, which should help all browsers out.
Complaining that Firefox didn't pass Acid2 until v3 doesn't make a lot of sense if you understand why the test was made. No browsers adhere to all standards 100%, but all the browsers except IE do a fairly decent job of rendering pages the way they're supposed to. So when Acid2 was created, the idea (AFAIK) was to put together a complex rendering that would expose a selection of bugs that would cause every major browser to fail it. It was supposed to be a sort of test that said, "even if your browser is doing a pretty good job, here are some places where it might fall apart."
So it's not supposed to be the end-all be-all test of standards compliance. You can pass the Acid2 test but still not render normal pages properly, or you could generally do a good job rendering pages but fail the test. The fact that it took Firefox some time to pass isn't an indication that it took them a long time to figure it out, but rather that they fixed in in their new rendering engine and took a while to put that rendering engine into their release version of the browser. There wasn't much reason to rush because it wasn't terribly urgent.
But the question is still whether the browser will generally render pages according to the HTML and CSS standards. Most browsers do far better than IE. As for "standard-compliant mode", I still wonder how standard-compliant it will be. Right now, if I make a page, I generally have to design it to the standards, which will make it run in most browsers, and then figure out how to make it display properly in IE. If IE8 makes it so I don't have to do that anymore, a lot of my complaints will go away.
Re:I'll still blame you for everything else. (Score:3, Informative)
Definitely. Definitely!
The Acid tests are not an indicator of standards compliance. They're tests of flaws in web browsers that web developers want fixed. KHTML may have passed Acid2 first, but it had a lot of rendering flaws. When Gecko didn't pass Acid2, it had less flaws and was more standards compliant overall.
Have you checked the size of the installer files? Way larger than that of any other web browser.
Re:Permissions (Score:3, Informative)
I typical business user isn't ging to be storing "report.txt" in a protected system path. They are going to save it in My Documents or a subfolder, the default location presented by Vista.