Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
Security Bug Internet Explorer The Internet

Experts Say To Switch Browsers In Light of IE Vulnerability 455

Posted by timothy
from the here's-my-number-if-the-place-burns-down dept.
It appears that the exploit in IE briefly mentioned a few days ago is causing a serious reaction: SteveAU writes "Microsoft has begun flooding media outlets with information advising users to switch to an alternate browser while a serious security flaw is being patched. The flaw, which affects all versions of Microsoft Internet Explorer, is manifested via malware and has infected over 6,000 sites thus far. Microsoft states: 'The vulnerability exists as an invalid pointer reference in the data-binding function of Internet Explorer. When data binding is enabled (which is the default state), it is possible under certain conditions for an object to be released without updating the array length, leaving the potential to access the deleted object's memory space. This can cause Internet Explorer to exit unexpectedly, in a state that is exploitable.'" According to the BBC report, though, Microsoft itself is only asking that users be "vigilant while it investigated and prepared an emergency patch"; it's outside experts who say to dump IE (at least for now).

Update: 12/16 21:11 GMT by KD : Microsoft will issue an emergency critical update for IE tomorrow.
This discussion has been archived. No new comments can be posted.

Experts Say To Switch Browsers In Light of IE Vulnerability

Comments Filter:
  • Red header (Score:2, Funny)

    by LingNoi (1066278)

    Whoa what happened to Slashdot's main page...

    This story's title header was red.. Is that like "woop woop warning warning" red? Or something else?

  • by elronxenu (117773) on Tuesday December 16, 2008 @08:54AM (#26131825) Homepage

    Water still wet.

    Pope still Catholic.

    • by Anonymous Coward on Tuesday December 16, 2008 @09:11AM (#26131993)

      and chairs still fly

    • by Anonymous Coward on Tuesday December 16, 2008 @09:19AM (#26132081)
      last time I checked, *my* pope was orthodox. or to be more precise, Pope and Patriarch of All Africa on the Holy Orthodox and Apostolic Throne of Saint Mark the Evangelist and Holy Apostle.

      happy flamebait!
      • by Chris Mattern (191822) on Tuesday December 16, 2008 @10:49AM (#26133121)

        last time I checked, *my* pope was orthodox. or to be more precise, Pope and Patriarch of All Africa on the Holy Orthodox and Apostolic Throne of Saint Mark the Evangelist and Holy Apostle.

        Otherwise known as "Leroy".

    • another OS (Score:4, Interesting)

      by TheMeuge (645043) on Tuesday December 16, 2008 @09:22AM (#26132131)

      Next week's news: "Microsoft experts" advise users to switch to temporarily switch to a different OS, as they prepare to roll out Windows 7... ... jokes aside I haven't been THAT peeved with Vista. The interface is awkward, file transfers are dramatically slower than Ubuntu, and downloading a file over the internet invokes a 20 second freeze in Firefox. Other than that, it seems more stable than XP, and is responsive enough on my recently upgraded desktop.

      It has been relegated to a game console status though, at least for me.

    • Re:In other news ... (Score:5, Informative)

      by Pollardito (781263) on Tuesday December 16, 2008 @10:41AM (#26133045)
      that's all news that is true, this article is not actually true:

      Said [Trend Micro's] Mr Ferguson: "If users can find an alternative browser, then that's good mitigation against the threat."

      But Microsoft counselled against taking such action.

      "I cannot recommend people switch due to this one flaw," said John Curran, head of Microsoft UK's Windows group.

      He added: "We're trying to get this resolved as soon as possible.

      so it's not actually Microsoft that's suggesting that people switch browsers, Microsoft has only "urged people to be vigilant while it investigated and prepared an emergency patch to resolve it."

      • by ConceptJunkie (24823) on Tuesday December 16, 2008 @12:46PM (#26134637) Homepage Journal

        Which is what Microsoft always says: You're gonna get screwed if you use our crappy browser, but at least we warned you.

        No software is perfect, and everything has security flaws, but it seems to me, even 8 years after Microsoft (claimed they) took a serious position on security, they still seem to have an order of magnitude more problems than everyone else. Yeah, I know, they're the biggest target, but for crying out loud, Google wrote chrome from scratch* in less time than IE7 was in beta (or if not, it wasn't too far off) and came up with a browser that blows away IE in every single way except the number of desktops that have it installed.

        Microsoft is at the point where they can do little but admit that there's nothing constructive they can do any more. It's been obvious for years to people in the know, but they've reached a point of diminishing returns: It obviously takes more effort to keep their bloated corpse of an operating system (and its 10-years-out-of-date browser) just working and free of 0-day exploits (leave alone catching up with the competition) than it would be to start over like Apple did with OSX.

        How much longer will it take for MS to wake up? When the amount of effort needed for them to keep Windows limping along exceeds to man-power of the entire planet? It probably won't begin until the chair-tosser-in-chief is gone, and then it take years for them to recover. It used to be that Microsoft put as much effort into maintaining their monopoly as they did in their software. Now it seems maintaining their monopoly receives all but the smallest fraction of attention. The rest goes to plugging holes in the about-to-collapse dyke.

        * For certain values of "from scratch"

      • Cycle of Abuse (Score:3, Insightful)

        by clarkn0va (807617)

        so it's not actually Microsoft that's suggesting that people switch browsers

        Au contraire. "I cannot recommend people switch due to this one flaw". Translation: We've given you countless reasons to switch already. Here's one more.

        IE users (and Windows users in general) remind me of the plight of the abused spouse, caught in the endless cyle of abuse [heart-2-heart.ca]. This is phase 2. A fix has been promised for tomorrow. That's phase 3. How many times is the average victim victimized before they leave? Way too many.

        db

    • by Pope (17780)

      Never been Catholic.

  • by celardore (844933) on Tuesday December 16, 2008 @08:59AM (#26131873)
    ...probably won't. Most uneducated users that read the article will probably be of the mindset "oh, it won't happen to me".
    • by Andr T. (1006215) <andretaff&gmail,com> on Tuesday December 16, 2008 @09:01AM (#26131901)
      I think that most people that read news about IT don't use IE already.
      • by SkankinMonkey (528381) on Tuesday December 16, 2008 @09:08AM (#26131967)
        Yea but the ones that they support and frequently think it's a good idea to click on the 'Hit the target to get a free iPod' ad is a good idea.
        • by Anonymous Coward on Tuesday December 16, 2008 @09:19AM (#26132089)
          Yea but the ones that they support and frequently think it's a good idea to click on the 'Hit the target to get a free iPod' ad is a good idea.

          I won one of these a few days ago. Just to let you know, they don't actually give you an iPod directly. Instead, they ask for your bank account information and deposit $250 (they say it's for tax purposes). I should be getting my money any day now!
      • by joelholdsworth (1095165) on Tuesday December 16, 2008 @09:17AM (#26132063)

        I was listening to BBC Radio 1, and they had a news item about it this morning. But I think GP is right - I can't imagine it will make many users switch. However, as more and more people within the technical community become jaded with the consistent poor quality in Microsoft's offerings, MS will inevitably loose mind-share, and hence their strangle hold on the industry will loosen.

        It's this sort of thing that made me switch over to Linux a year ago. I haven't looked back.

    • by LingNoi (1066278)

      Same thing with backups, they're never taken seriously until the company loses all its data and goes out of business.

    • by denis-The-menace (471988) on Tuesday December 16, 2008 @09:12AM (#26132009)

      Corps won't change either, cause their most computer-illiterate users happens to be their CIO and his/her underlings.

      If something huge happens, FF may actually get into corps even without a Mozilla-created, Corp-approved MSI package.

      • by fuzzyfuzzyfungus (1223518) on Tuesday December 16, 2008 @09:37AM (#26132317) Journal
        Speaking as an institutional IT underling, a Mozilla created MSI for Firefox would be really, really handy. As would a mechanism for installing extensions and updates in a more manageable way. Here, at any rate, there is no real opposition to FF per se; but deployment has, thus far, mostly foundered. "Well, IE updates can be deployed within the system with WSUS, FF updates will happen per machine and be blocked by the firewall, and there is no way in hell we'll be able to keep all the machines updated manually." Which is largely true.

        Now, this mostly comes down to the fact that Windows doesn't have anything nearly as nice as real package management(WSUS for MS apps and drivers only is the closest they really come), so apps end up rolling their own with varying degrees of success, which sucks. If we were running *nix this wouldn't be an issue. Unfortunately, that isn't really my option. If FF had a decently manageable MSI option, I'd probably install it on all user machines tomorrow; but until then I'll have to stick with using it on a more limited scale(You think I would use IE for anything beyond the broken intranet stuff?)
      • Re: (Score:3, Interesting)

        by archen (447353)

        Really it's not that simple. I was a supporter of firefox in my organization, and to my surprise I pretty much won. We use Firefox for nearly everything. Nearly. I have content adviser turned on for each of the machines which for the most part cripples IE and makes it nearly impossible to actually browse the web. IE is still very necessary for many sites which are required for our operation. Not internal "we developed in house badly designed pages", but actual corporate sites to manage various account

        • Re: (Score:3, Interesting)

          by Anonymous Coward
          In my organization, we use Macs. We don't have to, but we do, because everyone used to have their own operating system and their own trouble and having to use another computer for a while was a pain when you were a linux fan-boy and the other person was using windows or when someone simply didn't have any gui apps because he's a console fan-boy, etc.

          We're writing software that should be accessible via ssh and web, so the solution was simple: everyone will use Macs (honestly, it took me ONE day to get used
        • by Hal_Porter (817932) on Tuesday December 16, 2008 @11:49AM (#26133813)

          Really it's not that simple. I was a supporter of firefox in my organization, and to my surprise I pretty much won. We use Firefox for nearly everything. Nearly. I have content adviser turned on for each of the machines which for the most part cripples IE and makes it nearly impossible to actually browse the web. IE is still very necessary for many sites which are required for our operation. Not internal "we developed in house badly designed pages", but actual corporate sites to manage various accounts on the Internet. That's surprising in 2008 that companies could have their head stuck in the sand that badly, but they seem to be all over the place... and unfortunately in places required for essential function.

          I'm fortunate that the medium sized company goes along with this, because in any other organization we'd just use IE and that would be the end of it. Just managing the work arounds has actually been a lot of work, although in my mind it comes out to a wash in being a bit more proactive in preventing the vulnerabilities that flood IE.

          You can do much better than that. I duct tape huge boxing gloves to my users hands, that way they can't type malware in using a notepad and Alt key codes. I've also banned people carrying in USB peripherals (might have malware), laptops (might have malware), mobile phones (distracting and pointless) and A4 binders (might have malware written out as a long list of Alt key codes). I've also removed all the phones (someone might whistle malware down the phone to a 56K modem). Though I've covered all the ports, USB, network, modem and so on with epoxy resin. Still I believe in defense in depth.

          Some of my users have found out how to remove the gloves with their teeth, even though my security guards will beat anyone they see trying to do that. I've asked the CEO if I can amputate their hands and leave them with bandaged stumps but he obviously was too 'non technical' to understand. He just shook his head and walked off. Maybe muzzling persistent rule breakers after the third beating would be a acceptable. Actually I want to muzzle and blindfold everyone all the time and cut off the power. Still, even though the solution I have is not perfect it is very secure.

      • Re: (Score:3, Insightful)

        by Frosty Piss (770223)

        Corps won't change either, cause their most computer-illiterate users happens to be their CIO and his/her underlings.

        Many "corps" will not switch because they have internal applications that require IE for some reason (ActiveX...)

    • Re: (Score:3, Informative)

      by CSHARP123 (904951)
      AM news station here in Atlanta which is pretty popular during driving hours were warning today. People will certainly take a note when it is broadcasted on the news
  • Vulnerability (Score:5, Insightful)

    by conureman (748753) on Tuesday December 16, 2008 @09:00AM (#26131885)

    The only way to open iexplore.exe in my home computers is through the "run" tab. This is to prevent unfit users from not using one of the other browsae. I seldom format & install windows now, unlike before I took that measure.

  • by Reality Master 201 (578873) on Tuesday December 16, 2008 @09:00AM (#26131887) Journal

    Just start over. The thing's a chunk of crap that doesn't render stuff properly and must be a nightmare to maintain.

    Pick another rendering engine - WebKit or Gecko - and build a browser around it. Maybe provide IE classic for those poor schmucks who are at jobs with crappily coded intranet apps full of client side VBScript, but don't make it the default.

    • by hey! (33014) on Tuesday December 16, 2008 @09:28AM (#26132213) Homepage Journal

      They won't, because there are only two things shoring up their critical desktop OS monopoly in the enterprise at this point: Office and IE.

      User and developer dependencies on IE's peculiarities makes not having access to Windows inconvenient. Microsoft's own web software are designed to provide users of alternative browsers with inferior experience.

      Keeping those "poor schmucks" dependent on IE is worth a great deal of money to MS.

    • Re: (Score:3, Informative)

      by Blakey Rat (99501)

      IE has tons of backwards-compatibility cruft. They can't just yank it; there'd be thousands of apps that literally couldn't run because they depended on some obscure IE feature.

      That said, Microsoft *does* have an excellent (if slow) rendering engine named Orcas. As opposed to IE's engine, named Trident. It's used for their also-excellent Expression Web product. And, I think, Visual Studio, but I don't have that installed so don't quote me on that.

  • really what choice did they have? I can see a class action from *lots* of angry people who's computers have been hosed and bank accounts hoovered would cost far more then not acting. Not to mention the loss of faith.

    Now all we need is a certain percentage of people who try the fox being either to taken with it or too lazy to change it back.

    Poor MS, what with Vista they have been having a bad time of it recently.
    • Re: (Score:3, Interesting)

      by tekrat (242117)
      Poor MS, what with Vista they have been having a bad time of it recently.

      Poor Microsoft? You've gotta be kidding me. If your main products are crap, you get what you deserve. Anyone who thinks that Windows or IE are great obviously hasn't even tried anything else seriously.

      At the Trenton Computer Fair earlier this year I was handed an Ubuntu disc. I've subsequently loaned this disc to others, made copies, etc., etc, and everyone that actually put it in their computer and tried it came back to me to te
  • Is any browser safe? (Score:5, Interesting)

    by Toreo asesino (951231) on Tuesday December 16, 2008 @09:08AM (#26131963) Journal

    Personally I don't use IE for most things, but I don't use FireFox for reasons of security at all; just because the extensions rock.
    To my mind, all browsers have more or less the same number of security problems; name me a single mainstream browser that's not had a vulnerability this year for example.

    So in other words, we should find ways to seal off browsers from the normal desktop; lock it down in some low-rights, sandboxed safe environment planning that when it is hacked, it at least will be very limited in scope.

    And that, ladies and gentlemen, is why if I had to choose my browser on purely default security scope, I'd go for IE7/Vista or some customised FireFox setup that nailed it to the floor.

    Just a thought.

    • Re: (Score:2, Insightful)

      by bigpistol (1311191)
      But not all browsers are welded to the kernel.
      • by Anonymous Coward on Tuesday December 16, 2008 @10:00AM (#26132635)

        Neither is Internet Explorer. There is nothing about IE that has anything to do with the kernel. You confusion lies in the fact that you confuse "operating system" specifically with "kernel" which is not completely correct. Absolutely no part or component of Internet Explorer resides in privileged memory.

        Internet Explorer, however, is a part of the operating system in that a number of the libraries used in Internet Explorer the browser are modular and can be used through other applications, both first party and third party. Various components of the Explorer shell, such as Active Desktop, are accomplished through hosting the HTML renderer of Internet Explorer. Many applications also rely on those libraries are a variety of functions from rendering HTML to performing simple FTP commands. They could use other means to accomplish the same tasks, but the Internet Explorer API makes it exceedingly easy.

        So, no component of Internet Explorer is hosted within the kernel at all. However, Internet Explorer is a part of the operating system in that it is a constituent component of the platform API expected to exist for applications. Removal of those components will break scores of applications.

        Note that this vulnerability also does not impact Internet Explorer 7.0 on Windows Vista running within Protected Mode. Yes, the vulnerability can still be exploited and the arbitrary code executed but that code will be contained within a fairly tight sandbox which lacks the privileges to write data to any location, including the user's own profile, even if the current user is running as Administrator. Google Chrome on Windows Vista is the only other browser to use this functionality. No browser can completely prevent buffer overruns in loaded native plug-ins, but browsers may mitigate the effects by sandboxing themselves. Other browsers should take note and follow suit.

      • by Z34107 (925136) on Tuesday December 16, 2008 @10:30AM (#26132927)

        IE never was "welded to the kernel."

        IE exports a COM object, which lets developers add HTML rendering to an application with one line of code. So, that's one reason why they don't want you uninstalling it - HTML rendering is something a lot of Windows applications are expecting the OS to export.

        The closest it came to "welded to the kernel" was Active Desktop where the Windows shell used it to render a web page on your desktop. I think it was also used if you had an HTML background for folders, too. Not sure what happened to it in XP or Vista.

        About the only things that count as kernel-welded in Windows land are device drivers and services, of which IE is neither.

    • by Raenex (947668) on Tuesday December 16, 2008 @09:22AM (#26132129)

      So in other words, we should find ways to seal off browsers from the normal desktop; lock it down in some low-rights, sandboxed safe environment planning that when it is hacked, it at least will be very limited in scope.

      Except the browser is an excellent application to hack, even if sandboxed, because it has network access and is used for nearly everything these days, including online banking. If you want to be safer you'll have to use separate sandboxed browsers for finance vs email vs ... vs random browsing.

      • by Kozz (7764) on Tuesday December 16, 2008 @11:25AM (#26133553)

        ...use separate sandboxed browsers for finance vs email vs ... vs porn browsing.

        Fixed that for you.

      • Re: (Score:3, Interesting)

        by arevos (659374)

        Except the browser is an excellent application to hack, even if sandboxed, because it has network access and is used for nearly everything these days, including online banking. If you want to be safer you'll have to use separate sandboxed browsers for finance vs email vs ... vs random browsing.

        Isn't Chrome meant to do this? Each tab in Chrome is an individual sandboxed process.

    • by Svartalf (2997) on Tuesday December 16, 2008 @09:25AM (#26132183) Homepage

      Few browsers enable privilege escalation like IE does on a regular basis.

    • by LtGordon (1421725) on Tuesday December 16, 2008 @09:28AM (#26132205)
      Running web content in a sand boxed environment is exactly one of the features Google emphasized with Chrome. Web content is inherently untrustworthy so this is a smart move. It's sort of like wearing a web-condom: used to be that going bare-browser was mostly safe as long as you were careful who you interacted with, but nowadays even the pretty ones can burn you, so your best bet is to just wrap your tool ... with a sandbox. (I'm still working on the analogy)
      • Re: (Score:3, Funny)

        by Bearpaw (13080)

        It's sort of like wearing a web-condom: used to be that going bare-browser was mostly safe as long as you were careful who you interacted with, but nowadays even the pretty ones can burn you, so your best bet is to just wrap your tool ... with a sandbox. (I'm still working on the analogy)

        Try adding a reference to "extensions". That'll help.

    • Re: (Score:3, Funny)

      by IceCreamGuy (904648)
      The Links browser? Stallman knows what's up! What do you guys think, Lynx or Links? I prefer Links, just seems easier to use to me. Lynx actually did have a vulnerability disclosed in October, http://web.nvd.nist.gov/view/vuln/detail;jsessionid=031729623a47404f1389622ff35a?execution=e1s1 [nist.gov]. That damn Lynx has just gotten too mainstream to be safe these days!
    • by chrisgeleven (514645) on Tuesday December 16, 2008 @09:34AM (#26132279) Homepage

      Firefox to me is more secure in a way because it usually has security patches released within 48 hours or so after a 0-day exploit, sometimes even within 24 hours. Microsoft on the other hand has been known to leave 0-day exploits unpatched for months.

      Also, Microsoft patches have to wait for their nightly automatic install or when a user shuts down their PC. I believe Firefox checks every time it is launched for updates and installs them. The odds are, you are going to get patched quicker using Firefox then IE.

    • Re: (Score:3, Interesting)

      by the_B0fh (208483)

      First of all - Firefox was designed with security in mind.

      IE was not. That alone is enough to drive me off IE. Go to the Risks digest and read what Bob Atkinson wrote about Authenticode - he basically says that a broken screen saver has higher priority than security issues - and authenticode is the security technology behind ActiveX. And Atkinson is the fucking author of authenticode.

      http://catless.ncl.ac.uk/php/risks/search.php?query=authenticode [ncl.ac.uk]

      And what you want - that technology already exists. A com

    • Re: (Score:3, Informative)

      VMware is a downloadable image, essentially FF plus minimal linux, designed for their VMware Player, that essentially does that. It isn't what I'd call an elegant solution; but the improvement in security is substantial.
  • Wrong summary (Score:5, Informative)

    by OhHellWithIt (756826) * on Tuesday December 16, 2008 @09:14AM (#26132029) Journal

    Microsoft has begun flooding media outlets with information advising users to switch to an alternate browser while a serious security flaw is being patched.

    I don't see anywhere in TFA that Microsoft has advised people to use another browser. It's other experts. So this is a "dog bites man" story, not the other way around.

    Now, if you don't mind, I'll go back to my nap.

    • Re: (Score:3, Informative)

      by Sebilrazen (870600)
      Mod parent up, I RTFA and the mentions to switch are provided by Ferguson who's a TrendMicro guy, Curran, a UK Microsoft guy said, "Whoa... that's not what we meant..." roughly.
  • by Viol8 (599362) on Tuesday December 16, 2008 @09:14AM (#26132033)

    .. in fact I'm a diehard linux fanman (too old to be a fanboi!)

    But even I'm getting sick of the hysterical anti MS reaction every single time some exploit appears for some or other program. Some people particularly media commentators need to get a sense of perspective and understand that no complex piece of software can really ever be bug free and these sorts of errors will creep in occasionally. Who hear who codes in C or C++ hasn't had a similar bug in their own code from time to time even though you were sure you'd debugged everything and the code passed through testing fine? Probably all of us. So look around you to spot the glass before you start chucking any stones!

    • by Andr T. (1006215)

      Who hear who codes in C or C++ hasn't had a similar bug in their own code from time to time even though you were sure you'd debugged everything and the code passed through testing fine?

      That's why you should use Java. This would never happen!

      • Re: (Score:3, Insightful)

        by Svartalf (2997)

        Heh... You'd just have other exploitable issues, either within the Java JVM or in poorly written code- just not the same class of them. I don't place blind faith in a language to clean up after myself.

    • Especially since it happens nearly every day. Oh noes!!!! Everybody panic!!! Another exploit in Windows/Office/Explorer. WOE is us!!!

      Perhaps if we phrased it like a sponsored ad: "Todays exploit brought to you by yet another buffer overflow error!" "This morning's gaping security hole sponsored by Stormworm. Stormworm: The worm of choice for the discerning mailbot."

  • by Anonymous Coward on Tuesday December 16, 2008 @09:21AM (#26132121)

    RTFA.

    Said Mr Ferguson: "If users can find an alternative browser, then that's good mitigation against the threat."

    But Microsoft counselled against taking such action.

    "I cannot recommend people switch due to this one flaw," said John Curran, head of Microsoft UK's Windows group.

  • Uhhh, no... (Score:5, Informative)

    by IceCreamGuy (904648) on Tuesday December 16, 2008 @09:22AM (#26132137) Homepage
    FTS:

    Microsoft has begun flooding media outlets with information advising users to switch to an alternate browser while a serious security flaw is being patched.

    FTA:

    But Microsoft counselled against taking such action.

    "I cannot recommend people switch due to this one flaw," said John Curran, head of Microsoft UK's Windows group.

    Not trying to downplay the clear reasoning behind switching browsers, but the summary is just blatantly incorrect in this case.

  • by theaveng (1243528) on Tuesday December 16, 2008 @09:44AM (#26132427)

    My laptop has an older IE; version 5 I believe..... will this flaw affect that too, or is it just a flaw in the current version of IE?

  • Strange news (Score:3, Interesting)

    by femtoguy (751223) on Tuesday December 16, 2008 @09:48AM (#26132473)
    This is especially strange news in light of an article from zdnet, http://blogs.zdnet.com/security/?p=2304 [zdnet.com], saying that firefox is the top bad example from a list of 12 programs with the worst security record. More interestingly, they don't even mention Internet Explorer as having bad security problems, despite news like this. Does Microsoft just pay journalists to write things like this on the day before they know they have bad news to release in hopes that people won't notice their security problems?
  • Not MS, it's Trend (Score:3, Informative)

    by courteaudotbiz (1191083) on Tuesday December 16, 2008 @10:50AM (#26133131) Homepage
    From TFA

    "In this case, hackers found the hole before Microsoft did," said Rick Ferguson, senior security advisor at Trend Micro. "This is never a good thing."

    Then

    Said Mr Ferguson: "If users can find an alternative browser, then that's good mitigation against the threat."

    So NO, it's not Microsoft who recommends switching browsers, they even say

    "I cannot recommend people switch due to this one flaw," said John Curran, head of Microsoft UK's Windows group.

    I wanted to clarify it since the story wasn't that clear...

  • Only 0.02% ?? (Score:3, Interesting)

    by l2718 (514756) on Tuesday December 16, 2008 @11:05AM (#26133303)
    Quoth the MS hack:

    Said John Curran, head of Microsoft UK's Windows group: "At present, this exploit only seems to affect 0.02% of internet sites"

    The internet is large. One out of every 5000 sites is a lot. Cut your losses and run while you can.

  • by grasshoppa (657393) <skennedy.tpno-co@org> on Tuesday December 16, 2008 @11:21AM (#26133499) Homepage

    As much as I'd like to push out firefox for my users, I have many users in a domain environment with mapped applications directory; firefox is simply unmanageable in this environment.

    Of all the improvements they are making in firefox, they are ignoring a potentially very large audience by not including some way to manage the browser in a corporate environment.

    • I've been able to run Firefox to some extent in a corporate environment and keep it updated - I just create an MSI package whenever a new version of Firefox comes out (3.0.3, 3.0.4, etc) and then roll it out via group policy. Then I just let my users know they should use Firefox for all of their browsing, and use IE only for craptastic activex/VB intranet apps.

      You're right though - they really need to make it easier. Keeping plugins, etc updated is impossible.

  • by Toll_Free (1295136) on Tuesday December 16, 2008 @02:03PM (#26135799)

    "Microsoft has begun flooding media outlets with information advising users to switch to an alternate browser while a serious security flaw is being patched."

    Then

    According to the BBC report, though, Microsoft itself is only asking that users be "vigilant while it investigated and prepared an emergency patch"; it's outside experts who say to dump IE (at least for now).

    So, which is it?

    It's bullshit editing like this that keeps slashdot and other sites like it from being taken seriously by anyone other than the fervent geeks that perpetuate it. Seriously.

    When a title and a summary both contain conflicting statements, the article shouldn't even run.

    --Toll_Free

  • by belrick (31159) on Tuesday December 16, 2008 @02:31PM (#26136181)

    The article linked in the text Microsoft has begun flooding media outlets with information advising users to switch to an alternate browser while quotes a Trend Micro spokesman advising users to switch and a Microsoft spokesman explicitly saying he can't advise users to switch over one flaw. This contradicts the summary text.

Never try to teach a pig to sing. It wastes your time and annoys the pig. -- Lazarus Long, "Time Enough for Love"

Working...