Slashdot Log In
Symantec Rethinks Firefox vs IE Vulnerabilities
Posted by
Zonk
on Sun Mar 12, 2006 09:34 AM
from the double-think dept.
from the double-think dept.
chill writes "Last September security software vendor Symantec issued a report claiming IE had fewer critical flaws than Firefox and thus was more secure. Well, it seem they have now rethought that position. 'How we did it before wasn't a fair comparison,' said Oliver Friedrichs, the senior manager of Symantec's security response group. 'It wasn't an apples to apples comparison.' The key was vendor acknowledged critical vulnerabilities. Thus, if Microsoft (or the Mozilla Foundation) didn't agree it was critical, then it didn't get counted."
Related Stories
[+]
IE More Secure Than Mozilla? 534 comments
killproc writes "Symantec has issued a report that suggests that Internet Explorer may be more secure than the open source Mozilla Foundation browsers. "According to the report, 25 vendor-confirmed vulnerabilities were disclosed for the Mozilla browsers during the first half of 2005, "the most of any browser studied," the report's authors stated. Eighteen of these flaws were classified as high severity.
"During the same period, 13 vendor-confirmed vulnerabilities were disclosed for IE, eight of which were high severity," the report noted." "
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
imagine that (Score:5, Funny)
I'm SHOCKED!
The tables have turned. (Score:5, Insightful)
All of a sudden Symantec retaliates by deciding that Internet Explorer does indeed have more "critical" flaws than Mozilla Firefox does.
Parent
Re:imagine that (Score:5, Insightful)
I know this might come as a surprise to some of you, but there's a few strange individuals who have integrity, who do really strange things like telling the truth even when it may not be in their best interests. I suppose that might not fit into your worldview
Parent
Re:imagine that (Score:5, Insightful)
So really there are no people of integrity (in charge) in a company with more then a 100 employees.
Parent
So Symantec hates microsoft now?? (Score:5, Funny)
It took them (Score:5, Funny)
Surely it's just about potential for harm. (Score:5, Insightful)
If one browser allows an attacker to read arbitrary files, and another allows an attacker to delete arbitrary files, then the one that allows the deletion is surely worse however many ways there are to read files.
If one browser can be attacked in a generic manner, and the other needs some knowledge of the victim, then the one that can be attacked in a generic manner is less secure.
Now, exactly how an easy to implement low impact and a hard to implement high impact attack compare is still going to be subjective, but wherever you draw the line, it's going to be better than simply counting the nuber of critical bugs.
Re:Surely it's just about potential for harm. (Score:5, Insightful)
This isn't necessarily true. For instance, if the files that can be read include ones with, say, credit card information, wouldn't it be better to have those deleted (you can always re-enter the info to order online) than to have the information read without your knowledge and let someone else charge to your credit card?
The basic point you're making is quite correct, though.
Parent
OneCare (Score:5, Interesting)
Re:OneCare (Score:5, Insightful)
Parent
Re:OneCare (Score:5, Funny)
LOL, Great Point, I can see it now "Symantec Client Security Has Detected A Serious Vulnerability On Your Computer Click OK to Uninstall
Great way to drive pay-per-incident Technical Support too.
"Personal Security Suite Wars 2006 Coming to a Windows PC Near You."
Parent
Re:OneCare (Score:5, Funny)
You were modded funny, only because "prophetic" isn't a legitimate mod. Actually, McAfee beat them to it. [com.com] Their virus update sigs on Friday, March 10th classified MS Excel as a virus.
-Charles
Parent
Re:OneCare (Score:5, Informative)
Parent
Re:OneCare (Score:5, Interesting)
Parent
How can you trust them? (Score:4, Insightful)
They make some b.s. statements that just aren't founded in logic, or in a reasonably cynical view of how people/companies behave. The result is that they suggest you do the ridiculous, with your security (not theirs). Then they (for whatever reason) say something else.
I'm not even suggesting that they "came to their senses", but perhaps, for one reason or another, decided that Microsoft was not their friend anymore (or maybe firefox is their friend now).
Re:How can you trust them? (Score:5, Insightful)
No sane person would. By their own admission, it is clear that they gave a blank check to Microsoft. Whatever their motive for doing that, it shows a lack of devotion to the stated goal of their products.
If a company wants my money for securing my computers, they better show some integrity that doesn't shift depending on how their relationship with the bigger company is going that day.
Parent
A Scenario (Score:5, Funny)
Microsoft: We don't consider that critical.
But there's more... (Score:5, Interesting)
"Windows XP Professional, said Symantec, stays safe just one hour and 12 seconds, while the Windows 2000 Server (with SP4) made it an hour and 17 minutes. An unpatched Windows Server 2003 system lasted somewhat longer.
In contrast, unpatched Linux installations of both Red Hat Enterprise Linux 3 and SuSE Linux 9 Desktop were never compromised during their month-and-a-half exposure to attackers."
Re:But there's more... (Score:5, Insightful)
Parent
That's not exactly correct. (Score:5, Insightful)
On the Internet, it is possible to scan whole ranges of addresses looking for vulnerabilities. Automatically. 24/7. And exploit them automatically, 24/7.
What matters is whether the box has open ports or not.The system's security should be configured to account for the home user's non-patching.
Apple has. Their boxes, by default, have no open ports.
Ubuntu has. Their default install has no open ports.
No matter how many worms and infected machines are out there, a default Ubuntu box will never be infected by them.
The first step in security is to reduce the avenues of attack.
Parent
Not too surprising (Score:5, Interesting)
But Symantec has known for ages that MS is pushing into their space. Maybe they had a Netscape-esque agreement with Symantec and maybe Symantec found new evidence that convinced them partnering with MS isn't the best way to go?
It *could* be as simple as an upper-management type listening to the feedback the last report got, but I haven't seen an icy weather forecast for Hell today.
(For those who missed the MS Anti-trust days: it was 'alleged' that when MS decided that the 'net was not just a fad and MS needed to throw all their resources into making IE the dominant browser, MS offered not to compete in Mac-space if they left the Windows market quietly. Netscape refused, MS bundled IE with windows, and the rest is history)
Oi norton... (Score:4, Interesting)
another undocmented feature...
Number of bugs means... (Score:5, Insightful)
I have seen IT managers getting upset because there were 100's og bugs*.
Turned out all of them were because of ONE faulty thing.
I have seen bug reports of the form
1. pressing button A and then pressing button Y gets critical error.
2. pressing button B and then pressing button Y gets critical error.
3. pressing button C and then pressing button Y gets critical error.
etc etc
In other situations a manager was not upset, "there were only a few bugs*".
Later, this same manager became upset at a time that there were on the order of 50 or so "bugs*".
Turned out fixing those few bugs took more than o month, while those 50 were 'fixed' within a week.
So my professional view is that bug-counting doesn't count, the correct question is:
how sick did you get? (Compare getting bitten by a tsetse fly to getting bitten by a red ant...)
* To be honest: I am referring to a non-English term which is NOT equivalent to a bug, but more to 'a problem'.
Symantec tests windows xp (Score:5, Funny)
Damn (Score:5, Funny)