Dept. of Homeland Security Says to Stop Using IE

LWATCDR writes "I have been saying this for a long time but now it is offical. From Yahoo News: 'The Department of Homeland Security's U.S. Computer Emergency Readiness Team touched off a storm this week when it recommended for security reasons using browsers other than Microsoft's Internet Explorer.'" In related news, rocketjam writes "According to Wired, the widespread Internet Explorer security exploit last week and CERT's subsequent recommendation that IE users should consider switching to another browser has resulted in a large spike in downloads of the Mozilla Organization's Mozilla and Firefox web browsers."

If it's broke...well....we'll fix it later

Rather than come right out and say that their I.E. browser is not yet up to snuff in terms of security issues, Microsoft issues this absolutely delicious serving of corporate double-speak:

"In the meantime, we have provided customers with prescriptive guidance to help mitigate these issues."

This translates to a set of instructions for making changes in I.E. settings since the default settings are not terribly good for security. THe MS spokesperson said that a "comprehensive" security pack for I.E. will be out later this summer. You gotta love this. You just cannot make stuff up like this!

Cheers!

Erick

Re:If it's broke...well....we'll fix it later

Repeat after me: Global Class Action Lawsuit against Microsoft. Bunch of bumbling fubars. And that ain't the only whole they haven't plugged in months...

Re:If it's broke...well....we'll fix it later

The difference of course is that Sendmail and Apache fix security vulnerabilities in a reasonable amount of time (usually days, if not hours)

Furthermore, there are generally also configuration changes you can make in the mean time to these products to nullify the vulnerabiltiy. There is nothing you can do with IE except disable ActiveX and set the security level to high which (1) makes IE somewhat unusable and (2) STILL doesn't completly protect you.

Finkployd

Re:If it's broke...well....we'll fix it later

I would venture to guess that the majority of users who (1) know to do this and (2) know how to do this are probably not using IE anyway.

Finkployd

Re:If it's broke...well....we'll fix it later

How about the majority of folks who are not using Windowx XP? Can they install "IE SP2"?

Re:If it's broke...well....we'll fix it later

I believe the poster was referring to a company knowing about a severe defect in a product and simply failing to address the issue for a ridiculously extended period of time. It's especially dreadful when the same general problem keeps recurring. For major OS products, when a problem is revealed it is quickly fixed, and the problem *stays* fixed. You simply can NOT say this about Microsoft's products.

So yeah, we have a pattern of extreme negligence on the part of Microsoft. But I guess it can't be helped because they have no incentive to fix it (thank you USDOJ).

Re:If it's broke...well....we'll fix it later

Sorry, this analogy doesn't work. If a window is unlocked, it's easy to see that is so and how to lock it.

Going a little deeper, it's all about risk/benefit. People know the risks of having a window, and feel it's worth it to have the benefits of a window.

You simply cannot say that about the Windoze/IE flaws. Most people have little understanding (even now) of the risks of using insecure software and little or no understanding of how to mitigate the risks. The benefits are obvious, but the risks are still an unknown to most users.

IANAL, but I'm willing to believe that a class action suit against MS could be mounted and might even prevail, based on the negligence of the company.

Re:If it's broke...well....we'll fix it later

My windows aren't easy. I can't just stand in my house and determine whether my windows are locked or not. Ihave to walk ove to them. I have to look at the lock. Then I have to actually try to lift the damn window, since the locks are internal and I can't ever remember if "lever to the left" means locked or unlocked. Do I have grounds for a lawsuit if I can't tell if my house is secure?

You seriously better hope a class action lawsuit *never* comes up for this. That would seriously turn the entire software industry on it's head. Where would it stop?

If I'm playing a competitive game of UT2k4 and the mouse driver cuts out, can I sue Logitech for loss of potential profits?

If I'm writing my thesis and the power cuts out, can I sue the Utilities Company for my lost tuition?

If I'm using a statistical package and, due to some bug, I determine that shooting myself in the face with a loaded shotgun has a -0.314159 probability of death, can my mourning relatives sue the company?

At what point does the software manufacturer get to say "Hey, we did our part. The rest is up to you."

It's a very slippery slope.

Re:If it's broke...well....we'll fix it later

The problem with that analogy is that the very nature of a window is inherently insecure in various ways. If you can make it 100% (or 99%) secure, it's probably not a window anymore. But there's no such attribute of an operating system and its applications - it is not a given that software is reasonably expected to be insecure, especially a many $$$ operating system. And when there are security flaws that can be fixed and they are left unfixed, that is a heckuva lot more worthy of a lawsuit than windows not made out of "1/4-inch steel".

Re:If it's broke...well....we'll fix it later

More than anything the difference in terms of lawsuits is push and pull. Microsoft pushes their browser out, consumers have no choice in the matter.

Sendmail and Apache however are pull, they are available freely but you must go out and get them yourself.

For most software it's a question of cost. In terms of free software Microsoft is the only company in a position to "push", they push using their monopoly onto oem installs. Since nobody else has that monopoly, there is nobody else who produces and distributes free (as in beer) software who should be held liable for glitches in said software.

Re:If it's broke...well....we'll fix it later

You misunderstand. I am referring to the difference between making a mistake, but then making an effort to fix it, and making a mistake, and then blaming everyone but youself. All the while not fixing it.

I'm wondering at what point it becomes criminal negligance.

Finkployd

Re:If it's broke...well....we'll fix it later

As pointed out, IE & IIS and such are paid for. Another factor is that despite the weak remedy of the DOJ antitrust suit, MS was still found to be a monopoly. This puts them into a different class than most other software.

Despite the click-wrap license which claims no liability, I think it would be easy to show the contrary and the class action is a good idea. MS is a for-profit company and as such their goal is to make money. They aren't going to write any code unless it affects the balance sheet. Time to make the exploits show up on the 10-Q.

There's more truth in Dilbert than in Farenheit 9/11

Re:If it's broke...well....we'll fix it later

Also, if you see the bug in sendmail you can (in theory) find the bug and recompile, or download a patch from someone else who has done the same.

With IE you have no option but to depend on Microsoft for patches and updates.

Re:If it's broke...well....we'll fix it later

The problem is that OEMs are not free to change the browser. If you are a Microsoft OEM, you CANNOT replace IE at all. This is the root of the problem. Computers are bought as a package deal from OEMs, and Microsoft has prevented OEMs from including competitive software in the default installs.

IE is not free

You should be entitled to the full price of Internet Explorer. Oh wait.. they offer it for free.

They don't. By their own testimony, IE is an integral part of their operating system. And indeed, several important operations in Windows are impossible to perform without IE installed. The operating system is not free, and neither are its integral parts.

Here's one

"money" , and the reality that most people use IE because of illegal monopolistic actions that resulted in MSOS being the defacto install on their computers, so they use what came with the package, which includes IE, and they are encouraged to go onto the internet without adequate instructions, or without adequate protections, both of which are well known to MS and the various vendors who sold them their computers.

When you have the vast bulk of PCs the last decade and a half being shipped with MSOS, they had a responsibility to make sure they weren't violating anti trust laws, which they failed to do, and got convicted of it.

The consumer was long ago denied any reasonable* expectation of free market choice, when the vendors themselves conspired with MS to ONLY include MSOS to such an extent. It's intent, and to my way of seeing it, is an example of RICO action and should have resulted in MS and several large vendors getting charged with criminal violations, not just civil violations, and several billionaires going to jail over it.

Even though IE is a free download, it is easily observed that most people did not have some other OS OR of their free will go "download IE", it came as a bundled app with their monopoly enforced distribution of MSOS, and the product is seriously flawed. Seriously. The EULA should be challeged, and we need to get a determination of when and how any product may be profited from, but still avoid an implied warranty for suitability for purpose. If they get granted a patent and a copyright, they have certain responsbilites when they trade it in some fashion for money. When you receive something for free, it's a different story. That's the major difference there. And if that again causes a shift in free/open source, how it's distributed, it would be worth it to force closed source/propietary and for-profit sodftware to get classed as a product that is sold, and have normal consumer protections. The tradeoffs are worth it, IMO.

* please note, I said reasonable as opposed to technical. Technically yes, they had a choice, reasonably, no, there was little choice, and still not much. Walk into any big computer store, what is the default install on the boxes there? Are any of them safe to go on the net "as is", how they are sold? No, they are not. The EULA basically is an example of a vast huge case of consumer fraud, IMO. People assume their brand new computers will work, and part of their entire computer package they purchase with real money is the software that comes with it. They would sell little if any new computers bundlked with MSOS if they were merely labled truthfully, as in "you will probably get infected with virus, malware, trojans, backdoors, etc within one hour of being on the internet with the default install and configuration if you click accept on the EULA provided for the bundled microsoft software". If that sticker was on the outside of the boxes, the stores wouldn't seel hardly any of them. How many computers and copies of MSOS would they sell then, if they were merely required to tell the truth, even keeping the current EULAs in place, exactly how they are written now?

I personally *do not care* if the entire software industry top to bottom, left to right, inside to outside has to change licensing,thinking, what they do or how they do it, enough's ENOUGH on claiming a 60 year old industry that has raked in untold hundreds of billions of dollars or more isn't mature and sophisticated enough to offer products that can be covered by minimum consumer implied warranties. Time to take the training wheels off, and get rid of the EULA get out of any responsibility "license". If it slows down releases and causes huge shifts in PHB and investors thinkings and stock holders profits, I could care less, and I bet millions more consumers feel the same exact way. Software will still be written and sold or given away, just of much better quality. Releases will be slower, but they will be much better quality. Pressure will shift from get i

Re:If it's broke...well....we'll fix it later

Repeat after me: Global Class Action Lawsuit against Microsoft. Bunch of bumbling fubars. And that ain't the only whole they haven't plugged in months...

That last sentence gives me a better idea... forget the lawsuit. Encourage their spouses to deny them until those bugs get fixed.

Call it Project Lysistrata.

Uhh... that assumes they have spouses to deny them. If not, distribute their pictures to every singles bar and sweaty-palm dating site, with a "DO NOT TOUCH THIS PERSON." warning.

If they're not plugging holes now, they certainly won't be plugging holes until the bugs get fixed!*

* "or get plugged", depending upon gender and orientation. Deny, deny, deny until the bugs are fixed!

Re:If it's broke...well....we'll fix it later

Uhh... that assumes they have spouses to deny them. If not, distribute their pictures to every singles bar and sweaty-palm dating site

These are Microsoft developers. You'd better be distributing those pictures to all the hookers and massage parlors in and around Seattle.

Re:If it's broke...well....we'll fix it later

What is a 'Global Class action Lawsuit'? is this when the entire planet sues a company?

Perhaps Microsoft didn't adhere to Global Law and will face a Global Court. In front of this World Court where juristiction is not in any way ambiguous, microsoft shall be cleansed of all the evil wealth it created and be forced to continue to work for free on open source projects.

Re:Why's Parent "Funny?"

Quicken, Photoshop, and 3D CAD (SolidWorks). I rely on those programs. Make Linux run them and I'll switch immediately. Until then, I suffer with MS crap, along with the rest of the world.

Your reaction makes perfect sense - use what OS you need to to run the apps you want - but your post also contains the incorrect implication that there's something that Linux could do to make those apps run on it. There isn't. It's entirely in the hands of the application writers, and market forces. That's not something linux itself can change. It's a social problem, not a technical one. The apps don't exist on linux because the companies that make them don't think the effort to port would bring them enough new customers. This has nothing do to with any deficiencies in the OS itself. None.

Re:If it's broke...well....we'll fix it later

How about partials? Have they plugged any partials lately?

Only partially. (sorry about that;)

Re:If it's broke...well....we'll fix it later

It would be equally interesting if the US decided to class action the GOP for allowing MS to continue bundling IE in the OS when it
a) knew of the problems at hand
b) had already proven this was a monopolistic practice because of lack of choice
c) Balked at the chance to remedy the situation after b) was proven true in court, thus forcing numerous citizens to be exposed to risk without their choice or consent

"Willful neglect"?

(FTR: I do not generally approve of a sue-happy society)

Re:If it's broke...well....we'll fix it later

Doesn't the click-wrap license agreement stipulate that you agree to "indemnify and hold harmless" (or however it's phrased) Microsoft, such that you don't have recourse to lawsuit? IANAL, but that's my reading of it.

Leaving aside whether or not click-wrap licenses are actually enforceable, I suggest that all the folks who aren't using any MS products at all (myself included) -- and as such haven't agreed to any such nonsense -- band together to join a class action suit against them. Whether it's for all the time we're stuck burning, having to fix the Windows PCs our friends, family, &c constantly need fixed, network outages caused by virii that use Windows exploits as a vector (my ISP [cable] was more or less buried under the overload in traffic from MyDoom and Welchia or whatever they were called, to the point that their only recourse was turning off infected users' connections).

Does "people who don't use a product but are still inconvenienced, put out and may even have suffered financial loss (as did a friend of mine when our ISP choked on virus traffic) because of its foreseeable and preventable problems" consitute a class?

Re:If it's broke...well....we'll fix it later

Yes and Yes.

THIS SOFTWARE IS PROVIDED "AS-IS" WITHOUT ANY WARRANTIES....

Class action lawsuits are bullshit anyway. Only the attorneys and the class-leader(s) get any significant money. Everybody else gets twenty bucks after they fill out a mountain of paperwork. I'm glad I live in a state with no class action status.

Re:If it's broke...well....we'll fix it later

"Doesn't the click-wrap license agreement stipulate that you agree to "indemnify and hold harmless" (or however it's phrased) Microsoft, such that you don't have recourse to lawsuit?"

Yeah, but, wasn't it just a few weeks ago, that a company got out of legal problems involved with privacy (an airline?), because they argued that most of the plantiffs probably did not read the privacy statement they clicked to agree with....and therefore it wasn't binding.

Well, if that works in reverse...just claim you never read those click through EULA's.....and therefore aren't bound by them...and so you can sue.

Seems fair....?

Re:If it's broke...well....we'll fix it later

This is the wrong way to to. MS should lose market share for being insecure, that's certainly true, but the #1 reason that we suffer so much from MS' operating systems is the homogeneity of the OS market, and while they've fought as hard to stay on top as any other corporation would have, I'm not willing to say that it's their fault that everyone has been saying "screw security, I need Word" for 10 years.

We knew better, but we got burned. Now is the time to take responsibility for our actions and switch to non-MS products.

Re:If it's broke...well....we'll fix it later

Maybe this is a good time for all those to start badgering "IE Only" web sites (especially financial institutions) to wise up and support other browsers due to the security issues. I'm lucky my bank has already "seen the light" and started supporting any standards compliant browser.

For a while, I have had to have my browser lie to web sites about what it is on too many sites. For the most part, this is no longer needed.

Re:If it's broke...well....we'll fix it later

The #1 reason for security holes in MS products is NOT the homogeneity of the OS market. It is clearly a failure of Microsoft to take security seriously from the start. They programmed an OS that did everything for the stupid user so the stupid user wouldn't have to think. They ignored all the standards and specs to throw in their own proprietary garbage.

It amazes me that no one has pointed out the obvious:

With their TREMENDOUS market share, Microsoft has a moral (and probably legal) obligation to secure their software and they have failed to do this for years. Entire industries depend on MS software. There is no excuse. Failure to do this is simply immoral and unethical, but we have come to expect this behavior from MS.

Frankly a class-action lawsuit is long-overdue.

Re:If it's broke...well....we'll fix it later

...Entire industries depend on MS software. There is no excuse. Failure to do this is simply immoral and unethical, but we have come to expect this behavior from MS.

Remember, M$ is a corporation. Corporations have but one gole: profit. Morals come into play only when they affect profit. As M$ has a virtual desktop monopoly (for the moment), they have no need of morals.

Now if high level executives start doing hard time for the crimes the corporation(s) they run commit, morals will have a much greater influence.

Can we can this rubish once and for all please?

I don't know where you USian guys get this rubish about companies have only one goal, the damned profit.

You have been brainwashed and repeat your little mantra like the good Chinese workers used to parrot Mao's Red Book.

Companies can be the expresion of an ideal, the realization of a dream or the intent to attack social problems. You have companies that have been set up to ensure fair trade of tea and coffee, other companies that operate in a cooperative basis in which the workers are owners and benefit.

In Brazil a well known style of management (like some forward thinking USian companies like Google) support their employees to start their own businesses on their free time using company's resources that otherwise would not be utilized.

Many companies have programs to vinculate them with their local communities (mine is one of them) helping with reading skills, IT skills on deprived schools, and promoting on their employees a culture of solidarity and social responsibility. Many of you don't know, but many corporations have strict guidelines about what is legal or moreal and what is not, and employess are lectured constantly (to the point of boredom) about legal and moral obligations.

There are companies out there that compete trying to put innovative products on the market and not by the shameful "embracing and extending" touted by the greatest megalomaniac of the IT industry.

The companies are what you want them to be, if they only pursue profit without regards for the consequences it is because greedy unscrupulous individuals have been made heroes by their peers, the media and unsuspected Red Book reciters.

Re:If it's broke...well....we'll fix it later

Let's see.. 10 years ago I was thinking how cool it was that I could have a windowing system of any kind on a cheap generic computer. What were the alternatives to Win3.1 on DOS for my 486? By the time OS/2 came out, it was too late. Windows owned the market. Why bother with OS/2 then?

I mean, really. In 1994, I was not thinking, "Oh geez, these worms and trojans and virii sure are a pain unique to Windows--maybe I could switch to some UNIX-like OS on my Intel computer." I was thinking, "How can I get the web working with my 14.4 modem?" and "Wow, CD-ROM drives sure are cool."

Re:If it's broke...well....we'll fix it later

Oh, please. A managed runtime is not a magical security bullet. In the case of Internet Explorer here, these are not the buffer overflows, off-by-one or signedness errors that a managed runtime could ever protect against. These are simple security design errors. Microsoft wanted to show how great their IE engine was and implemented security zones so that local HTML-only applications could exist using the engine. They are being burned by this, now, as people find new ways to turn the higher security 'Internet Zone' into the lower security 'My Computer' or 'Trusted Sites' zones.

Of all programming errors, buffer overflows, off-by-one, and signed mistakes are some of the easiest spot and to fix. Other errors, like SQL injection, privledge separation, races and the dozens of other errors that can cause crashes, security vulnerabilities, or denial of service attacks, can not be protected against by a managed language because they're outside the scope of the language itself.

Re:If it's broke...well....we'll fix it later

Though Apache is demonstratably better than IIS, and there is plenty of proof that anything database, filesystem or network related is far better in Linux than in Windows, I am uncertain about desktop software.

My impression is that the stuff being forced onto the Linux desktop is as huge of a bloated and hacked mess as anything coming out of Redmond, and that only the variety and minor market share of any of them is preventing exploits as bad or worse than anything in IE. Though I doubt anything on Linux is as bad as Outlook, but neither is anything else from Redmond that bad.

Capitolism

"Global Class Action Lawsuit against Microsoft"

This is what people don't understand about capitalism. If you don't like the product, you don't have to sue, just stop using the damn product.

I really hate this attitude, "the man keeps us down, so lets sue." It makes absolutely no sense at all. Corporation uses child labour to make affordable products, sue them. Heaven forbid you should accept responsibility for it and stop buying their low-quality products. MSFT sells software for too much money, sue them, don't simply use something else. It's no wonder we have so much unnecessary litigation in this country.

Re:Capitolism

"Capitolism": The tendency to put golden domes on buildings.

Seriously, avoiding certain purchases only goes so far. If action isn't taken to proactively stop clothing manufacturers from using sweatshop child labor, then they'll keep doind so, forcing everyone else to do the same thing or get priced out of the market. When it's all made that way, what do you do then, build a loom and start farming sheep and cotton?

Re:Capitolism

You don't quite seem to understand capitalism, I'm afraid. It's not a system that responds to public opinion and the needs of the collective social good - it responds to supply, demand, efficiency, convenience, & price. When a person makes a purchase decision, there is a very complex multi-variable equation being solved, a reflex calculation of interfering and intersecting desires as opposed to the prices of the objects for sale.

People will without fail attempt to make the choice they feel is most advantageous to themselves. Valuation is in the eye of the purchaser, and it is this that the purchaser's ethics and ideals of social good must affect in order to affect the outcome of any purchase.
People who complain about Wal-Mart's behavior yet continue to purchase Wal-Mart's goods, for example, do not weigh the cost of the social ill they believe Wal-Mart creates heavily enough against the value of the goods to stop them from making the decision to buy Wal-Mart's product.

This is exactly the same reason why consumers won't pay a price premium for the privilege of not fucking over struggling third-world coffee farmers. Bad shit that happens to other people isn't seen to be as important as bad shit that happens to one's self, even when the bad shit that happens to you is relatively trivial, such as having to spend that extra $3 for the guilt-free version.

This is precisely why courts of civil and criminal law at the state and federal levels have authority over business activities - there are many sorts of behavior that will give a company a large competitive advantage that are collectively perceived as undesirable, but which will clearly be rewarded financially by a pure system of capitalism. Undesirable and socially harmful behavior can be proscribed and reprimanded by the courts, which is a socialist aspect of our American marketplace, like it or not. I think that overall it's more beneficial than harmful, but that's just my opinion.

As regards the question of whether or not Microsoft's activities have been sufficiently harmful to consumers to merit the prosecution of a class-action lawsuit, I would suggest that it is certainly the right of American citizens to raise that question in a court of law if they feel that there is sufficient reason to do so, and that the social order we have wherein, where we would accept the decision of the court in this question, is working reasonably well in such an instance.

Re:Capitolism

Oh those Ford Pinto's that exlpode in flames when rear-ended? Don't sue, just don't buy the things...

No, lawsuits are a reasonable way to redress injury caused by faulty product design.

The economic pressure by fewer sales is one too, but especially in monopoly markets, legal instruments may be the only effective way to curtail abuses in a reasonable amount of time.

If you produce crap defective product, expect lower sales AND lawsuits. Both reduce the profit of the company and can be used a lever to induce better behavior. Both are legitimate tools.

Cheers,
Greg

Re:Capitolism

That still doesn't address previous damages. Fleeing to another product only prevents FUTURE damages. A harm has still been done. Harm will likely continue to be perpetrated until the careless party is made to be accountable.

Individuals are subjected to the "Crime and Punishment" mentality, corporate persons should be given no special treatment in this regard.

Microsoft will not be sued...

...because they are a monopoly (in regard to the IE bugs and the DHS advisory).

They will be sued because they were willfully negligent in the maintenance a monopoly product, the sabotage of which inflicts material damage upon third parties in the range of hundreds of millions of dollars.

Don't let your dislike of antitrust law cloud the real harm that this software has done. If Standard Oil had sold petroleum products that destroyed the engines of their customers during their monopoly breakup, would they still be liable for damages? Of course.

p.s. IANAL.

Translation for the Layman

Original: "In the meantime, we have provided customers with prescriptive guidance to help mitigate these issues."

This translates to a set of instructions for making changes in I.E. settings since the default settings are not terribly good for security. THe MS spokesperson said that a "comprehensive" security pack for I.E. will be out later this summer.

Translation: After all those horses get out of the way, we'll have your barn door fixed in a jiffy.

Re:If it's broke...well....we'll fix it later

It's nice to see such a rush of good news.

* Valenti gets the boot.
* AU sets up a free CA.
* European software patents are being rejected.

And now this... I guess we Americans will have a lot more to celibrate on the 4th, at this rate? :)

Hate to bust your bubble...

* Valenti gets the boot.

Sure, but he's been replaced by another DRM-lover. Trust me, there's no clue coming to the MPAA.

* AU sets up a free CA.

Ok, I'll agree with you about this bit of good news... once I see it in IE's default CA list.

* European software patents are being rejected.

Wrong. The Dutch reversed their vote. This does not *yet* invalidate them, although it is a good start... keep the pressure up on your EU representatives!

Re:If it's broke...well....we'll fix it later

"In the meantime, we have provided customers with prescriptive guidance to help mitigate these issues."

Ummm... I don't think so.... here is a link to the US-CERT Vulnerability Note VU#713878 [cert.org] which (I think) is where this all starts. Go right to the bottom (OK, this is slashdot, so I'll cut-and-paste)

Use a different web browser

There are a number of significant vulnerabilities in technologies relating to the IE domain/zone security model, the DHTML object model, MIME type determination, and ActiveX. It is possible to reduce exposure to these vulnerabilities by using a different web browser, especially when browsing untrusted sites. Such a decision may, however, reduce the functionality of sites that require IE-specific features such as DHTML, VBScript, and ActiveX. Note that using a different web browser will not remove IE from a Windows system, and other programs may invoke IE, the WebBrowser ActiveX control, or the HTML rendering engine (MSHTML).

The way I read that last sentence, CERT say you are not safe unless you get rid of the IE6 functionality.

Re:If it's broke...well....we'll fix it later

Well, at least the DoHS didn't recommend cover your Windows with plastic and using duct-tape to seal the cracks this time...

Bad Bureaucrat! Naughty!

Bad, bad, bad! No more bribes for you!

What's next, a recommendation that everyone stop using Microsoft Windows?

New: Microsox Windlls FU SP7 w/Ubernet Exploiter (a free pile of bugs in each release!)

I have been saying this for a long time but now it is offical.

<Shakespeare mode=Hamlet>: There needs no ghost, my lord, come from the grave to tell us this.</Shakespeare>

Really. How long before the Whitehouse figuratively grabs Tom Ridge by the lapels and tries to throttle him. Such harsh treatment for a huge dono^H^H^H^Hemployer. Oddsbodkins, what next, the GWB DoJ was soft in pursuing the danger of monopoly exploitation of the browser market?

Re:Bad Bureaucrat! Naughty!

Billy G. is looking through his bribe-book and is making a big cross-out in it.

Now he's trying to find John Kerry's phone number to tell him "hey, wanna be President? No problem, you're in...the stuff that happens in November is just a formality, but trust me, my next call is to Diebold to finally tell them who I want to win...just remember to have your guy tell everyone that IE and Windows is the OS of choice now...buh bye"

Re:Bad Bureaucrat! Naughty!

Sorry, Steve Jobs already beat BillyGoat Gates to the punch [theinquirer.net].

Re:Bad Bureaucrat! Naughty!

why should he call them up? they are running their stuff on winCE

he just need to update some dll and that's it ;)

Re:Bad Bureaucrat! Naughty!

http://johnkerry.com was running Apache on Linux when last queried at 26-Jun-2004 10:33:54 GMT

http://georgewbush.com was running Microsoft-IIS on Windows 2000 when last queried at 25-Jun-2004 13:05:27 GMT

Re:Bad Bureaucrat! Naughty!

Only on slashdot could a webserving platform serve as a factor in a presidential election....

Its About time

Horray for the Department of Homeland Security! LWATCDR is not the only person that has been saying "get off of IE" for a long time.

Now the pressure is on Microsoft to get their shit together and make IE more secure, or risk losing their commanding lead in the web browser department. Even my dad, who would rather not use a computer than have to start using different programs, has asked me to put FireFox on his system. And my dad's boss, who is quite possibly one of the most computer illiterate people in the world, has expressed interest to him in moving the whole office off of IE onto another browser.

It really says something for how widespread this news is. If I was MicroSoft, I would be scared at this point.

Re:Its About time

Horray for the Department of Homeland Security!

I feel so....conflicted.

They say IE is bad, which is good, but they're big brother which is bad. My brain 'splode now, thank you.

Re:Its About time

This just proves the old adage "It's that 90% of politicians that give the other 10% a bad name".

Don't worry!

You just need learn to love the big brother. It may take time, but in the end, you will love him. We will take care of that.

Now, how many fingers?

Re:Its About time

• Horray for the Department of Homeland Security!

I feel so....conflicted.

I know, it's like watching a fight between an IRS auditor and a PETA employee. You just hope it goes the distance.

Re:Its About time

If I was MicroSoft, I would be scared at this point.

Well, they are. According to wired (emphasis mine):

Gary Schare, director of the Windows Client Division at Microsoft, said that CERT's advice had been misrepresented in much of the press coverage.

"Microsoft certainly respects the work CERT does to help protect the Internet and users. Regarding the consideration that users switch browsers, it is unfortunate that the published articles have misrepresented CERT's suggestions, and we are working with CERT to clarify their advice," Schare said.

In other words, Ballmer has probably already contacted Bush to remind him about the terms of his re-election campaign funding by MS...

Re:Its About time

I'm kind of offended. They assume I'm using Windows.

Re:Its About time

IE has been discontinued on MacOS, too.

DUPE!... well, mostly.

Been there, done that, got the t-shirt.
We did this story on Sunday... [slashdot.org]

However, in CowboyNeal's defense, both articles cited here were published after that story on Sunday, and we now have the news of Microsoft's rather weak reaction claiming that CERT didn't mean what we all saw them say and Mozilla's reaction that downloads are up since the first reports. Still, that's a Slashback, not a new story.

Re:DUPE!... well, mostly.

That was CERT's announcement, this is actually the Department of Homeland Security making this recoomendation. 2 different orginizations, same recommendation.

Re:DUPE!... well, mostly.

Not really. This is the original source document... [networks.org]

Notice that it's the Department of Homeland Security seal at the top of the document. For our purposes, CERT is a subset of DoHS... it's just that the media is now picking up on the more known name of the larger organization to bring the story to the masses.

Of course

resulted in a large spike in downloads of the Mozilla Organization's Mozilla and Firefox web browsers

Duh. All our friends at Microsoft need it too.

*grin*
*grin*

Re:Of course

Some folks at microsoft recommend [msn.com] firefox. Ok slate isn't directly microsoft but it is an msn publication.

Yup, they sure did!

I didn't listen to them when they asked me to duct tape and plastic wrap my house, I didn't listen to them when they raised the alert level 5 different times, I didn't listen to them when they told me to trust them, but I am glad that other people do... Perhaps this will do double duty! It will fix websites that cater to IE only so that they work with the currently "broken" Firefox so that I don't have to refresh or cross my fingers to get it to work.

Re:Yup, they sure did!

I think what we will see is more "Looks best in FireFox 0.x" disclaimers at the bottom of sites, which is a very good thing for all of us.

I use Firefox and I *don't* want to see "Optimized for Firefox" or similar appearing on the web.

I want web designers to follow the W3C standards. I want to be able to browse in Lynx as well. I want the blind to be able to access web content. It is for that reason that I don't want Firefox to take 90% of the browser market. If 4 or 5 browsers have roughly equal share, there will be much more incentive for web designers to do their job properly. </rant>

Oh, the irony

I want web designers to follow the W3C standards

And yet you don't properly open your <rant> tag? For shame!

Re:Yup, they sure did!

Yeah... it's not going to change much.

How many users actually know what Internet Explorer is?
How many of those users will hear about this message?
How many of those users will know where to get an alternative browser?
How many of those users will be motivated enough to actually want to switch browsers?
How many of those users will be competent enough to download and install a new browser?
How many of those users will be competent enough to handle any problems that come up instead of just saying "this sucks" and switch back to IE?

I recently switched to FireFox because of this horrible security hole, and even though I'd consider myself a very advanced user, I had a couple problems getting things running smoothly. It would randomly lock up and crash on me - turns out that importing old IE settings is what caused it. Oh, and you want to reinstall it to get rid of your problems? Have fun hunting down that user profile directory that you don't know exists and doesn't automatically remove itself on uninstall. Configuring the UI is a huge pain in the ass.

Ironically, it doesn't display Slashdot right sometimes, either.

Great News

"According to Wired, the widespread Internet Explorer security exploit last week and CERT's subsequent recommendation that IE users should consider switching to another browser has resulted in a large spike in downloads of the Mozilla Organization's Mozilla and Firefox web browsers."

I hope that this also translates into a large spike of donations to the mozilla organization. Firefox and T-bird are teh moh scheezi, and i started using mozilla years ago.

I've donated about $150 over the years, how bout y'all?

And yet from the justice dept

the courts have ruled that Msft's bundling and pushing IE with every OS purchase is good for the consumer. Let business be free to manipulate their customers! It's good for the economy.

Man, this'll be just liek when video games normed

Now all us computer nerds will lose our counter culture edge. Plus you'll no longer be able to detect a fellow geek merely by his browsing choice. I guess we'll have to go back to tossing off random Kevin Smith quotes and seeing who catches on.

Re:Man, this'll be just liek when video games norm

Well, if you really want to be counter culture, just wait a few months, then start using IE again after the bulk of computer using Americans move over, that will really shock your friends, it can be like a cult

Re:Man, this'll be just liek when video games norm

And by thier inability to spoell wile doing so.

Amazing...BTW, if you haven't used..

Firefox, you need to do yourself a favor. Flawless pop-up blocking, the beauty of tabbed browsing...real standards implementation...the list goes on and on. Now, if only Windows would be declared a national security risk...

Re:Amazing...BTW, if you haven't used..

You know, everyone says that but I never have problems. I've been using Mozilla (and then FireFox) for ages and I constantly do online banking (psecu), access my (admittedly too many) credit cards (mbna, discover, amex, etc) via web sites, get all my news online, buy stuff online, etc. The only time I ever had a serious problem using a website that was designed for IE and didn't work in Mozilla was AT&T's Blackberry webmail client. Seriously, that is THE ONLY ONE.

I think this whole "IE is required for banks, online stores, etc". is a big FUDdy myth. Start pointing out sites that do not work with standards if there are so many and let's all encourage those sites to fix their broken stuff.

Finkployd

Profit

1) Create product that a smaller portion of the population uses, thus keeping the effectiveness of attacks on your product less desirable than the other 2) Give your product away for free, open sourced, and up to date with all the latest standards, oh, and make it more secure (novel idea, really) 3) ??? (wait about five or six years for a government agency to declare your competitor's product unsafe enough to get the CERT all riled up) 4) Profit, or How Mozilla Pays M$ Back for The Whole Killing of Netscape Thing

Rise of the...

4) Profit, or How Mozilla Pays M$ Back for The Whole Killing of Netscape Thing

It's so great to see Mozilla rising from the smoldering ashes that MS left Netscape in, only to come back and bite MS in the ass. It's so symbolic, they should change Mozilla's name to "Phoenix" or something.

Huh? Oh. (Gilda Radner on SNL voice....) Nevermind.

switch

Hopefully people switching to FF will mean that more bugs will be squatched from it. Perfect timing for that 1.0 release.

Firefox's Gestures

After making the switch to Mozilla Firefox and using it for two days, I'm hooked. I downloaded the All-in-One Gestures extension, and I can't for the life of me figure out how I ever lived without it. It's a whole new paradigm in browsing. This is another milestone in the MS exodus towards open source and Linux. Disclaimer: I do not work for Mozilla... just a satisfied user.

Homeland Security actualy works!!!

wow!!

Heh, oops...

From the Yahoo article:

Alternative browsers such as Mozilla or Netscape may not protect users, the agency warned, if those browsers invoke ActiveX control or HTML rendering engines.

Phew, thank goodness the open source coders are smart enough to leave those nasty HTML rendering engines out of web browsers!

Lynx

The only really safe browser! Not so good for browsing porn sites, but since you want to download the images anyway, maybe lynx is good for that too!

Re:Lynx

Not so good for browsing porn sites, but since you want to download the images anyway, maybe lynx is good for that too!

I only read them for the articles.

Homeland Security Be Damned

Recently I was cleaning rather obnoxious spyware off of my sister's laptop. To prevent further infection, I was asking her to install Firefox. I said it'll block popups. Still reluctant. Tabbed browsing? Nope. More secure? Nu uh, still stubborn. Stop the spyware? No. (She's getting irritated at this point). CERT Recommended to stop using IE? Still won't let me install it.
*pause*
She then asks if our mother uses it. I said yes (thanks to me).
"Ok, install it."

Homeland security be damned, it's the MOTHERS we need to convert.

Re:Homeland Security Be Damned

I've got a better way to convince users.

We need to stand up and tell all the family members and friends we're supporting for free - we are, after all, unpaid Microsoft technical support, without whom the users might as well be using command-line Unix - that they can either stop using IE, stop calling us for support, or expect a $200.00 per hour charge, with a one hour minimum per call.

Enough is enough. No more unpaid work cleaning up after Bill. It's like walking behind an elephant with a dustpan and a broom.

Re:Homeland Security Be Damned

We need to stand up and tell all the family members and friends we're supporting for free - we are, after all, unpaid Microsoft technical support, without whom the users might as well be using command-line Unix - that they can either stop using IE, stop calling us for support, or expect a $200.00 per hour charge, with a one hour minimum per call.

Riiiight... see, if you do that, your family might kick you out of the basement. Not that I would know or anything. Nosiree.

(What, did you think you were good for anything else?)

Firefox will install with 'power user' access

For those considering installing Firefox on Win2k PCs they don't have 'administrator' accounts on, I can report that it installs and works perfectly well from a 'power user' account. Perfect for those considering an installation on a work PC.

You should probably find out if IE uses any work-related proxy-server and change that setting manually in Firefox once the install is complete.

Happy browsing!

Re:Firefox will install with 'power user' access

Heck, you can even get an install of firefox that will fit on a 16MB USB key and requires no installation, and leaves little to no trace:

http://johnhaller.com/jh/mozilla/portable_firefox/

Re:Firefox will install with 'power user' access

A 'power user' still has admin rights, just not permissions to read other user's home directories. The 'power user' group in NT5 is pretty much worthless. You should be using only the administrator and user groups.

Yeah Right

Homeland Security says to stop using IE but in the Air Force we're still using it and I haven't heard any plans to switch to something else. It's good to know that the DoD is listening to the security measures of the other departments.

Re:Yeah Right

Same here in the Army. But you are expecting a LOT if you think that the military will change the web browser overnight.

First a committee/team has to be put together to verify the recommendation not to use IE. Then an alternative will have to be selected. This means another committee/team will have to determine what the alternatives are. Once the alternative web browsers are identified, they will have to be tested to make sure that they are secure and compatible they are. This testing can very depending on how indepth they go and how soon they realize that a large number of military web sites are IE only!! Once a replacement browser is selected, a Plan of Action has to be determined to figure out how the new web browser will be installed and how the completed installation is reported back up the chain of command. Once all of this has been completed, it will then be briefed to the head shed at the Pentagon who will then make some modifications before giving an order that all computers have a new web browser installed.

This doesn't take into account any turf battles that may come up during this process, fixing all of the IE only military web sites, complaints and stubborn refusal from users (IE will have to be completely removed otherwise people will still use it), all of the modifications to the Plan of Action as it goes down the chain of command, the several weeks it will take for each DOIM and unit to figure out how they are going to implement the Plan of Action, DoD civilians.....

It should take the military a few months to install a new web browser.....

Re:Yeah Right

NOAA has also told its employees to stop using IE. Unfortunately for us, though, Netscape 4.7 is the only other browser that is default installed (goes with the mail client), so now everyone is using that, and wondering why all the pages suddenly look like crap (we stopped designing for 4.7 a year ago). There was a rumor that we are being upgraded to NS7.2, but I have yet to hear any further details.

Kinda funny...

Not 4 months ago MSN.com (obviously slanted) was trumpeting around "BROWSER WAR IS OVER!!!" and proclaiming that IE was the clear victor (though they never gave the conditions that made it a victor, they just sensationalized and re-iterated the same shit over and over in different wording in True Fox News Style(tm))

MS to "win the browser war" just in time to have their browser shot down every time they turn.

They had better wake up to this, too... These days, "internet" is about 85% of what computing is about. MS with all their attempts to blur the lines between your computer and the internet, and their flagship web application is poo.

I believe it's time for a cliche...

The Department of Homeland Security...recommended for security reasons using browsers other than Microsoft's Internet Explorer.

Well, no shit sherlock.

True.. but you're forgetting one thing.

You're right, but remember that they cannot run anything unless they have a brilliant and ingenious way to transform jpegs and boldface text into an infection.

NO ACTIVE X. That means no sneaky little programs in your system.

The open source movement is well on top of issues like this... always have been.

Also, politically speaking, the open sourcers and black hats are cousins on different sides of a moral question. Virus writers and spyware jockeys don't go out and try to attack open source. They know what they are up against. They prey on the weak.

Remember, Open Source is dragging Microsoft down on a mayonnaise sandwich budget. They know who not to mess with.

Now if we could only get Homeland Security to start talking about OUTLOOK EXPRESS, then I would dance a jig.

No... because it is a design issue

Is IE targeted because it is widespread? Perhaps. But that does not mean Mozilla is just as insecure.

It's not just that IE is widespread, but its a design issue. If the usage numbers were inverted, IE would still have more exploits because it has some extremely poor design concepts behind it. First, it is directly hooked into the OS. If an exploit executes on the browser, then it is a very short leap for it to execute on the OS. Second, IE has a promiscuous plug-in model that allows nasty malware to execute without enough checks or controls.

What drug was the IE design team engineers taking when they decided to to let (or at least failed to prevent) untrusted program execution? The drug is named "Market-share". They were trying to turn on as many features as possible to capture every possible market. Microsoft made an early design decision to tout features over correctness. It is a fatal defect that now is probably nearly impossible to correct.

Now that MS is re-starting IE development, they should probably do what the Mozilla team was forced to do years ago. When Mozilla first inherited NS-Navigator 4.X, they looked at it and decided to ditch most of it. They started clean with new design concepts. I think MS is going have to do the same thing. The current design of IE is fattaly flawed. It will have to be rebuilt from the ground up with a new security model.

Firefox, Mozilla and performance

I use Mozilla for most things, though on my Mac I increasingly use Safari, for the simple reason that I feel that Mozilla's rendering engine needs work. Gecko is slower at rendering pages than the engine powering Safari. Maybe had I a more recent computer I wouldn't notice the difference so much, but for many people this could be a sticking point. Some people I have spoken to still feel Mozilla and Firebird lose out against IE for just this reason. Other than that, I like the browser (Mozilla that is), and I am using the most recent release.

tough to get employers to listen

Where I work, the new management is enamored of IE. Although our current IT dept. installed Mozilla on all our computers (and REMOVED IE) I hear we'll be forced to use Outlook for email in the near future. It makes me want to vomit. Whenever family or friends tell me about their computer problems, whether viruses or adware or whatever, my main advice is 1) stop using Internet Explorer and 2) stop using Outlook.

I've been posting news articles like this one around the workplace, but man, is it hard to get anyone to listen. If HQ won't even listen to this headquarters's own IT department, why should they listen to someone in R&D?

Bah. Anyone have any advice on this?

Re:tough to get employers to listen

You mu$t phra$e your propo$al$ in term$ that management under$tand$ ... Seriously, though, you need to obtain quantifiable evidence that proves the organization will save money, and how much. Anybody who knows what you are doing will resist you, so watch out...

A fix for IE??

Microsoft [microsoft.com] released a fix for this issue today. Basically it disables the ADODB.Stream object. However, it requires a regedit to implement. I imagine a hotfix is forthcomming. Still, Firefox and Mozilla don't suck at all, so people should at least use this as an excuse to give them a try IMO.

Re:A fix for IE??

Too bad that ADODB.Stream is just a symptom and not the root cause of IE's problems. Applying this will only temporarily break some of the IE rootkits, until they come up with a different method for writing files.

Give advice to alternative browser newbies!

I've been interested in switching browsers for awhile now -- particularly since my windows is borked and despite owning it legitimately (won in a contest) it think it's pirated and refuses to get any IE security patches.

But a few confusion points are holding me back. Likely holding back a lot of folks who might switch, so if you know, dive in and lay down some evidence...

1. Which of the two browsers is simpler / less bulky, Mozilla, or Firebox? I don't want something slow loading, bloated with features, and overcomplicated. You know, IE.

2. Can either of them merge with Windows the way IE does? Running URLs from the Run box, for instance. I don't want to accidentally launch IE by the old methods.

3. Does Mozilla still have that stupid "download manager"? How do I turn it off? Every time I wanted to save a file that thing would pop up when I just wanted the simple windows of an IE download that go away when done.

Obviously, I am t3h n00b. But that means I'm the audience you need to sell on the idea of ditching Microsoft the most -- and I plan to pass it on to friends, coworkers, etc.

Re:Give advice to alternative browser newbies!

In answer:

1. Which of the two browsers is simpler / less bulky, Mozilla, or Firebox?

Firefox is less bulky (about 5MB download) as it is just the browser. Mozilla also has an email/news client, chat client & HTML editor built in.

2. Can either of them merge with Windows the way IE does?

Not quite. A URL is really just a filetype determinied by the file extension (.htm, .html, etc.) In Windows, you can point those (and other) filetypes to whatever applications you want - even when you install Mozilla/Firefox, it asks to be the default browser, in which case it will open most URLs, even from the run box.

Unfortunately, Microsoft specific sites, like "Windows Update" never seem to open anything other than IE and seem to deliberately bork any other browser. Also, because IE essentiall underpins Windows Explorer, you can never really weld in a 3rd party browser as tightly as IE.

3. Does Mozilla still have that stupid "download manager"? How do I turn it off?

There is a download manager that opens a smaller window for the files you are downloading. It has been improved in Firefox, it is not obtrusive particularly and I find it more useful to have it there than to not have it there. You can set it to download each file to a directory of choice or just have it download everything to one place you specify.

Firefox is also themeable, has the Google search bar built in and a lot of pop-up blocking. It REALLY is a better browser, full stop.

Re:Give advice to alternative browser newbies!

Ok here is a little more detail:

1) Firefox is lighter

2) Whatever browser is set as the default is what the Run box will open. Firefox will never be as integrated as IE, but that integration is part of the problem. It is a good thing. Open Firefox from an icon and use it as just a web browser, not as a file browser, desktop viewer, whatever else IE wants to be.

3a) In Mozilla you can disable the download manager by going to Edit->Preferences. Under the Navigator section select Downloads. On the right side of the screen you can choose Download Manager, Progress Dialog, or nothing for downloads.

3b) Under Firefox (0.9.1) you can trun off the Download Manager, but the alternative is no Progress Dialog of any kind. To do this go to Edit->Preferences. Select Downloads on the left. On the right side set the download folder to whatever you want and then look at the settings for the download manager.

This is all from a Linux box, but the settings for the Windows version of Mozilla and Firefox should have identical settings.

I have never been able to use WindowsUpdate from Mozilla. Of course even if you uninstall IE from XP or 2000 all the parts of it are still there, just the icon is gone.

HTH
the_crowbar

Another recommendation ...

The Department of Homeland Security recommends not to use George Bush anymore - because of serious security leaks and erratic behaviour.

In other news, DHS says Stop Using Airplanes.

Not that it stopped hordes of travellers anyway.

Maybe people will choose to take charge of their own computer security like I've ranted about for years now.

But monopolies are good!

Yeah...monopolies are great! See...you can um, build a browser that doesn't really follow any w3c standards. But since you're a monopoly, it doesn't matter and it forces everyone to code for your browser instead of by the standards. And then...you don't have to worry about that pesky competition and the innovation that is created by competition. That silly innovation could lead to very secure browsers all around.

Oh wait...now it's all tumbling down. Who would have guessed being a monopoly and then not even following any standards but marching to the beat of your own drum would end up hurting you?

Yet...I still wonder how this will affect Microsoft. Do they even care?

don't click on links in IE

A support article [microsoft.com] by Microsoft suggests a solution to the holes in their product, specifically the one where an address can be spoofed and displays a different url than the one you're actually at. Solution: Don't click on links! :)

"The most effective step that you can take to help protect yourself from malicious hyperlinks is not to click them. Rather, type the URL of your intended destination in the address bar yourself."

Congratulations Mozilla Team.

I think I speak for everybody here when I say: Thanks for the great browser Mozilla team! Great Work!.

This comment proudly posted through Firefox.

Serious for MS

This kind of thing could be serious for Microsoft. Their strategy is 'thick client' - the browser and other features are integrated into the operating system. If security issues remain while the browser becomes a fundamental part of future Windows use, their are in trouble.

Re:Serious for MS

Actually, I thought their strategy was "thick customer"

Rich

Keep using Internet Explorer!

If we all stop using Internet Explorer, the terrorists have won!

Closed captioned for the PR impared

"Microsoft certainly respects the work CERT does to help protect the Internet and users. Regarding the consideration that users switch browsers, it is unfortunate that the published articles have misrepresented CERT's suggestions, and we are working with CERT to clarify their advice," Schare said.

Let's see what we have here.
- First sentance tells us that Microsoft isn't going to try to attack the credibility of CERT because that'd be unlikely to get anywhere.
- Second sentance is trying to blame "the media" for misreporting the story, but the media's working from a primary source that has a section heading called "Use a different web browser". I don't know how you're "misrepresenting" that when you take that as a suggesting to download any browser that isn't Internet Explorer which means Mozzila, Opera, Netscape or any other compeitor out there. They want CERT to take back the recomendation to just stop using IE... that's the only kind of "clarification" that's possible here.

Microsoft clearly wants a CERT retraction. But do they stand any chance at getting one?

Re:Closed captioned for the PR impared

http://www.kb.cert.org/vuls/id/323070 says in boldface "Use a different web browser".

I don't think the media misreported that.

So here's a question...

1) IBM is our friend
2) Apple is no longer just for coddled sheep
3) Sun is dying
4) Sun is embracing linux
5) Sun is no longer embracing linux
6) SGI is dying
7) ???

8) We might be watching the beginning of the end for Microsoft. Not just in this, but the whole pile of events over the last couple of years. If Microsoft loses relevance, and market share, and withers away...

Who Is Going To Be The New Evil Empire????

I want to know who to unconditionally hate next!!

Lawsuits and whining?

Anyone want to place bets on whether some clever MS lawyer is preparing to argue that any antitrust action related to the browser bundling should be tossed out, because the feds are now encouraging people to use browsers written by the competition? After all, if the government acknowledges that there is legitimate competition, then clearly, MS must not be abusing its desktop monopoly, since so many people are now downloading those free alternatives... right?

As an alternative... imagine if DHS came out and said that a flaw in GM vehicles aided terrorists, and people should purchase Ford and Chrysler vehicles until the flaw is repaired. Do you think GM would immediately start demanding financial compensation for lost sales and market share from the federal government?

Now, extend that to MS, despite the fact that IE is, effectively, free. If the whole thing still seems unbelievable, insert Robert Heinlein's quote about corporations thinking they have an unassailable right to make a profit above all else here. I'll bet good money MS is already preparing the legal briefs for some kind of retaliation.

Now for all the badly designed web sites

Cool, will that mean that some of the idiot web designers will actually start taking non-compatibility complaints seriously? Like those ladened with Javascript that works nowhere else but with IE. Take Expedia.com, where the calendar pop-ups [expedia.com] only work with IE or Priston Tale web site [pristontale.com] where the side menus don't appear if you don't have IE (I already supplied a fix which was ignored) - actually this one should be lumped with the GIS2 web site for excesive use of Flash.

Maybe pigs will fly first?

Just one note Mozilla has one big advantage over Opera and Safari for MS base corportate networks: it supports NTLM.

Ahem, Ahem

I'd like to take this opportunity to emphasize the negatives of an unhealthy competitive market.

When monopolists crush the competition, and you have one company with 95% marketshare, that company gets lazy.

It produces shitty products, slows development (compare development now with when they were trying to crush netscape), all the while making monopoly profits.

Thankfully, the GPL seriously reduces the barriers to entry, because it would be DAMN hard to get either Gecko/Mozilla or KHTML/Konqueror/Safari relicensed and 'shut-down', or integrated into the MS lineup.

Mark my words, if there was no one else but Opera, MS would think long and hard about crushing it.

Monpoly bad, folks, m-kay?

This is great

I've now moved my family over from IE to Firefox - before I wouldn't really have been able to do it as they would have complained when something didn't work the same, but now I have a great reason (stopping our computers getting compromised), and they're all behind it.

My daughters actually prefer it now - citing the way that they don't get pop-up ads any more.

It's good - I think by the time Microsoft come out with a patch they'll be so used to Firefox they won't want to go back to IE.

A side effect of Pop-Up blocking

Netcraft confirmed in a report today that the beleagured Pop-Up Advertisement industry is citing Mozilla and Firefox as the driving force that has snuffed out their livelihood and threatens to drive them into extinction....

(c'mon, someone else can do this better than me) :-D

In other news.... when parasites and popups are no longer possible, what sorts of nefarious crap will the nefarious-mongers do next?

What goes around comes around...

Wow. Think how much worse this'd be for Microsoft if IE was a core part of the operating system!

- mark

To help convince non-techie users...

Here's my piece I did on the topic about a week before the CERT announcement:

http://www.dmiessler.com/reading/ie.html

Criticism of MS unfair...

It's easy to bash Microsoft, but I think we should give credit where it is due. After all, Microsoft has acted very quickly to fix this problem; users who have patched their version of IE can no longer access the Department of Homeland Security's webpage [dhs.gov].

What's wrong with IE? Huh? News to me...

I think its interesting (and I really don't know what to make of it) that this has created almost no buzz at all in the mainstream media. One would think that a recommendation from CERT might raise some news outlets eyebrows, but nary a word in most papers, on most news. The related story at CNN leads one to believe that the main issue with the latest Trojan is IIS, with IE just a minor player. Fox had nothing as of this morning, and of course here in Microsoft Land (Seattle), the papers wouldn't dare besmirch the Sacred Cow that is MS.

Sorry to say, until the big 2 (Fox News / CNN) and the evening news picks this up, it's just more of the same: a bunch of techies preaching to the choir.

windows update at risk?

my question is, if 1) there's no patch yet for IIS servers to defend against the attack, and 2) the microsoft update servers are all IIS, then how can we know that microsoft update hasn't been hacked? hmm? (oh the humanity!)

Nobody goes there anymore... It's too popular.

I love the Firefox, have been using it since Phoenix days... It's great browser, and I've gotten a few of my friends to switch, especially when seeing the browsing features, let alone the security advantages, of which, I confess, I know little about. It's one of those "well, this is more secure, so use it."

But the thing is, now that more people are flocking to it, Firefox could become a target. The script kiddies will start looking for flaws in Firefox and attempting to exploit them. I mean, why go to the trouble of writing any type of malicious code unless you're going to impact the greatest number of users?

I'm not saying that Firefox has many, if any, known security issues (too lazy to research that right now), but if they're out there, they're sure to get exploited once it becomes attractive to do so.

I know that there are many /.ers that can school me on the finer points of Firefox security, so please, explain it's security advatages in layman's terms, and how they can remain secure from a determined hacker.

Thanks in advance.

Stock Homeland Security Bulletin: Duct Tape!

For immeditate release:

The Dept. of Homeland Security recommends that if a Web Application requires MS I.E. and you cannot use Mozilla or competitor please follow the following instructions in case of accidentally browsing the Internet with this software:

1) Cover the Computer (Tower or Desktop) with Plastic.

2) Place Duct Tape over the window on the Monitor Screen when a Pop-Up or insecure page loads. Once you have closed I.E. and ran virus checks you may contact Homeland security for permission to remove the Duct Tape and resume normal computing operations.

Advanced Security Technologies (AST) to Save Us

Schare said the Windows XP Service Pack 2 with Advanced Security Technologies, expected to be released later this summer, will deliver improved security infrastructure that will help reduce a PC's vulnerability to certain types of attacks.

You can almost see the little TM symbol next to the Advanced Security Technologies, reassuring us that Microsoft is busily developing corporate-speak acronyms to protect our systems.

Of course my experience using and supporting products with the "improved security" underlying those acronyms is that I get nagged all the time about apparent bugs that are actually "features." Outlook Express and Outlook, for example, protect users from attachments that could be harmful by ... (drumroll) ... hiding the attachments. What moron decided that was a good idea? I guess the calls to the help desk saying "Everyone else got that attachment except me" help keep me at work, but I'm still not impressed. And my boss can't sync his Palm with Outlook without being warned that an external program is trying to access his address book. Microsoft omitted the "allow this particular program to do this and never pester me about it again" button, so I get complaints about this "feature" every couple months.

While Microsoft now tries to clean up this mess by asking CERT to "rephrase" their warning (wait a couple days - they will), I'll keep suggesting my users switch away from their products. It's been a good solution so far.

The PR Spin Cycle

Gary Schare, director of the Windows Client Division at Microsoft, said that CERT's advice had been misrepresented in much of the press coverage.
So the press misquoted CERT? I've read the text and almost everything I've seen is a quote, albeit summarized occasionally.
I think it's absolute comedy that when MS plays hardball, it's just business as usual, but when things swing the other way they can't stop complaining how they aren't getting a fair shake.

Regarding the consideration that users switch browsers, it is unfortunate that the published articles have misrepresented CERT's suggestions, and we are working with CERT to clarify their advice," Schare said.
Translation: We are currently researching ways to extort CERT into issuing a new statement saying our browser is the most secure as long as you don't use the default settings we chose for you. Fact: IE is the most secure browser when completely blocked by a firewall.

Cool, just after a PHB here

Instructed the internal webmaster team to ignore all other browsers -- to save valuable time and effort, of course. Which -- since they use Microsoft web tools only -- instantly led to the whole intranet web-site becoming disfunctional in Mozilla, Konqueror, and Opera.

I objected and got called "Ayatollah of web-compliance" :-)

Mozilla is vulnerable too

Alternative browsers such as Mozilla or Netscape may not protect users, the agency warned, if those browsers invoke ActiveX control or HTML rendering engines

Did anyone RTFM from the Yahoo link. It says at the very bottom that Mozilla is vulnerable too. I use Mozilla myself but it appears that the real culpret is ActiveX which you can install on Mozilla [mozdev.org]. I don't think this plug in will work on platforms other than windows so it's really a platform issue.

Re:Mozilla is vulnerable too

Uh, it is reported that the trojan only automatically installs itself with IE. For other browsers, you have to download and run a GIF image that is disgused as an EXE with the infamouse double-extension social engineering trick.

Did you read the page you linked to?

This plugin is included with Netscape 7.1, and is configured to only work with the Windows Media Player control.

link to the US-CERT announcement

a link [cert.org] (http://www.kb.cert.org/vuls/id/323070) to the US-CERT pub recommendation. It is also interesting to note that the suggestion to "use a different web broswer" is the last offered (see section III. Solution).

As if people listen to DHS...

the widespread Internet Explorer security exploit last week and CERT's subsequent recommendation that IE users should consider switching to another browser has resulted in a large spike in downloads of the Mozilla Organization's Mozilla and Firefox web browsers

I'm sure the spike in downloads has absolutely nothing to do with the recent release of new versions of Firefox & Thunderbird [slashdot.org]...

Re:Stupid Question: Why Scripting, ActiveX, Java?

Yes there is good reasons to have Java/ActiveX on a web page. E.g. on an internal private network, where you have trusted users and want things like signature pads uploading signatures to a database. Or how about on a public network, there is a wonderful tool to trace a route with a cool picture of the globe (but this is done without violating network security).

With Java you have to actively accept the dismantling of security, if someone clicks yes to trusting an unknown source then they will get an ugly lesson in trusted computing. With ActiveX it comes out of the box with no security and one has to actively enable security. Given the majority of home users are never going to do this, and the majority are using Windows, a massive ripe resource for worms/viruses/spammers exist. Active X suffers from fundamental security flaws, and is going to cost Microsoft a lot to fix the damage to reputation and loss of customers.

Folks, don't get too exited

It is bad PR for Microsoft and we are all exited about people now starting to install Firefox and Opera. But what in the world makes us believe Microsoft will just sit and watch?

Sooner or later MS will provide some kind of fix for the security holes. Then there will be a version of IE coming which has tabbed browsing and all the other niceties in Firefox and Opera. That new IE will enter the desktop conveniently through Windows Update. That day people will be happy that IE is safe and they will go back to using it. Just because they are used to it and they do not need to bother finding and installing some other strange program.

Today Firefox and Opera are attractive because they offer better features and improved security over IE. What makes us believe it will always be like that? And are features and security good enough to battle the desktop monopoly?

Time to uninstall IE!

After all these years of preaching that IE is evil, perhaps some people are finally beginning to see the truth (Now that it is biting them on the butt).

And since this is the almighty Homeland Security, this means that all government agencies should now panic and try to uninstall IE from all of their computers. (Oops, where is that elusive uninstall option? No, not that one, all it does is delete the icon.)

I guess that also means that anybody who has a site that only works in IE is a terrorist! :)

In related news ...

The left-wing Slashdot community (that is, 99.8% of Slashdot readers) immediately becomes Internet Explorer advocates in order to avoid being on the same side as the Bush Administration on anything.

Achance for improving the security of Mozilla, too

A dramatic increase in the userbase will also make the mozilla/firefox platform more attractive for exploit seekers/writers. Such increased level of "real-world testing" will benefit the quality of the browser in a very positive way if handled properly by the developers.

Govt. sites

So when is the Govt. going to fix all of their web sites to work with Mozilla? Currently there are a great number of sites that only work with IE and some businesses rely on those sites.

Incorrect Wired conclusion?

"CERT's subsequent recommendation ... resulted in a large spike in downloads of the Mozilla Organization's Mozilla and Firefox web browsers."

I hate to ask, but didn't the CERT recommendation happen right around the same time as release of 0.9.1?

Without sources I can't refute or support the Wired's article, but it provides no support of it's conclusion itself...

CERT gave the warning nearly a month ago

The Department of Homeland Security's U.S. Computer Emergency Readiness Team touched off a storm this week when it recommended for security reasons using browsers other than Microsoft's Internet Explorer.

CERT gave the warning on June 10 [cert.org]. BBC reported this on June 14 [bbc.co.uk].

apt-get remove internet_explorer

If only IE were included in the debian/stable distribution so I could have the pleasure of uninstalling it.

Migration.

I made the switch last night myself. Moved from a hodgepodge of using Mozilla's mail/news client to Thunderbird, and from IE to Firefox. Why? Because I got tired of pop-ups defeating the Google toolbar, and I figured the individual packages would get updated more often.

The Firefox move was painless, and I'm not missing IE.

Whoever decided to skip any sort of wizard to migrate Mozilla mail to Thunderbird has made a mistake. That was *not* painless, and the average user is going to balk at editing text files.

Reality Check

Does anybody realize just how hard it is to make people change their browser or OS? I work in IT and almost no one has even heard of Firefox. Only one (besides me) has it installed...and we are IT. This is not the end of anything for the evil empire, this CERT notification won't move M$ market share of browsers by more than 1%. And since the overwhelming majority run IE, we will all still have to have IE just to be able to continuously repair and troubleshoot it. Sorry for the reality check, but end-users are skeptical about any change, unless they feel 100% sure they will gain much, loose little. People say this is the end of the empire, but most people who run Linux and OS X have a Windows PC also.

Re:Reality Check

Does anybody realize just how hard it is to make people change their browser or OS?

Huh? I find it's really easy to make people switch.. the conversation goes something like this:

Them: "Why is my computer running so slow? And Why do I have all these popups when I'm not doing anything?"
Me: "Your system is infected with malware.. I will clean it"
[an hour or so passes as Spybot and Adaware do their thing, and I do my thing with Toolbarcop]
Them: "How do I keep this from happening again?"
Me: "Internet Explorer is not secure. If you use it, this WILL happen again, and there is nothing you can do about it. Oh, and Russian Hackers will steal your passwords and credit cards. The only thing you can do is switch browsers to this new one called Firefox."
Them: "What does it look like? Does it have a googlebar? Will my popup blocker still work?"
Me: "Looks pretty much the same as IE, except Favorites are called Bookmarks."
Them: "Bookmarks! I remember those from Netscape"
Me: "You'll feel right at home then. Google search and pop-up blocker are built into the browser"
Them: "Sign me up!"
[I set IE to high security, add windowsupdate to trusted sites, and install Firefox making it default browser. Remove all IE icons, put Firefox icons in their place.]

I've converted 5 people in the last week.

I have 1 suggestions for the firefox people: Bundle (or at least provide an installation page that opens when you first run the browser with links to install) Flash, Shockwave, and Java.. With those 3 things installed, there is no reason to open IE again.

In Other News...

Mozilla and others work to make their browsers just as insecure as IE:

Browser Plug-in Standard [slashdot.org]

I'm sorry, but "rich" web content basically equates to "insecure" from what I can tell. The more dynamic and powerful you make downloaded code, the harder it is to keep it in check.

Save the "rich" content for some separate application-oriented protocol and leave it out of HTML. That way I can download and run some sort of OS-independent application (the goal) from a trusted site when I need to, and don't have to worry about Joe-random web site abusing it. Surfing the web and running some site-specific application are two distinct tasks with quite different security requirements. I wish folks would stop mixing them, as the problems caused are only going to get worse IMHO.

The beginning of the end?

This may be the beginning of the end... if people massively switch to Firefox (which is open source, not from MS, and damn good), the perception about FOSS will certainly change... people will realize MS is not the only choice.

The next step could be a Windows desktop, but with Firefox, Thunderbird, OpenOffice, and all free/open software with Linux counterparts... once they get used to all that software, the final switch to Linux is seamless.

Possibly a repeat, but very funny

Did anyone else notice this tidbit in the article:

Gary Schare, director of the Windows Client Division at Microsoft, said that CERT's advice had been misrepresented in much of the press coverage.

"Microsoft certainly respects the work CERT does to help protect the Internet and users. Regarding the consideration that users switch browsers, it is unfortunate that the published articles have misrepresented CERT's suggestions, and we are working with CERT to clarify their advice," Schare said.

My jaw just dropped open. How are the reports misrepresenting CERT's statements? Get a new web browser can mean only one thing - GET A NEW FRICKIN' WEB BROWSER! How could that possibly be "misrepresented"?

It's basic english - we use it every day! Are you honestly working with computers while not knowing ordinary conversational language? Perhaps we need to tell Microsoft what the definition of IS is.

But in my mind I can see a Microsoft lackey going - "No, no, no, what the really meant was get a new blouse. Um, CERT doesn't like turquoise tops.... uh, yeah that's what they meant."

I don't know what's more pathetic - the fact that Microsoft is trying to accuse others of misrespresenting them, or the fact that many people will believe them and just stick with IE.

Ugh it just disgusts me how blatant and open they are about their lies and coverups. It makes me feel dirty just to see the little IE icon up on slashdot now.

But I'll tell you one thing - people who work for Microsoft certainly must be gearing up for very successful careers in politics.

Here's a fun rule for your server...

This was pulled from an OS X discussion group:

<IfModule mod_rewrite.c>
RedirectMatch permanent (.*)cmd.exe(.*)$ http://www.microsoft.com
RedirectMatch permanent (.*)root.exe(.*)$ http://www.microsoft.com
RedirectMatch permanent (.*)\/_vti_bin\/(.*)$ http://www.microsoft.com
RedirectMatch permanent (.*)\/scripts\/\.\.(.*)$ http://www.microsoft.com
RedirectMatch permanent (.*)\/_mem_bin\/(.*)$ http://www.microsoft.com
RedirectMatch permanent (.*)\/msadc\/(.*)$ http://www.microsoft.com
RedirectMatch permanent (.*)\/MSADC\/(.*)$ http://www.microsoft.com
RedirectMatch permanent (.*)\/c\/winnt\/(.*)$ http://www.microsoft.com
RedirectMatch permanent (.*)\/d\/winnt\/(.*)$ http://www.microsoft.com
RedirectMatch permanent (.*)\/x90\/(.*)$ http://www.microsoft.com
</IfModule>

Kerry using flaw to gain "donations"

<tinfoilhat>
This must by how John Kerry raised over $3 million on Wed. They're obviously using stolen credit card numbers harvested with the help of I.E.
<\tinfoilhat>
http://www.nytimes.com/2004/07/02/politics/campaig n/02donate.html?ei=5006&en=5c451b599da13f1d&ex=108 9432000&partner=ALTAVISTA1&pagewanted=print&positi on=

Big question

Will the US Goverment require the removal or disabiling of IE on all of it's computers for security reasons?
If Microsoft continues to claim that they can not remove IE from Windows will the US goverment start removing Windows from there computers and replace it with Mac OS/X and or Linux?
Since they Include IIs in this what does it mean server 2003 and Longhorn?

Remember people that write websites that only work in IE are terrorists.

Isn't this the same people....

...who advised everyone to use Microsoft products, despite the fact that one of their own organizations made a secure Linux available for free?

Dear Homeland Security,
Compare and contrast:
(1) Your ass
(2) A hole in the ground.

How to disable IE

I got the following batch files off the net somewhere, and it seems to work for Win2K and probably XP. To disable IE, run:

@echo off
C:
cd "\Program Files\Internet Explorer"
if not exist IEXPLORE.EXE goto End
if exist IEXPLORE.EX_ del IEXPLORE.EX_
if not exist IEXPLORE.DIR md IEXPLORE.DIR
if not exist IEXPLORE.DIR goto End
attrib -r -h -s IEXPLORE.EXE
ren IEXPLORE.EXE IEXPLORE.EX_
if exist IEXPLORE.EXE goto End
ren IEXPLORE.DIR IEXPLORE.EXE
echo IE disabled.
echo If prompted, click "Cancel" then "Yes" on File Protection restore.
echo Run enable-ie.bat to allow IE to run again. :End

It still runs if you put a URL into a window bar though, but if your alternative browser is the default browser then it'll launch for everything else.

To re-enable Bill's little helper:

@echo off
C:
cd "\Program Files\Internet Explorer"
if not exist IEXPLORE.EX_ goto End
if not exist IEXPLORE.EXE goto Activate
attrib -r -h -s IEXPLORE.EXE
rd IEXPLORE.EXE
if exist IEXPLORE.EXE del IEXPLORE.EXE :Activate
ren IEXPLORE.EX_ IEXPLORE.EXE
echo IE enabled. :End

Informative IE Links - IE Bashing Extraordinaire

This browser warning [zesiger.com] page thoroughly trashes MSIE, but every phrase is linked to a news article that uses the exact same verbiage in order to demonstrate that it isn't just anti MS FUD - It's the honest truth. It's designed and maintained for webmasters to deliver to the IE-using visitors to their webpages. You can read the source code for some more information about that. In case you're curious, here's a paste of the text and links that it has - This should prove quite effective with anyone you're trying to convince to stop using IE:

Warning!

Your web browser - a version of Microsoft Internet Explorer - may not function properly on this website [com.com], and could have a large number of problems [microsoft.com] that allow hackers to hijack it [pcworld.com] with viruses [microsoft.com]. These viruses could be used by criminals to secretly take over your computer [cnn.com], download child-pornography [theage.com.au], or to commit acts of terrorism [channelnewsasia.com] and fraud [guardian.co.uk]. You may automatically update it now [microsoft.com] with Microsoft's available patches, however, there is a possibility that a necessary patch will not be available [techweb.com] due to Microsoft's somewhat sluggish development schedule [ecommercetimes.com].

The US Department of Homeland Security [yahoo.com] strongly suggests [wired.com] that you stop using Internet Explorer immediately.

There are several standards-compliant [webstandards.org] web browsers that you may use instead of Internet Explorer. Please install one of them as a replacement.

• Opera [opera.com] [Download Now [opera.com]]
• Mozilla [mozilla.org] [Download Now [mozilla.org]]
• Netscape [netscape.com] [Download Now [netscape.com]]
• K-Meleon [sourceforge.net] [Download Now [sourceforge.net]]

If you suspect that your computer is already being used for criminal activity, it is critical that you seek help from a computer professional in your local area. You may also try one of the free web-based virus scanners [wilders.org] that are available.

From the Yahoo! News article...

Alternative browsers such as Mozilla or Netscape may not protect users, the agency warned, if those browsers invoke ActiveX control or HTML rendering engines. (emphasis added)

I'm pretty sure *most* browsers invoke some kind of HTML rendering engine. Yes, even Mozilla.

I.E. Active X object, not just any HTML renderer

That is not what they are talking about. Internet Explorer allows you to embed IE inside of another application. You can even put a different name on the taskbar and call it another application, even with your own icon. In theory, some scam artist could write their own "web browser" in about 15 minutes. The problem here is that you really are using Internet Explorer, even if you are claiming to be some other application.

More often this is used in applications like AOL (IE is the default browser in AOL), where they use this ActiveX component to display web content. I think AOL uses their own e-mail system, however. You can also see this in the Real Player application, again if they are going to display web content instead of playing music or an audio/video clip. (Try this if you have Real Player.) Other application also use this, in things like About boxes or even a cool splash screen when you start an application. Sometimes they even do full TCP/IP http requests for content, including machine-specific data. A good security hole if I ever heard of one, and a cheap and easy spy app as well.

Mozilla does not use the I.E. rendering engine... they have their very own, so they don't need it. A while back it was a common task for CS instructors to assign students to make their own HTML rendering engine. I wrote one myself just to see if it could be done. Not a beginner task, but still something well within the capabilities of any recent CS college graduate (if they actually taught you anything).

Re:Who cares about security,

A more important question is, do Firefox and Mozilla format the webpages correctly?

As long as the people writing the pages aren't intentionally hosing your browser... [com.com]

Re:Let's turn this around, shall we

Then it will be interesting to see if Mozilla has the same inherent weaknesses as IE, won't it? For years MS has used the excuse that they're the largest installed base, thus the target for most virii, etc. I say lets see if thats true.

How to get plugins to work

If you find some sorts of plugins don't work, there are instructions for fixing that on your windows box on the Mozilla Plugin Support Page [mozdev.org]. A longer list of FAQs is at http://plugindoc.mozdev.org/faqs/ [mozdev.org].

This has information on plugins like: Adobe Reader, Java Plugin, Macromedia Flash Player, Macromedia Shockwave Player, QuickTime, RealPlayer 10, Windows Media Player, etc.

Re:Let's turn this around, shall we

Apache has sustained much more "pressure" and has a very good security track record - just like Mozilla by the way.

Open Source software can be (and often is) of better quality, especially when it comes to security.

The only "security issues", I've heard about Mozilla were about reading files or crashing - and those were instantly fixed. IE is so flushed with real grave security holes (like "take over computer") that crashing or reading files isn't even worth reporting, never mind fixing.

Microsoft usually does nothing unless there is an exploit - then maybe they do something - or (like with IE lately) they still don't do anything unless the exploit is used by a lot of people.