Comments on: Symantec: Mozilla browsers more vulnerable than IE

But the security specialist also finds that Microsoft's browser is the only one widely exploited by hackers today.

[System Tyrant]

My opinion.

Sounds to me like an incomplete report. From their own admission it doesn't take into consideration how fast a flaw is fixed or how many are still open.

It looks to me more like a one sided report trying to make open source look less secure than closed source. Not having read the report it sounds like what it might be saying is that flaws are easier to find in open source than in closed source.

Without consideration for how long each browser took to fix the flaw and the number of exploits before a patch was released this report just doesn't look like much to help a user or company make an informed decision on what browser to use (if that was the purpose of the report). Like I said though I haven't read the report and you can't go by what the press says, so it maybe just the oppisite of that.

[nrlz]

also other things to consider

- Scope of the bug in terms of the size of the affected area as opposed to just its severity. (e.g., a security bug in bookmarks vs. a bug in the Javascript engine)

- Speed of which bugs are fixed in terms of the complexity of the architecture. (e.g., fixing bugs in Notepad vs. Visual Studio)

- Quality of fix in terms of whether the bug is cerified not to affect other features or third-party applications. (Imagine if an IE fix actually disabled Microsoft Office! Havoc!)

- Quality of support in terms of providing help and documentation to the end-users, whom apply the patches. (ISO:9000)

[Ishvale]

Your 'opinion'

Perhaps you should read the report before offering your obviously biased comments?

[System Tyrant]

My opinion.

Sounds to me like an incomplete report. From their own admission it doesn't take into consideration how fast a flaw is fixed or how many are still open.

It looks to me more like a one sided report trying to make open source look less secure than closed source. Not having read the report it sounds like what it might be saying is that flaws are easier to find in open source than in closed source.

Without consideration for how long each browser took to fix the flaw and the number of exploits before a patch was released this report just doesn't look like much to help a user or company make an informed decision on what browser to use (if that was the purpose of the report). Like I said though I haven't read the report and you can't go by what the press says, so it maybe just the oppisite of that.

[nrlz]

also other things to consider

- Scope of the bug in terms of the size of the affected area as opposed to just its severity. (e.g., a security bug in bookmarks vs. a bug in the Javascript engine)

- Speed of which bugs are fixed in terms of the complexity of the architecture. (e.g., fixing bugs in Notepad vs. Visual Studio)

- Quality of fix in terms of whether the bug is cerified not to affect other features or third-party applications. (Imagine if an IE fix actually disabled Microsoft Office! Havoc!)

- Quality of support in terms of providing help and documentation to the end-users, whom apply the patches. (ISO:9000)

[Ishvale]

Your 'opinion'

Perhaps you should read the report before offering your obviously biased comments?

Symantic is becoming....

the new disinformation minister.
They will do anything to keep people using Windows and IE...more
profit.

[sanenazok]

Vested Intersts

Symantec is MS licensor of several technologies, such as the defragmenter, and most likely the future anti-virus. Whatever happened to disclosing such financial ties. Guess corporate misinformation suits did not go far enough. Arr the pirate sez: "arrrr ye matey me smell a rat."

Like you said, more users of IE, more market for Symantec.

[Sentinel]

Symantec and MS

Symantec has always been a Microsoft lackey. They are one of those companies who forced their clients to buy upgrades for their software just to make it compatible with Windows XP when it was first released. It's not surprising that they put out reports flaming open source browsers (like someone said, if people use IE, it means more profit for them).

Symantic is becoming....

the new disinformation minister.
They will do anything to keep people using Windows and IE...more
profit.

[sanenazok]

Vested Intersts

Symantec is MS licensor of several technologies, such as the defragmenter, and most likely the future anti-virus. Whatever happened to disclosing such financial ties. Guess corporate misinformation suits did not go far enough. Arr the pirate sez: "arrrr ye matey me smell a rat."

Like you said, more users of IE, more market for Symantec.

[Sentinel]

Symantec and MS

Symantec has always been a Microsoft lackey. They are one of those companies who forced their clients to buy upgrades for their software just to make it compatible with Windows XP when it was first released. It's not surprising that they put out reports flaming open source browsers (like someone said, if people use IE, it means more profit for them).

The foundation OS, is the FLAW, no matter the browser veiled ovder it

Windows security is Non-existent, thats the basis of this study.
No matter what internet browser is placed on top if Windows,
the cracks or hooks in this operating system are still present no
matter what browser is used.

Sure, Firefox browser doesnt have as many pre-built hooks
down into Windows as Internet Explorer does, probably because
reverse-engineering Windows code is against the law for them,
but if the bricks of this Internet house are built on top of
Windows, there is only so much protection you can have.

The ultimate goal would be for MSFT to build a true Internet OS,
one that is not for the desktop, does not have hooks to DCOM,
or .exe, or Active-X. Until Windows is locked down, by design,
from the start, no browser will be able to protect PC users from
the features Windows offered to businesses for tying data
together, that are subsequently used by the hackers to tie the
hooks into a "web" of unintentional process calls and backdoor
traps.

Using a more secure OS from the beginning is the only solution,
and with Bill Gates screwing his unknowing customers any
chance he gets, this will not happen anytime soon.

What a shame as we waste countless hours and billions of
dollars while he got the fortunes by making a horses rump of
you with his desire to stop Netscape at any cost; lets just mash
IE into Windows.

Although Gates is dumb, he is betting that many others are
dumber than he is, thus they keep buying Windows.

Why doesn't Mozilla care about security?

If Windows is so insecure, why are those that write Mozilla-based browsers targeting it? Don't they care about security?

Microsoft has the burden of maintaining compatiblity with Windows code that predates the Internet era and its risks.

What is Mozilla's excuse?

[rabjrcnet]

Gratitude for your comments

I have often wondered what would happen with a
sudden demise of Bill Gates/WINDOWS

[rabjrcnet]

Gratitude for your comments

I have often wondered what would happen with a
sudden demise of Bill Gates/WINDOWS

[rabjrcnet]

Gratitude for your comments

Let's try that again ...
The problem seems to reside more in the
"cattle herd" mentality of the American people,
even though the cut-throat practices of Bill Gates
are not to be denied. If Bill/WINDOWS perished
tomorrow, would we be able to accelerate the
development of LINUX to replace WINDOWS, any more
than we could accelerate billions of dollars of
relief to the victims of Hurricane Katrina at
New Orleans?
As a mathematician/chemist/electronics
engineer, I can only comment about the disapproval
of my purchase of a 2000 HONDA Insight. I was
told how stupid it was to buy untried motor-based
technology, even if we've known how to wind a
motor since the beginning of the last century.
Five years later, modulo a small amount of
aftermarket modification (AMSOIL synthetics
in place of "genuine HONDA"), here I am getting
as much as 90.0 mpg @ warm weather/level highway
cruising, while the rest of you are green with
envy as you get pummelled with wild fluctuations
of gasoline prices.
Analogously, we can talk about the better
security accoutrements of LINUX/UNIX, but I don't
suppose that we can expect LINUX to take the
place of WINDOWS until China and a lot of other
nations adopt LINUX and thereby force the hand
of the United States to do likewise.

The foundation OS, is the FLAW, no matter the browser veiled ovder it

Windows security is Non-existent, thats the basis of this study.
No matter what internet browser is placed on top if Windows,
the cracks or hooks in this operating system are still present no
matter what browser is used.

Sure, Firefox browser doesnt have as many pre-built hooks
down into Windows as Internet Explorer does, probably because
reverse-engineering Windows code is against the law for them,
but if the bricks of this Internet house are built on top of
Windows, there is only so much protection you can have.

The ultimate goal would be for MSFT to build a true Internet OS,
one that is not for the desktop, does not have hooks to DCOM,
or .exe, or Active-X. Until Windows is locked down, by design,
from the start, no browser will be able to protect PC users from
the features Windows offered to businesses for tying data
together, that are subsequently used by the hackers to tie the
hooks into a "web" of unintentional process calls and backdoor
traps.

Using a more secure OS from the beginning is the only solution,
and with Bill Gates screwing his unknowing customers any
chance he gets, this will not happen anytime soon.

What a shame as we waste countless hours and billions of
dollars while he got the fortunes by making a horses rump of
you with his desire to stop Netscape at any cost; lets just mash
IE into Windows.

Although Gates is dumb, he is betting that many others are
dumber than he is, thus they keep buying Windows.

Why doesn't Mozilla care about security?

If Windows is so insecure, why are those that write Mozilla-based browsers targeting it? Don't they care about security?

Microsoft has the burden of maintaining compatiblity with Windows code that predates the Internet era and its risks.

What is Mozilla's excuse?

[rabjrcnet]

Gratitude for your comments

I have often wondered what would happen with a
sudden demise of Bill Gates/WINDOWS

[rabjrcnet]

Gratitude for your comments

I have often wondered what would happen with a
sudden demise of Bill Gates/WINDOWS

[rabjrcnet]

Gratitude for your comments

Let's try that again ...
The problem seems to reside more in the
"cattle herd" mentality of the American people,
even though the cut-throat practices of Bill Gates
are not to be denied. If Bill/WINDOWS perished
tomorrow, would we be able to accelerate the
development of LINUX to replace WINDOWS, any more
than we could accelerate billions of dollars of
relief to the victims of Hurricane Katrina at
New Orleans?
As a mathematician/chemist/electronics
engineer, I can only comment about the disapproval
of my purchase of a 2000 HONDA Insight. I was
told how stupid it was to buy untried motor-based
technology, even if we've known how to wind a
motor since the beginning of the last century.
Five years later, modulo a small amount of
aftermarket modification (AMSOIL synthetics
in place of "genuine HONDA"), here I am getting
as much as 90.0 mpg @ warm weather/level highway
cruising, while the rest of you are green with
envy as you get pummelled with wild fluctuations
of gasoline prices.
Analogously, we can talk about the better
security accoutrements of LINUX/UNIX, but I don't
suppose that we can expect LINUX to take the
place of WINDOWS until China and a lot of other
nations adopt LINUX and thereby force the hand
of the United States to do likewise.

[Nathan Lunn]

But the report, released Monday...

Released where? Since the story (conveniently) neglected to supply a link to the report, here it is. Although, you will have to give much personally identifiable information to Symantic, the Great Security Company that they are, in order to download the 106 page PDF report.

https://ses.symantec.com/content.cfm?articleid=1539

[Nathan Lunn]

But the report, released Monday...

Released where? Since the story (conveniently) neglected to supply a link to the report, here it is. Although, you will have to give much personally identifiable information to Symantic, the Great Security Company that they are, in order to download the 106 page PDF report.

https://ses.symantec.com/content.cfm?articleid=1539

[Earl Benser]

Once more.....

... we seem to have a solution in search of a problem. Symantec
makes fairly good virus protection software, but other than for
MS products, the need for Symantec's programs is quite low.
With no threat, no sales.

As reported: "Symantec admitted that "at the time of writing, no
widespread exploitation of any browser except Microsoft
Internet Explorer has occurred," but added that it "expects this
to change as alternative browsers become increasingly widely
deployed.".

Can't blame them for trying to pump sales. But we don't have to
pay any serious attention to their rather obvious marketing
maneuvers.

[Earl Benser]

Once more.....

... we seem to have a solution in search of a problem. Symantec
makes fairly good virus protection software, but other than for
MS products, the need for Symantec's programs is quite low.
With no threat, no sales.

As reported: "Symantec admitted that "at the time of writing, no
widespread exploitation of any browser except Microsoft
Internet Explorer has occurred," but added that it "expects this
to change as alternative browsers become increasingly widely
deployed.".

Can't blame them for trying to pump sales. But we don't have to
pay any serious attention to their rather obvious marketing
maneuvers.

[aabcdefghij987654321]

Mitchell Baker is.... a man?

Quoting the article:
"Mitchell Baker, president of the foundation, said earlier this year that its browsers were fundamentally more secure than IE. He also predicted that Mozilla Foundation browsers would not face as many problems as IE, even as their market share grows."

Mitchell Baker is a woman:
http://tinyurl.com/dd9tm

Good way to check the sources!

[WebmasterOfWarStoke.com]

lol

sometimes i thing cnet is as bad as CBS at checking sources lol

[Jon Skillings]

Pronoun fixed...

...in reference to Mitchell Baker. Thanks for catching that.

[aabcdefghij987654321]

Mitchell Baker is.... a man?

Quoting the article:
"Mitchell Baker, president of the foundation, said earlier this year that its browsers were fundamentally more secure than IE. He also predicted that Mozilla Foundation browsers would not face as many problems as IE, even as their market share grows."

Mitchell Baker is a woman:
http://tinyurl.com/dd9tm

Good way to check the sources!

[WebmasterOfWarStoke.com]

lol

sometimes i thing cnet is as bad as CBS at checking sources lol

[Jon Skillings]

Pronoun fixed...

...in reference to Mitchell Baker. Thanks for catching that.

[dysonl]

Misleading Title

Unfortunately, most people will read only the title and form an opinion as to which browser is better.

RE: Misleading title

Be responsible in your reporting. A misleading title, in this case, can cause serious harm. Even though Mozilla may have had more security vulnerabilities discovered early in 2005, it is still much safer to NOT use IE.

During the last two years, several friends have solicited my help repairing their computers after receiving trojans through IE or Outlook Express. Trojans are at epidemic proportions right now and MS is slow fixing the vulnerabilities because they don't have any competition.

BTW, my favorite browser is currently Opera. http://opera.com/

[dysonl]

Misleading Title

Unfortunately, most people will read only the title and form an opinion as to which browser is better.

RE: Misleading title

Be responsible in your reporting. A misleading title, in this case, can cause serious harm. Even though Mozilla may have had more security vulnerabilities discovered early in 2005, it is still much safer to NOT use IE.

During the last two years, several friends have solicited my help repairing their computers after receiving trojans through IE or Outlook Express. Trojans are at epidemic proportions right now and MS is slow fixing the vulnerabilities because they don't have any competition.

BTW, my favorite browser is currently Opera. http://opera.com/

[dabruro]

vulnerabilities: 31 for IE vs 28 for Firefox

Including the secunia vendor-unacknowledged ones:
13+18=31 for MS IE
25+ 3=28 for Firefox

[c|net Reader]

c|net: Where's the Balance?

As revealed, the total vulnerability picture is different than the one you've permitted Symantec to market. Proper balance in your story--aside from a less controversial title--calls for showing the Secunia statistics and explaining the difference between the numbers. It would seem that Mozilla quickly owns up to vulnerabilities (and fixes them in short order), whereas MS sits on vulnerabilities and won't acknowledge them. There can be good reasons to not acknowledge a vulnerability, including reasonable time to verify, but they shouldn't preclude reporting the whole story.

[adlyb1]

But...

The argument for open source has always been thousands of eyes means less bugs in the wild.

By my count, you are only 3 better.

The reality is many components in Open Source projects are written by very small teams or even a single individual and code reviews are only done when problems surface with application testing.

I'm not knocking Open Source (I have actually worked on three projects). I'm just tired of people overhyping technology. Its a complex application made by humans...there will be problems.

[dabruro]

vulnerabilities: 31 for IE vs 28 for Firefox

Including the secunia vendor-unacknowledged ones:
13+18=31 for MS IE
25+ 3=28 for Firefox

[c|net Reader]

c|net: Where's the Balance?

As revealed, the total vulnerability picture is different than the one you've permitted Symantec to market. Proper balance in your story--aside from a less controversial title--calls for showing the Secunia statistics and explaining the difference between the numbers. It would seem that Mozilla quickly owns up to vulnerabilities (and fixes them in short order), whereas MS sits on vulnerabilities and won't acknowledge them. There can be good reasons to not acknowledge a vulnerability, including reasonable time to verify, but they shouldn't preclude reporting the whole story.

[adlyb1]

But...

The argument for open source has always been thousands of eyes means less bugs in the wild.

By my count, you are only 3 better.

The reality is many components in Open Source projects are written by very small teams or even a single individual and code reviews are only done when problems surface with application testing.

I'm not knocking Open Source (I have actually worked on three projects). I'm just tired of people overhyping technology. Its a complex application made by humans...there will be problems.

[WebmasterOfWarStoke.com]

geeze

sometimes i think that certin companies are in certin other companies back pockets
ive noticed not just symantec but several other companies bad mouthing firefox for the last couple of months ever since they broke the 15% marketshare usage barrier
its like somone is afraid ;)
well if you are realy wanting tobe secure you can use the updated CVS versions of Mozila and firefox updated almost every day
to keep up with all the security problems or do like i do and grab the most recent major revision when ever an update is available

[WebmasterOfWarStoke.com]

geeze

sometimes i think that certin companies are in certin other companies back pockets
ive noticed not just symantec but several other companies bad mouthing firefox for the last couple of months ever since they broke the 15% marketshare usage barrier
its like somone is afraid ;)
well if you are realy wanting tobe secure you can use the updated CVS versions of Mozila and firefox updated almost every day
to keep up with all the security problems or do like i do and grab the most recent major revision when ever an update is available

[dam7ri]

Apples & oranges

What everyone fails to realize is that Symantec found 25 flaws in the first 6 months of this year, in Firefox. How many flaws have been found in IE, since its release? What version of IE are we on now, and we are still dealing with the same flaws as the previous versions. Let's not even take into account the length of time that we are exposed to vulnerabilities, with IE. Firefox gets fixed, quickly.

You make a good point.

Looking at the number of flaws is one thing..... looking at how fast
those flaws are patched...and if they were taken advantage of is
entirely different.
As we all know.. Microsoft is in the habit of waiting until it is too
late.

Plus... there were 10,866 new Microsoft Windows virus and worm
variants in first half 2005... scary.

[dam7ri]

Apples & oranges

What everyone fails to realize is that Symantec found 25 flaws in the first 6 months of this year, in Firefox. How many flaws have been found in IE, since its release? What version of IE are we on now, and we are still dealing with the same flaws as the previous versions. Let's not even take into account the length of time that we are exposed to vulnerabilities, with IE. Firefox gets fixed, quickly.

You make a good point.

Looking at the number of flaws is one thing..... looking at how fast
those flaws are patched...and if they were taken advantage of is
entirely different.
As we all know.. Microsoft is in the habit of waiting until it is too
late.

Plus... there were 10,866 new Microsoft Windows virus and worm
variants in first half 2005... scary.