IE 9 Beats Other Browsers at Blocking Malicious Content 235
Orome1 writes with an article in Net Security. From the article: "Microsoft's Internet Explorer 9 has proved once again to be the best choice when it comes to catching attacks aimed at making the user download Web-based malware. This claim was made by NSS Labs in the recently released results (PDF) of a test conducted globally from May 27 through June 10 of the current year, which saw five of the most popular Web browsers pitted against each other. Windows Internet Explorer 9, Google Chrome 12, Mozilla Firefox 4, Apple Safari 5, and Opera 11 were tested with 1,188 malicious URLs — links that lead to a download that delivers a malicious payload or to a website hosting malware links."
I still think... (Score:2)
Lynx is safer still. Some of the browsers for Emacs are fairly secure, too.
Re: (Score:3)
How secure can Emacs be with all that malicious Lisp code floating around?
Re: (Score:2)
Re: (Score:2)
I am the psychotherapist. Please, describe your problems. Each time
you are finished talking, type RET twice.
How secure can Emacs be with all that malicious Lisp code floating around?
Are you sure malicious lisp code floating around?
Re: (Score:2)
While Lynx is probably very secure right now, it has seen a security hole or two: https://secunia.com/advisories/product/5883/?task=advisories [secunia.com]
Just because it is a text browser with very little features doesn't necessarily make it safe, although the chances for a vulnerability are lower under the *same* conditions.
Nice try (Score:2)
I almost believed this story, then, with my superior intelligence (as shown by my browser, Opera) I realized that this story is probably pulled out someone's ass.
Re: (Score:3)
Nice reference :)
Re:Nice try (Score:5, Insightful)
If by "pulled out of someone's ass" you mean "they engineered the test to perform best with Internet Explorer 9", then completely.
The main center-point of this test was evaluating a "cloud based trust ranking algorithm". But the study provides no evidence that these algorithmns exist in any of the browsers; its a simple assumption which is likely false (especially when you look at the graphs). What the graphs are really showing is the performance of each browser's black list versus a set of URLs they selected, and not randomly.
If you look at the graphs themselves, they actually don't show the action of any algorithm (which would likely linearly increase or show volatility); in fact, IE9 (With App Rep) is simply a straight line. It's pretty clear that the URLs they used were already in the black list before hand, and that straight line is a continual rejection of them.
Testing a browsers ability to 'blacklist' websites is fine, I guess, but my first problem with this study is that's not the only way to measure 'security'. My second problem is that there's no evidence that the browsers themselves actually perform this activity, making the tests in the study feel like "studying the maximum (flying) climb speed of humans, rats, horses, and bats". My third - and the most troubling - problem is that they don't provide any information as to how these lists were obtained. They only say they tried to "mix URLs so as to make sure that certain domains were not overemphasized", and "NSS Labs operates its own network of spam traps and honeypots.", in addition to "In addition, NSS Labs maintains relationships with other independent security researchers, networks, and security companies,".You can assume without being overly bold that this list could have been a list of URLs that they knew IE would block. Conversely, you could probably easily design a similar test that would have Chrome at 100% block rate, and IE 9 at 10% - it's merely a measure of "what sites were in our test pool that are also in the browser's black list"
Pffft.
Re: (Score:2)
If by "pulled out of someone's ass" you mean "they engineered the test to perform best with Internet Explorer 9", then completely.
Studies have shown that random detritus pulled out of someone's ass performs best on IE9!
Re: (Score:2)
but my first problem with this study is that's not the only way to measure 'security'.
Exactly correct. Indeed, if you read the first footnote of the report, you will see,
Note: This study does not evaluate browser security related to vulnerabilities in plug-ins or the browsers themselves.
The study does not evaluate the security of the browsers themselves.
Re: (Score:2)
I almost believed this story, then, with my superior intelligence (as shown by my browser, Opera) I realized that this story is probably pulled out someone's ass.
Someone with superior intelligence probably would've remembered the correlation between browser usage and IQ was shown to be an elaborate hoax [digitaljournal.com].
(Yes I know you weren't being serious, but feel free to "whoosh" anyway)
If you block everything, your score is 100% (Score:5, Insightful)
MSIE got the highest "malware detection rate" because they used it in a mode where nearly every page is marked as "dangerous". It had the highest detection rate but also the highest false positive rate.
If I sit at the airport saying "that plane is going to crash" for every plane that takes off, and eventually get it right, that doesn't mean I'm able to predict which planes are going to crash (even though I got "100% of the crashes" right)...
Re: (Score:2, Informative)
Finally! A legitimate complaint about the study. I was beginning to doubt we could do anything other than beat our chests and say "MS BAD!" Kudos to you!
Re: (Score:2)
Re: (Score:2)
If I sit at the airport saying "that plane is going to crash" for every plane that takes off, and eventually get it right, that doesn't mean I'm able to predict which planes are going to crash (even though I got "100% of the crashes" right)...
I don't think you'll be allowed to sit there long enough to make your scenario statistically likely.
As a matter of fact, I doubt you'll get the chance to observe more than one plane taking off.
Is it safer than FF + NoScript + GNU/Linux? (Score:2)
Is IE9 safer than Firefox + NoScript running on a non-Windows operating system that's less targeted by malware authors?
Re: (Score:2)
it appears there is no testing against non-malware links done
Somewhere near the end they mention that they tried some popular sites (Amazon, Microsoft, Yahoo, Google ...) to see if they weren't accidentally blocked.
"Surprisingly", no browser failed :)
NSS Labs: The best studies money can buy (Score:5, Insightful)
Of course, when your methodology is that only the bare browser configuration is allowed (e.g., no AdBlockPlus, no NoScript) and you carefully select the malware URLs (obtained from "honey pot" email addresses and then filtered, and then "prune out non-conforming URLs" -- without fully specifying what made them non-conforming) *and* require the malware URLs to be live for at least 6 consecutive hours it gets a lot easier to massage the results. To further exaggerate results not only does a "hit" increase the score but a "miss" decreases it to magnify the difference.
This is the same song as they sang about IE8 with the same, predictable, results. Microsoft didn't pay them a wad of money for this study for nothing.
Re: (Score:3)
Re:NSS Labs: The best studies money can buy (Score:4, Interesting)
Re: (Score:2)
I don't care about them; I care about how secure my browser is, and my friends' and parents' browsers, which I've configured similarly to mine. As far as I'm concerned, even if the virus gets as far as downloading its executable, just as long as MSE stops it when they try to launch it I consider that a successfully thwarted attack.
Re: (Score:2)
I don't care about them; I care about how secure my browser is...
Actually, I do care about them, but they aren't really relevant. Someone who doesn't know about extensions is not going to be reading studies about browser safety.
The study should consider the audience. Anyone digging for information about browser security is going to know about noscript.
Even if noscript wasn't one of the most commonly installed browser addon, an article about browser security should certainly discuss it. The .pdf with the results is 21 pages long, and doesn't even mention noscript, yet
Re: (Score:2)
Ah, so you ignore the rest of their methodology because it was clearly indefensible?
If the study was really aimed at identifying browser security then a NoScript enabled browser *should* be part of the test. It would illustrate the difference between not using NoScript and using NoScript. It would illustrate the difference between IE9 and FF with NoScript. There are two problems with that:
1. Due to their mechanism for grossly exaggerating minute variations, it would sink IE9 as being the run away favorite.
Re: (Score:2)
Re: (Score:2)
Since people don't tend to read the article (much less the NSS Lab's purchased findings that were mislabelled as a study)
So did you read the study? Did you come across the following section?
This report was produced as part of NSS Labs’ independent testing information services.
Leading vendors were invited to participate fully at no cost, and NSS Labs received no
vendor funding to produce this report.
Actually, this is a running study, so it also reflects the speed by which the browser vendors update their respective reputation databases. Some 85 new urls were entered on average each day (after being confirmed as malware-serving urls) throughout the quarter. NSS releases these results each quarter.
Re: (Score:2)
Your average luser isn't going to know about ABP or NS.
Try again.
Re: (Score:2)
How do you know MS paid for this?
Re: (Score:2)
when your methodology is that only the bare browser configuration is allowed (e.g., no AdBlockPlus, no NoScript)...
... then you're doing it right. If Mozilla wants the benefit of extensions for studies, then merge them into the trunk. Because right now, neither ABP nor NoScript are part of Firefox. There's no reason that something testing Firefox should test those.
Re: (Score:2)
Fair enough, but can we then stop bitching about upgrades breaking add-ons?
Either add-ons are a critical feature of Firefox and deserve consideration in such a report, or they're not, and in that case their non-presence can't be a criticism. /. can't have it both ways!
Re: (Score:2)
It's fine with me, the only extension I use is Firebug, which incidentally is also terrible for benchmarks.
This being said, in the past we've seen speed benchmarks showing Firefox out front, with everyone here complaining about memory leaks. At that point I was advocating running the benchmarks with the top 5 or so extensions installed since virtually no-one on Slashdot runs vanilla Firefox. Those results would probably be more illustrative about how "power users" run Firefox (and would decrease or eliminat
Yeah.... no. (Score:2)
IE's idiot mode where it tells you "I'm sorry, Dave, I'm afraid I can't do that" might be better at keeping users off bad websites than other browsers, okay.
Give me a study that shows the actual infection rate once you've visited the site; I'm betting that the scores would look different then.
IE 9 does not work with XP (Score:2)
It has to be (Score:2)
Well IE9 HAS to be the best at "catching attacks aimed at making the user download Web-based malware".
That's because only the most stupid web user (read: the most stupid 50%) click banners which go "OMG YOU MUST MAKE YOU COMPUTER FAST AND NOT HAVE VIRUZES NAO!". And yes...they are using Internet Explorer, because quite frankly, they aren't smart enough to spot that Chrome/Firefox are better than IE.
FF4 - How unfair! (Score:4, Insightful)
Yet again another M$ sponsored study makes IE look better by using an ancient version of Firefox. FF4 is like way out of date. How dare they make such claims.
Re: (Score:2)
LOL. Another one in a slippery rope of drawbacks to version inflation death: Even the studies that are supposed to praise you cannot honestly keep.
FF6 was officially released *today*, making the results look ancient because we still expect a major number to last a full year or two for FF. Sadly, I couldn't find much web feedback of this "brand new" version in my native language (a nice way to avoid all the shills and paid reviewers so deeply ingrained in the English-US blogosphere). Zero feedback means I'd
Re: (Score:2)
Malware/phishing protection in Firefox has been essentially unchanged since Firefox 2 received code to do this from Google using their SafeBrowsing service, and Firefox 3.5, 4, 5, 6, 7 and 8 will behave identical, the performance being determined by the Google service.
I don't know of any active efforts inside Mozilla or by the community at large to improve it.
Re: (Score:2)
then again its testing chrome 12 too (hint: its very old) and IE10 is around the corner. you were saying?
Re: (Score:2)
There are a lot of problems with the study such as a small sample size, cherry-picking malware that IE does well against, lack of peer review, complete denial of the existence of layered security in the form of extensions or sandboxing, the complete lack of credibility of NSS labs, and the fact that Microsoft paid for the study. The versions used are not one of those problems. FF4 and Chrome 12 were the current releases at the time they tested the browsers. FF4 actually came out a few days after IE9. It's j
What, 4 days out of date? (Score:2)
Ok I jest but seriously, FF 4 was current until about a month and a half ago. That a study was using it is unsurprising, it probably was current when they set up the study.
Why the other browsers won't get IE's score (Score:3)
1) The false positive rate of IE is very high. It should be obvious that if you give a lot of false warnings, users will disable or ignore the feature, making it worthless. IE already warns if you download something uncommon, for crying out loud.
2) This "cloud based protection", tracking, among other things, popular downloads, means that info about visited URLs gets sent to Microsoft. There are privacy issues with such a system.
Well duh (Score:2)
Browser versions??? (Score:2)
The choice is quite interesting ... Opera 11 dates back to 16.12.2010 and Safari 5 to 17.6.2010.
Mozilla Firefox v4 entered the "end of life" on May 25, 2011.
Chrome 12 dates back to 07.06.2011, but that's v12.0.742.
Without proper version numbers all those tests are at least dubious.
Re: (Score:3)
They tried to use recent version numbers but Firefox wasn't willing to tell them which version it was and Chrome had the time to go up three major versions by the time their download was done.
Re: (Score:2)
That's wonderful but... (Score:2)
Why is this so hard to believe? (Score:2)
If Google Chrome was found to be the best at blocking malicious content, no one would doubt this study.
There is no reason why Microsoft can't have the safest browser on the market. If the Microsoft was smart, they would invest heavily in security to undo the years of damage IE6 caused to its reputation.
This still could be a flawed study, but people shouldn't be so quick to judge just because Microsoft is the winner.
OMG its fake! (Score:2)
Forget that these tests are repeatable, and can be independently conducted and verified most of the "OMG M$ SPONSORED MICROSOFT FAKE STUDY = ADVERT" crowd ignores this fact.
How do you know how much M$ paid these people, anyways? Prove it. Like, with pictures. Better yet, maybe some shredded invoice numbers and accounting figures from M$ headquarters trash dumpsters? Seriously some of these claims are so
Re: (Score:3)
What scientific method? There's no science in this "report." It's pure pseudoscience. The results are not repeatable, the data is not available for independent analysys, there are huge methodology flaws, etc.
Except they can't. Do you work for NSS Labs? They have a history of astroturfing and lies in public.
Once upon a time (Score:2)
There was a time when a headline like this never would have made the front page of slashdot. It's because of this kind of thing that I only come back to slashdot on the rare occasion that I have run out of other things to read on the internet. And what's this? Addthis.com showing up in noscript? Please, bring back the quality!
Unfortunate choice of words... (Score:2)
"Microsoft's Internet Explorer 9 has proved once again to be the best choice when it comes to catching attacks..."
Is that "Catching" like "Aha! I caught that wascawy wabbit" or is it "Catch" like "If I connect this PC to the internet for a couple minutes without loads of anti-virus protection and a beefy firewall, IE will catch something really nasty..." or even "Catch" like "A filter on a drain, a low place where nasty things tend to accumulate...". Because inquiring minds want to know!.
This isn't to say
FF with AdBlock NoScript installed or without? (Score:2)
Important question.
FireFox is a platform where we have these things called addons.
NoScript prompts you before running any piece of Javascript, classified by the site it came from.
Who paid? (Score:5, Interesting)
This report was produced as part of NSS Labs’ independent testing information services.
Leading vendors were invited to participate fully at no cost, and NSS Labs received no
vendor funding to produce this report.
Firefox still does not have a sandbox in place. That right there is a severe problem. Especially as Firefox is *the* browser with most vulnerabilities. The only thing Mozilla has going for Firefox security is that they are really fast to patch once a vulnerability has become known.
Re:Who paid? (Score:5, Interesting)
You have a valid point about the sandbox - but the study doesn't really do security a justice, when comparing the browsers.
Malware is seldom a browser injection issue, but is instead vectored through plug-ins (I'm looking at YOU, Adobe!) which are privileged at a higher-level than the "sandboxed" container application.
Flash has been a real horrorshow. It was never designed - rather acquiring tacked-on and retro-fitted capability for dynamic content updating, video playback and scripting with user interactivity, etc.
I could deliver extended anecdotes about the 0-day flash and pdf exploits that I've witnessed, unfolding right in front of me... Suffice it to say, fully patched systems with browser sandboxes are not immune. :-)
The combination of security and privacy extensions that are developed for Firefox are, still, unmatched. Ghostery, AdBlock+ and BetterPrivacy will together prevent the opportunity to ever render many of the malicious, content delivered exploits. They also serve to screen and scrub the most pernicious of web-threats: covert bugging and monitoring of the browser by a third party.
Re:Who paid? (Score:5, Interesting)
You have a valid point about the sandbox - but the study doesn't really do security a justice, when comparing the browsers.
Malware is seldom a browser injection issue, but is instead vectored through plug-ins (I'm looking at YOU, Adobe!) which are privileged at a higher-level than the "sandboxed" container application.
No. These days some 85% of infections derive from social engineering. Malware comes in through the user. Vulnerability exploits seems to be a lot less effective these days. Social engineering is precisely what the tested security (reputation) mechanisms are aimed at.
Having said that, yes, Flash is really, really bad. So is Java. And both are rather prolific, regrettably.
I could deliver extended anecdotes about the 0-day flash and pdf exploits that I've witnessed, unfolding right in front of me... Suffice it to say, fully patched systems with browser sandboxes are not immune. :-)
That piques my interest. When was this? AFAIK there has not been a *single* in-the-wild sandbox breach of neither Chrome nor IE (yes, pwn2own demonstrated a combination of 3 techniques which escaped the IE sandbox - but this has not been reported in the wild). Up until some (fast) versions ago, Chrome did not sandbox Flash. IE did that since IE7.
The combination of security and privacy extensions that are developed for Firefox are, still, unmatched. Ghostery, AdBlock+ and BetterPrivacy will together prevent the opportunity to ever render many of the malicious, content delivered exploits. They also serve to screen and scrub the most pernicious of web-threats: covert bugging and monitoring of the browser by a third party.
Whether they are unmatched is a matter of opinion. Firefox requires addons and will block more broadly (which is desirable to some). To me, the fact that FF code quality seems to lack (they have had most vulns reported for the last 5 years going) combined with their nonsensical refusal to implement a sandbox makes it a no-go for me. (I'm, using Chrome, btw).
Re: (Score:3)
No. These days some 85% of infections derive from social engineering. Malware comes in through the user. Vulnerability exploits seems to be a lot less effective these days. Social engineering is precisely what the tested security (reputation) mechanisms are aimed at.
An even better defence against such attacks, is Apple's model... If you can't install/execute anything that's not come from a trusted source, social engineering simply isn't going to work...
People who aren't sufficiently technically competent to understand the dangers of social engineering and not fall for such scams, should only be using walled garden type systems such as Apple's. Current complex computer systems are just totally unsuitable for the vast majority of people.
However what i will say, is that t
Re: (Score:3)
Re: (Score:2)
Or the fact that OSX bites it in pwn to own first every. single. time. Protip: the first one to drop a machine get 10,000 USD so they are gonna go for the easiest target so they can get paid and since Windows Vista that AIN'T Windows. you might want to read this [wordpress.com] before you start touting Apple security
Maybe the fact the winner won the machine they pwned had something to do with the selection. Or that the contest wasn't a race but a turn based contest. But let's conveniently ignore those facts.
Re: (Score:2)
An even better defence against such attacks, is Apple's model...
A whitelist approach certainly has its advantages - securitywise - to a blacklist (reputation) approach. However, in the case of Apple you get the distinct feeling that in also coincides with their strangehold on the revenue stream. With a white-list approach you give up freedom and convenience. In the case of iOS you subject yourself to the whim of Apple. Some don't see a problem with that. Personally, I think it interferes with the computer as a general-purpose device. However, as computers (and phones in
Re: (Score:2)
An even better defence against such attacks, is Apple's model... If you can't install/execute anything that's not come from a trusted source, social engineering simply isn't going to work...
To be fair a white-list has been possible on Windows since (at least) Vista. This has been beefed up at little with Windows 7 / 2008R2. Security policy settings allow an administrator to enforce a number of rules, such as path rules, network zone rules, hash rules and certificate rules.
The certificate rule is rather advanced and based on authenticode. Basically an admin can set up rules for specific vendors or all vendors where the code has been signed using a certificate from a trusted set, i.e. through tr
Re: (Score:2)
The easy solution is to sandbox the entire browser and all of it's plugins. Try sandboxie (http://www.sandboxie.com/) if you're running windows and are paranoid enough to do that.
Re: (Score:2)
Especially as Firefox is *the* browser with most vulnerabilities.
Citation please? Actually don't bother, because the statement is impossible to support with any amount of evidence. Firefox is the only major browser that openly reports vulnerabilities so of course it is going to have the highest publicly countable number. And even if you had an accurate count of known vulnerabilities from the other vendors, known vulnerabilities hardly equates to total vulnerabilities, even less so when every vulnerability is counted as equal to every other one.
Re:Who paid? (Score:5, Informative)
Citation please? Actually don't bother, because the statement is impossible to support with any amount of evidence.
2008: http://www.favbrowser.com/firefox-browser-with-the-most-disclosed-vulnerabilities/ [favbrowser.com]
2009: http://tech.blorge.com/Structure:%20/2009/11/09/firefox-leads-in-browser-vulnerabilities/ [blorge.com]
2009: http://www.computerworld.com/s/article/9140582/Firefox_flaws_account_for_44_of_all_browser_bugs [computerworld.com]
You can also query Secunia for vulnerabilities. With the new version number scheme and ultra-fast previous versions retirement (where you are left vulnerable if you don't upgrade immediately), you'll have to grok the numbers somewhat. Basically count the *unique* CVEs affecting all FF versions since -say FF3.5. Do the same for IE8&9. You will not like the result.
Firefox is the only major browser that openly reports vulnerabilities so of course it is going to have the highest publicly countable number.
BS. All the major vendors are obligated to report vulnerabilities through Mitre. All browser vulnerabilities are assigned unique CVEs.
And even if you had an accurate count of known vulnerabilities from the other vendors, known vulnerabilities hardly equates to total vulnerabilities, even less so when every vulnerability is counted as equal to every other one.
If you consider a set of browsers which must be assumes to receive an equal amount of scrutiny (IE,FF,Chrome), if one browser year after year comes out with most vulnerabilities, surely that does say something about code quality.
Re: (Score:2)
Where are those mod points when you need them?
Re: (Score:3)
BS. All the major vendors are obligated to report vulnerabilities through Mitre. All browser vulnerabilities are assigned unique CVEs.
Browser vendors are not obligated to do any such thing.
Firefox reports every vulnerability discovered, even those discovered in alpha and beta versions (which is a normal function of beta testing)... By contrast, commercial software is rarely available to the general public at all until a late beta stage, bugs found and fixed during the early development phases will never be disclosed to the public.
Commercial companies, not just browser makers, generally only admit to vulnerabilities which have (or are thre
Re: (Score:2)
Firefox reports every vulnerability discovered, even those discovered in alpha and beta versions (which is a normal function of beta testing)...
They report them in the open, but they are *not* considered vulnerabilities of released software and they are not reported as such to NVE or Mitre and they are not assigned CVEs. You cannot find any CVE referring to a beta or alpha version of FF.
By contrast, commercial software is rarely available to the general public at all until a late beta stage, bugs found and fixed during the early development phases will never be disclosed to the public
Yes, well, when it is not available any security bugs found during the testing/security push don't matter, do they? I mean, I expect the vendor to make a security push, reviews and fuzzing during both development and testing. The final product which is released is w
Re: (Score:2)
Re:Who paid? (Score:4, Informative)
Secunia specifically states [secunia.com] "The statistics provided should NOT be used to compare the overall security of products against one another. It is IMPORTANT to understand what the below comments mean when using the statistics, especially when using the statistics to compare the vulnerability aspects of different products."
Some companies, especially those with closed-source browsers, may not disclose all vulnerabilities they fix. The number of vulnerabilities fixed also doesn't take into account how severe the vulnerabilities are, or how long it took the vendor to patch them. Which would you rather use, a browser that has ten small vulnerabilities, all patched within days of being discovered, or a browser that has one severe vulnerability that has not been patched in months?
Re: (Score:2)
Surely this ends the argument?
Re: (Score:2)
Re: (Score:2)
Firefox may not be the most hardened browser around these days, but were it not for firefox things would be a lot worse...
Without firefox taking significant market share away, MS looked likely to never bother updating IE...
But also the fact that no single browser still controls 95%+ of the browser market is a VERY good thing. It not only means that standards and interoperability become important which has made mobile browsers viable, it has kickstarted the alternative browser market (without firefox there w
Re: (Score:3, Insightful)
Prediction:
The results are favorable to Microsoft, so there will be a ton of skepticism, investigation, and outright dismissal. However, when studies favorable to this particular community's ideologies are announced, none of that occurs, even though the same kinds of skepticism can and should be applied.
Kind of correct. (Score:5, Insightful)
Yep. Mostly because Microsoft has a history of purchasing favourable "findings" from "independent" "research" firms.
Kind of. The process and parameters should always be checked. But the other browsers do not have a history of their parent companies purchasing favourable "findings".
It's called "learning from experience".
There is no reason to forget every past instance when evaluating a new instance. Quite the opposite, in fact.
Re: (Score:2)
Basically microsoft has build a boat full of holes (I believe they callis something like MS-Windows) and they pnly produce software for that environment.
What are you on about? They produce software for plenty of platforms other than Windows, their own ones like their phone/Zune OS and the XBox as well as Mac OS X.
Re:And who paid for this study? (Score:5, Informative)
http://www.thetechherald.com/article.php/200912/3268/Can-you-trust-the-NSS-Labs-report-touting-the-benefits-of-IE8 [thetechherald.com]
So apparently they tested IE8 and thought it was awesomesauce. Uhm, ok... I thought IE8 wasn't completely terrible but I wouldn't say it was good. That link seems to think NSS might be a microsoft shill. But ok, I like to be open minded. Let's keep looking. Going down the first page of my google search:
Firewall Vendors Challenge Findings of NSS Labs Report | PCWorld
Haavard - Malware report from NSS Labs manipulates statistics?
Google Responds to NSS Labs Browser Security Report | News
A recent test by NSS Labs gave a near-perfect score to Internet Explorer 9 beta and very poor marks to Chrome and other browsers.
So uhm... yeah... at first glance, I'd say treating them with some skepticism seems more than warranted here.
Re: (Score:2)
I must admit, Microsoft is showing a lot of positive progress.
1. Windows 7 was a big improvement in stability & usability. (I can't attest to security as I pretty much never have been infected since 98 days).
2. IE 9 is actually showing itself somewhat impressive on HTML5 rendering, and more...
--
Rather than demonize Microsoft, I think we should laud them in finally starting to turn the ship around (technically) if not (ideologically).
Re: (Score:2)
This isn't about ideology. This is about experience.
You would like to pretend that our biases are not borne out of some rational basis but they are.
Trust is earned over a long period and Microsoft just isn't there yet.
Re: (Score:2)
Re: (Score:2)
Re: (Score:3)
Re: (Score:2)
Re: (Score:3)
...and I respectfully ask: Who cares?
The study is comparing the latest released versions of the major browsers to show who can handle current threats. IMHO if you are still using an outdated browser then you have no right to feel all warm and fuzzy with your security.
Step 1: Upgrade to latest version of browser of your choice.
Step 2: THEN decide if this study gives you reason to want to switch to IE (of said latest version)
I predict you didn't RTFA and are doing exactly what Parent said only trying to soun
Re: (Score:2)
...and I respectfully ask: Who cares?
Since XP can't run IE 9, and a significant percentage of PC's are still running XP or a derivative thereof, IE 9 shouldn't be the only version of IE tested. With the number of add-ons that broke with the upgrade to Firefox 4, and the upgrade to Firefox 5, there is a significant percentage of Firefox users who are not using Firefox 4 or Firefox 5 or even Firefox 6 (which was released this week).
Testing the latest browsers is good for somethings, but the browsers they tested make up a minority of the brow
Re: (Score:2)
Firefox and Chrome are the safest browsers out there, especially if you use Adblock and NoScript
Chrome doesn't have NoScript. The closest they have it NotScripts [wikipedia.org], which sucks by comparison. Nothing, IMHO, can touch Firefox with AdBlock and NoScript. Comparing any other browser to that configuration should almost have to come with an asterisk indicating that, though X browser may be more secure in the STOCK version, nothing compares to the POTENTIAL security of Firefox with the right add-ons.
Re: (Score:2)
Re: (Score:2)
The latest version of Chrome now allows you to run individual plugins if necessary. This is useful for running just one embed and not things on the side.
However, it took a few versions to get that right - almost as if the developers never heard of the flash banners that took 200% CPU.
Re: (Score:2)
It could be a study by a PC vendor involving 1,188 sites with Apple malware. (They have to include IE after all, and nobody likes looking like a fool.) Or it could be a genuine study by a really bad security guy (all the browsers support Selenium, so they could have automated tests against as many URLs as they liked - a mere thousand in an automated test is really not that many, given that they'll have been testing against similar attack vectors in many cases).
Not that it matters much. It's not like the mos
Re: (Score:3)
I'm fairly sure both Firefox and Chrome are the safest browsers out there
Well shit, man, what the hell are you doing? Have you contacted the authors of the study to inform them that you are "fairly sure"? I'm sure this is information that will be useful to them. All they have now are one thousand, one hundred and eighty-eight data points for each of five browsers, I doubt they even allowed themselves to dream that you would be "fairly sure" about what they were trying to study. I'm fairly sure that they only reason they didn't contact you first to get your input was because
Re: (Score:2)
I think someone should point out clear the difference between the term "Blocking" and the term "Unable to render".
Re: (Score:2)
Thing is, neither firefox nor chrome do sufficient badware filtering. Neither is as configurable via group policy to allow scripts to run on sites that you need to run scripts, yet put other sites in less trusted zones.
Out of the box your assertion may hold water, but in the real world where you're trying to enable crappy internal third party web applications to work, I suggest that IE is easy to secure.
Telling users to totally turn off scripting, etc isn't really feasible if they need that functional
Who uses IE 9? (Score:2)
Wrong question with "firefox is better", etc etc. The real question is, who the hell uses IE9 in the first place?
About 7 in 10 Windows 7 users in the states.
As we've mentioned before, Microsoft skipped XP support for Internet Explorer 9 in order to compete more effectively on Windows 7. In July on Windows 7, Internet Explorer 9 hit 18.5% share worldwide and 24.8% in the United States. There are indications that this strategy is working. Although Internet Explorer lost usage share on XP, on Windows 7, Microsoft increased global usage share, going from 54.6% in June to 54.8% in July. And in the U.S., Internet Explorer share on Windows 7 grew 0.6% to 68.1%.
Browser Wars [hitslink.com] [August 1, 2011]
I dont' care how good it is at "blocking malicious content" if the underlying OS is still completely unsafe, which is due to what consumers put on their PC's.
Unpatched 0%
Vendor Patch 100%
Microsoft Windows 7 Solution Status (Based on 28 advisories from 2011) [secunia.com]
Re: (Score:2)
Secunia also posts stats on IE 9:
In 2011:
Three advisories, all patched by Microsoft. Two "Highly Critical," one not critical at all. Vulnerability Report: Microsoft Internet Explorer 9.x [secunia.com]
This story caught my eye as well:
For the very first time in its history, the top 10 rating of vulnerabilities includes products from just two companies: Adobe and Oracle (Java), with seven of those 10 vulnerabilities being found in Adobe Flash Player alone. Microsoft products have disappeared from this ranking due to improvements in the automatic Windows update mechanism and the growing proportion of users who have Windows 7 installed on their PCs.
Kaspersky Lab: Turbulent quarter as hacktivism increases [globalsecuritymag.com]
Re: (Score:2)
IE has disappeared from this ranking because it is no longer ubiquitous enough to be worth targeting, having something like a 40% market share, while flash player, adobe acrobat reader and java are installed on well over 90% of systems (including non windows systems).
Hackers will always target software with the largest market share, because the more potentially vulnerable systems that exist the more an exploit is worth. It's only good business.
Microsoft have not really disappeared, because the vast majority
Re: (Score:2)
I disagree, Windows has been dumbed down to the point that it's a valid criticism to make. MS has had an incentive to make sure that users aren't smart enough to be able to switch to another OS. And it seems to be working quite well.
Re: (Score:2)
It does now (Ctrl+J after you start downloading, then check the Location column for each file). It didn't in pre-release versions (I forget which, but I used them).
Re: (Score:3)
They also made a few technical errors in the report, at least surrounding Opera. At one point, they list "Opera 10" as having 6.1% block rate, yet earlier in the report they list that as the rate for Opera 11 and Opera 10's rate as 0.00%. That, combined with the absolutely gushing praise for IE9 and its App block (or w/e they call it) filter lead me to suspect quite strongly that this is just another MS paid add by an "independent" (i.e. not directly MS-owned) company.
No technical examination of any other b
Re: (Score:3)
I don't know, but I use my PIN number at the ATM machine all the time now!
Re: (Score:2)
The protocol for doing so has been extended to include malware downloads at some point, and Chrome implements this, but this part of the protocol is not documented, so Firefox (and Safari) don't.
Re: (Score:2)
They found IE9 to be the best choice to defend against attacks aimed at IE9. Other browsers where found to be severely lacking in in defending against attacks aimed at IE9.
Not only that, but they ran all of the tests on Windows. That is hardly the platform that you would choose if you were trying to block malware, so given a free choice of platform IE would be at a severe disadvantage because it is tied to Windows[1]. The test nullifies that disadvantage by making all of the browsers play on Microsoft's home ground. I don't see how they could possibly claim that this was an unbiased test.
[1] unless you count IE5 on Mac OS, which is unlikely to win any prizes in this contest.
Re: (Score:2)
Re: (Score:2)
My experience with IE, which I do use, is that you get a "xxx.exe is not commonly downloaded and could harm your computer" as soon as you download anything that isn't popular software. Given that this provides zero useful information, I would expect most users to completely disregard it after a while.
And I bet, correction, I'm sure the study result won't look so good in that case.
Without more information about the false positives encountered, I'd consider it worthless for an objective evaluation.