Forgot your password?
typodupeerror
Internet Explorer Government Microsoft Security IT

UK Gov't Says "No Evidence" IE Is Less Secure 342

Posted by timothy
from the maxwell-smart-elocution dept.
aliebrah writes "Lord Avebury tabled a parliamentary question in the UK regarding the security of Internet Explorer and whether the UK government would reconsider its use. He got an answer from the UK Home Office that's unlikely to please most Slashdot readers. The UK government contends that 'there is no evidence that moving from the latest fully patched versions of Internet Explorer to other browsers will make users more secure.'"
This discussion has been archived. No new comments can be posted.

UK Gov't Says "No Evidence" IE Is Less Secure

Comments Filter:
  • by toQDuj (806112) on Sunday January 31, 2010 @07:04AM (#30969250) Homepage Journal

    That's very likely true, as the stupidity of the user remains the weakest factor in security.

    • by MichaelSmith (789609) on Sunday January 31, 2010 @07:13AM (#30969282) Homepage Journal

      That's very likely true, as the stupidity of the user remains the weakest factor in security.

      And this is a constant in the UK Government?

      • by toQDuj (806112)

        I have no evidence for believing otherwise. OTOH, I do know there are (very) stupid people working in the government of the Netherlands, or so my friend working there indicates. IT savvy people perhaps don't try to get work at the UK government.

        • Re: (Score:3, Insightful)

          by jonbryce (703250)

          I don't know if they try to get work or not, but judging by the governments' computer systems, they certainly don't succeed.

          • Re: (Score:3, Informative)

            by xaxa (988988)

            The bit of government I work for (a non-departmental public body) still has Windows 2000 and IE6 on most desktops. Unfortunately, the budget for this organisation has remained static for over a decade -- if the next government is serious about increasing science spending (rather than just talking about it) then maybe the budget will be increased! But I doubt it.

            • Re: (Score:3, Interesting)

              by Maxo-Texas (864189)

              You know... one reason for this has to be the acquisition procedures.

              My company pays about $2,000 for desktops and laptops that I can buy at fry's for $490 to $700.

              As a result, it can take 90 to 120 days to get a laptop which we could buy directly the same day. I have two projects waiting on hardware as a result.

      • by Runaway1956 (1322357) on Sunday January 31, 2010 @07:57AM (#30969496) Homepage Journal

        This is the same UK government which thought that Windows for Subs was a good idea, right?

        http://www.theregister.co.uk/2009/01/15/royal_navy_email_virus_outage/ [theregister.co.uk]

        Royal Navy warships lose email in virus infection

                * Alert
                * Print

        Windows for Warships(TM) combat kit unaffected, says MoD

        By Lewis Page Get more from this author

        Posted in Malware, 15th January 2009 16:53 GMT

        Free whitepaper - What Exchange can't do - and Dell can

        The Ministry of Defence confirmed today that it has suffered virus infections which have shut down "a small number" of MoD systems, most notably including admin networks aboard Royal Navy warships.

        The Navy computers infected are the NavyStar (N*) system, based on a server cabinet and cable-networked PCs on each warship and used for purposes such as storekeeping, email and similar support functions. N* ship nets connect to wider networks by shore connection when vessels are in harbour and using satcomms when at sea.

        • by roscocoltran (1014187) on Sunday January 31, 2010 @08:17AM (#30969580)
          I loled at this fake, then I type "windows for warships" in google... We are living in a strange world.
          • Re: (Score:3, Insightful)

            by ibsteve2u (1184603)

            I lollled when I thought of Microsoft's having started offshoring back in 2004 [seattlepi.com]; the thought of Indian programmers writing code for their old colonial master's warships is...amusing.

            Of course, I also find the thought of having blind faith in the golden handcuffs of capitalism to be amusing.

          • Re: (Score:3, Funny)

            by mjwx (966435)

            I loled at this fake, then I type "windows for warships" in google... We are living in a strange world.

            Meanwhile, on a Royal Navy warship.

            [Captain] Leftenant, time to impact.
            [Officer] 15 seconds sir,
            [Officer] 13 seconds to impact sir,
            [Officer] 23 seconds sir,
            [Officer] 2 minutes?

      • Re: (Score:3, Insightful)

        by PopeRatzo (965947) *

        And this is a constant in the UK Government?

        And really, is this the kind of thing that the "Home Office" does in the UK?

        Y'all be weird over there.

    • by BikeHelmet (1437881) on Sunday January 31, 2010 @07:14AM (#30969284) Journal

      But the trend of users getting infected seems to indicate IE is worse. User stupidity hurts, but so do unpatched remote code execution flaws.

      Microsoft likes to tout how insecure other browsers and OS's are because they receive more security updates, but I'm not convinced. It's a poor measurement of security.

      There's no way to know how many landmine exploits are in IE. I consider Firefox more secure, because as its market share goes up, the number of ITW exploits doesn't seem to be exploding.

      • Re: (Score:2, Informative)

        by abigsmurf (919188)
        The majority of exploits nowadays attack plugins. Firefox is just as vulnerable to PDF exploits as IE is.

        There are also plenty of Firefox vulnerabilities out there, they just don't get national headlines like IE does. Here's a current one [theregister.co.uk].
        • Re: (Score:3, Interesting)

          by Shisha (145964)

          I'm very happy that majority of users use IE. This makes it still the most attractive target for hackers. In turn that means that they have less time to work on exploits for the browser I'm using. "Security through obscurity" works in this case (though of course the phrase comes originally from open source vs. closed source).

          • by palegray.net (1195047) <philip.paradis@pa l e gray.net> on Sunday January 31, 2010 @08:02AM (#30969520) Homepage Journal
            The fundamental issue here actually is "security through obscurity," although not in the context that you use it (instead, referring to the traditional context). With closed source software, you're at the mercy of the manufacturer when it comes to even getting an acknowledgment of security issues, let alone receiving fixes in a timely fashion or before damage is already done. Microsoft has a terrible track record in this department; more times than I can count I've become aware of a security issue they were alerted to weeks or months late.

            With Firefox, there is generally a very high degree of transparency when it comes to security problems. Additionally, fixes are pushed out quickly. Although Firefox continues to gain market share, the actual damage caused by exploits continues to remain quite low. That's certainly not the case with IE, and as long as it's closed source that won't change.
            • by Anonymous Brave Guy (457657) on Sunday January 31, 2010 @01:59PM (#30971710)

              With closed source software, you're at the mercy of the manufacturer when it comes to even getting an acknowledgment of security issues, let alone receiving fixes in a timely fashion or before damage is already done.

              This argument endlessly amuses me. Do you really think the exact same thing is not true of OSS-based browsers such as Firefox and Chrome?

              Hint #1: If you have not personally evaluated the source code of the browser you are using, nor employed a skilled specialist to do so for you, then you are just as dependent on other parties over whom you have no direct control to identify and patch security issues before the bad guys exploit them. The theoretical possibility that you can examine the source code is just security theatre unless you actually spend the time and resources to do it.

              Hint #2: Which OSS browser do you think has a public bug database listing all known vulnerabilities, whether or not they have yet been patched, and keeps that database updated immediately every time a new vulnerability is reported?

              With Firefox, there is generally a very high degree of transparency when it comes to security problems.

              Unless you are one of the select few with access to the full security issue process, you don't know that.

              Additionally, fixes are pushed out quickly.

              Or that.

              Although Firefox continues to gain market share, the actual damage caused by exploits continues to remain quite low. That's certainly not the case with IE, and as long as it's closed source that won't change.

              Or any of that.

              If you really don't see the blind spot you're exhibiting here, try answering these simple questions (and be honest with yourself):

              • When you bashed IE above, how many exploited vulnerabilities in the latest version of IE did you actually know about?
              • How many confirmed cases could you name where damage had been caused as a result of one of the exploits you just listed (if there were any)?
              • Did you know whether those vulnerabilities (if you could actually name any) had been patched, and if so, how quickly?
              • How would you answer the same questions for the latest versions of the major OSS-based browsers?

              If you can't immediately answer those questions, and provide yourself with objective, factual data to support your claims above, then please consider that you may just be projecting your own prejudices based on IE6 from many years ago onto the IE8 of today, while letting your own faith in OSS onto other browsers convince you that they are more secure even though you don't have access to all the facts.

              • by Anonymous Coward on Sunday January 31, 2010 @03:04PM (#30972386)

                Answers you won't listen to:

                When 20 other people have gone through a door and come back out again, I will assume that it's safe to walk through the door. Likewise though I may not have read all the code in Firefox, if there were any big problems, someone WOULD have seen it: Microsoft do not have half the world's web browser writers,

                How many people HAVE the latest version of IE? Now how many NEVER use flash or Adobe plugins? Because they require you turn off the security and then IE8 becomes vulnerable again. Did you know that?

                Google would have got dinged. Likewise, please do the same about Firefox. You've narrowed the window so small there's nothing left of the hole.

                And how would YOU answer?

                IE8 today has many or most of the downsides that IE6 has. Unless you lock it down so much you can't use it.

                But FF 3.5 when locked down as much is still usable. Putting it under LIDS makes it much safer. Adding RBAC from NSA makes it yet more secure.

                And still usable.

                You cannot say the same of IE and Windows.

              • Re: (Score:3, Interesting)

                by turbidostato (878842)

                " The theoretical possibility that you can examine the source code is just security theatre unless you actually spend the time and resources to do it."

                Except that both thory and History disproved that. Read about Bentham's panopticon.

              • Hint #1: If you have not personally evaluated the source code of the browser you are using, nor employed a skilled specialist to do so for you, then you are just as dependent on other parties over whom you have no direct control to identify and patch security issues before the bad guys exploit them.

                Speaking of tired old arguments, you lost all credibility right there. Thankfully, it was in the opening statement of your "rebuttal," so I don't feel too compelled to slog through a more lengthy reply.

                Suffice it to say there are a lot of eyes on Firefox, for both the code itself and for evaluating and testing exploits. This process occurs transparently; anyone can (and a crapload of people do) participate. This is absolutely the opposite of Microsoft's model, and no amount of denial or hand-waving on your part is going to change that.

          • "Security through obscurity" works in this case (though of course the phrase comes originally from open source vs. closed source).

            I believe that you are referring to "Security through lack of interest for malicious intent due to popularity or rarity", while the meaning of the phrase "Security through obscurity" would be clearer with the word obfuscation instead. But hey, then it wouldn't rhyme or be as memorable either.

        • Re: (Score:3, Informative)

          by cl!p (902247)

          There are also plenty of Firefox vulnerabilities out there, they just don't get national headlines like IE does. Here's a current one [theregister.co.uk].

          This is not a exploit in firefox. This is a vurnabillity in some IRC servers. The Freenode people agree [freenode.net]. They are moving to a new IRCd.

          • Re: (Score:3, Interesting)

            by abigsmurf (919188)
            It is ALSO an IRC server vuln. You can't tell me that starting up an IRC session without the user's knowledge is something that should be expected.
            • Re: (Score:2, Informative)

              by cl!p (902247)

              You can't tell me that starting up an IRC session without the user's knowledge is something that should be expected.

              Thats not what is happening. Firefox is just running a post request to a IRC server. The Irc server happely ignores all the http protocol headers and iterprets the data in the post request as a irc protocol data. So the only thing firefox is doing "wrong" is allowing a post request to a non-standard port.

        • by Anonymous Coward on Sunday January 31, 2010 @07:32AM (#30969378)

          The majority of exploits nowadays attack plugins. Firefox is just as vulnerable to PDF exploits as IE is.

          That most attacks come through plugins is exactly why Firefox is better than IE [mozilla.com]

        • Re: (Score:3, Interesting)

          The majority of exploits nowadays attack plugins. Firefox is just as vulnerable to PDF exploits as IE is.

          Speaking of the PDF weaknesses, are those inherent to the spec, or are they vulnerabilities that only show up in Adobe's implementation?

      • by Daengbo (523424) <daengbo AT gmail DOT com> on Sunday January 31, 2010 @07:25AM (#30969338) Homepage Journal

        I might actually believe that a fully patched IE8 is on par with other browsers, but the UK gov't will undoubtedly take the Home Office's decision to mean that IE6 is OK, too. That's scary.

      • by toQDuj (806112)

        Still, the user would have to browse to a malicious site. Perhaps the users who "choose" IE (or not choose at all and end up with the default browser), are the type of users more likely to browse to particular types of sites. Changing them to choose another browser, therefore, would not prevent them from browsing to sites with malicious code. This malicious code can then still be executed if it's a vulnerability in a plug-in instead of the browser.

        Now I think the browser should keep the plug-ins in check..

      • by hedwards (940851) on Sunday January 31, 2010 @09:33AM (#30969892)
        Well, there's a couple things going on there. Other vendors actually patch flaws rather than just adding them to the errata because they didn't feel like fixing them. Sure they don't fix all of them, but things which aren't fixed are far less likely to come back and bite the user or require changes to the code base which aren't reasonable on the current revision. But they do get fixed or some how addressed in future versions.

        The other thing is that other vendors actually acknowledge when there's a vulnerability which they can't patch post haste which makes it seem like they've got more bugs since they don't have a secret list of unpatched vulnerabilities. Nor do many of them have the option of dong so. Sunshine is the best disinfectant after all.
      • Re: (Score:3, Interesting)

        by Locutus (9039)
        there is ample evidence that flaws existed in MS IE for months, and sometimes years, and Microsoft knew about them and did not fix. That in itself throws out the idea that anyone outside of Microsoft has any clue as to how many flaws there have been or are. Hiding flaws does not mean they do not exist.

        On another note, there should be plenty of evidence of flaws and exploits which were in IE but not in Firefox, Opera, or even Safari. Things where IE has intimate knowledge with stuff like ActiveX, COM, their
    • Re: (Score:3, Interesting)

      by abigsmurf (919188)
      Except there is no evidence that a fully patched version of IE could be exploited. The bug was there but it was impossible to exploit with the default security settings.

      I notice Slashdot is quietly ignoring the IRC exploit currently in the wild for Firefox.
      • by toQDuj (806112)

        I have never seen anyone use a browser for IRC, so perhaps the impact of the bug is not very heavy.. But then again, I don't know what the current youth is into.

      • Re: (Score:3, Funny)

        by MrMr (219533)
        Let me give you the official microsoft reply:

        It is a feature

        If you ask for data to be transported via ftp, smb, irc, or whatever protocol you need, that's what firefox does. The fact that some IRC servers don't want large amounts of automatically generated data but still fail to block it is not a firefox bug.
      • Re: (Score:3, Insightful)

        by hedwards (940851)
        Somebody else already posted about that, and it's not a Firefox exploit, it's an IRC server exploit. The only thing that Firefox is doing that's possibly wrong is allowing one to post to a weird port. The server failing to properly interpret the packets coming to it is really not something that the Firefox devs can reasonably be expected to fix.
    • Thanks to the China exploit most IE versions out there execute arbitrary code just by visiting a web site. I don't think this is true for any other browser: e.g. when new vulnerabilities are discovered in Firefox they are patched quickly (Microsoft sits on bugs for months or years) and most user actually upgrade to the latest Fx version because they don't have to fear that a security upgrade will cripple their computer.
    • Re: (Score:3, Funny)

      by NoPane (1536723)
      It really doesn't matter what browser they use, they will still copy unencrypted data onto CDs and then put them in the post, send unencrypted emails to each other, leave laptops and memory sticks on the train or if that fails, stand in front of photographers with confidential information showing. The 'Chinese' (or whoever) really don't need to bother with browser attacks.
    • No, WRONG (Score:3, Informative)

      by omb (759389)
      1. This is the POLITICAL part of government and is as easily bought as ISO, maybe easier.

      2. Look at the record of UK Government IT projects.

      3. It is not IE that makes Windoze insecure, it is the OS and the design philosophy

      -- COM is a security disaster

      -- executing any vaguely executable rubbish based on its extension is a disaster

      4. Backward compatibility, and a zillion features that assume an essentially insecure and trusted
      world are a disaster. M$ has no way out.
    • Re: (Score:2, Interesting)

      by AftanGustur (7715)

      That's very likely true, as the stupidity of the user remains the weakest factor in security.

      While that may be true, that is the right answer to a different question.

      The original Question was:
      To ask Her Majesty’s Government what discussions they have had with the governments of France and Germany about security risks of using Internet Explorer; and whether they will encourage public sector users to use another web browser. [HL1420]

      The problem Google and others had was that they were not using "the latest and fully patched version of IE", but instead outdated but fully supported version

  • by Doviende (13523) on Sunday January 31, 2010 @07:08AM (#30969268) Homepage
    Sorry, how many users are actually using the latest fully patched version of IE? Google is still trying desperately to phase out IE 6, of which there are still many users. Perhaps as a "neutral" gesture to throw MS a bone, they could make an announcement saying "Upgrade to the latest IE8, or to another browser such as Firefox, Chrome, etc. Your current version of IE is probably ass^H^H^Hinsecure".
    • Microsoft is fine to go ahead and do things behind the users back but they won't force IE updates on people. If they would do this (and quit worrying about if they've pirated Windows before allowing them to get IE updates) then we would have fewer problems. For once can't they abuse their monopoly in a way that helps society?
  • *No* evidence? (Score:5, Insightful)

    by henrypijames (669281) on Sunday January 31, 2010 @07:09AM (#30969274) Homepage

    It's one thing to say there is insufficient evidence, but *no* evidence?!

    • Re: (Score:3, Insightful)

      by MrMr (219533)
      If you've personally handled the evidence I can see a way in which you could truthfully claim that.
      But I'm a cynic.
  • by Trepidity (597) <.delirium-slashdot. .at. .hackish.org.> on Sunday January 31, 2010 @07:15AM (#30969290)

    In UK governmental English, "to table" apparently means something like "to propose" or "to bring up for consideration", almost exactly the opposite of the U.S. meaning, which is "to withdraw from further consideration".

    I guess there's some international disagreement over whether this mythical table is where you put things to be considered, or where you put things to die. Perhaps to Britons, putting things on a table is officially proposing them, whereas to Americans, if it's on the table it's inert, and if you want it proposed, you had better have it in your hand waving it in someone's face.

    • Re: (Score:2, Informative)

      Think about King Arthur and the Knights of The Round Table. Obviously questions were brought to the table, asked, answered and debated. Nothing "inert" about it. I guess any part of the history of our ancestors prior to the discovery of America is not taught over there very much.
    • Re: (Score:3, Informative)

      by Tim C (15259)

      Perhaps to Britons, putting things on a table is officially proposing them

      Well I don't know for sure, but I'd always assumed that it was from "to bring something to the table", which is a fairly common expression here in the UK. (Think meeting room table, and bringing something with you for consideration (or perhaps even a dining table))

      • by Trepidity (597)

        Yeah, oddly, "to bring something to the table" is the same in US English. But "to table" something is the opposite--- to take it off the table, so to speak.

        • Think of "to table" something as setting it down in US English, as opposed to putting it up on the table in the UK. Context clues help to make it clear, and I have heard it used the "UK" way in the US. E.G. "Alright, lets table that, what else have you got?" - Lets set it down and move on; "Good idea Frank! However keep in mind if we (put this on the) table this now, we wont have time for your other presentation." - What are we about to look at or talk about?

      • Re: (Score:3, Informative)

        'To table' has colloquial meaning that might change from place to place. However in both the US and UK, when you are operating under Roberts Rules or a variant of it, an item (e.g. motion) is 'on the floor' when its being discussed. Passing a motion 'To table' it is to figuratively take it from the floor (where people on the floor are discussing it) and place it on the table (so we don't forget it). A motion to take it from the table is a motion to bring it back to the floor for discussion. Sometimes the 't

    • by gigne (990887) on Sunday January 31, 2010 @07:37AM (#30969400) Homepage Journal

      Yes, indeed you are correct.

      UK: To place an item on the agenda for discussion.
      US: To remove the item from consideration.

      In the UK we shelve discussion items when they are removed from consideration.

    • Re: (Score:2, Interesting)

      by Anonymous Coward

      Other countries don't play poker, apparently -- but even in that game winning is accomplished by putting card on the table and demonstrating which card one has.

      I think American English use is misguided.

      But then, I'm biased, I think the entire English language is braindamaged.

  • by Manip (656104) on Sunday January 31, 2010 @07:33AM (#30969390)

    A fully patched IE8 running on either Vista or Windows 7 is far safer than Firefox. Why?
      - Low privileged mode. IE8 runs with lower rights than the logged in user, Firefox doesn't...
      - DEP is turned on for IE8 by default. Firefox has to be added (or the "all applications" option).
      - IE8 patches can be deployed from the Domain very easily. Firefox on a corporate network is a pain in the butt...

    Now I entirely grant that this is Microsoft's browser running on Microsoft's OS and thus it gains unfair advantages but that doesn't change the facts or reality of the situation.

    • Re: (Score:3, Informative)

      by Anonymous Coward

      There are currently 23 unpatched advisories for IE 6.x http://secunia.com/advisories/product/11/
      There are currently 10 unpatched advisories for IE 7.x http://secunia.com/advisories/product/11/
      There are currently 3 unpatched advisories for IE 8.x http://secunia.com/advisories/product/11/

      Advisories often contain multiple vulnerabilities. Doing a little quick math, that comes out to around 59 vulnerabilities (not an exact number, just a ballpark estimate) for those 3 versions of IE

      This is compared to 0 unpatc

  • by noidentity (188756) on Sunday January 31, 2010 @07:42AM (#30969416)
    They just need grow suspicious of IE harboring WMDs. Then the lack of evidence wouldn't be a problem at all.
  • What would the cubicle spooks at the UK Government Communications Headquarters do without MS?
    They would have to learn to hack real operating systems and would have messy logs to correct everytime.
    No more UFO hunters with perl scripts.
    Forward intelligence teams and community policing with their 'sneak and peek' anti gang, eco and domestic terrorist operations.
    All the ex spooks selling back MS cracks, ip loggers, websites, tools with polished gui's at dreamy consulting fees.
    Then you have the bureaucrat
  • by guyminuslife (1349809) on Sunday January 31, 2010 @07:47AM (#30969444)

    The latest patched version of Internet Explorer fixed the bugs that Microsoft found. The latest patched version of other browsers fixed the bugs that other browser-manufacturers found. Ergo, there is no evidence that the latest patched version of Internet Explorer are less secure, since the officially "known" security features have been fixed.

    In fact, there's no evidence that there are any bugs at all in the latest patched versions of any software ever written, unless the manufacturers have explicitly stated that there are. In which case, in order for policymakers to accept such a report, they would need to prove that this is the case, by lobbying the government to the effect that their software is inferior.

    • Re: (Score:2, Informative)

      by Anonymous Coward

      Please forgive me if I'm wrong but I was under the impression Microsoft had know about this latest flaw for several months, but had deemed it not important enough to fix, so there IS evidence that they do not immediately fix all know security holes.

  • by Jane Q. Public (1010737) on Sunday January 31, 2010 @08:01AM (#30969516)
    I don't know why it would "not please" Slashdot readers. I am very pleased. That is the funniest thing I've read all week.

    Nothing like a good laugh to start your morning.
  • by Joce640k (829181) on Sunday January 31, 2010 @08:07AM (#30969536) Homepage

    Are these the same people who said IRAQ was full of WMDs and terrorists?

  • by lattyware (934246) <gareth@lattyware.co.uk> on Sunday January 31, 2010 @08:10AM (#30969550) Homepage Journal
    I fucking hate our government. Seriously. They just all appear compeltely incompetent.
    • Re:This is why... (Score:4, Insightful)

      by malkavian (9512) on Sunday January 31, 2010 @08:23AM (#30969614) Homepage

      Probably because they are.
      By "insufficient evidence" they usually mean "we've not heard enough to convince us". Which means "Someone was telling us stuff, but we don't really understand the field that they were trying to explain about. Instead of trying to understand the stuff we don't understand, we prefer to play nice with the money, because that tells us it's all good.".
      The prime qualifications in Labour are history, classics, and a few Lawyers, advertising and marketing. Not really anyone with any solid scientific skills.
      So, rather than work out the hard stuff, and make scientific dispassionate decisions which will make the country stronger and genuinely safer, they prefer to use rhetoric and assume that things work by fiat (we say the world works that way, ergo it does, because we say, which is why it lost pretty much the core of its drugs advisory group because the scientific advice of some highly qualified and internationally renowned people was completely ignored, and the opposite decision was made as policy, AND the politician hounded the scientist for not backing him up and twisting scientific results to fit into what he wanted things to be like).
      I don't trust 'em as far as I can spit 'em. They need to understand scientific method, not empty rhetoric.

  • Missing the point (Score:5, Insightful)

    by sparky81 (1309369) on Sunday January 31, 2010 @08:27AM (#30969620)
    "The reason for this statement by the UK government is very simple - it has intranet and business systems in virtually every government department which work only with IE. They frequently ridiculously old versions at that - IE6 take a bow - giving the lie to the "latest, fully patched" comment anyway. There is no way that the UK government is going to incur the conversion costs for these systems at this moment given the state of its books at the moment. Stating that IE was insecure would create an inexorable pressure to do exactly that. This statement has nothing to with security, and everything to do with internal government politics.
    • by M-RES (653754) on Sunday January 31, 2010 @08:45AM (#30969678)

      I was going to mention this very issue and you beat me to it. I know people who work in local government, both as 'users' of the in-house systems and 'sysadmins' on those same systems, and they all tell me how outdated their setups are. They're by and large using IE6 across the board, because the browser-based apps they use work in IE6 and if there's the slightest glitch in updating the browser they won't touch it - they just don't have the budget to deal with the issue and test it rolled out across such huge networks.

      If it doesn't work someone would have to take the blame and we all know how civil servants do everything they can to avoid having any responsibility whatsoever for any decisions, hence the 'committee'. The committee provides plausible deniability wherein any single member can say "I didn't agree with the decision, but the committee decided...".

      Welcome to the cosy sheltered world of civil service. People who work there genuinely couldn't survive in the 'real world' of private business/industry!

  • by DaveGod (703167) on Sunday January 31, 2010 @08:39AM (#30969646)

    The quote bears no reflection of any opinion on the security or quality of IE in general. The "user" being referred to in the quote is UK government staff, using UK government IT, and his response is wholly within that context. As is very often the case on Slashdot (and, to be fair, much of the media), the summary shifts the context slightly and then omits significant information and thus infers something other than what was communicated at the time.

    Immediately after the quoted text, unmissable except by the most... Let's give the benefit of the doubt and say hurried of submitters and editors, is the following: (my emphasis added for the most hurried of Slashdot readers)

    26 Jan 2010 : Column WA317

    Microsoft issued a patch to fix the recent Internet Explorer vulnerability on 21 January. Prior to this, government departments had been issued with a GovCertUK alert on how to deal with this particular incident and to mitigate vulnerabilities in relation to particular versions of IE.

    A government user, operating on government systems, such as the Government Secure Intranet (GSi), will benefit from additional security measures, unlikely to be available to the average home computer user. These include tools which actively monitor for evidence of any malicious attacks.

  • by bl8n8r (649187) on Sunday January 31, 2010 @08:51AM (#30969700)

    only need to google it for chrissakes:
        IE ~ 1200: http://www.google.com/#hl=en&q= [google.com]"internet+explorer"+site%3Awww.us-cert.gov
        Firefox ~ 800: http://www.google.com/#hl=en&q= [google.com]"firefox"+site%3Awww.us-cert.gov

  • by cvtan (752695) on Sunday January 31, 2010 @09:04AM (#30969770)
    Evidence was gathered on a Tuesday.
  • I could believe that (Score:3, Interesting)

    by RobertLTux (260313) <robert&laurencemartin,org> on Sunday January 31, 2010 @09:45AM (#30969950)

    "there is no evidence that moving from the latest fully patched versions of Internet Explorer to other browsers will make users more secure."

    So if you have Windows 7 with all patches and MSIE 8 with all patches
    INCLUDING NONPUBLIC MICROSOFT INTERNAL PATCHES (to fix bugs not patched for yet)
    then yes you could be just as safe as if you had another browser.

    But what are the chances that somebody will be able to get all the patches without getting tagged?

  • by DrXym (126579) on Sunday January 31, 2010 @10:27AM (#30970176)
    In a monoculture the attack surface is large since everyone is using the same code and therefore vulnerable to the same bugs. Just moving users onto a mix of other browsers lowers the attack surface even if each individual browser has its own fair share of bugs.
  • by jc42 (318812) on Sunday January 31, 2010 @11:04AM (#30970406) Homepage Journal

    What I notice is that the headline and most of the discussion here talk about the security of "IE", while the Home Office said "the latest fully patched versions of Internet Explorer". There seems to be little understanding that these aren't synonyms.

    But does anyone here work for an organization of any sort (government, industry, academia, whatever) that requires that everyone use "the latest fully patched versions of Internet Explorer"?

    In all the cases that I know of, when there's such standardization, it's for releases that existed shortly before the standard was established. It's now years later, and the standard is still in place (though often violated by workers who want better security or more features).

    A number of people have written about organizations that are still standardized on IE6 and don't permit upgrades to IE8. Is there any data available on how widespread this might be? In my experience, such data is hard to come by, since both governments and private corporations tend to be secretive about their inner workings.

    So could the Home Office be pushing for upgrades to W7+IE8? Nah; I thought not.

  • by unity100 (970058) on Sunday January 31, 2010 @11:35AM (#30970592) Homepage Journal

    matters like these. with their paranoid attention to detail, psychopathic inclination to procedure, and ungodly patience with working on intricate technical details, any word from germans in that area would trample any word from britain at any point for me.

    the fact that u.k. government has been shitting and screwing up in every other field for the last 10 years does not help either.

  • Define "prove" (Score:3, Insightful)

    by CAIMLAS (41445) on Sunday January 31, 2010 @01:06PM (#30971280) Homepage

    The level/degree of proof the UK government seems to be requiring for this is the 'scientific' type. For most things in life, statistical analysis tends to be enough.

    What this guy said is akin to saying that North Korea has the strongest army in the world, because there's no proof to the contrary.

    Pick any of these:

    1) Lackluster/no security features.
    2) Lack of improvement over the years. One of the cardinal rules for security is continual improvement.
    3) Repeated exploit of said piece of crap.
    4) Microsoft itself more-or-less admitting it's insecure and unrepairable - they effectively abandoned it years ago.
    5) Anecdotal evidence from tens of thousands of computer repair types; I guarantee you IE is the vector for 9 out of 10 malware infections, and most of those are probably IE.

    I'd wager they've been paid off. Anyone with even the slightest amount of intellect can look at the information available and determine that IE6 is rubbish. It's a hell of a lot less proof than most governmental bodies act - often, said bodies act in direct contradiction to the facts for the purpose of special interests money.

Machines certainly can solve problems, store information, correlate, and play games -- but not with pleasure. -- Leo Rosten

Working...