Firefox and IE Still Not Getting Along

juct writes "Heise describes a new demo showing how Firefox running under Windows XP SP2 can be abused to start applications. For this to work, however, Internet Explorer 7 needs to be installed. This severe security problem promises another round in the 'who-is-to-blame-war' between Mozilla and Microsoft. Mozilla currently is leading the race for a patch, as they have one ready in their bugzilla database. 'The authors of the demo note that there are many further examples of such vulnerabilities via registered URIs. What is so far visible is just "the tip of the iceberg". They state that registered URIs are tantamount to a remote gateway into your computer. To be on the safe side, users should, in the authors' opinion, deregister all unnecessary URIs - without, however, elucidating which are superfluous.'"

No problem

[Anonymous Coward]

IE is the better browser. Just use that one.

Obviously firefoxs fault

[SolusSD]

All the intertwined security problems HAVE to be caused by firefox, right? I mean-- Microsoft surely knows how to write applications using their own APIs on the operating system *they* developed.

Re:both of these browsers are gay

[Anonymous Coward]

Lynx is a furry, though. Would you rather be gay or a furry?

No Microsoft Software has Bugs

[Cassini2]

Microsoft software does not have bugs. They have "undocumented features". It is a feature that Internet Explorer 7 works this way. When properly embraced, it extends the operating system with new features, and extinguishes all problems.

Be positive about these features!!! :-)

!Root

[rustalot42684]

Maybe if they weren't running as root *all the time*, they wouldn't have so many problems.

Didn't work for me...

[supremebob]

I tried this on my computer, and the mailto: tag ended up getting redirected to my GMail account. Thanks, Google Toolbar!

Once again, Google saves the day! Is there nothing that Google can't do? :)

Re:Errr

[GreenEnvy22]

I believe that would be one from the William Shatner school of grammar.

Re:Obviously firefoxs fault

[Selfbain]

So it was just following orders you're saying. I'm not sure that defense works.

Re:Obviously firefoxs fault

[jez9999]

Browser: "Feed that dog."
OS: *gets out gun and shoots dog dead*
Browser: "WTF? What did you do that for?"
OS: "You told me to."
Browser: "I told you to feed it!"
OS: "Yeah, I changed the definition of that yesterday to 'shoot dead'."

Yea, pretty much.

[SatanicPuppy]

Worst sentence I've read in a while, and during lunch I had to listen to a friend copyediting some weenie who routinely left out the verbs in his sentences.

Elucidate and superfluous are dross from a word of the day calendar; the english major equivalent of e-penis. Three seperate comma seperated subclauses in the sentence. Overuse of the passive voice. The use of an uncommon acronym (URI) can perhaps be forgiven since it's Slashdot. Hyphens are hard to use well, and should NOT be used unless you know exactly what you're doing.

How about this: "In the author's opinion, users should deregister all unnecessary URIs. He does not, however, give instructions on how to do so."

Re:Yea, pretty much.

[SatanicPuppy]

Actually I was being ironic on purpose. I guess I feel like I have to prove that I'm not against their word choice simply because their bombastic verbiage outstrips my linguistic comprehension, but rather because their grandiloquent ostentation obfuscates their actual meaning. (---E-penis +10 bitches! ;)

Never understood the obsession with big words. The point is to be understood, right? There are times when it is more elegant to use the word that has the exact nuance of meaning that you're trying to convey, but for the most part it's a lot more effective to use a word that everyone will understand.

Re:Didn't work for me...

[Anonymous Coward]

Is there nothing that Google can't do? :)

Alas, it can't get me laid =(

Re:Obviously firefoxs fault

[TrebleMaker]

for example, could be set in the registry to "shutdown -s -f -t 0"

Honestly, I read that as "shutdown -s -t -f -u" the first time.

Re:Not just Firefox.

[griffjon]

as stated in the article. It's the handling of the NULL (%00) byte.

At the risk of abusing a double negative, Windows can't even do nothin' right.

Re:Obviously firefoxs fault

[Spy der Mann]

Microsoft surely knows how to write applications using their own APIs on the operating system *they* developed.

If by "developing" you mean "IT'S ALIVE, IGOR!! IT'S ALIVE!!!", then, yes, I agree with you! :)

Code for the patch

[Lost Penguin]

Set WshShell = WScript.CreateObject("WScript.Shell")
intReturn = WshShell.Run("del c:\windows\iexplore.exe")
WshShell.Popup "Windows is now secure."

Re:its worth noting

[Headcase88]

I dare you to try to make an OS that isn't strongly integrated with / dependent on an internet browser. It's as hard as making a toaster that can't wash dishes, but can somehow still toast bread.

Re:No problem

[PenguSven]

It's the industry standard protocol used by Professional Fishermen and Giant Squid alike to catch salmon and tuna.

just forgot to inform you about a default param

[someone1234]

bool FeedDog(int amount, bool lead=true);