Firefox meets the truth - Page 2

**Wyzcrak** · 09-21-2005, 02:34 AM

Ah. Again zdnet (except... this time it's "news." instead of "blogs." -- heh) works to educate us. Again, I've bolded what most interested me. The next-to-last paragraph reiterates Mr. Roza's points.

Quote:

Originally Posted by Mozilla hits back at browser security claim

Nitot said that Mozilla's reaction time was faster than Microsoft's. "If you look at our ability to respond, we are in much better shape. On 6 September an IDN buffer issue was reported to Mozilla. On 8 September it was publicly disclosed. We ask our developers not to mention any problems until we have a fix for them, but for some reason he went public. On 9 September we had a configuration change that disabled the IDN problem, that users could implement manually, or they could use a patch. Within ten days [Mozilla] had a newer version that was fixed completely."

"If you look at Microsoft — this month [Microsoft] decided to skip a security patch," so any vulnerabilities won't be addressed, according to Nitot. "That's not the kind of thing that happens with us," he said.

He also argued that, according to security company Secunia's statistics, the Microsoft vulnerabilities were more critical, and had been so over a longer timescale. In the period 2003 to 2005 Secunia have issued 22 security advisories regarding Firefox 1.x, and rate it as "less critical". In the same period Microsoft Internet Explorer 6.x had 85 Secunia advisories, and is rated as "highly critical".

"Basically their vulnerabilities are more critical. With Firefox — yeah, you have holes, but they're much less serious." Nitot likened the differences between Firefox and IE vulnerabilities as being like injuries: "Which would you prefer, to have a broken finger, or your head ripped off?"

Heh. I'll take the broken finger, thanks.

GAH!! LOOK! Just as I suggested:

Quote:

Originally Posted by Wyzcrak

Also, does it not stand to good reason that more vulnerabilities will be discovered for an open-source product than will be discovered for a closed-source product? If so, doesn't the open-source product, with full exposure and a literal army of developers prepared to remedy that which has been exposed, stand to be patched faster, more often, and with greater review than the closed-source product?

From the above-quoted article, later down:

Quote:

"Firstly, there has been a wide adoption of Firefox in a short space of time. More security researchers and people with more nefarious motives have been able to look at the code base. Secondly, as Firefox is open source more people have access to the code base, so they are free to look for bugs. IE is closed source, and so it's more difficult to access the code."

Quote:

People who have swapped [from IE to Firefox] ... should ask whether the assumption that Firefox is more secure than IE is valid anymore.

At what point does the idea that Firefox is more secure transform from an assumption to a fact? Are the findings of two separate security firms releasing numbers like the above not enough?

**Wyzcrak** · 09-21-2005, 02:43 AM

An interesting comment from a Slashdot reader regarding Mozilla's response:

Quote:

Symantec's report is also slanted becasue it uses vendor confirmed vulnerabilities rather than both confirmed and unconfirmed ones. This leads to misleading headlines and hurts Mozilla's reputation. I am suprised that Mozilla didn't say anything about that.

He makes a good point, and it goes to what I said about open-source vs closed-source. Mozilla can't hide or deny vulnerabilities, so they must confirm them. Microsoft does not answer to the same test, as they have not released their source?

Another interesting comment:

Quote:

To the non-techie, MS is a known quantity and The Mozilla Foundation is not (I'm thinking along similar lines to name-recognition at the polls). At the very least, a I-say, they-say approach seems to muddle the issue more than clarify it for those not willing to do their own research.

That blog Mito referenced, while it has validity in its roots, is largely hype. For someone who takes the time to actually read the security papers, things look less alarming for someone considering Firefox as an alternative to whatever they're trying to escape in the IE experience.

Speaking of which... Firefox 1.0.7 just got released. Any new IE versions out tonight?

.143 Beth© · 09-21-2005, 11:45 AM

Quote:

Originally Posted by Lt.Snow

Hell YA!! Down with IE, I need to see a new tab when I press Ctrl+T, I Need extensions upon extensions, I Need that oooso nice popup blocker, and most of all When I Hold Ctrl And Wheel My Mouse Wheel Back I WANT THE WORDS TO GET INFINITELY BIGGER!!!

MY NAME IS DEVIN AND I USE FIREFOX

Wow, the words do get bigger!!

I used IE and within 2 weeks with medium security settings I had 3 installed toolbars and tons of popups. When I would turn my comp on it would poup with golden tiger casio ETC. Now that I have Firefox i have had no popups, or toolbar installations.

rs_al · 09-21-2005, 12:17 PM

Wyz, I wouldn't spend a lot of time discrediting the report. If counting Windows bugs like "someone pings port 1234 and your computer is now their computer" and linux bugs like "someone who has a user account on your machine and rights to compile and execute programs could compile a program that could take advantage of a race condition in the library loader and possibly get root" as equals has taught me anything, a vulnerability count is just silly. Especially when microsoft labels any user privilige escalation exploit as "important", whereas they are always critical in linux. There's a double standard at work here that totals cannot express.

Quote:

Originally Posted by .143 Beth©

Wow, the words do get bigger!!

I used IE and within 2 weeks with medium security settings I had 3 installed toolbars and tons of popups. When I would turn my comp on it would poup with golden tiger casio ETC. Now that I have Firefox i have had no popups, or toolbar installations.

This wasn't the exact picture I was looking for, but close enough:

**Wyzcrak** · 09-21-2005, 12:24 PM

That picture is very amusing. lol

Wulfyn · 09-21-2005, 12:55 PM

I think a lot of people are getting the wrong end of the stick about the report. I don't think he is trying to say that IE is a better choice than FF at the moment. All he is saying, as far as I can see, is that FF, which was largely left alone by the hacking community, is not attracting more attention.

Whether you believe his facts (and think that FF is now attracting more attention than IE) or you do not (in which case maybe you accept that FF is now attracting more attention than it was a year ago) is down to you, and any additional research you might wish to conduct. I for one cannot believe for a second that a browser (or any program) that is open source can claim to be secure. I mean the hackers have the build right their in front of them in most cases.

Personally I think that the main reason IE has more exploits is because it is the most commonly used browser, and because it is made by Microsoft. These attract different sorts of hackers. The main 'kiddie scripters' will target IE because they hate Microsoft, Bill Gates etc ad nauseum. However a lot of people make money from installing toolbars and the like into your browser. These people won't care who made it, they are simply after the numbers. As FF and other browsers get more popular they will start to become a target.

I personally use Opera, but it is not a perfect browser. Sure I don't have any malicious code try and use ActiveX to sneak it's way in, but then Opera doesn't have it switched on, so I don't get to see anything which uses ActiveX either. My preference is that I'd rather not have something I want than have something I don't want. Opera also has other security problems (like if you have a secure window and an insecure window open at the same time, the insecure window can actually be used to gain access to the secure window through your browser).

rs_al · 09-21-2005, 01:22 PM

Quote:

Originally Posted by Wulfyn

I personally use Opera, but it is not a perfect browser. Sure I don't have any malicious code try and use ActiveX to sneak it's way in, but then Opera doesn't have it switched on, so I don't get to see anything which uses ActiveX either. My preference is that I'd rather not have something I want than have something I don't want. Opera also has other security problems (like if you have a secure window and an insecure window open at the same time, the insecure window can actually be used to gain access to the secure window through your browser).

With Opera being free now, you're going to see it start carving up a much bigger chunk of the market. Not an option for me though- doesn't run on linux

Wulfyn · 09-21-2005, 01:32 PM

But that's the downside to it - as soon as it gets popular it will be subject to exactly the same sort of money-scam attacks as the other browsers are/will be

Best thing to do to keep your browser good is to tell everyone else how crap it is

perry · 09-21-2005, 02:54 PM

Quote:

Originally Posted by rs_al

Not an option for me though- doesn't run on linux

Sure it does.. Just installed it.

Quote:

Version information
Version 8.5
Build 1358
Platform Linux
System x86_64, 2.6.13-gentoo
Qt library 3.3.4
Java No Java Runtime Environment installed

Browser identification

Mozilla/4.0 (compatible; MSIE 6.0; X11; Linux x86_64; en) Opera 8.5

Firefox is my main browser.. and I feel quite safe running it on Linux.

Cpt.Destructo · 09-21-2005, 03:30 PM

I'll stick with Firefox too. I used to have all sorts of virus and unwanted files using IE..never ONCE had a problem with Firefox.

ME thinks MS doesn't like the competition.

**Pokerface** · 09-21-2005, 03:51 PM

I'm hardcore. I telnet and read the raw HTML.

Root · 09-21-2005, 04:06 PM

Quote:

Originally Posted by Pokerface

I'm hardcore. I telnet and read the raw HTML.

roflmao you go girl

I'm sticking with FF. The only time IE gets used on my PC is when CS is running. I like opera too.

Root

Cain · 09-21-2005, 05:19 PM

Quote:

Originally Posted by Pokerface

I'm hardcore. I telnet and read the raw HTML.

Lynx, anyone?

-=[dMw]=-Cain

rs_al · 09-21-2005, 05:35 PM

Quote:

Originally Posted by perry

Sure it does.. Just installed it.

Firefox is my main browser.. and I feel quite safe running it on Linux.

I'm guessing that's a 64 bit kernel, and on gentoo, I highly doubt you are running a 32 bit version of x and libraries- how is it that you're running the 32 bit executable?

perry · 09-21-2005, 05:50 PM

Quote:

Originally Posted by rs_al

I'm guessing that's a 64 bit kernel, and on gentoo, I highly doubt you are running a 32 bit version of x and libraries- how is it that you're running the 32 bit executable?

http://packages.gentoo.org/search/?s...emul-linux-x86

09-21-2005, 12:24 PM	#20 (permalink)
Wyzcrak Join Date: May 2003 Location: Memphis, TN Posts: 14,148	Re: Firefox meets the truth That picture is very amusing. lol __________________ Steam Community? Add me. \| Join #tacticalgamer \| Search Results Legend \| New Posts Forum Filter \| Postbox Toggle \| Live Thread Review \| One Line Results \| Free Remote, Encrypted Backup Darkilla: In short, NS is pretty much really fast chess. With guns. Apophis: I haven't seen anyone say that SM's are better than non-SMs. Nordbomber: This is THE first server I've seen where either side can comeback from out of seemingly nowhere with the right teamwork. en4rcment: I have NEVER experienced the type of gameplay that I have found here. Nightly I am amazed at the personalities and gaming talent. Root: Welcome to TG. Feel free to punctuate your sentences correctly. Monkerz: Its gonna take all my skills to beat those boys off in the future.

09-21-2005, 12:55 PM	#21 (permalink)
Wulfyn Join Date: May 2005 Location: Norwich, UK Age: 29 Posts: 4,236	Re: Firefox meets the truth I think a lot of people are getting the wrong end of the stick about the report. I don't think he is trying to say that IE is a better choice than FF at the moment. All he is saying, as far as I can see, is that FF, which was largely left alone by the hacking community, is not attracting more attention. Whether you believe his facts (and think that FF is now attracting more attention than IE) or you do not (in which case maybe you accept that FF is now attracting more attention than it was a year ago) is down to you, and any additional research you might wish to conduct. I for one cannot believe for a second that a browser (or any program) that is open source can claim to be secure. I mean the hackers have the build right their in front of them in most cases. Personally I think that the main reason IE has more exploits is because it is the most commonly used browser, and because it is made by Microsoft. These attract different sorts of hackers. The main 'kiddie scripters' will target IE because they hate Microsoft, Bill Gates etc ad nauseum. However a lot of people make money from installing toolbars and the like into your browser. These people won't care who made it, they are simply after the numbers. As FF and other browsers get more popular they will start to become a target. I personally use Opera, but it is not a perfect browser. Sure I don't have any malicious code try and use ActiveX to sneak it's way in, but then Opera doesn't have it switched on, so I don't get to see anything which uses ActiveX either. My preference is that I'd rather not have something I want than have something I don't want. Opera also has other security problems (like if you have a secure window and an insecure window open at the same time, the insecure window can actually be used to gain access to the secure window through your browser). __________________

09-21-2005, 01:32 PM	#23 (permalink)
Wulfyn Join Date: May 2005 Location: Norwich, UK Age: 29 Posts: 4,236	Re: Firefox meets the truth But that's the downside to it - as soon as it gets popular it will be subject to exactly the same sort of money-scam attacks as the other browsers are/will be Best thing to do to keep your browser good is to tell everyone else how crap it is __________________

09-21-2005, 03:30 PM	#25 (permalink)
Cpt.Destructo Join Date: Jun 2005 Posts: 74	Re: Firefox meets the truth I'll stick with Firefox too. I used to have all sorts of virus and unwanted files using IE..never ONCE had a problem with Firefox. ME thinks MS doesn't like the competition. __________________

09-21-2005, 03:51 PM	#26 (permalink)
Pokerface Join Date: May 2003 Location: MD, USA Age: 30 Posts: 5,773	Re: Firefox meets the truth I'm hardcore. I telnet and read the raw HTML. __________________ NS Game Officer. TF2 Admin. BF2 Admin / Scripter. PM with issues. Tempus: Pokerface is nailing it right on the head. Everyone who is arguing against him is simply arguing against reality. <anmuzi> it is not permitted to have privacy or anonymity <LazyEye> yeah when I play on TG the server digs though my trash Arm yourself with knowledge: TG NS TF2 BF2

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Setting up FireFox/Favorite Extensions	CingularDuality	Hardware & Software Discussion	73	03-22-2007 02:20 PM
The truth about PETA.	CingularDuality	The Sandbox	36	12-10-2006 07:31 PM
New FireFox user	kin3	Hardware & Software Discussion	2	10-27-2006 01:25 PM
Spellbound Spellchecker for Firefox 1.5.0.1	Darkilla	Hardware & Software Discussion	0	04-07-2006 03:41 AM

Sponsored links

Sponsored links

Sponsored links