July 17, 2008 1:29 PM PDT
Mozilla updates Firefox with three security patches
On Thursday, Mozilla pushed out a new security update for its new Firefox browser. Version 3.0.1 for Windows and Mac addresses vulnerabilities in malformed GIF files on Mac OS X, command-line URLs that could launch multiple tabs when Firefox is not running, and a potential remote code execution by overflowing CSS reference counter.
Meanwhile, Mozilla updated the earlier version of Firefox with 2.0.16 on Tuesday. The update addresses two of the Firefox 3 critical issues--command-line URLs and overflowing CSS reference counter.
Version-specific updates have been pushed out automatically to existing Firefox users.
Mozilla will continue to update Firefox 2 until mid-December.
As CNET's resident security expert, Robert Vamosi has been interviewed on the BBC, CNN, MSNBC, and other outlets to share his knowledge about the latest online threats and to offer advice on personal and corporate security. Listen to his podcast at securitybites.cnet.com or e-mail Robert with your questions and comments. 
Let's see a service update for something the customer already has and can use without the update verses not even being able to get a phone and having to take home a non-working phone just to get it activated, if you can get it activated.
I'll take my free browser that I am using right now any day over a phone that I can't even put my hands on if I wanted to buy one.
At least FF isn't getting exploited everyday like IE.
[CNET editors' note: personal attack deleted].
Leria, You "knew" the FF3 wouldn't be perfect? How brilliant of you!
So forgiving?
Of what? That FF fixed the issue fast enough that it wasn't exploited?
If MS could do that we might be more forgiving of its thousands of flaws and exploits running around for it.
FireFox is just as buggy and can't get it right either..they still need to release security ptaches..so are you really safer with FireFox? Maybe a little, but the facts speak for themselves.
And yes, I will be slammed for this....but facts are facts..even if they are easily overlooked.
If you knew the difference between a flaw, an exloitable flaw and an exploit you wouldn't be asking such inane questions.
Security patches? Well obviously there needs to be security patches. You don't think hackers are gonna just sit there and keep trying to exploit the same security flaws No, what hackers do is attempt to find new ways to exploit things. They aren't stupid, they adapt with the patches. Nobody is safe when they are connected to other computers (the internet). There isn't 100% safe, there is safer. Think about it, Microsoft keeps with their patch Tuesday schedule. What if there's a security problem exploited on Wednesday the week before? Now think about Mozilla, oh there's a problem, let's fix it and push this build out ASAP. Also Firefox has been shown to be the most updated browser simply because of the easy way of updating using the partial update method. I still don't like downloading a full exe each time to update Opera and I certainly don't want to wait for Windows Update to update my IE. Obviously the must frequently updated and patched browser will be the safer one. The browser evolves with the dangerous environment on the internet much more quickly.
That is wrong. They are usually discovered by security researchers who want to stop the bad guys.
My point is: look at it for what it is, not make it an issue because you love FireFox so much!
Perhaps, perhaps not. Depends when it was discovered.
That you can't see a difference should clue you in to the fact that you aren't educated enough to have a valid opinion.
IE is part of a crappy OS, it doesn't just run on top of it. It is part of it. That means any exploit is automatically more severe because of it.
IE has thousands and thousands of security exploits floating around.
MS takes months to push out a fix, and when it is complete they wait for "patch day" to come around, even if it is three weeks away and some worm is ravaging its customers machine.
Every non-trivial piece of software will have bugs(yes, a flaw is usually a bug) in it. That is a given. It doesn't excuse anyone for having massive amounts of flaws and exploits floating around for its piece of crap program.
If Firefox had new exploits written for it every day and Mozilla ignored resports for months and than taking months to push out a fix they would get taken to task as well.
But they don't. They developed their program with security in mind which brings down the number of security issues considerably, but it doesn't bring it down to zero, and never will. They don't fight bug reports, they immediately investigate, fix and patch. That what being a responsible, professional developer is about.
Secure programming, finding bugs and fixing them are not trivial exercises. They require deep understanding of not only the language you are using but the underlying OS memory management and what is going on in hardware. Too many "programmers" read C++ for dummies and write a hello world program and think they are qualified to be a developer. There is a reason most reputable development houses require at least a CS degree since most reputable CS programs give its students the background knowlege required to be a programmer, even with languages and frameworks that handle memory for the programmer. There are still many security and performance related issues that someone with the proper background can catch. Although sadly, very few CS programs require or even offer security specific courses, but this is slowly changing.
I fully agree with the last paragraph of your statement, having done developing myself. I'm plaing devil's advocate here: while I agree that MS should not have made Internet Explorer part of the OS, there is absolutely no proof that Mozilla could handle the bugs, flaws, or whatever you would like to call them any better.
- by macadato July 21, 2008 5:04 AM PDT
- Firefox is the safest browser on earth.
- Like this Reply to this comment
-
Showing 1 of 2 pages (28 Comments)