Mozilla fixes risky Firefox flaw

TalkBack 44 of 137:

Next »

« Previous

• Thread View
• Flat View

With all due respect...check your sources

The information you are presented with in the article is neither complete nor accurate. It is always good practice to double check your sources and what exactly they mean by high severity (it is very oppinionated and many vendors have different oppinions), therefore I checked a neutral source with nothing to gain from either browser suffering. In the IT field a highly regarded source is a site called Secunia. Secunia has long been considered the best neutral source for security profiles on applications (note: I have no connection to Secunia). I'm just stating this so readers understand their credibility.

According to Secunia, Internet Explorer 6.0 has 14% vulnerabilities marked at extremely critical. 29% allow system access to your machine, another 19% allows a security bypass. Secunia currently has 79 vulnerabilities noted for IE 6.0. 20 vulnerabilities remain unpatched and at least one unpatched is considered highly critical.

Firefox on the other hand has only 12 security vulnerabilities in version 1.0, in beta releases (0.x versions) there were 26. Even if you add them together its still nearly half the number of Internet Explorer's. Out of Firefox 1.0's vulnerabilities, 4 remain unpatched. Now here is the important part: A bad vulnerability in firefox involves spoofing a web site to make it look like another site, a bad vulnerability in IE involves full system access or bypassing security features. The highest a firefox vulnerability has been rated by secunia is "Moderately Critical", where as IE has many rated as "Extremely Critical" (the highest severity you can get).

Please read over the site, even check out some others if you wish to verify the data (such as Security-Focus). Firefox's largest problem with security is with websites spoofing other websites, and that is considered severe to firefox. In IE a spoofing vulnerability is nothing considered to the many ways for a remote person to take over your system. You really have to put things in persepctive.

It is important to note that all of this information is based on machines that are fully up to date with patches and service packs. See the truth is, IE is integrated with the operating system. There is no reason why a web browser should *ever* have access to your OS, but yet IE is like a tunnel right into it. Firefox is more isolated, this is why system access through firefox is much more rare and when it does happen, its usually only under very special circumstances.

As far as code maturity goes, both the base code for IE and Firefox is nearly a decade old and bugs have been worked out of both for an equally long time. Firefox is constantly rewritting its legacy code with new code to be more secure, as most of its security problems stem from its old Netscape code. Its an on going battle but Firefox is currently definitly the winner in security (and arguably features too). Don't let one article with various quotes (possibly) taken out of context let you think otherwise. The misinformation presented in the article makes me weary of the credibility of the rest of it.

Regards,
Steve

Posted by: sgk284   Posted on: 03/23/05 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Building the Virtualized Enterprise with VMware Iinfrastructure VMware VMware virtualization software has been adopted by over 120,000 enterprise ... Download Now
• The Impact of Virtualization Software on Operating Environments VMware Today's use of virtualization technology allows IT professionals to ... Download Now
• Key Strategies for Federal Agencies - Safe and Cost Effective Migration for Legacy Hardware GovConnection The federal government has mandated that federal agencies reduce energy ... Download Now