Comment Re:I wonder (Score 1) 369
And I for one am tired of hysterically anti-Microsoft bigots. Microsoft USED to play the games you indicated around security issues and it got them smacked by security researchers and the public at large. Since then they have been remarkably forthright about security issues, and probably have one of the most open and transparent security disclosure policies of any browser company. Not as open as an OSS browser, sure, but LOT better than Apple as an example.
- Claim: MS is leaving major vulnerabilities unpatched.
Reality: No evidence to back up your assertion. All major vulnerabilities discovered by the "outside" world are patched swiftly, and there appears to be no good motive to support such behaviour on the part of MS - Claim: MS are fudging the patch notes.
Reality: No evidence to back up your assertion. Do you think that if notes were being "gamed" in this way it would have remained unnoticed for so long? Conspiracy theory logic. - Claim: A single recent vulnerability, swiftly patched proves that IE is overall more insecure than Firefox.
Reality: Anecdotal evidence is not significant over large data sets. Do you also use magnets to remove pain? Cast horoscopes? - Claim: Cenzic is being paid by Microsoft.
Reality: No evidence to back up your assertion. Requires a reputable security company to put its reputation on the line for a potential tiny uptick in IE acceptance. Conspiracy theory logic.
The reality is that the "given enough eyeballs, all bugs are shallow" law is not totally true for security. Dedicated and trained people doing comprehensive end to end security analysis is required to make a truly secure product. This is tricky to arrange in OSS development, since security work is boring grunt work, developers do not relish it and rarely volunteer for it. Admittedly, such work is also normally not done in proprietary companies either, due to the cost implications. When it IS done however, we should expect that the proprietary product will be tend to be more secure than the OSS one, simply because of the dedicated focus that can be applied.
Microsoft has a lot of backlog to overcome in terms of security, so given that we should expect to see it's products become more and more secure until they begin to overtake the OSS competition. Assuming their focus remains, of course. This is precisely what we are seeing for browsers, and seeing the beginnings of with operating systems as well.
Do I use IE? Nope, hate it with a passion. I find it buggy, it renders poorly, and it's slow. But it appears I can no longer call it insecure, because the evidence suggests that it's not anymore.