Slashdot Log In
IE More Secure Than Mozilla?
Posted by
CmdrTaco
on Tue Sep 20, 2005 10:10 AM
from the now-wait-a-minute-here dept.
from the now-wait-a-minute-here dept.
killproc writes "Symantec has issued a report that suggests that Internet Explorer may be more secure than the open source Mozilla Foundation browsers. "According to the report, 25 vendor-confirmed vulnerabilities were disclosed for the Mozilla browsers during the first half of 2005, "the most of any browser studied," the report's authors stated. Eighteen of these flaws were classified as high severity.
"During the same period, 13 vendor-confirmed vulnerabilities were disclosed for IE, eight of which were high severity," the report noted." "
Related Stories
[+]
Symantec Rethinks Firefox vs IE Vulnerabilities 214 comments
chill writes "Last September security software vendor Symantec issued a report claiming IE had fewer critical flaws than Firefox and thus was more secure. Well, it seem they have now rethought that position. 'How we did it before wasn't a fair comparison,' said Oliver Friedrichs, the senior manager of Symantec's security response group. 'It wasn't an apples to apples comparison.' The key was vendor acknowledged critical vulnerabilities. Thus, if Microsoft (or the Mozilla Foundation) didn't agree it was critical, then it didn't get counted."
This discussion has been archived.
No new comments can be posted.
IE More Secure Than Mozilla?
|
Log In/Create an Account
| Top
| 534 comments
(Spill at 50!) | Index Only
| Search Discussion
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
(1)
|
2
(1)
|
2
Questions (Score:5, Insightful)
(http://das.doit.wisc.edu/)
How quickly and effectively were the Mozilla/Firefox vulnerabilities patched in comparison to IE?
Is there any consideration given to the fact that Internet Explorer is a decade old and integral to the OS, and STILL routinely has extremely critical vulnerabilities, and may have an untold number of yet-to-be-discovered critical vulnerabilities?
Assuming customer choice is important, a customer can elect to not use Firefox and remove it from their system. Can the customer remove IE? Can the customer even elect to not use IE, or does the OS still force them to use IE for some tasks?
I could go on, but I think it goes without saying that at best this "report" uses extremely flawed logic to draw its conclusions, and at worst, Symantec is shilling for Microsoft.
Or both.
Re:Questions (Score:5, Informative)
Re:Questions (Score:5, Insightful)
(http://www.smoking-gnu.net/)
You know what, they have large revenues from a MS Windows-related market, and they produce Norton Antivirus, Norton Utilities, and all the damn product line.
If they start saying that a free (as in beer) OpenSource browser (maybe one that works even on GNU/Linux, sheesh!) is able to actually lower the number of virus/malware you get, people may start considering the switch.
If people get less virii/malware, this means less revenues for them. And what if people discover things like ClamAV, which also works on GNU/Linux? What next?
I ain't saying that Symantec is creating new virii by itself (that's an urban legend like alligators in sewers), but I ain't saying they want to lose customers too.
I'll just wait a less biased source than Symantec, or "Microsoft Watch". It's like Microsoft saying that the TCO of Windows is less than the one of GNU/linux (or vice-versa, for what matters).
PS: this doesn't mean that Firefox is "the most secure" thing around. It isn't. But it is free software and works really well for me. I won't switch to Opera now because of this stupid report, nor because Opera has gone free as in beer. A lot of
Anyway, the damage a Firefox bug can do is limited to user space; a hole in IE, which is tightly tied with Windows kernel... brrr.
head-in-sand (or head-in-ass?) (Score:5, Informative)
Jesus fucking Christ. This has got to be the worst number doctoring all day long. From TFA:
There is one caveat: Symantec counts only those security flaws that have been confirmed by the vendor. According to security monitoring company Secunia, there are 19 security issues that Microsoft still has to deal with for Internet Explorer, while there are only three for Firefox.
Oh, well that's just a minor fucking nuclear bomb. Doesn't that make the count 28 to 32? For fuck's sake....the 19 vulnerabilities that Microsoft simply hasn't acknowledged just don't count? This new revelation should make it much cheaper to make secure software...after all, I'm sure it takes far fewer man-hours to do nothing then it does to fix something, and according to Symantec, it produces better results, too!
Re:Questions (Score:5, Funny)
Re:Questions (Score:5, Insightful)
(Last Journal: Monday March 19 2007, @12:36PM)
Is there any consideration given to the fact that Internet Explorer is a decade old and integral to the OS, and STILL routinely has extremely critical vulnerabilities, and may have an untold number of yet-to-be-discovered critical vulnerabilities?
10 years from now, the latest Mozilla version will probably have critical vulnerabilities. Each new version will have different technologies to deal with as well as have new developers/programmers involved. If one thing is constant in programming any app, as time goes on and new versions come out, there are always new bugs and problems. Mozilla won't be immune to those.
Re:Questions (Score:4, Insightful)
Anything that can deceive the user like spoofing a title bar should be taken as a security risk. I'm sorry you don't, I just hope you're not someone working on the Firefox code.
10 year old latest version? (Score:4, Interesting)
This is true. However IE is supposed to be a mature application. It isn't a new version that comes out every few months. At some point shouldn't a developed app reach a point that it is locked down and secure?
Re:10 year old latest version? (Score:4, Insightful)
(Last Journal: Monday March 19 2007, @12:36PM)
Re:10 year old latest version? (Score:4, Insightful)
Every technology IE 6 supports is older than IE 6. IE 6 was released years ago, and hasn't upgraded its support for internet technologies, nor has it added new ones. So really, the argument that "IE 6 is vulnerable because it supports changing technologies" is hogwash. IE 6 is an unchanging application with multiple years available for fixing vulnerabilities.
Re:Questions (Score:5, Informative)
It's not running in the kernel. It doesn't run with privileges that are above the current users. In fact, there's nothing about IE's "integration" that Mozilla isn't just as vulnerable to (in effect, anything IE can do, so can Mozilla, because IE just uses userland API's the same as Mozilla does).
Re:Questions (Score:4, Interesting)
(http://programmers.malfunct.net/)
Re:Questions (Score:5, Insightful)
Re:Questions (Score:5, Interesting)
(http://bangpath.org/)
Keep firefox secure, vote for bug #262536
Bug 262536 [mozilla.org] "Bigger notice for updates and critical updates" has been marked resolved by Ben Goodger: "This is fixed by the new update system UI."
8-)
Re:Questions (Score:5, Informative)
(http://stylus-toolbox.sf.net/ | Last Journal: Tuesday May 15 2007, @11:50AM)
Re:Questions (Score:5, Informative)
But yeah, I can't pay my power bill unless I use IE, so I know you pain and think it's stupid, too.
Re:Questions (Score:5, Informative)
Re:Questions (Score:5, Interesting)
If I weren't so lazy I'd find the comparison. I'll leave that as an exercise for the reader and google.
Re:Questions (Score:5, Insightful)
(Last Journal: Tuesday June 28 2005, @12:57PM)
FTFA, it looks like the *conclusion* that IE is more secure is News.com's, and Symantec is just presenting the numbers. Symantec is quoted as saying "at the time of writing, no widespread exploitation of any browser except Microsoft Internet Explorer has occurred" which doesn't sound like they're drawing the conclusion that IE is more secure.
Does anyone have a link to the actual report? My first instinct is that TFA is just trolling, but I could be wrong.
Re:Questions (Score:4, Insightful)
(http://symbii.com/)
Not only is TFA trolling, so is Slashdot. We're just rehashing all the debate from 4 days ago [slashdot.org].
(or 10 days ago [slashdot.org], and so on...)
Re:Questions (Score:5, Interesting)
(http://www.pjrc.com/ | Last Journal: Thursday June 27 2002, @04:31PM)
As I explained in another post, I believe their numbers are wrong [slashdot.org].
The simple reason is because many bugs where viewing a malicious web page could allow remote code execution (or something similarly nasty) are reported as "windows" bugs rather than "internet explorer" bugs.
If you actually read throught the microsoft bulletins, and consider anything where simply using IE allows an attack (which requires reading the vulunerability info rather than Microsoft's searchable fields of impacted software), you'll find a lot more bugs than Symantec is claiming.
But you don't need to do all that work... I did it, admittedly rather quickly, a few days ago. Just follow that link, and the one in that post, to my quick summary of "simply using IE" bugs.
While googling around, I also found several others mentioned on various security sites, which didn't seem to correspond to any of the bulletins. And complaints of known bugs still not fixed. And some microsoft "notices" which basically claim "that's not a bug, you just need to avoid doing XYZ".
My quick list alone almost puts IE to the raw number of bugs as firefox, and I'm sure if someone did all the digging needed to compile a list that also included other non-microsoft-bulletin sources, we'd see what is plainly known... that IE has a lot more bugs.
It's sad that Symantec couldn't do this. Looks like they simply using Microsoft's database, which ignores lots of bugs Microsoft doesn't "officially" consider IE bugs (even though simply viewing a page with IE is the attack vector), and all the bugs Microsoft is ignoring or denying, or has quietly fixed.
Flaw in the methodology (Score:5, Insightful)
(http://perens.com/ | Last Journal: Tuesday February 07 2006, @08:49PM)
Bruce
How to respond to bad Mozilla security news on /. (Score:5, Funny)
1.) First, immediately dismiss the results, just like you did in the last Mozilla security story. Mozilla is flawless.
2.) Randomly reference Open Source, claiming the flaws were easier to find because of it, which has nothing to do with the report in the article and actually sounds like a criticism of Open Source, if anything.
3.) Accuse the study of bias or "shilling." ALWAYS do this when the study goes against your pre-made worldview (in this case, Mozilla being flawless). When the study gives the opposite conclusion, agree with it and praise it, often with related anecdotal stories.
4.) Reference Internet Explorer's age, which has little to do with and doesn't change Mozilla having more flaws than Internet Explorer today.
5.) Ask how quickly the Mozilla vulnerabilities were patched, ignoring that Mozilla has marked vulnerabilities "Confidential" before for them to sit for two years unfixed.
6.) Claim Internet Explorer is integral to the OS, when you argued that Internet Explorer was easily removed from Windows during the anti-trust trial.
7.) Claim matter-of-factly that, for some reason, it "goes without saying" that the study uses some sort of flawed logic, without citing the logic, giving proof, or backing the statements in any way. Simply claim it, knowing everyone will mod you up because they, too, want to believe Mozilla is flawless.
Re:Symantec? (Score:5, Interesting)
(Last Journal: Wednesday July 26 2006, @04:50AM)
Yea but... (Score:5, Insightful)
dupe? (Score:3, Informative)
Security is a process! (Score:5, Insightful)
(http://ostermiller.org/ | Last Journal: Friday February 17 2006, @11:59AM)
Security is a process not a state.
A browser that has 5 reported vulnerabilities is not more secure than a browser that has 30. All it takes in one vulnerability to make your browser insecure
Once any vulnerability is discovered, relative security depends upon is how many users are exposed, and for how long.
Given that vulnerabilities have been found in both, security comparisons should compare the steps taken to reduce the window of vulnerability.
A simple comparison of the number of vulnerabilities does not give much indication about how long the average user was exposed. Nor does it give an indication of how many hackers are taking advantage of the vulnerability to give you a useful security indicator: "How likely is that any given user was hacked via the product".
Currency calculator that accepts free form input such as "23 canadian dollars --> rupees" [coinmill.com]
Re:Security is a process! (Score:5, Interesting)
(http://theravensnest.org/ | Last Journal: Sunday October 07, @07:05AM)
- What is being done proactively to ensure that the system remains secure?
Once a new form of vulnerability is discovered, is the rest of the code audited to ensure that no other vulnerabilities of this nature exist? Is the vulnerability class documented, and are the coding guidelines for the project updated to ensure that people who read them (all committers, at a minimum) don't make the same mistake again?There is a reason why I trust the security of OpenBSD more than most other projects. Security is not just a process, it's an attitude.
Vunerable? (Score:5, Insightful)
How many? (Score:4, Insightful)
(http://www.sglider.net/ | Last Journal: Tuesday January 16 2007, @03:02PM)
1. How many 'high severity' bugs did IE have to fix to get to that point? Remember also that IE is integrated into Windows, so any vulnerability that affects Windows affects IE in one way or another (and vice versa).
2. How many have been disclosed by Microsoft before being fixed? They are notorious for not disclosing these things until after it is fixed, and even then they don't always label it as a "IE" fix.
Re:How many? (Score:5, Interesting)
(http://urban.cream.org/ | Last Journal: Wednesday December 07 2005, @09:24AM)
What drivel.
There are several massive logical ballsups here, made by the linker and the linkee.
1) Not all exploits are created equal. Look at the number of those Moz exploits rated by Secunia as 'Extremely Severe' or 'Critical' compared to those for IE.
2) Mozilla Firefox is not bug free. No piece of software is bug free, and only a mentally retarded moron would believe otherwise. What is important is not that security flaws get found, but (a) how open the organisation is about the flaw [full disclosure] and (b) timeliness of fixes.
3) Mozilla believes in full disclosure, Microsoft does not.
4) The average time taken to patch a flaw in Firefox is two days. IE has unpatched vulnerabilities going back SIX YEARS.
5) Critical components of Firefox run in an sandboxed unprivileged space. When Firefox flaws are discovered, the damage done is minimised. IE runs everything with administrator privileges. When IE is exploited (regularly), a full-on system-rape inevitably follows.
6) ActiveX. The unsafe system by which 90% of spyware, adware, trojans, porn diallers etc. enter your system. Guess which browser has ActiveX turned on by default? Yes, IE. Firefox doesn't support ActiveX because it's just too bloody dangerous.
The security arguments being made about IE vs Firefox in that argument are unreconstructed luddite ballacks.
Although, honestly, we all know security is not the reason we geeks like Firefox. We like it because OMG 3XT3NSI0NZ!!!
So squish.
Martin
Bug Free (Score:5, Interesting)
Security flaws? (Score:3, Informative)
Re:Security flaws? (Score:5, Insightful)
(Last Journal: Friday November 10 2006, @02:16PM)
(1) Even though IE is old, the nature of threats changes -- not all the security holes could have been predicted five years ago.
(2) Just because Mozilla is newer doesn't mean that they don't have the responsibility to have fewer holes in security. On the contrary, the Mozilla developer community has had the opportunity to learn from all the security holes of IE, and to develop the code from the ground up in such a way that limits vulnerabilities.
That said, response time to threats is better for Firefox. The total threat posed is probably less, because the time of exposure is a fraction of IE vulnerabilities.
But Mozilla faces a tough road ahead -- if they maintain or gain market share, they have to be very cautious, as their vulnerabilities will begin to be targeted seriously by malware.
Anyone who uses any browser online should still be running virus-detection software. This will never change, no matter what OS or browser you use.
a few days ago (Score:3, Informative)
(http://www.lightandmatter.com/)
Mozilla hits back at browser security claim (Score:5, Informative)
http://www.zdnet.co.uk/print/?TYPE=story&AT=39219
So spyware installation is a feature? (Score:4, Insightful)
(http://www.hipersonik.com/)
So the alternative conclusion of the symantec report would be: Spyware holes in MS IE are not spyware holes, but easy software installation features.
Symantec is a scourge (Score:5, Interesting)
(http://www.rumour.com/)
I kid you not, Symantec has been saying "Don't use the Mac, it's insecure! Or Linux! Or Mozilla! They're not secure, oh noes!!!"
Guess why... maybe it's because they don't have products for those operating systems... or maybe it's because there are no virii in the wild, and they haven't been able to figure out how to write good enough virii for those OS' to scare people into buying their shitty product?
You decide. I already have.
Symantec's Business? (Score:5, Interesting)
I mean, it may not be secure in the traditional sense of the word, but with all the trojans/malware/ActiveX vulnerabilities out there, surely IE is the best way to "secure" profits for themselves?
Re:Let the zealots start their engines... (Score:4, Insightful)
(http://www.starfishsystems.ca/)
Don't be a troll. An opinion is a statement based on subjective criteria. And yes, everyone has them, and comparisons between them are not particularly interesting.
But we're not talking about subjective matters here. Symantec has released a security analysis, whose premises and reasoning may or not be correct at various points. That's what we're discussing here. Symantec is not saying, "We think Britney Spears is cute." It's claiming that vulnerabilities have been found faster in one browser versus another over a certain period of study.
Our discussion is about the merits of that claim. It's called a rational discussion. I'm sure there will be some subjective opinions thrown in as well. After all, we're not a corporation issuing a press release on the findings of a security study, so tests of intellectual rigor are a bit different here.
Another repost... almost word for word this time (Score:5, Informative)
(http://www.hooklinesinker.org/)
It not only makes
Anywho...
Cliff notes of last story:
IE's exploits would be someone taking over your computer remotely
Firefox's exploits would be malicious popups/crashing (of browser only)
So the "severity" thing doesn't really matter here.
IE is more secure... (Score:5, Funny)
(http://suso.suso.org/ | Last Journal: Tuesday March 09 2004, @12:03AM)
Re:IE is more secure... (Score:4, Informative)
(Last Journal: Thursday July 12, @12:30PM)
I know you're joking, but as it happens, you're actually wrong. [microsoft.com]
2/2/2004: KB832894: Security Update for IE6/Windows XP: "This affects all computers with Internet Explorer installed (even if you don't run Internet Explorer as your Web browser)."
Yes, IE is that fucking bad.
All lies! (Score:4, Funny)
All of those bugs reported last year for IE were well founded, with serious implications that needed to be released to the public for THEIR OWN SAFETY!
Obviously these Mozilla bugs reported this year are miniscule at best, and it does the community a great disservice to release any information about them!
Gates is the devil! Impeach Bush! Katrina is a direct result of WalMart cutting lunches! And Starbucks is lacing their coffee with microscopic beta nanomachines, built to track and report our intake of caffeinated beverages!
Current Secunia Ratings (Score:5, Informative)
(http://www.murorum.demon.co.uk/)
Mozilla Firefox 1.x with all vendor patches installed and all vendor workarounds applied, is currently affected by one or more Secunia advisories rated Less critical
This is based on the most severe Secunia advisory, which is marked as "Unpatched" in the Secunia database. Go to Unpatched/Patched list below for details.
Currently, 3 out of 22 Secunia advisories, is marked as "Unpatched" in the Secunia database.
And IE
Microsoft Internet Explorer 6.x with all vendor patches installed and all vendor workarounds applied, is currently affected by one or more Secunia advisories rated Highly critical
This is based on the most severe Secunia advisory, which is marked as "Unpatched" in the Secunia database. Go to Unpatched/Patched list below for details.
Currently, 19 out of 85 Secunia advisories, is marked as "Unpatched" in the Secunia database.
Opera (Score:3, Interesting)
Yay Opera for windows, and Konquerer for Linux!
--LWM
RTFA (Score:5, Insightful)
With a MAJOR Caveat (Score:5, Interesting)
(http://slashdot.org/ | Last Journal: Wednesday September 24 2003, @10:01AM)
How about this: a report that identifies the vulnerabilities associated with a vendor, and not a product. In other words, after the initial public announcement of a vulnerability, we report how long it took the vendor to release a patch. Lower scores are better.
Anybody think that'll work? If not, why not?
Blowing smoke. (Score:3)
(Last Journal: Tuesday October 16, @02:57AM)
I can say with confidence that I have laughed mightily at colleagues, friends and family members running IE who have to juggle two or three anti-malware programs and still wind up shoulder-deep in the Windows Registry or re-install because of security holes in IE.
Symantic can only blow so much smoke up my ass before reality re-asserts itself. Theoretical vulnerabilities are bad. Giant screaming voids you could drive a Peterbilt through are worse. Open Source Software frequently gives you the former. Microsoft can be counted upon, in a lead-pipe cinch, to deliver the latter.
SoupIsGood Food
Yawn. Follow the money. (Score:5, Informative)
(http://e42.us/)
From TFA:
Symantec counts only those security flaws that have been confirmed by the vendor. According to security monitoring company Secunia, there are 19 security issues that Microsoft still has to deal with for Internet Explorer, while there are only three for Firefox.
Nice. So in terms of checking off the reported vulnerabilities and counting each one equally, if the report would be honest, IE would have 32 issues and Firefox would have 29. For the sake of this report, all vulnerabilities are equally bad, right? Well, not according to TFA:
Symantec admitted that "at the time of writing, no widespread exploitation of any browser except Microsoft Internet Explorer has occurred," but added that it "expects this to change as alternative browsers become increasingly widely deployed."
So the IE vulnerabilities result in widespread exploitation and the Firefox ones don't, but firefox is somehow worse? I think the only way in which firefox is worse, from Symantec's perspective, is that the constantly malware-infested machines (where IE is the main infestation vector) inflate demand for the crap that Symantec peddles, and they're afraid that if people aren't constantly suffering from the pain of these infections this demand will evaporate.
Feh. Maybe I'm a cynic, but this looks like marketing poorly disguised as research to me...
They are just protecting their interests (Score:3, Insightful)
(http://slashdot.org/)
If people start jumping ship (Win+MSIE) onto another ship, Symantec will see that they will sell fewer floatation devices.
This is a pretty pathetic attempt to sway opinion by Symantec.
Criticality and Vulnerability Window (Score:3, Informative)
(http://www.traxel.com/)
Lots is being made the past few days about the number of security holes found in various browsers. Just to try to keep the discussion from descending to complete irrelevance, here's the stats that actually matter:
Solution Status (has it been fixed?):
http://secunia.com/graph/?type=sol&period=all&pro
http://secunia.com/graph/?type=sol&period=all&pro
Criticality (how bad is it if I get hit?):
http://secunia.com/graph/?type=cri&period=all&pro
http://secunia.com/graph/?type=cri&period=all&pro
Unpatched Criticality (what can happen to me today?) Requires a little more looking - see the list at the bottom of each page:
http://secunia.com/product/11/ [secunia.com]
http://secunia.com/product/4227/ [secunia.com]
IE: 5 unpatched moderate or greater criticality
Firefox: 0 unpatched moderate or greater criticality
Finally, and unfortunately not clearly covered in [the Secunia] report is vulnerability window - how long does a bug go without being patched. You can, however, make a fairly good estimate by looking at the patch time for highly critical or worse bugs:
MS has been making big improvements lately, so I'll only look at the MS holes from the past year (the older ones have dramatically longer vulnerability windows) (I've also left out holes which were publicly discovered as a result of a windows patch)
IE Highly+ Critical Windows (past year)
http://secunia.com/advisories/12806/ [secunia.com] 103 days
http://secunia.com/advisories/12889/ [secunia.com] 108 days
http://secunia.com/advisories/12959/ [secunia.com] 29 days
http://secunia.com/advisories/13482/ [secunia.com] 53 days
http://secunia.com/advisories/15891/ [secunia.com] 7 days
Firefox Highly+ Critical Windows (all time)
http://secunia.com/advisories/14654/ [secunia.com] 7 days
http://secunia.com/advisories/14938/ [secunia.com] 24 days
http://secunia.com/advisories/15292/ [secunia.com] 5 days
http://secunia.com/advisories/16043/ [secunia.com] 7 days
http://secunia.com/advisories/16764/ [secunia.com] 3 days
Keep the discussion rational - security is hard, so is assessing security. Be skeptical of anyone who has a dog in the fight (eg: Symantec). [Which is not to say that Symantec cannot be trusted for Windows security, only that their PR department's press releases regarding software security should be treated as suspect - particularly when they draw questionable conclusions from insufficient data.]
IE vs Windows bugs (Score:5, Informative)
(http://www.pjrc.com/ | Last Journal: Thursday June 27 2002, @04:31PM)
But within the bulletins, there are lots of bugs, like the one fixed by MS05-024 [microsoft.com] that aren't "technically" IE bugs. But the end result is that a malicious web page (or advert iframe) could do something nasty... usually execute arbritrary code (install spyware or a virus if the server is infected). If simply viewing a web page with IE allows an attack, I call that an IE bug, regardless of where the actual bug is located by Microsoft's way of thinking.
Notice how the "affected software" of MS05-024 is many versions of windows, but Internet Explorer isn't specificly mentioned. So when someone tallies IE bugs, this one probably doesn't make the list. But the "Vulnerability Details" section says:
I can see how a journalist could do such poor research. But Symantec? Come on, I found 22 nasty IE bugs by just browsing though 40-some Microsoft bulletins. That Symantec only thinks there's 13 doesn't build much confidence in the supposed "market leader" of anti-virus products!
Symantec is living off of their rep from the 80s (Score:3, Insightful)
Brand familiarity and name recognition are suitable substitutes for quality when it comes to business and profits. I wouldn't touch any of their software with a 10 foot IDE cable anymore, and haven't for the past few years.
Vendor-confirmed? (Score:3, Insightful)
(http://www.silverglass.org/)
I think this is the kicker. The 25 vulnerabilities for Mozilla are almost certainly all the known vulnerabilities. For IE, how many vulnerabilities are there that've been reported that MS hasn't publicly acknowledged?
In addition, what's the severity? The last Mozilla vulnerability was the IDN bug, which was trivially worked-around by changing one config setting until a patch was released. Contrast that to the recent vulnerability in IE that MS won't discuss details of, other than to say that it allows total compromise of the machine and they won't be patching it until next month, and there's no workaround for the bug because nobody knows what the bug is (outside of MS, the security company that found it and the black-hats, of course).
My take on it: Mozilla may be having more vulnerabilities reported, but it's still fewer than in IE and those vulnerabilities are less severe, easier to work around without crippling your system and fixed sooner than IE's holes. From a user's viewpoint, this makes Mozilla more secure than IE.
For those who may be fooled by this (Score:5, Insightful)
(http://www.michaelchaney.com/)
This exposes the gulf between open source security and proprietary security. Ignore for a minute the fact that Symantec a) has a vested interest in you using insecure products and b) uses highly flawed methodolgy as their "count" is actually "count of vendor-admitted bugs". There's a major difference between a vulnerability in Mozilla and a vulnerability in IE.
Since we don't have the source for IE, any vulnerability found is, by definition, exploitable. Someone found a way to exploit it- you get a vulnerability.
Vulnerabilities found in Mozilla, on the other hand, are often theoretical in nature. Someone looking through the source finds the problem, but no exploit is written.
Another major problem is here:
My entire system isn't going to be compromised from me browsing with Mozilla. Period. Somebody is confused.
In other news... (Score:3, Informative)
Show me a percentage (Score:3, Insightful)
If Firefox had been more popular, would it have been more exploited? Would it have been worse than IE? These are useless questions.
The point is, Firefox users are more secure than IE users. And Firefox developers are much better listeners than IE developers. People who use Firefox have a better experience with their computers. And that is why IE has lost market share.
I hope nobody takes all these B. S. articles seriously.