Slashdot Log In
New IE Holes Discovered
Posted by
CowboyNeal
on Sat Nov 29, 2003 09:08 AM
from the yes-even-more dept.
from the yes-even-more dept.
joelt49 writes "Yahoo! News is reporting that 7 new security holes for Internet Explorer have been discovered by a Chinese researcher; however, there apparantly aren't any attacks on IE yet." The part about this story that gets to me is that the researcher didn't alert Microsoft before posting to a public mailing list. Sure, a lot of people don't like Microsoft, but that's no reason to make it worse for the millions of people who are forced to use Microsoft products, especially for security holes which have yet to be exploited.
This discussion has been archived.
No new comments can be posted.
New IE Holes Discovered
|
Log In/Create an Account
| Top
| 801 comments
(Spill at 50!) | Index Only
| Search Discussion
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
(1)
|
2
Incident response times (Score:5, Insightful)
(http://www.astradyne.co.uk/tet | Last Journal: Friday November 09, @08:34PM)
Yep, not ideal. But it'll be interesting to see whether MS's claims of having a faster response time to security incidents that the Linux community stands up. Will they have a patch available withing the next day or so? You can guarantee that the Mozilla or Konqueror communities would have in the same circumstances...
Re:Incident response times (Score:5, Informative)
(http://troed.se/ | Last Journal: Wednesday April 16 2003, @03:42AM)
Feel free to Google.
No Exploit, eh? (Score:5, Informative)
(http://www.assurancetechnologies.com/ | Last Journal: Tuesday October 28 2003, @10:37PM)
Exploit code, anyone? A simple google search or a Bugtraq archive browse should do it.
Re:No Exploit, eh? (Score:5, Insightful)
(http://djdavetrouble.com/ | Last Journal: Thursday September 01 2005, @10:34PM)
Re:Incident response times (Score:5, Informative)
It's even worse when done by design [winntmag.com]. Once a scoundrel - always a scoundrel.
Re:Incident response times (Score:5, Insightful)
(http://chexsum.blogspot.com/ | Last Journal: Friday August 23 2002, @02:23AM)
I can understand Internet Explorer needing to be tested against the rest of Windows and its APIs but Mozilla is a stand-alone web browser - as long as the API isnt affected it ['full regression testing'] shouldnt matter too much IMO.
Re:Incident response times (Score:5, Insightful)
This is also something to watch out for when developers try to mimic the Microsoft Windows system while making Linux more and more user friendly.
IMHO
LoB
Re:Incident response times (Score:5, Insightful)
Code reuse is code reuse, whether it is Windows, Unix, or any other OS/app. Modern programmers are taught to do code reuse, and saing "This is not the design methodology used in the *nix world" is plain stupid.
When gzip security hole was discovered, it hit hundreds of Unix applications, because they reused the code from this library. Is the "design methodology" any different?
The gzip bug demonstrated that it sometimes can even be worse on *nix, due to source code coping instead of shared libs, so that the bug had to be fixed in multiple places.
By the way, Netscape was / Mozilla is actively trying to make itself a platform for writing applications using its XPCOM/XUL and other technologies. It is not very successful so far, but when it will, its bugs and patches will hit lots of independent applications, just like bugs/patches in IE do now.
Re:Code reuse is code reuse (Score:5, Insightful)
And you don't know anything about gzip vulnerability and instead generalize your ideas of how it should be to how it is actually done.
Lots of applications were using customized version of gzip, e.g. Linux kernel used a trimmed down version of gzip. They could not be simply recompiled with new library - the bug had to be fixed in every copy of the source code - yet, it was code reuse via copy/paste as much as it could possibly be. Too little applications used shared library, so even those application that used standard gzip had to be rebuild with new static library.
And if *nix world moves to using shared libraries more, it will face the same problem Microsoft has - a single security fix in a single shared library can potentially break any of hundred applications that use this library, and all these applications has to be tested with patched version. Which is still better than patching hundred applications independently.
Re:Incident response times (Score:5, Insightful)
Re:Incident response times (Score:5, Insightful)
(http://smatch.sf.net/ | Last Journal: Tuesday May 17 2005, @04:19PM)
Re:Incident response times (Score:5, Insightful)
(http://slashdot.org/)
Re:Incident response times (Score:5, Insightful)
This gets back to the terms sproketboy used: no "commingling" in a "properly written application".
I won't go into a 10-page lecture on software engineering. But just because an application is depended on by any others doesn't mean they're comingled, or improperly written. A good component app will have a limited number of interfaces to the rest of the system (on the order of 10-200, and hopefully towards the low side).
Testing the program's correctness on those interfaces gives you a high trust that it'll work correctly in the larger system.
Microsoft(tm) IE(r) isn't like that. It doesn't have defined interfaces to the rest of the system. Its not an application which runs on the OS kernel and talks with other apps. It's source code is intermixed with much of the rest of the Windows OS. Testing every interface isn't enough to show that a new version is working right... you'd have to go through every line of code and see how it might possibly perturb Windows itself.
Compared to component-interface testing, that's a prohitably lengthy task; a combinatorical explosion of places to check.
no Kate working no editors
Again, Kate is one component, and testing that component's agreement with each of its public interfaces should be enough to verify there are no critical bugs. That only works if the components are well-separated enough. But separation leads to slowness, and Microsoft wants to be fast.
Microsoft doesn't either (Score:4, Informative)
Re:Incident response times (Score:5, Insightful)
The whole premise behind FSF is that it is FREE, the user accepts some responsibility in the transaction, in this case by reporting bugs and helping to test beta versions before the code is released live. You seem to be saying that Microsoft has never released code that was not finished, 100% Quality Assured, no Security holes.....
If you believe so strongly in your statements, why do you post AC?
So I say Mod the Grandparent DOWN, MS whiners be damned!
Re:Incident response times (Score:5, Insightful)
Microsoft has released service packs that kill peoples applications, so much so that they have had to remove the service pack and put in a differnt one to patch the broken patch. Even Microsoft can't check the way everything works with everything.
The big differnce is that with open software, you can patch it yourself, or hire somebody to patch it for you. With MS, you can't patch it, and unless it effects enough people, you can't get MS to patch it either.
Re:Incident response times (Score:5, Interesting)
Have you seen what happens to people who report security issues to MS? Follow the full-disclosure and bugtraq lists sometime; you will be astounded. MS repeatedly ignores reports until there is an exploit. They have gone so far as to lock hotmail accounts of people reporting issues.
They have repeatedly demonstrated a knee jerk reaction to deny problems until they're public, at which point they announce that they've been working been on it all along.
Honestly, with their resources, they could give Linux a serious run on patch speed, but only if they change their mindset first.
Re:Incident response times (Score:4, Informative)
(http://www.on-fire.org/ | Last Journal: Monday October 15, @01:29AM)
If they are, then I can see why researchers aren't playing their silly game, especially if they discover several bugs. Further, Microsoft is giving up a small advantage they could have over open source. If they allowed non-public reporting of security bugs, then they could have that information before the crackers get it, while open source bugs are generally reported to open developer lists.
it wouldn't change anything (Score:5, Insightful)
(http://www.typecastsolid.com/ | Last Journal: Sunday November 30 2003, @08:05PM)
P.S. Is it news anymore that IE has holes?
Re:it wouldn't change anything (Score:5, Insightful)
You may be right, but it still doesn't change anything. I think this guy should have told Microsoft first, waited, if they don't respond within 48 hours, report it.
If you get a standard stupid automated copy/paste reply, report the holes.... but you SHOULD give the company some notice. As stated in the article, not giving the company any info just makes it bad for anyone having to use IE.
Is it news anymore that IE has holes?
Nope. Seriously, who here gives a crap about IE holes? Everyone here probably knows that using IE is about as secure as getting water in a fishingnet.
Re:it wouldn't change anything (Score:5, Interesting)
(http://www.pjrc.com/ | Last Journal: Thursday June 27 2002, @04:31PM)
I believe the current "best practice" is to wait at least 1 week for the vendor to initially respond... and to give them at least 1 month to create a patch if they (privately) acknowledge the problem.
But giving them ZERO hours is about as bad as it gets.
Re:it wouldn't change anything (Score:5, Informative)
Re:it wouldn't change anything (Score:5, Interesting)
(http://benandwen.net/~bwalton)
Consider that people use IE because "it's there," and not generally for any other reason. These people are going to continue to do so until the consequences are too high. Really, the same should apply to corporations too. The more often they get bent over, and the rougher those encounters are, the more the point gets "driven" home...I've been on a campaign lately trying to get people to switch from IE. I've been pushing Netscape 7.x instead of Mozilla though, as I find explaining the difference is tedious to say the least. I'd prefer if they used the AOL-brand free version, but Netscape is better than nothing.
Really, this should go for all MS products with shoddy track records. Any time you have to explain why "the computer was infected with another virus, even though you had AntiVirus software," be very _blunt_ about the reasons. Internet Explorer was designed to kill Netscape, not be secure..."Yes, you're virus signatures were up-to-date (not likely), and you still got a virus." That's because MS knew about the problem 3 months ago but it wasn't made public so they didn't fix it. It's not Norton/McAfee's fault. This virus didn't exist until yesterday...
Now, I'm not saying I think every use should immediately switch to Linux, but I do recommend Mac OS X quite often. I know that nothing is perfect, but it's time people started using _anything_ other than Windows and IE. Don't hide the flaws of the other systems. Yes, Mac OS X did have a problem recently. Nothing is perfect. Most things just happen to be more perfect than Windows and IE.
-Ben
Re:it wouldn't change anything (Score:5, Insightful)
(http://slashdot.org/)
At the end, we did not bother. After a few more months, it was made public (not by my friend though). Nowadays, reporting MS bug becomes a dangerous maneouver... If MS is really serious about security and good quality software, they would put a contact on the front page and offer reward for anyone who spots a new major bug. Before then, I don't see why we need to be nice to MS.... They say they are capitalist. We should respect their value and don't do any free work for them...
It's hardly bad... (Score:5, Insightful)
(Last Journal: Thursday March 11 2004, @12:40AM)
Sure, a lot of people don't like Microsoft, but that's no reason to make it worse for the millions of people who are forced to use Microsoft products, especially for security holes which have yet to be exploited.
If OSS people can fix the bugs in less than half a day, it should be a piece of cake for a giant software company with lots of programmers to do the same. Sure, a days warning would have been nice, but if there isn't a fix by tonight, it only shows badly on Microsoft.
Re:It's hardly bad... (Score:5, Insightful)
New Rival to Internet Explorer... (Score:5, Funny)
A spokesman was quoted as saying, "It's the only way we can release a product with more holes than IE".
It is unconfirmed if StringVest will be integrated into Windows XP SP2 or if we will have to wait until LongHorn is released.
I've been trying my best to switch people away (Score:5, Interesting)
Re:I've been trying my best to switch people away (Score:5, Interesting)
(Last Journal: Friday November 30, @12:50PM)
I have a neighbour whose computer is currently fried - it'll apparently not boot at the moment, and needs a reinstall of whatever version of Windows it runs. She came over recently and said at some point she needs to use the Internet, and when I offered to let her use my connection said "Oh, I'd be using it for hours".
So I offered her a laptop. I told her if she makes sure she uses it on the side of the appartment closest to mine she'd be within range of my wireless network "so you'll not have to do anything, just switch it on and start browsing".
"Oh" she said, obviously hearing words like "wireless" and "network" and "browser", "That sounds far too complicated!"
I am still gobsmacked about that one, but you're right: it's the words. The more you try to explain to someone how much better (or even how much easier) something is, the more complicated they assume it is. And that really works against you when trying to explain how much simpler something is because by default they assume they'll have to do all the stuff they do now: if you explain they'll not need to, it's hard to word it in such a way that it doesn't sound complicated to a non-technical user.
I suspect that's Mozilla's real problem (and the problem with so many platforms previously that were technically superior, and much more user friendly) - the technical people are the ones who realise the benefits, so everyone assumes you have to be a genius to use them.
Re:I've been trying my best to switch people away (Score:4, Insightful)
(http://uk.geocities.com/chalybeous | Last Journal: Tuesday May 04 2004, @06:37AM)
I use Mozilla Firebird [mozilla.org], myself, and like you, I've tried to encourage my friends to switch. ;-)
Doesn't help much when I'm forced to use a university workstation (like today), but I find it's a better quality browser than IE. Renders faster, blocks pop-ups, and I find tabbed browsing to be pretty much invaluable.
Of course, the best thing about Firebird is, I can still watch Doctor Who: Scream of the Shalka [bbc.co.uk]
There are, of course, some times when you have to use IE (like Windows Update, though I guess I could always just download each update manually).
The big problem I've hit is that, even with all these MSIE vulnerabilities that come out on a near-weekly basis - not to mention annoying pop-ups and pop-unders, and other little security-related issues - I don't seem to have any success.
So what's your persuasive technique for getting people onto pre-1.0, non-MS, reliable-but-not-100%-complete software?