Become a fan of Slashdot on Facebook

 


Forgot your password?
Close
typodupeerror
×
Security Bug Microsoft

IE Vulnerabilities Page Removed 474

Posted by timothy from the now-you're-on-your-own dept.
Henry V .009 writes "PivX Solutions has removed its (in)famous Unpatched IE Vulnerabilities page. Is Microsoft really getting better? From the site: 'Given Microsoft's recent positive actions together with the current rise in attacks against IE we have agreed to give Microsoft a good faith reprieve and have taken down our 'Unpatched' page. This was done in both a spirit of cooperation and for the good of the internet as a whole. As the ubiquitous browser that is utilized to access the internet, we all depend on IE too much to have crooks, social deviants, malcontents and crackers from messing with our lifestyles and our livelihoods. ENOUGH IS ENOUGH!'"
This discussion has been archived. No new comments can be posted.

IE Vulnerabilities Page Removed More

IE Vulnerabilities Page Removed

Comments Filter:

  • Google to the rescue... (Score:5, Informative)

    by wo1verin3 ( 473094 ) on Sunday October 12, 2003 @05:24PM (#7196379) Homepage
    Google cache [google.ca]
    • Something tells me this was accompanied by the greasing of palms.

      • Re:Google to the rescue... (Score:5, Insightful)

        by AstroDrabb ( 534369 ) on Sunday October 12, 2003 @10:31PM (#7197537)
        I think you hit the "nail on the head". Their blurb sounds just like someone who was paid. I bet MS even wrote it. From their blurb:
        As the ubiquitous browser that is utilized to access the internet, we all depend on IE too much to have crooks, social deviants, malcontents and crackers from messing with our lifestyles and our livelihoods. ENOUGH IS ENOUGH!'"
        This doesn't sound like it came from a security specialist. Usaully security guys want to find EVERY hole to make the system better. It is also funny how they put in the part about crackers, crooks and deviants. I guess anyone that wants to find security holes fall into this category? That part of the blurb is what makes me think some MS drone had a part in writing it. Oh, and "we all depend on IE too much"? What is up with that? Like MS didn't put that in there? I guess there are not a bunch of better browsers out there like Mozilla, MozillaFirebird, Opera, etc.

        • Another PR effort at the expense of business (Score:5, Insightful)

          by SgtChaireBourne ( 457691 ) on Monday October 13, 2003 @04:22AM (#7198194) Homepage
          I think this is a continuation of the attempt to squelch technical discussion [computerweekly.com] especially regarding (embarrassing) security issues, and in particular agains full-disclosure. Microsoft would like to move to releasing patches once a month rather than once a week on wednesdays and a prerequisite for that is keeping the public out of the loop. In order to stay in business, MS must hinder customers from figuring out that Windows is not ready for the Internet, and won't be for years [computerweekly.com].

          As Schneier predicted [zdnet.co.uk], for Microsoft, the threat is bad publicity, and they are going to produce a security system that deals with the threat. Without some kind of disclosure, sysadmins cannot take stop gap measures to secure their systems. This is just another instance of rather than working on securing its products to a level needed for the Internet, the issue is being handled as a PR problem.

          Time to upgrade [eweek.com] if you haven't already.

  • As the ubiquitous browser that is utilized to access the internet, we all depend on IE too much to have crooks, social deviants, malcontents and crackers from messing with our lifestyles and our livelihoods.

    And as most of us here on Slashdot would say: That's exactly why it SHOULDN'T be the ubiquitous browser. And despite it all, it still is.

  • As the ubiquitous browser that is utilized to access the internet, we all depend on IE too much...
    Who, exactly, is we? And have this "we" ever heard of any alternate browsers such as Mozilla and the like? For those in the loop, it's just nice to know there is some light in the darkness of the internet browser.
    • "We" = 98 or whatever percent of all web users
    • "we" would be the 95% of the world that uses IE as a browser. It's okay to be elitist about your browser usage, but not ignorant to what everybody else does.
    • Uhh, check out Google's Zeitgeist [google.com]. It includes browser usage stats, and just about everyone is using IE. I'm sure you're aware of this and were just trying to be pedantic, but you're just being stupid.


      • I expect that most of the sites that track this use the browsers identifier string to compile statistics.

        I use Opera, and it comes preconfigured to misidentify itself as IE 6.0 - probably in response to the websites that check the string and won't let you in if you aren't using Netscape or IE.

    • 'We' is the vast majority of the Internet. I don't know figures (anyone?) but I know of no-one who uses anything but IE if they're on Windows. Tragic but true.

      Mobilising the generic user to actually sit up, pay attention and in short give a shit would be great, but personally, I won't hold my breath . . .

    • Re:This can't be serious (Score:3, Interesting)

      by Davak ( 526912 )
      "We" is the Average Joe using the computer--obviously not the slashdot crew.

      The world would be a much better place if everybody who used a computer knew as much as we did.

      However... I'm sure people in the mechanic websites make fun of people like us all the time too because we phuck up our cars all the time.

      Most of us know computers... most of them or at least the "we" in the quote above... do not really understand computers and computer security. That's why putting pressure on microsoft to fix its damn
      • hahah. I will bet money that even here on slashdot, IE takes up at least 90% of the browsers....

        hmmmm. have they done this sort of tracking?

      • Re:This can't be serious (Score:5, Insightful)

        by The Man ( 684 ) on Sunday October 12, 2003 @06:41PM (#7196773) Homepage
        However... I'm sure people in the mechanic websites make fun of people like us all the time too because we phuck up our cars all the time.

        I'm sure they're justified in doing so, too. When I need something done to my car, I take it to a mechanic so that the work is done right. Likewise, when someone needs a web browser, I expect them to rely on software written by people who know what they're doing. I might ask a mechanic for reference customers, and consult the Better Business Bureau or local car club to make sure his work is of good quality. A sensible mechanic who needs a browser might check the Internet for references on a particular browser, also to make sure the work is of good quality.

        See any parallels here? There's no excuse for not doing one's homework. There are plenty of articles available and accessible to the lay computer user that describe the some of the many problems with IE. There's no reason for an intelligent user not to read them and make an informed decision. Quite frankly, as an expert in the field of software, I do not believe any intelligent user could make an informed, good faith decision to use IE. Therefore I conclude that most users are not intelligent, are not acting in good faith (ie they don't care about the quality of the products they use), or are too lazy to spend five minutes gathering information. Since the latter two are just subcases of the first, it's safe to assume that 90% of computer users are not very intelligent. This is independent of any expert bias - their use of IE is not foolish because they're expected to understand the problems with IE on a technical level, it's foolish because there's no need to understand those details in order to see that IE is not a quality product and is in fact unsafe to use. I don't need to understand intimate details about strengths of materials, bending moments, and energy absorbtion to know that a car is unsafe if its gas tank is likely to explode in a collision. In the same way, I don't need to understand the details of exploiting a buffer overflow to know that a browser which is known to compromise a user's personal information is unsafe.

        Flamebait? Call it whatever you like, but if people spent 1/10 as much effort making sure they had a safe, effective, reliable computing environment as they spend to ensure the same about other aspects of their lives - such as their cars - there wouldn't be an IE as we know it today.

      • Re:This can't be serious (Score:5, Insightful)

        by steve_l ( 109732 ) on Sunday October 12, 2003 @07:11PM (#7196895) Homepage
        In a way it is extra pressure: if they don't think MS is doing enough then they can bring the site back. I'd also note that in Win2003 server, IE is locked down a lot more than ever before, to the extent of disabling ActiveX download outside of the trusted zone, cranking back the rights to sites in that zone and then adding *microsoft.com in. That way windows update works but most other active X support is gone. However, they have a lot to do, in ways that may break some things but would make the systems less vulnerable, not just to classic IE hacks but email scams
        1. Stop interpreting those spam-friendly http://2343455/ urls
        2. Stop interpreting scam-friendly http://ebay.com:url@123456/ urls
        3. Stop whining when browsing to a site that has AX disabled. A small icon is ok; a dialog box 'you are getting a worse experience is not.
        4. Make it possible and easy to fully uninstall outlook express. you cannot even delete this on XP; system recovery brings it back. Ugly manual hacks last until the next critical upgrade gets forced on the machine, at which point it reappers.
        5. Crank up the security settings for everyone who isnt using win2k3
        6. Rebuild IE with VS.net 2003 and set the 'check for buffer overflows' flag in the build.
        7. Stop integrating Windows Scripting Host with IE. Every IE install forcibly adds .js, .vbs and .wsh file extensions to the path and enables their execution. I have to rebind these to notepad on my machines.
        8. Give us a no-images options for the email zone.
        There are probably lots more of these things to do. All I see for the current user base is after-the-fact bug fixes rolled out intermittently, not attempts to address fundamental problems.

  • Don't worry folks, Microsoft isn't a monopoly! (Score:5, Interesting)

    by Infonaut ( 96956 ) <infonaut@gmail.com> on Sunday October 12, 2003 @05:27PM (#7196389) Homepage Journal
    we all depend on IE too much to have crooks, social deviants, malcontents and crackers from messing with our lifestyles and our livelihoods.

    Any time one piece of software from one company can be responsible for such negative impact on our lives because of how poorly it was designed, while still remaining far and away the dominant product in its category in spite of superior software being readily available, that's a sign that the ill effects of monopoly power are at play.

    • Re:Don't worry folks, Microsoft isn't a monopoly! (Score:4, Insightful)

      by zangdesign ( 462534 ) on Sunday October 12, 2003 @05:39PM (#7196469) Journal
      that's a sign that the ill effects of monopoly power are at play

      And that the competition has no marketing ability. Not to harsh on your mellow or anything, but do you really believe technical superiority is what wins over the masses? Drop a billion or so per year on marketing and then see how your favorite browser does in terms of marketshare (or any software for that matter).

      It is not enough to tout the technical advantage. You have to have someone who can translate into simple terms so Ma and Pa Walmart can understand that. Advertising is not about telling the truth, per se, but rather about making things look good regardless of any other factors. That's what Microsoft excels at (well, that and backroom deals).

      The point of all this is: Microsoft may be a monopoly, and they may wield that power ham-handedly, but the competition let them get their by making assumptions that weren't true, namely that technical ability would actually mean more than it does to the public.
      • And that the competition has no marketing ability. Not to harsh on your mellow or anything, but do you really believe technical superiority is what wins over the masses?No, what wins over "the masses" is being there, right on the desktop, upon installation of the OS, and being just good enough to not push the user to go downlaod something else on their crappy-ass dialup connection.
      • And that the competition has no marketing ability. Not to harsh on your mellow or anything, but do you really believe technical superiority is what wins over the masses?
        No, what wins over "the masses" is being there, right on the desktop, upon installation of the OS, and being just good enough to not push the user to go download something else on their crappy-ass dialup connection. Marketing hasn't even had an opportunity to play in the game yet.
        • You've got a very good point. First, Mozilla takes about an hour to download over a 56k modem. That's an immediate turn-off for any user trying to get at it. Second, how many users are even aware that the browser is a seperate component that they have a choice in? I mean half the population thinks that AOL is the internet. Even more knowledgable users might not be aware that Internet Explorer is just one of many browsers, just as they may not be aware that you can replace Explorer with something like Litest
      • Hey, that billion or so has to come from somewhere. People bought the product before there were billions to market it.
        • ...sooner or later it adds up to real money."

          People bought the product before there were billions to market it.

          The whole point of Microsoft's conviction under the anti-trust laws is that that statement is false. People bought other products and the browser was strapped to them (shafting SpyGlass systems en passant).

          Microsoft claim(ed) that Bad Things would happen if you used a different browser with Windows (kind of like a car manufacturer saying "if you run your car on any other oil, it will blow up"

          • It's a long and twisted story.

            Netscape wanted to 0wn the net and they riled up Microsoft and now Microsoft sorta 0wns it instead.

            I'm not sure either would have been a good thing, but I know there wasn't anybody involved who was a nice guy.
      • Marketing??

        You're kidding, right? Your "marketing" could consist of $500 cash to anyone who replaces Internet Explorer with ANY other browser of their choice, and fewer than 10% of computer users could succeed without help.

        Microsoft has captured nearly 100% of the browser market by abusing their operating system monopoly. Virtually everyone uses IE because it comes bundled with Windows, plus Microsoft illegally prevented other companies from preinstalling other browsers. Microsoft strangled competitors
      • I can say, I am not a zealot or open-source hippy, and I run windowsXP (patched up like hell), and my main browser is mozilla firebird. I like tabbed browsing and firebird is very fast and not bloated. It's easy to use and skinnable, and hasn't crashed once on me yet.

        If they advertised it, people would use it.
    • I don't think it matters. Much. Until this story I'd never even heard of pivx before. I'd hardly call them famous. It's not like they are the only site keeping a list of IE vulnerabilities and other embarassing things that need patched or fixed. It's not like Microsoft security issues aren't anything but common knowlege. If you asked 100 random people on the street about how secure Windows is, I'm sure you'd get at least 95 people that said something like "well, you can get a virus" or "email can take over

    • Re:Don't worry folks, Microsoft isn't a monopoly! (Score:5, Insightful)

      by NanoGator ( 522640 ) on Sunday October 12, 2003 @06:43PM (#7196780) Homepage Journal
      "while still remaining far and away the dominant product in its category in spite of superior software being readily available, that's a sign that the ill effects of monopoly power are at play."

      No, it's a sign that Mozilla needs a PR firm.

      Face facts: Lots of stuff that has been popular over has had a superior alternative. Newton/Palm. GameBoy/GameGear/Lynx/Nomad. Beta/VHS. USB/Firewire. Etc. You don't need a monopoly for that situation to be created.

      Now, in this case, we do have a monopoly that puts IE in front of the users. Worse, IE does the job quite well. If you asked the average user out there what could be done to make IE better, the answer would not be "Tabbed browsing!". Why? Because they've never heard of that!

      Cripes people. There are no commercials on TV about Mozilla or Opera. There are very few (if any) hints to Mozilla's existence on the mainstream news. You have to visit Slashdot to be blasted with Mo's zealotry. So tell me, how's anybody even supposed to know it exists?

      Spare us the MS blame game. There are things that competing browsers can do that they simply aren't. When those avenues are exhausted, you can draw one of two conclusions: 1.) Microsoft has an impenetrable monopoly on the browser market. or 2.) The market has decided they like IE better. In the first case, you can bitch and moan. In the second case you can improve Mozilla.

  • So, to paraphrase... (Score:3, Insightful)

    by thecampbeln ( 457432 ) on Sunday October 12, 2003 @05:27PM (#7196394) Homepage
    Microsoft is never going to make these change, so our experiment of embarrassing them into patching hasn't worked, so we might as well give up so that we don't benefit hackers. I can't say I fault their logic...

    What were the reasons against a monopoly that my economics teacher tested me on again?

  • bravo pivx! (Score:4, Interesting)

    by Davak ( 526912 ) on Sunday October 12, 2003 @05:28PM (#7196403) Homepage
    We all should give pivx [pivx.com] a huge hand!

    First, they applied the pressure to help force microsoft into fixing the software.

    Second, they are now giving microsoft some slack (negative reinforcement?) for trying to fix its browser.

    Bravo guys!

    Plus, these guys are hiring! [pivx.com]
    • Why? Have the vulnerabilities all been fixed now? If not, then they need to be made public. This is a bad day if IE still has wide open vulnerabilitty to known attacks.
  • Damn, the last browser with good VTP support [satirewire.com].
  • But unfortunately browsing will be even more tied into the OS with Longhorn according to Microsoft. IE6 sp1 will be the last standalone version of their browser.

  • Wow, great! The internet as a whole thanks you! (Score:3, Funny)

    by vistic ( 556838 ) on Sunday October 12, 2003 @05:34PM (#7196443)
    How fortunate this is for the internet community! Imagine if IE were open source like this Mozilla thing! Keeping every working detail and possible vulnerability all very hush-hush is what makes IE the great browser that it is! How does Mozilla survive? I mean, come on... Bugzilla [mozilla.org]? They should follow these guys example and shut down.

    For the good of the internet as a whole!
  • "This was done in both a spirit of cooperation and for the good of the internet as a whole"
    Meaning we were bought off by M$.
  • at least put up links to alternative browsers like mozilla and help SOLVE the monoculture problem!

  • Huh? (Score:2)

    by The Man ( 684 )
    I for one do not rely on IE in any way, shape, or form. This will never change. I encourage these crooks and deviants to exploit away. The only way for IE to get fixed or evicted by market forces is for those who use it to be hit hard by attacks. Letting Microsoft off the hook is inappropriate. The page should come down only when all the holes it describes are patched. My response, were I in Pivx's place, to any such request would be "I'll remove the page when its contents are no longer relevant. Whe

  • Right. (Score:2)

    by mcc ( 14761 )
    Since the crooks and social deviants don't have any way whatsoever other than that page to find out about Microsoft's internet vulnerabilities.

    Anyway, IE is too much a part of our lives for it be easy for us to know exactly what risks we are exposing ourselves to by using it. Enough negative PR is enough.

    Ignorance is strength!
  • Could it be that M$ put some pressure on them, either directly or indirectly, through their government/business contacts?

    Any time Balmer screams 'uncle' it makes me want to turn the screws tighter - not let off...
  • After the second read I still couldn't decide if he was trying to be tongue in cheek or if he actually meant all that crap about good will and social deviants.

    What a load of shit, and what a way to lose one's credibility.
  • I think some of the new anti-hacking laws prohibit anyone from disclosing such vulnerabilities, as a warning or not. Someone may have called these guys and told them to take it down or face Federal prison.
  • The Ravenous Bugblatter Beast of Traal is a mind-bogglingly stupid animal. It has almost no capacity for learning from experience and is therefore surprised by virtually everything that happens to it. Here is an example of how stupid it is: it thinks that if you can't see it, it can't see you. Its behavior would be quite endearing if it wasn't spoilt by this one thing: it is the most violently carnivorous creature in the Galaxy. Avoid, avoid, avoid.
  • I think they're referring to the recent declaration that security is now Microsoft's number one priority.

    ... which came however many months after the earlier declaration that... security is now Microsoft's number one priority.

    (C'mon, guys, you have to say it more often to really get the "mantra" feel...)

  • We all need to know of the vulnerabilities, rather than hiding our heads in the sand and pretending they're not there. How else can users make informed decisions about what they use?

    I myself recently changed over from IE to Firebird, as I was just too fed up with the system slowdowns, the lack of feature advancement, and the glaring holes IE has. I had to learn about these issues the hard way. How do you expect Mr. and Mrs. Average User to make any sort of informed decision about their situation and vul

  • A Larger Problem (Score:2, Interesting)

    by wingspan ( 113604 )
    So, the page that kept track of unpatched MSIE holes is gone. That means that MSIE is now treated like any other software; the vulnerabilities are reported, but no one keeps track *publicly* of what is unpatched.

    Why aren't other pages keeping track of unpatched vulnerabilities in other software? Well, have you ever tried to match up the CVE database with patches? It's difficult. I don't know anyone who can answer how many unpatched vulnerabilities are present in W2K, XP, and the like. Has to be boatl

  • A short history of IE vulnerabilities: (Score:3, Informative)

    by Futurepower(R) ( 558542 ) on Sunday October 12, 2003 @06:18PM (#7196674) Homepage

    A short history of vulnerabilities reported by PivX:
    • June 18, 2002: 18 vulnerabilities
    • August 8, 2002: 22 vulnerabilities
    • September 9, 2002: 19 vulnerabilities
    • November 19, 2002: 32 vulnerabilities
    • December 9, 2002: 19 vulnerabilities. (Microsoft fixed 15 on Nov. 20, but two new ones were found.)
    (From my article: Windows XP Shows the Direction Microsoft is Going. [hevanet.com]

  • "Good-faith reprieve" (Score:4, Interesting)

    by dbarclay10 ( 70443 ) on Sunday October 12, 2003 @06:28PM (#7196719)
    I sincerely hope that if Microsoft doesn't fix each and every valid vulnerability that was listed on that page, within six months, that the page gets restored.

    It has been proven time and again and again and again that vendors, especially monopoly vendors, will not fix their systems in a timely manner unless they're pressured to. And by "timely manner", I mean within four weeks.

    The last five or six MS security bulletins I've seen had lapses of between SIX AND NINE MONTHS between the reporting of the problem and the release of the patch.

    So two things:

    1) If Microsoft doesn't fix all the currently-known vulnerabilities within six months, somebody should take it upon themselves to start tracking them again
    2) If Microsoft can't get their act together and release patches for new vulnerabilities in a timely manner (instead opting to waffle for six months while real people's systems are getting exploited because MS is _never_ the only entity to know a vulnerability, and it's almost guaranteed that somebody with nefarious intentions does), then somebody should take it upon themselves to start disseminating as much information as is required for *real* preventative measures to be put in place

    I'm all for giving them one more chance, but I'm not willing to sacrifice my clients' systems by changing my standards for this "chance". They either do what they should do, or they have to deal with me telling my clients exactly what they need to do to protect themselves from a given vulnerability - and that information would almost certainly be enough for a black-hat to use if it ever got leaked.

    If you think my standards are too high, consider that other vendors whose software is used on systems which literally control life-or-death systems often release fixes within hours and days, not weeks and months.
    • It has been proven time and again and again and again that vendors, especially monopoly vendors, will not fix their systems in a timely manner unless they're pressured to. And by "timely manner", I mean within four weeks.

      How can 4 weeks be considered a reasonable amount of time to fix a bug and issue a patch when IT people who merely DEPLOY the frick'in patch complain that 4 weeks isn't enough time to deploy a patch?

      I'm all for quick turn around, but I wish people would be a bit more consistent with thei

      • How can 4 weeks be considered a reasonable amount of time to fix a bug and issue a patch when IT people who merely DEPLOY the frick'in patch complain that 4 weeks isn't enough time to deploy a patch?

        Most of my clients have a few hundred computers. When it's important, they'll usually get a patch deployed on every machine in a few hours (work split between a halfdozen people).

        There are tools that scale very well. One of my clients has 4,377 servers (just looked that up), and somewhere around 14,000 wor

  • Normal people have never heard of Mozilla (Score:3, Interesting)

    by QuantumG ( 50515 ) <qg@biodome.org> on Sunday October 12, 2003 @06:30PM (#7196729) Homepage Journal
    Unless you're a geek, you don't know about Mozilla. You might know about Netscape and think 4.1 was about the end of the line. You may even have tried one of Netscape's releases of Mozilla and thought it sucked (which, let's face it, it does). Most users of IE think that installing a different browser on their computer will break IE. They fear losing their bookmarks and their history. All that's really needed is a good public education program. Most of which can be achieved by each of us sending our non-geek friends to www.mozilla.org.
  • What the summary DIDN'T include...

    As you know Microsoft has just released a new patch MS03-040, which renders several IE vulns obsolete. We are presently testing the efficacy of the vulns reported to be fixed and we can report that MS03-040 is doing the job it was intended to.

    So why was that left out? Reading the summary I just thought that these people were being nice guys to Microsoft, and not that Microsoft actually addressed and fixed many issues with IE.

    One sided journalism?
    • "So why was that left out? Reading the summary I just thought that these people were being nice guys to Microsoft, and not that Microsoft actually addressed and fixed many issues with IE.

      One sided journalism?"

      Ah, new to Slashdot?

      This is exactly the reason that so many 'Microsoft Apologists', as they're affectionately called here, argue with popular opinion. Simply put, you really have to RTFA with stories about MS because they ALWAYS have the worst possible spin here. As a result, people come out and

    • Re:Why isn't the most important reason given? (Score:4, Interesting)

      by carlfish ( 7229 ) <cmiller@pastiche.org> on Sunday October 12, 2003 @06:56PM (#7196831) Homepage Journal
      The patch "renders several IE vulns obselete". Most software vendors release patches for their software, and it's nice to see Microsoft continue to do so. That's not really news, though. The news is that the service that tells us what vulnerabilities remain has gone.

      That releasing a patch removes the need to know about the outstanding vulnerabilities is simply nonsense.

      Which IE vulnerabilities are rendered obselete by the patch? Which remain? "Several" is not "all". It's quite likely not even "most". Which ones are still there? Well, suddenly pivx aren't going to tell us.

      It's dark. You are likely to be eaten by a grue.

      Charles Miller
  • I wonder if the site was just hacked by Microsoft. I don't think they could have issued a better press release if they tried. If it wasn't hacked (which I really don't think it was), it sure seems like they're trying to kiss M$'s ass on this one.
  • we have agreed to give Microsoft a good faith reprieve and have taken down our 'Unpatched' page.

    They don't give a timeline for how long it will take for Microsoft's complete lack of action in fixing its crappy software before they become so pissed off that the put the page back up.
  • I keep hearing about how it is that some web servers are set to block your access if your user agent does not report IE. Then again, alternative browser makers don't want you to report that you're using IE because then there is the illusion that everyone is using IE. I think it would be good if there was a "masquerade as IE" button in the toolbar to use on a case-by-case basis to get into troublesome web pages. That way, we can get into web pages they only want IE on, and everyone else who collects stati

  • This is a mistake (Score:3, Informative)

    by rossz ( 67331 ) <ogre&geekbiker,net> on Sunday October 12, 2003 @06:58PM (#7196841) Journal
    Unless there is bad publicity surrounding a security hole, Microsoft does nothing. Keeping the security problems public and well known give us (the internet community) several things.
    1. Incentive for Microsoft to fix the problems.
    2. Warnings to the community of just how common these problems are.
    3. Fun ideas to implement in web pages to mess with idiots who insist on running IE instead of anything else.
  • Fortunately [216.239.53.104], Google can remember the past. Long live history, down with big brother!
  • Please understand that nobody asked us to take "Unpatched" down. For the reasons we described above, we have taken this proactive step in an effort to be a larger part of a long term solution.

    Translate: "It was a condition of our settlement with Microsoft that we make it sound like we took this down of our own volition".

  • Need I say more.
  • Ignorance is bliss.
  • and their brother are now using IE to create huge botnets and make revenues from stupid users...

    I'm sure some of them are going to sue MS for not letting them own a leaving ;-)

  • Hrm (Score:2)

    by Dalcius ( 587481 )
    Didn't Ballmer recently say something about wishing all the sites/organizations like this would just "shut up"?

    I'm not one to believe in conspiracy theories, but it's not my perception that IE has been doing much better. I do wonder what part, if any, Microsoft had in this.

  • It's not that I'm lazy (Score:3, Interesting)

    by Bobb Sledd ( 307434 ) on Sunday October 12, 2003 @08:25PM (#7197163) Homepage
    "See, Bobs, it's not that I'm lazy, it's that I just don't care."

    I am a web designer, and I am fully aware of the problems with IE - security and otherwise. But personally, I really don't care about its vulnerabilities. My job is to make my web pages look correct in maybe this version and a few versions back of IE, but that's really it.

    Ok. So you can take over my computer with a web page. Well, I'm not going to YOUR web page.

    My email filters out spam. Not going. I don't look for warez, don't check out pr0n, don't download any hip new software.

    I DO go to my bank's web site and look at my balance, read /., check for updates for Trillian or some other software I might use, or update a driver. Yes, I'm a boring user. But I really don't have time for much else, and since I don't think my bank nor any of those other sites I visit have an interest in doing malicious things to me... I just don't care, plain and simple.

    I know it's not a safe way to live, and I think that if my computer were destroyed right now I'd shrug and say "meh." And then build another one.

    Maybe others feel the same?

    • Re:It's not that I'm lazy (Score:4, Insightful)

      by Admiral Burrito ( 11807 ) on Sunday October 12, 2003 @11:32PM (#7197713)
      Ok. So you can take over my computer with a web page. Well, I'm not going to YOUR web page.

      That doesn't help much. The recent QHosts malware (which used one of the 31 unpatched IE holes to install itself) was distributed via a banner ad. You don't have to visit $badguy's web page if $badguy has hacked into one of the web sites you do visit, or if he can use the commercial banner ad network to serve up his exploits.

  • Be a part of the solution: use Free Software. (Score:3, Interesting)

    by jbn-o ( 555068 ) <mail@digitalcitizen.info> on Sunday October 12, 2003 @08:35PM (#7197198) Homepage

    From the site:

    We appreciate your interest and your support of our security research efforts over the past several years. Please join with us in being part of the solution.

    Try Mozilla [mozilla.org] or Konqueror [konqueror.org] instead--two fine free software web browsers (and there are many others). Then consider switching to a free software operating system so you don't bump into holes in other applications and have to wait for the proprietor to fix them for you. If you want to inspect, copy, distribute, or modify free software programs you can do so (or get someone else to do so for you). Freedom is really worthwhile.

Slashdot Top Deals

The first Rotarian was the first man to call John the Baptist "Jack." -- H.L. Mencken

Close