Not quite OT: Browser security

Coursedesign wrote on 5/13/2005, 11:09 AM
Scanit NV, an international security firm, said in today's issue of Windows Secrets that there were only 7 days out of 366 in 2004 during which IE had no unpatched security holes. This means IE had no official patch available against well-publicized vulnerabilities for 98% of the year.

The equivalent for Mozilla/Firefox was 26 days, but each vulnerability was patched before exploits were running on the Web. This resulted in zero days when a Mozilla or Firefox user could have been infected.

This doesn't mean you'll be perfectly safe forever of course, but there seems to be a much quicker response to problems in Firefox compared to IE, and once you get used to tabs, there is no going back IMHO.

My most critical editing and compositing workstation doesn't even have e-mail, and browsing (with Firefox) is only used for downloading updates. BTW, Firefox also handles downloads more conveniently than IE.

IE7 may be MS' rescue when it becomes available sometimes this year (probably late in the year).

For anybody on W2K, I just got notice about a security hole where if you just select an [intentionally malformed] file in Windows Explorer (without double-clicking it), it executes without notice...

Security management is something we as users shouldn't have to deal with, but until operating systems become more mature we just don't have a choice.

Comments

BillyBoy wrote on 5/13/2005, 12:04 PM
Once Jessie James was asked why he robbed banks. He replied that's where the money is.

Of course Microsoft's browser has been exploited more, because it is overwhelmingly the browser most often used. If you are some nut case that gets off on being a malicious hacker the whole point is to in effect to cause as much harm to as many people as you can. So sure, they target Microsoft's products since they are more used than anything else. If Firefox ever got the same market share then they too would be exploited.

There are all kinds of security holes in software in general. Those in Windows, other Microsoft products simply have been exploited more, because like Jessie James knew to rob banks to get money, hackers know to go to Microsoft software to have the best chance to inflict the most damage.
Coursedesign wrote on 5/13/2005, 12:31 PM
So if Internet Explorer is where the robberies occur, you are saying it would make sense to avoid it?

Firefox gets help from not supporting ActiveX, which is a very dangerous interface to use for a web browsers. Anybody who chooses to use IE can of course turn this off in Zone Security Settings.

The main problem with IE's security is that the code has evolved over ten years, with features just being piled on (1.0 was released in 1995). When MS wrote the core code for IE 1.0, they thought of the Internet as a trustable environment. Various patches here and there never changed that fundamental assumption, which is the source of most of the problems. IE7 will change that of course.

Mozilla 1.0 was released in 2002. That's quite a bit later than the 1995 launch of the first version of IE, and in 2002 there was a lot more experience with the security threats of the internet, making the core of the code less vulnerable.
BillyBoy wrote on 5/13/2005, 1:34 PM
No, it simply doesn't make sense to just blame the browser, its the POPULARITY of the browser that make hackers target it. I've sure been critical of Microsoft at times, but fair is fair. If Firefox or Opera or any browser you pick were the number one browser then they would be the number one target of hackers and then you would see all kinds of security issues exploited with them.

Microsoft's browser has more "security" holes because its the most targeted browser....the risk is because of its popularity not because its any more or less secure than others..Hackers simply have targeted it and exploited it more, because its the number one browser in use.

Your comparision is overly simplistic. Don't support ActiveX, don't support scripting, etc., the "core" code is newer all really mean nothing. Any hacker that wants to invest the time to mess around, can/will HAS exploited the code regardless who's code it is, what programming language its is written in.

Any code who's purpose is to allow communications with other computers via the Internet, what any browser does and has to do, makes it superable to those who would exploit it for malicious means.

I doubt IE7 will really be any more secure either. Perhaps for a short time, but not in the long term. Its the nature of how things are.
Coursedesign wrote on 5/13/2005, 2:01 PM
I don't care if it's the popularity of a browser that is causing it to be attacked more, or if it's sloppy code. It doesn't matter, and there is really no need to assign blame.

Nothing is 100% secure, so all we can do is to go with the most secure browser we are willing to accept.

If FF is less targeted and has been more secure so far (in practical use), then it makes sense to use it.

If we cannot accept FF because we don't like the concept and we want to stick with IE, then we face the next choice: how much of IE should we lock down (ActiveX, etc.)?

MS says IE7 is written from the ground up to put security first, and I believe them if for no other reason than their self-preservation. It is also a strong indication from Microsoft that IE6 is not fixable.

The share of non-IE browsers has doubled in the last six months, from about 6% to about 11-14% depending on the source. Everybody is justly concerned about the massive amount of security holes appearing regularly in IE, and many users are even more concerned about how it has taken Microsoft months to fix some of the most critical holes after they were exposed.

Forty years ago it used to take about 30 seconds to steal a car and drive away with it. Today, the better cars take 3-4 minutes to steal, which is a deterrent. Some cars have challenge-response computer code chips built into the ignition keys, I would imagine those are not so easy to drive away with.

We should be able to focus on our work, not this security joke.
BillyBoy wrote on 5/13/2005, 4:17 PM
If they wanted to, car manufacturers COULD make cars nearly theft proof. They haven't. I wonder why. I also wonder why they still are using 100 year technology. I mean come on, its 2005 and cars mostly still use the internal combustion engine invented over a century ago. Laughable. We put men on the moon decades ago, yet we can't build a mass produced car that doesn't need gasoline. Again, if they wanted to they could. Seems the problem is they don't want to. Curious minds wonder why not.
Coursedesign wrote on 5/13/2005, 7:06 PM
I think it's even been 125 years now since the first auto rolled. Electric cars were popular around the turn of the first century thereafter (1900), but soon got beaten by internal combustion engines slurping gasoline bought in glass bottles at the nearest pharmacy....

This engine type has survived because its further development never stopped.

The gas turbine came and went (good only for constant rpm), ditto for external combustion engines based on the Stirling concept or steam power.

Batteries aren't quite good enough yet, and charging them from coal or oil powered generators in power plants doesn't make so much sense either.

Fuel cells may be great someday, but it's not imminent.

Hybrids look very promising, because you can get the torque of a V8 with the fuel economy of a 4-cylinder, and they are particularly efficient and low-polluting in town, but the manufacturing cost is still high.

Diesels are popular in Europe because of their very high fuel efficiency, and the latest generations of European diesel cars are incredibly clean, even ULEV. Unfortunately these cars can't use current U.S. diesel fuel which is 50 times dirtier than what is legally OK in Europe.

If you look at GM, it seems they are just lazy. They are now financially rated as "junk", with the explanation from financial analysts that they shouldn't have bet the company on one scenario only: selling inexpensively made primitive truck chassis with shiny SUV bodies at high prices. When people got concerned about gas prices, they had no Plan B...

Gasoline is hard to beat for energy by weight. It has 10 times more energy per pound than dynamite...

Biodiesel looks fairly promising also, apparently there is a pretty sizable fleet in Sweden that is actually profitable (and gets rid of waste that would have cost money to dispose of otherwise), and there are scattered trials in the U.S. and elsewhere too.

Hydrogen has been suggested, but there are enough problems with that to keep manufacturers busy for decades.

In a way you're right about "they don't want to". [I trust the grammatically minded Vegas users in this forum know why I put the period outside the quotes...]

Many years ago I had a long dinner with the top administrator for the original "man on the moon" project. His description of it made it clear that the only reason they were able to actually do it was that every single person who worked for NASA then wanted it to succeed, all the way to the guy who cleaned the toilets.

Not so with alternative automobile technologies. The government gives you up to a $100,000 immediate tax deduction if you buy a Hummer monster-SUV with every conceivable toy and accessory, for use in your own business. And that's even if you're an accountant, book editor or ice cream inspector (real job!) with no use for a 6,000 lb. iron hulk. But if you buy a fuel efficient sedan, you have to write it off over several years, no immediate tax deduction there...

BillyBoy wrote on 5/13/2005, 8:11 PM
Not to put a political spin on it, but last night it was reported that we as a country have now spent over $300 billion on fighting a war most people now feel was wrong. That's almost a third of a trillion dollars and counting folks, all down the drain. Remember that next time you fill up your gas tank when hundreds of billions more are going overseas to countries, one in particular where 15 of the 19 highjackers that attacked the United States on 9/11 came from.

Also take note that the world's four largest oil companies, Royal Dutch/Shell, BP Group, ExxonMobil and Chevron Texaco since 2003, raked in $97 billion in profits. The more stunning fact is $23 billion of that came from sales in the first three months of this year.

Bush does nothing. Congress does nothing. You think Americans would get tired of bending over grabbing their ankles. Meanwhile a Appeals court said yesterday VP Dick Cheney doesn't have to make public what he and his energy task force talked about in their secret meeting where the current administration gave them just about everything they asked for. Four oil companies in one quarter "earn" 23 billion in profits. Wink, ,wink. Must be nice to have powerful friends.

TheHappyFriar wrote on 5/13/2005, 9:10 PM
I'd say that even if Firefox/Mozilla/Netscape became the most popular browser we'd still see more hacks into IE. Just for the simple reason that IE is part of Windows and is always there, so it's not a variable if people want to hack. If IE could be removed then it wouldn't be a tempting target anymore.

Of course if MS didn't go around touting it's great security, maybe people wouldn't be so upset when they are proven wrong.
Redd wrote on 5/13/2005, 10:42 PM
When I was still using IE, I was getting (not an exaggeration) up to a dozen "Windows Explorer has encountered an error and has to close. Would you like to send to Microsoft" per day. This still happened even after doing a reformat and fresh install of XP Pro.
But when I stopped using IE and switched to Firefox, the errors stopped. I'll still get one every few weeks or so. Technically I have no idea what caused them or even a technical reason why they stopped, but I'm a true Firefox fan now. Now I use as little MS software as possible.
Coursedesign wrote on 5/13/2005, 11:34 PM
The IE code in Windows XP can be removed (really), but that has too many disadvantages for most people.

It is still a big help to not use the code for manual browsing.

BTW, BB, W thanks you for your federal income tax contribution towards the new $4,000,000,000 cash gift to so the poor oil companies can afford to drill in the Gulf of Mexico. Next: Transportation Bill support for liquor stores along highways. You are excused if you think I'm kidding. Unfortunately...

Makes Microsoft look pretty good, eh?