Follow Slashdot stories on Twitter


Forgot your password?

Symantec Rethinks Firefox vs IE Vulnerabilities 214

chill writes "Last September security software vendor Symantec issued a report claiming IE had fewer critical flaws than Firefox and thus was more secure. Well, it seem they have now rethought that position. 'How we did it before wasn't a fair comparison,' said Oliver Friedrichs, the senior manager of Symantec's security response group. 'It wasn't an apples to apples comparison.' The key was vendor acknowledged critical vulnerabilities. Thus, if Microsoft (or the Mozilla Foundation) didn't agree it was critical, then it didn't get counted."
This discussion has been archived. No new comments can be posted.

Symantec Rethinks Firefox vs IE Vulnerabilities

Comments Filter:
  • by Anonymous Coward on Sunday March 12, 2006 @09:39AM (#14902078)
    profit motive = incentive to lie

    I'm SHOCKED!
    • Re:imagine that (Score:2, Insightful)

      by nevernamed ( 957351 )
      I agree. How can you believe that firefox is less secure than IE? You're probably on crack if you think that.
      • by Anonymous Coward
        Given that IE is a far more mature code base than Firefox (version 6 versus version 1.5) I would expect IE to be far more secure than Firefox. The fact that more people use IE causes more security flaws to be found anyway since more people look for flaws in it.

        Plus, IE doesn't use the page renderer to handle the user interface like Firefox does - that's already bitten Firefox several times and doubtlessly will continue to as people find ways to jump from "unsafe" content to "chrome" content.
        • Re:imagine that (Score:3, Interesting)

          by zippthorne ( 748122 )
          Wait.. are you using PR version numbers as your basis for comparison?

          That's like saying windows 95 is more mature than [linux distro using kernel version 2.6.x] because as anyone can see, 95 > 2.6.
    • Re:imagine that (Score:3, Interesting)

      by Anonymous Coward
      Of course, the two concepts are completely unrelated, when one realizes that lying doesn't occur because the lier decided that lying was NOT in his best interest. Lying occurs because the lier, at the time, decided it would benefit him somehow. In other words, in order to profit. (Profit doesn't have to be measured in raw dollars, but can take the form of anything which an individual considers to benefit him.) Therefore, all lying is an attempt to profit, just like all truth telling is an attempt to profit.
      • Re:imagine that (Score:5, Insightful)

        by causality ( 777677 ) on Sunday March 12, 2006 @01:02PM (#14902723)
        (Why would someone tell the truth if they didn't believe it was in their best interest, i.e. for profit?)

        I know this might come as a surprise to some of you, but there's a few strange individuals who have integrity, who do really strange things like telling the truth even when it may not be in their best interests. I suppose that might not fit into your worldview ...
        • Re:imagine that (Score:2, Insightful)

          by DarkJC ( 810888 )
          If they tell the truth, then most likely they do get something out of it. Perhaps they think if they tell the truth in cases that it might not be in their best interest, they'll still earn and maintain the respect of people. People always tell the truth to benefit themselves, whether that's profit-wise or otherwise.
        • Re:imagine that (Score:5, Insightful)

          by killjoe ( 766577 ) on Sunday March 12, 2006 @03:32PM (#14903223)
          People with integrity can't run big businesses. If a person with integrity starts a business and runs it ethically it will never get past the small to medium business range. Untethical people will always outcompete you because there is so much profit in sleaze.

          So really there are no people of integrity (in charge) in a company with more then a 100 employees.
          • Re:imagine that (Score:4, Insightful)

            by hey! ( 33014 ) on Monday March 13, 2006 @09:40AM (#14906724) Homepage Journal
            People with integrity can't run big businesses. If a person with integrity starts a business and runs it ethically it will never get past the small to medium business range. Untethical people will always outcompete you because there is so much profit in sleaze.

            Oh, I don't think that is true at all. Ask people about Bill Hewlett, and they'll tell you he was a great engineer who was fanaticaly about treating his employees with respect. Although ethics issues have arisen in some of Berkshire Hathaway's insurance subsidiaries, nobody has anything but stellar things to say about Warren Buffet's personal integrity and of course business acumen.

            The thing is, these guys are are rare combinations of technical genius, organizational ability, and personal insight -- what they call these days "emotional intelligence". Most entrepreneurs fall short in one or more areas, and so bluster, pretense, and faking of results is common. With a bit of luck a sense of timing, these guys may achieve a measure of success. Nonetheless, while you can never predict how chance may affect the outcome of the best laid plans, in a one to one contest of entrepreneurship, I'd put my money on Warren Buffet against a guy who's main qualification is that he's willing to lie and cheat.

        • Yes, but in this case? I don't think so. What appears to have happened is that he lied for the benefit of Microsoft and didn't get the compensation for it that he expected.
          • Yes he got the compensation expected.

            You see, the idea of selling security related products and releasing reports that the more secure web browser is actualy less secure only increases those sales and deepens the need for the public to purchase thier products.

            What they didn't count on was the target audience's core constituants aren't the type that know only what product advertising tells them. When people started calling bull on these claims and demonstrating the differences between the two browsers, and
      • Re:imagine that (Score:3, Insightful)

        by Hosiah ( 849792 )
        Why would someone tell the truth if they didn't believe it was in their best interest, i.e. for profit?

        Well, see, this story's example shows "the truth will always out." This is another one of those shifting paradigms you heard your PHB muttering about. In the present information age, with a battalion of bloggers on the job and snoopers ferreting to the very bottom of the data pile, it's damn near impossible to keep anything secret. So, you publicly deny that your product has *any* flaws, then get caught;

    • There's a support reason too - overly paranoid IT managers don't necessarily need to know about security issues that don't necessarily affect them.
    • by babbling ( 952366 ) on Sunday March 12, 2006 @01:10PM (#14902747)
      ... and now the tables have turned, and Microsoft is competing with Symantec. (Windows OneCare)

      All of a sudden Symantec retaliates by deciding that Internet Explorer does indeed have more "critical" flaws than Mozilla Firefox does.
  • by nich37ways ( 553075 ) <> on Sunday March 12, 2006 @09:42AM (#14902084) Homepage
    I guess the latest TCO Microsoft is great checks failed to appear this week....
  • by colonslashslash ( 762464 ) on Sunday March 12, 2006 @09:43AM (#14902088) Homepage
    Over 6 months to realise and admit that? Nice going ...
  • by 91degrees ( 207121 ) on Sunday March 12, 2006 @09:44AM (#14902093) Journal
    Weakest point, and amount of possible damage.

    If one browser allows an attacker to read arbitrary files, and another allows an attacker to delete arbitrary files, then the one that allows the deletion is surely worse however many ways there are to read files.

    If one browser can be attacked in a generic manner, and the other needs some knowledge of the victim, then the one that can be attacked in a generic manner is less secure.

    Now, exactly how an easy to implement low impact and a hard to implement high impact attack compare is still going to be subjective, but wherever you draw the line, it's going to be better than simply counting the nuber of critical bugs.
    • by syntaxglitch ( 889367 ) on Sunday March 12, 2006 @10:04AM (#14902152)
      If one browser allows an attacker to read arbitrary files, and another allows an attacker to delete arbitrary files, then the one that allows the deletion is surely worse however many ways there are to read files.

      This isn't necessarily true. For instance, if the files that can be read include ones with, say, credit card information, wouldn't it be better to have those deleted (you can always re-enter the info to order online) than to have the information read without your knowledge and let someone else charge to your credit card?

      The basic point you're making is quite correct, though.
    • Theoretically, yes; the trouble is, we don't know the potential for harm. We only know what exploits have actually been found -- in fact, we don't even know about all of those; we only know about those which have been exploited enough to have been recognised by security folks.

      I'd say, based on previous performance, that both browsers probably have exploits allowing people to read files, delete files, get local root privileges, etc. The question should really be: how many such problems are there, how eas

  • OneCare (Score:5, Interesting)

    by ROOK*CA ( 703602 ) * on Sunday March 12, 2006 @09:46AM (#14902097)
    I wonder if Symantec's "rethinking" of it's position has anything to do with Microsoft Announcing a Competeing offering (OneCare Live), apparently Symantec will no longer just take Microsofts word whether a suspected flaw is actually a bug/vulnerability or not, Sorry Microsoft that ole "Naw, that's not a vulnerability, it's just an undocumented feature" doesn't look like it's going to fly anymore.

    • Re:OneCare (Score:5, Insightful)

      by brian0918 ( 638904 ) <> on Sunday March 12, 2006 @09:53AM (#14902122)
      Of course they're connected; there's no other possibility. Listening to Symantec's opinion on this would be like asking Philip Morris for an opinion on the link between cigarettes and lung cancer. So, how long until MS OneCare starts getting flagged as malicious spyware by Norton, or vice versa?
    • Re:OneCare (Score:5, Interesting)

      by ntsucks ( 22132 ) on Sunday March 12, 2006 @10:17AM (#14902198)
      Perhaps the Symantec marketing trolls have embarked on a subtle campaign to undermind the general public's trust in Micro$oft's ability to deliver secure products. Basically a "Who do you trust?" positioning of themselves against OneCare Live. Strange as it may seem Joe Six Pack probably does not have the Slashdot crowd's contempt for Micro$oft's ability to deliver secure products, thus leaving some room for Symantec to discredit them.
      • Re:OneCare (Score:4, Insightful)

        by burnin1965 ( 535071 ) on Sunday March 12, 2006 @02:56PM (#14903110) Homepage
        "Perhaps the Symantec marketing trolls have embarked on a subtle campaign to undermind the general public's trust in Micro$oft's ability to deliver secure products"

        I suspect there is little public trust in the security of Microsoft's products that is worth undermining. Most people have been beaten into submission and have simply accepted their fate of dealing with the maladies which accompany Microsoft's products. At the same time everyone has also accepted that open source offerings are much more secure than Microsoft products but are beyond their technical skills.

        It is more likely that the Symantec marketing trolls are merely attacking their new enemy, Microsoft. Before the enemy was open source because of its public perception as a secure solution that does not need Symantec services, now Microsoft is the enemy because they are competing directly with Symantec. By scaring people away from products which don't require Symantec's services by refuting wide spread beliefs they hoped to maintain their market of installed Microsoft products which require their service, but now their greatest risk is that of losing their market directly to Microsoft.

        I'm with you in that Symantec's sudden change of heart concerning the security of IE verus Firefox appears rather disingenuous and loaded with ulterior motives, but I doubt there is a general feeling of trust between Microsoft and their customers which Symantec needs to break. Symantic is merely adding fuel to a long raging fire of mistrust of Microsoft and a perception of a need for protection against Microsoft's security failures. One could hardly say the negative perception of security in Microsoft's products is undeserving, to the contrary they made the mess they are in, but that doesn't mean that Symantec is suddenly devoid of malice towards Microsoft these days.

        It is also possible that the people at Symantec are truely printing what they believe to be the truth, its always good to give people the benefit of the doubt, but it does seem rather suspicious considering the circumstances.

  • by putko ( 753330 ) on Sunday March 12, 2006 @09:51AM (#14902112) Homepage Journal
    How can you trust these guys with your security?

    They make some b.s. statements that just aren't founded in logic, or in a reasonably cynical view of how people/companies behave. The result is that they suggest you do the ridiculous, with your security (not theirs). Then they (for whatever reason) say something else.

    I'm not even suggesting that they "came to their senses", but perhaps, for one reason or another, decided that Microsoft was not their friend anymore (or maybe firefox is their friend now).
    • by spiritraveller ( 641174 ) on Sunday March 12, 2006 @10:00AM (#14902141)
      How can you trust these guys with your security?

      No sane person would. By their own admission, it is clear that they gave a blank check to Microsoft. Whatever their motive for doing that, it shows a lack of devotion to the stated goal of their products.

      If a company wants my money for securing my computers, they better show some integrity that doesn't shift depending on how their relationship with the bigger company is going that day.
  • A Scenario (Score:5, Funny)

    by BumpyCarrot ( 775949 ) on Sunday March 12, 2006 @09:52AM (#14902116)
    Symantec: Internet Explorer feasted on my childs bones.

    Microsoft: We don't consider that critical.
  • But there's more... (Score:5, Interesting)

    by ABoerma ( 941672 ) on Sunday March 12, 2006 @09:53AM (#14902118)
    I like the other part of TFA better:

    "Windows XP Professional, said Symantec, stays safe just one hour and 12 seconds, while the Windows 2000 Server (with SP4) made it an hour and 17 minutes. An unpatched Windows Server 2003 system lasted somewhat longer.

    In contrast, unpatched Linux installations of both Red Hat Enterprise Linux 3 and SuSE Linux 9 Desktop were never compromised during their month-and-a-half exposure to attackers."
    • by DanteLysin ( 829006 ) on Sunday March 12, 2006 @10:10AM (#14902175)
      So if you are a noob and don't patch your systems, you get by longer on Linux than Windows. No surprise there. My guess is that there are more Windows oriented viruses/worms circulating the Internet. The take home message is "patch your system". We Slashdotters know better, but does the regular home user?
      • My guess is that there are more Windows oriented viruses/worms circulating the Internet.

        Undoubtedly there are. And Microsoft's PR flacks, who apparently decided which vulnerabilities are labeled as critical in TFA (very few), also argue that Windows is attacked more because it's more popular. By that reasoning Apache should have a much worse security record than IIS since it's at least twice as popular. But if anything it's the other way around. The simple truth is your basic cracker/delinquent types are

      • by khasim ( 1285 ) <> on Sunday March 12, 2006 @11:29AM (#14902419)
        My guess is that there are more Windows oriented viruses/worms circulating the Internet.
        "More" is correct. But the implication being that that is why the Linux boxes were not cracked is incorrect.

        On the Internet, it is possible to scan whole ranges of addresses looking for vulnerabilities. Automatically. 24/7. And exploit them automatically, 24/7.

        What matters is whether the box has open ports or not.
        The take home message is "patch your system". We Slashdotters know better, but does the regular home user?
        The system's security should be configured to account for the home user's non-patching.

        Apple has. Their boxes, by default, have no open ports.
        Ubuntu has. Their default install has no open ports.

        No matter how many worms and infected machines are out there, a default Ubuntu box will never be infected by them.

        The first step in security is to reduce the avenues of attack.
        • On the Internet, it is possible to scan whole ranges of addresses looking for vulnerabilities. Automatically. 24/7. And exploit them automatically, 24/7.

          Scary thing is that it's true. I still get hits from bots trying to find old versions of PHP XML-RPC to exploit, and that itself is annoying. It's simple enough to run `nmap -p80 -oX boxen-to-pwn.xml` (or whatever IP subnets you wish) and then make a script to check all those servers that respond and to attempt to use the XML-RPC exp

        • "No matter how many worms and infected machines are out there, a default Ubuntu box will never be infected by them."

          Unless, of course there is a vulnerability in the networking part of the Linux kernel. It has happened before, but of course it is quite unlikely thing to happen - although I wouldn't say "never".
      • No, that's why in Windows XP SP2, the default setting is to have updates be downloaded and installed automatically.

        • It is not unknown for updates to have new "features" and EULA clauses. It isn't just a matter of repairing the original product, it is a matter of transforming the original product into something new and not necessarily what the customer intended to purchase.

          It would be a good thing for the IT industry, in the long term, for these things to get a good legal test. This would rein in the abusers, while clarifying the rules of business for the honest folk.

      • So if you are a noob and don't patch your systems

        That should be So if you are a noob and don't patch your systems within one hour of connecting it to the net ! People do connect vigin boxes directly to the net, you know...

    • The only news there is that software firewalls work.

      (The original release of XP should have had a firewall active, but that's another story.)
  • Not too surprising (Score:5, Interesting)

    by enigma48 ( 143560 ) <jeff_new_slash@j ... m ['fdo' in gap]> on Sunday March 12, 2006 @09:53AM (#14902120) Journal
    My first thought was that this makes perfect sense - now that MS is a competitor of Symantec, they're going to discredit them as much as they can.

    But Symantec has known for ages that MS is pushing into their space. Maybe they had a Netscape-esque agreement with Symantec and maybe Symantec found new evidence that convinced them partnering with MS isn't the best way to go?

    It *could* be as simple as an upper-management type listening to the feedback the last report got, but I haven't seen an icy weather forecast for Hell today.

    (For those who missed the MS Anti-trust days: it was 'alleged' that when MS decided that the 'net was not just a fad and MS needed to throw all their resources into making IE the dominant browser, MS offered not to compete in Mac-space if they left the Windows market quietly. Netscape refused, MS bundled IE with windows, and the rest is history)
    • by nvrrobx ( 71970 )
      Microsoft was a strategic partner of Symantec until the day OneCare was released. Note I said was.

      Yes, I work for Symantec. Any opinions I express in a post are my own and not necessarily those of my employer.
  • Considering Firfox still has a fairly tech-savvy userbase (who in theory patch often), it'd be interesting to see what percentage of security exploits actually happen when using to two browers in the real world.

    I believe that Firefox would have a significantly lower security breach rate than IE, but further compared with Opera or Safari?

    Funny Adult Vids and Clips [] from Laugh

  • Oi norton... (Score:4, Interesting)

    by djsmiley ( 752149 ) <> on Sunday March 12, 2006 @09:57AM (#14902131) Homepage Journal

    another undocmented feature...
  • ooops, sorry (Score:3, Interesting)

    by yagu ( 721525 ) * <> on Sunday March 12, 2006 @09:59AM (#14902137) Journal

    It seems almost disingenuous to "rethink" this so late. Of course it's more than a little irritating, it directly impacts the perceptions and usage levels of the competing browsers. It's kind of like yelling "fire" in a crowded theater, waiting until the resultant stampede kills many in the theater and then saying, "I'm rethinking this, and it looks as if there is no fire."

  • RTFA....then think about it. Then ask which set of facts are they sticking too?

    Maybe they should do a security software resource usage comparison!

    There is a difference between "truth" and "honesty" where truth is about "a point truths" where you can be selective and deceptive. But "Honesty", thats full scope.

    They are not very honest.

    It does seem that one of teh things they do to help secure your system is to be having your system so busy running their software that it doesn't have time to run anything else.
  • by plankrwf ( 929870 ) on Sunday March 12, 2006 @10:09AM (#14902168)
    I'm working in the IT industry myself, and one of the well-known problems with bug-counting is... well, counting bugs.
    I have seen IT managers getting upset because there were 100's og bugs*.
    Turned out all of them were because of ONE faulty thing.

    I have seen bug reports of the form
    1. pressing button A and then pressing button Y gets critical error.
    2. pressing button B and then pressing button Y gets critical error.
    3. pressing button C and then pressing button Y gets critical error.
    etc etc

    In other situations a manager was not upset, "there were only a few bugs*".
    Later, this same manager became upset at a time that there were on the order of 50 or so "bugs*".
    Turned out fixing those few bugs took more than o month, while those 50 were 'fixed' within a week.

    So my professional view is that bug-counting doesn't count, the correct question is:
    how sick did you get? (Compare getting bitten by a tsetse fly to getting bitten by a red ant...)

    * To be honest: I am referring to a non-English term which is NOT equivalent to a bug, but more to 'a problem'.
    • This sort of thing happens all the time in game development. Bugs 1 - 142 might be "Go to location 1. Jump. Wrong animation plays." "Go to location 2. Jump. Wrong animation plays." etc. Bug 143 might be that if you attempt to pause while saving the game it erases your memory card, eats all the food in your refridgerator, and puts gum in your DVD player.

      At the beginning of a bug-squashing beta period, your team may be killing a hundred bugs per day. By the end, you may spend the last weeks desperately
      • by mav[LAG] ( 31387 ) on Sunday March 12, 2006 @05:48PM (#14903779)
        This reminds me of a friend of mine who used to be a professional game tester for an EA dev team near where I live. Although somewhat looked down upon, testers are actually a terribly important part of the game dev process. If you're looking for budget to save, look somewhere else.

        Nobody told that to the manager. For the next project my friend was given absolutely nothing to work with - no design docs, no resources, no source code, no debug version, no reporting sheets - zip. Just a crappy PC with - occasionally - the latest build on. All his requests for the basic tools to let him do his job properly went unheeded. So he started filing bug reports via email like this:

        To: Developers
        Subject: Game is broken - fix it

        To: Developers
        Subject: Game crashes - needs to be fixed

        To: Developers
        Subject: Game broken - needs fixing

        He was quickly provided with the tools he needed :)
      • And you're not counting that the "re-engenier" step in the "PITA" bugs can sometimes render some of the bugs you spent time fixing earlier a waste, since you may have to rework entire portions of the code.
  • Hi Symantec (Score:4, Insightful)

    by babbling ( 952366 ) on Sunday March 12, 2006 @10:09AM (#14902171)
    Welcome to 2 years ago. This new Firefox browser is pretty cool, eh?

    I wonder if anyone ever took Symantec seriously when they made this claim. Most computer illiterate users wouldn't have even heard about Symantec saying this, and those that did (eg. Slashdot readers) would already know better. It's as if Symantec is in their own little universe where it seems as thought everything incorrect is actually correct.
    • It's not about whether or not anyone takes the claim seriously. It's a little public relations kickback from Symantec to Microsoft, that Microsoft's PR department can use when talking with big corporate clients who start to believe that IE is a security problem and might switch. "No, you don't understand! An independent study revealed that Firefox is less secure than IE."

      Remember, these are corporate IT people. They don't think for themselves much. This way, if there's a total security meltdown, at lea
      • Re:Hi Symantec (Score:3, Interesting)

        by babbling ( 952366 )
        True. I wonder if this latest admission from Symantec is a response to Microsoft's new (when Vista comes out...) virus/spyware scanner subscription service. Symantec are now competing with Microsoft.
  • FTFS:

    "The key was vendor acknowledged critical vulnerabilities. Thus, if Microsoft (or the Mozilla Foundation) didn't agree it was critical, then it didn't get counted."

    Mozilla has Bugzilla to keep track of it's issues, MS is notorious for claiming bugs are in fact features.

    Also, IMHO any security issue is 'critical'. Someone once said that MS's 'critical vulnerabilities' are security flaws that should never have made it past design stage [].

  • by Centurix ( 249778 ) <> on Sunday March 12, 2006 @10:13AM (#14902190) Homepage
    "We have substatially tested Windows XP and have found the operating system to be completely bug free. Out tests were conducted in a time period of 1 minute, which contains 60 seconds. As all seconds are effectively the same, we can safely say that Windows XP will be safe for all future occurances of seconds."
  • I guess I'll have to "rethink" my reliance on any Symantec security program.
  • Whose company products in all my years of computer maintenance have overall caused me more problems than all the malware/viruses they were supposed to be fighting. Thanks for the heads up!
    • Whose company products in all my years of computer maintenance have overall caused me more problems than all the malware/viruses they were supposed to be fighting. Thanks for the heads up!

      You can say that again. Where I'm working now, "Are you using Norton Internet Security or Anti-Virus?" is about question number 2 on the process for troubleshooting email problem calls. The first one is "What is your email address?". It's a 50/50 decision on if I'd rather taken on the virus/trojan world.......
  • Seriously? (Score:3, Insightful)

    by user24 ( 854467 ) on Sunday March 12, 2006 @10:32AM (#14902232)
    You're seriously telling me that Symantec just added up the number of times a flaw was labelled "critical" by the owning company of the product, and based their 'report' on that - wtf?

    I mean, *I* could have done that. When I hear that one of the leading security companies has issued a report on the security of two competing products, I assume that they've actually evaluated those products, rather than just spat back the company literature.

    My already little faith in the company that brought us Norton has sunk lower still.
    • Re:Seriously? (Score:3, Insightful)

      by ScrewMaster ( 602015 )
      That's not really fair to Peter Norton. The original Norton Utilities were a pretty decent package. I used them for years to help maintain a big Wildcat! BBS. Symantec eventually bought him out, but kept the Norton Utilities name for marketing purposes since it was about the best-known product of its kind at the time.
  • Damn (Score:5, Funny)

    by pHatidic ( 163975 ) on Sunday March 12, 2006 @10:38AM (#14902249)
    Oh shit I'm going to have to switch back now! Do you have any idea how long it took to get IE running on Linux?
  • by Anonymous Coward
    Symantec used to make top notch products. When I recently was exposed to their client software again assisting friends, I was shocked to see that they now make the worst security suite. It is just completely unsuable for customers. Their failure to even have their software work with Windows XP SP2 (and letting their customers take the problems such as all programs stop having internet connectivity but their own ...) is evidence that they with their "platform play" is becoming increasingly at odds with Micro
    • I spent two days removing thos POS from a friend's machine last week. Symantec publishes the instructions to uninstall manually, because the automatic install DOES NOT WORK.


      Countless services and hooks into the operating system, tied into Microsoft's automatic installation system, forcing itself to re-install if you miss a trace of the uninstall procedure (which is, itself not complete).

      Before uninstalling, it would take up to 5 minutes to boot XP, after uninstalling, the bootup w
  • by AngryNick ( 891056 ) on Sunday March 12, 2006 @11:00AM (#14902310) Homepage Journal
    It seems to me that a 1:1 comparison of flaw counts is just going to show you how may potential problems there are...not your risk of getting hit through one of them.

    Let's say that I wrote the world's most flawed web browser (Anger Browser 1.0), with several hidden RC function and a welcome mat for specially scripted spyware installers. Yes, it has 500 more flaws than IE, but I only have an installed user base of two. Does this mean that my browser presents a higher risk than a browser with 100,000,000 users and one flaw?

    All things the same, a flaw in IE presents a higher weighted risk than a browser with a fraction of the user base. Combining that with the relative ignorance of the average IE user, I say that a flaw in IE presents a much higher return to the bad guys than any other browser out there.

  • by pikine ( 771084 ) on Sunday March 12, 2006 @11:09AM (#14902339) Journal
    Since arguing the merits of one browser over another leads to no end, I hope this post would be somewhat refreshing to read.

    Assuming a security measurement can sway users for switching from one browser to another, I propose the following measurement: multiply the number of vulnerabilities by market share, and call this the impact. At first glance, this is brutally unfair for IE, which continues to have the majority market share, but hear me explain.

    Let's make another assumption. Suppose all competing browsers have vulnerabilities that lead to the same outcome, then the likelihood that script kiddies choose one browser over another to exploit is more or less determined by the browser's market share. Every vulnerability adds to this likelihood. Therefore, in the end, we end up summing a browser's market share a number of times that is the number of vulnerabilities for that browser. This is the same as multiplying number of vulnerabilities by market share. The result is a measurement of insecurity impact.

    What happens if we adopt measuring impact for insecurity?

    Since Firefox is a minority in browser market share, it can afford to have more bugs and be relatively secure. Its most critical vulnerabilities have lower impact than IE's equivalent. Suppose users then decide to switch to Firefox. The increase in Firefox market share means its vulnerabilities have higher impact. At one point, it becomes less secure than IE, and users start to switch back. We go back and forth and eventually reach an equilibrium. If users are perfectly "browser elastic" (have no resistence to switch browsers), then at the equilibrium, market share is inversely proportional to the number of vulnerabilities for all browsers. Of course, in the real life, things are never that simple, but let's keep things simple. It is good enough to point out that letting impact determine market share is more desirable than letting vulnerability count to determine market share.

    How can the impact score improve current measurement of security?

    We all know that some vendors like to play the optimist game by purposely reducing the severity of a vulnerability or even hiding it. If a certain highly popular browser vendor wants to manipulate the impact score, it has to to cheat a lot, and at one point this cheating will become painfully obvious. Hopefully, the risk of causing a scandal would limit the vendor's cheating to a degree that does not significantly variate the impact score.
  • Well surprise surprise, Symantec demonstrates themselves to be of the calibre of Wall Street "analysts": regurgitating things that other people tell them, and passing it off as insight. How about doing some critical thinking of their own?

    Why do we keep reading about opinions of "analysts" everywhere? I guess I need to stop reading the Mac rumor sites so regularly; their "news" are often just "analyst predicts ..." The news media certainly don't paint "analysts" as being anything more than sock puppet m
  • "Thus, if Microsoft (or the Mozilla Foundation) didn't agree it was critical, then it didn't get counted."

    That's it! That's the secret to making bug-free software! Not fix anything then deny it's a bug! That's what I'm gonna do!

    "Hey, this is a critical exploit!"
    "No, it's not."

  • Symantec is hardly a trusted objective source of security information. For them it's all about fear factor. Now with the two articles combined they paint both browsers as being unsecure.

    A trusted source would say:
    1. Keep computer upto date.
    2. Use Firefox as default browser.
    3. Don't trust any ads, pop-ups, or unexpected e-mails.
    4. Don't install every free screensaver you run across (or other stupid games/junk you might download)
    5. Keep your A/V software upto date. (And use something better, cheaper, and faster than
  • Excuse me? (Score:2, Insightful)

    by mabu ( 178417 )
    Since when does Symantec have any credibility relating to computer security issues?

    Now when there's a report on the most efficient way to waste CPU time, memory and disk space, making computers slow down to a crawl, their commentary will be respected.

  • This makes me think of the CVSS [] and how inaccurate it also is.

    Most vendors will downrank/ignore/contest vulnerabilities. Then they will try to make comparisons between themselves and their competitors off a biased vulnerability score, impact, etc.

    Software vendors should have no part in acknowledging/ranking the legitimacy of vulnerabilities, once the security community has properly identified them, and repeated results, apart from sending a Thank you note to the security gurus th
  • by Lightzout ( 697564 ) <lightzout&gmail,com> on Sunday March 12, 2006 @03:08PM (#14903144)
    This has to be the best troll ever. I feel like I am the moth, there is the flame, gonna die, cant turn back now, going in anyway! I think this is funny for two reasons. One symantec has no interest in securing anything but profits and secondly the fact that symantec could make the "news" by publicly admitting something so obvious to most saavy consumers is all the proof I need that the joke is me. Expect Symantec to announce its Firefox browser bundle soon.
  • Oliver Friedrichs?

    Who is this loser? How can we still be stuck listening to this garbage?

    Are we not men? Are we not people with critical thinking skills?

    Where is the independent security consultant, the person who cares only for the study and the results? This Oliver Friedrichs guy only cares about profits. If a company doesn't agree with you that their product has vulnerabilities, then you publish the study anyway, and give them the results.

    Where is the OSS front line these days? Do we even have a goal, or

Recent investments will yield a slight profit.