Firefox Security Head Says Microsoft Obscures OS Holes 214
theranjan writes "When a Security Strategy Director at Microsoft decided to compare Internet Explorer security vulnerabilities with those of Mozilla Firefox, he may have forgotten that the Head Security Strategist of Mozilla was a former MS employee. In a rebuttal of the study, which finds IE more secure than Firefox, Mozilla said that the number of vulnerabilities publicly acknowledged was just a 'small subset' of all vulnerabilities fixed internally. The vulnerabilities found internally are fixed in service packs and major updates without public knowledge. 'For Microsoft this makes sense because these fixes get the benefit of a full test pass which is much more robust for a service pack or major release than it is for a security update. Unfortunately for Microsoft's users this means they have to wait sometimes a year or more to get the benefit of this work. That's a lot of time for an attacker to identify the same issue and exploit it to hurt users.'"
Well Duh! (Score:5, Insightful)
Re:Well Duh! (Score:5, Insightful)
So do you agree with them in their belief that their stockholders are more important than their paying customers?
Re:Well Duh! (Score:5, Insightful)
No I don't. I think that's a major flaw with publicly traded companies and is one reason why I never want my own company to go public.
This is also one great thing about OSS, it doesn't have to appease to money for the most part. The other half for open source is probably reputation, but its the status quo to release vulnerabilities so its not as big of a deal.
Re:Well Duh! (Score:5, Insightful)
When companies invest money, features get added -- features that benefit the company investing the money. For example, there's Google's Summer of Code. And the money that Google invests in the Mozilla Foundation. What's the default search engine in Firefox? Oh, right, Google. What page does Firefox go to by default? A special Google/Firefox start page. What searches are in the default bookmarks? Google's.
And then there's the fact the open source software authors sometimes work for companies that demand certain things get added...like Andrew Tridgell of Samba who works for IBM's storage division. There's lots of stuff in Samba for IBM's NAS solutions.
Yes, open source authors definitely listen to their users...but they also know which side of their bread gets buttered.
Re: (Score:2)
Your rebuttal agrees with your opponent's point.
Weasel words: they're not just for breakfast any more.
Re: (Score:3, Insightful)
This is also one great thing about OSS, it doesn't have to appease to money for the most part.
vs.
This is also one great thing about OSS, it doesn't tend to appease to money for the most part.
Big difference. I think you responded to the latter, not the former. Yes, money impacts open source, but the difference is that open source projects can always choose not to listen to the money -- or get forked. You can't just fork Microsoft the moment their shareholders get annoying.
Re: (Score:3, Insightful)
Re:Well Duh! (Score:4, Insightful)
Too many people forget that without customers, there is no money and there is no company.
Re:Well Duh! (Score:5, Insightful)
Re:Well Duh! (Score:4, Insightful)
Monopols answer only to the government, and in these times the US government doesn't seem to want answers from Microsoft
Aha! (Score:4, Informative)
Yes, as long as it is the Adam Smith variety of free market. Once you get monopolies, the invisible hand goes *poof* and you no longer have a free market.
I personally believe we could throw out 999 out of 1000 laws and regulations and have a happier healthier economy and society. For instance, I would throw out all business licenses and the associated regulation, such as health inspections for restaurants; that's how much I distrust regulation and how it distorts the free market.
But monopolies are just as bad on the business side as they are on the government side, and there has to be some way to prevent them and break them up. Rather than have a government monopoly to break up business monopolies, I would have some way for citizen lawsuits to do the trick. You have to prevent market domination via rackets like those practiced by Microsoft, or the old AT&T, Standard Oil, etc., or you no longer have a free market.
Re: (Score:3, Insightful)
Also once this happens it is difficult for a free market to re-assert itself.
I personally believe we could throw out 999 out of 1000 laws and regulations and have a happier healthier economy and society. For instance, I would throw out all business licenses and the associated regulation, such as health inspections for restaurants; that's how much I dis
Re: (Score:2)
Let us look at the result of breaking Big Oil (aka Standard Oil) apart, from today's perspective. We have Iran, Iraq and general instability in the middle east. We have global warming (or so they say). We have cities built for cars, and not pedestrian or mass transit. We have a
Re:Aha! (Score:5, Insightful)
The free market model operates on several key principles:
It's not difficult to demonstrate that in the real world, these things don't happen.
You have monopoly or monopsony (look it up) situations; Very rarely the buyers are informed; cartels and herd-like behaviours further alter the model.
In the end, the free-market model, which is based on the supply-demand equilibrium, is all fine and dandy on paper. In reality, a completely deregulated market is an utopia, just like the communist ideal was an utopia.
I know there are many libertarians on Slash, which is mostly an American thing; not being an American, my view may seem unpopular...
Re: (Score:3, Insightful)
For instance, I would throw out all business licenses and the associated regulation, such as health inspections for restaurants;
I work in the food industry, as a manager (one of two lines of work I do). I do not want an unregulated food industry. Do you have any idea how many people would get sick and/or die form bad food products or unsafe environments? Do you have any idea how many have in the past? I also have worked closely with the health care side in many projects involving pathogens. Do you r
Re: (Score:2)
But corporations themselves are a government creation. Not allo
Re: (Score:2)
Such as copyright. Which is the fundamental anti-free-market regulation that supports Microsofts market control and monopoly (and would support any other non-FOSS replacement just as well).
Re: (Score:2)
Each little step of regulation has a noble purpose, but the combined weight slows down the economy so much that we would be better off without the regulation. I would rather have restaurants brag about the inspection company they hire on their own than have the government force one bureaucracy on everybody.
Do you ever eat at friends' houses? How about a neighbor you hardly know? How about a potluck at school or church or work o
Please explain (Score:2)
Re: (Score:2)
That' why I said there has to be more more opportunity for individual people to enforce freedom of choice and availability of information. One of the problems with government monopolies is that they enforce their monopoly status by superior firepower. Lawsuits and a litigious society suck, but they suck less than rule b
Re: (Score:3, Insightful)
As the post above you, thank you for pointing out the overlooked/ignored obvious realities of capitalism.
I am an American (USA variety), and I get sick and tired of the ignorance espoused by people who think the system will just work. It is so much like listening to some gibbering idiot go on about their perpetual motion device, or unlimited free energy device (or to date, flying cars). People seem to want to totally gloss over the greed, corruption, collusion, laziness, theft, graft, bribery and other b
Re: (Score:2)
Re: (Score:2)
Unix lost the war because of pricing and lack unified desktop environment. Linux is winning the long war by taking the best of Unix, offering it free (beer and speech) and having usable desktop GUI (Gnome/KDE).
Unix lost a war it could have won, Linux is winning the war for Unix like OSes, along with Apple for the BSDs.
Re: (Score:2)
It would be more correct to say that the free market operates "better" the more buyers and sellers there are, and the better the available information is. Your bullet points are not absolute requirements for the market to function. Furthermore, things like monopolies and uninformed market
Re: (Score:2)
Absolutely correct.
Thank you for pointing out the often overlooked/ignored fundamental reality of capitalism and any form of government regulation.
InnerWeb
Re: (Score:2)
And how many billions of dollars will be swindled, how many thousands of companies will be destroyed, how many millions of customers will be abused, before this happens? Does the average person still have any idea that there is an alternative to Microsoft? I doubt it.
The definition of "monopoly" is that your position in the market is that you can pretty much call all the shots, regardless of what customers or competitors, (o
Re: (Score:2)
The average user hasn't heard of a Mac? Bullshit.
"In a sense, the battle of OSS against Microsoft is a mirror of the battle of individual freedoms against the tyranny of domination for "the public good" that is going on the U.S. and elsewhere. Right now, the good guys are losing, IMO. But they are not down and far from out."
If OSS really is 'losing' a battle against Microsoft, you might want to let them know
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Don't you think that more happy customers would mean more money to Microsoft's bottom line?
Re: (Score:2)
I think you'd have a hard time convincing a company that has $40 billion in cash of that principle. Discount the Zune? Heck, they could just give away the Zune to everyone in America and still have cash left.
Re: (Score:2)
I don't know if I'd expect them to go that far, but maybe they should think about their (existing)paying customers when dealing with bugs, firmware, licensing, pricing, etc...
Re: (Score:2, Insightful)
No, as long as unhappy customers keep paying, because either: 1. They believe the alternatives are too hard to learn, or 2. Their games only run on Windows, having more happy customers won't change a thing.
It's not like happy customers pay more for Vista than unhappy customers.
Re: (Score:2)
Without customers there is no way a company is going to make any money. Happy customers tends to mean more money, through repeat business and positive word of mouth; unhappy customers tends to mean less money, due to negative word of mouth. Of course this only works when there is actual competition...
Re: (Score:2)
If *I* had 50 billion dollars in cash in the bank, I'm pretty sure I could make scads of money without a single customer.
And given my experience running a business that depends on happy customers, if I could tell my customers to f*ck off, and yet still make unbelievable amounts of money off my $50bil in cash, I probably would.
Re:Well Duh! (Score:5, Insightful)
And how do paying customers benefit when MS reveals unknown security holes in their products, even after they are patched? Its already believed the unsavory element reverse engineers MS patches looking for ways to exploit vulnerable unpatched systems, how does MS flagging a patch as "fixes unreleased security vulnerability X" help anyone, including linux users? By increasing the size of botnets?
The problem isn't MS hiding its vulnerabilities, its a fundamentally flawed analysis. No proprietary software company airs its dirty laundry the way open source does, there's no benefit to it. The comparison was apples and oranges.
Re: (Score:2)
Transparency in things like security would go a long way in bettering Microsoft's reputation. Techies give their opinion to Joe Sixpack when asked, and I bet most of the opinions about Microsoft's security is lacking. One can only imagine what they haven't disclosed when it comes to security vulnerabilities. Maybe that is the way it has to be with closed-source, but it makes you wonder
Re:Well Duh! (Score:4, Interesting)
There's no excuse for delaying a security patch, even a couple weeks. They have the ability to patch vulnerabilities in a timely fashion, and are deliberately not doing so.
This should end up being a class action. Normally I'm not crazy about lawsuits, but there are far too many people and enterprises affected by this issue, and a multi-billion dollar settlement will definitely get everyone's attention. When the stockholders end up making less money as a result of the one-time charge, they'll demand that MS do something to keep it from happening again. Money is all they care about, and they'll scream bloody murder.
Hmm, maybe the stockholders (read: the fund managers) should sue. There's certainly precedent for them to do so.
Re: (Score:2)
One is testing. You don't want to issue a patch that breaks critical functionality. Since we're talking about the OS, that means that you don't want to break anything. Who knows what people out there might be relying on?
The other is business, Microsoft's core clientele. Businesses want to test patches with their installation, then deploy them, and they want to do it on a predictable schedule. Patch Tuesd
Re: (Score:2)
Re: (Score:3, Insightful)
Because they can make informed decisions (Score:5, Insightful)
Central to any theory of efficient markets is the assumption that both consumers and producers can make informed decisions free of coercion. If the consumers do not have information, they cannot make an informed decision. Companies are not generally obliged to share all information about their products, but they are prohibited from intentionally deceiving customers. Cigarette makers were not sued because cigarettes cause cancers, but because they had determined internally that cigarettes caused cancers and they then made claims to the contrary. That is, they intentionally deceived both the consumer and the regularly agencies.
By analogy, Microsoft can say 'we build secure software' all day long. But if they claim, 'we develop more secure software than our competitors' they open themselves up for liability IF it is determined that they are making claims that they know to be false. In this case this seems to be hypothetical. But it is a testable hypothesis. And after reading the internal memos made public in Combs v. Microsoft, it is a quite plausible hypothesis.
Re: (Score:2)
What are these "informed decisions" you speak of? Consumers not having information? Wha?
Capitalism works like this:
The monopolies and cartels already have all the information they need to decide how they want consumers to behave. I can't see what sort of "information" we as consumers need except to do what we're told.
Re: (Score:2)
Re: (Score:2)
Their Stockholders ARE the customers (Score:2, Insightful)
Re: (Score:2)
In this case, the stock doesn't go down just because they had too many security holes, the stock goes down because too many security holes make their products harder
Re: (Score:2)
Re: (Score:2)
There is no belief to it. It is a legal requirement that a corporation must put the interest of its shareholders above all else. The question that should be asked is who is #2. The company or its customers?
Re: (Score:2)
Re: (Score:3, Funny)
touche... (Score:4, Funny)
It's Probably Also Interesting to Note... (Score:5, Funny)
Ah, the wonder of Slashdot moderation (Score:2, Insightful)
Re: (Score:3, Insightful)
Re:Ah, the wonder of Slashdot moderation (Score:4, Funny)
deserved reputation ... (Score:2, Insightful)
Window S. (Score:2)
More vulnerabilities fixed != worse sw (Score:5, Insightful)
Re:More vulnerabilities fixed != worse sw (Score:5, Insightful)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Microsoft's responsibility is to the vast majority of its customers...
And they serve those customers by deceiving them and claiming to have fewer holes because they keep a lot of their holes secret even after they are fixed? You're also ignoring the number of holes MS finds that they don't fix. I know some people who used to work at MS and even after they started their security drive, the majority of bugs with security implications were not prioritized high enough to be fixed... ever. Sorry, but MS tried to deceive people by pretending holes they did not publicly acknowledg
Not the first time... (Score:5, Insightful)
They have compared the published vulnerabilities between windows and various linux distributions, when the same applies as discussed in this article - issues found internally may or may not be fixed, but are not disclosed to the public.
Also many linux distributions typically include a massively larger set of packages than windows does, a distribution such as debian or gentoo supports more packages than microsoft do across their entire product line.
Re: (Score:2)
But, remember..according to MS, IE *IS* a part of the OS.
Cheers!
Strat
Whole section of the report not covered (Score:5, Insightful)
Re: (Score:2)
Re:Whole section of the report not covered (Score:4, Insightful)
Since you don't pay for FireFox, there is really no reason not to upgrade.
With MS you have to pay for EVERY new version which is released. In my world that is kind of a huge difference. And if you are just talking about IE, well, you really shouldn't be using old versions anyway...
Re: (Score:3)
Of course he's just talking about IE - unless the Mozilla Foundation released an OS recently that I hadn't heard about...
Besides, it's not as easy as "you shouldn't be using old versions". Some third parties develop software targeted specifically at a given version of IE. If they won't fix their so
It depends... (Score:2)
-Standardization in large user groups. If you are an IT department that supports a few thousand users, you probably want the same (tested in advance) set of applications on all PCs so you can cut down on the complexity of your support issues.
-Regulatory requirements in safety critical applications:
If you do stuff like medical devices, the above becomes mandatory because you have to show a validation of the software c
Re: (Score:2)
It isn't that easy to have multiple versions of MSIE on one Windows machine either. As well as the utter stupidity of software which insists that th
Re: (Score:2)
An upgrade may break an extension/addon. Though the Open Source nature of the software means that such things tend to get fixed PDQ.
With MS you have to pay for EVERY new version which is released.
Typically you don't. IIRC Windows XP originally shipped with IE5. At least in terms of money. The problem is more along the lines that upgrading MSIE tends to come bundled with all sorts of updates to Windows. Whereas Firefox tends to k
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Insightful)
I work at a large corporation with two standard supported browsers: IE and Firefox. When IE 7 was released, we received an e-mail warning us not to upgrade, as doing so would break critical applications. Similar thing with XP SP2. New releases of Firefox just get pushed out without problem.
Re: (Score:2)
To construct my own strawman: If you do a small change every day for a year it wont be very disruptive, but if you release 365 changes on Dec. 31st that will be rather disruptive.
Re: (Score:2)
Second, it takes us about 4 or 5 days to automatically update 90+% of our users and with a couple of week's time, we get about 99% of them moved forward. Because there's no cost to updating, and because it's automatic, we don't need to support older versions for years and years.
Ask Microsoft what their updated percentages are across their various releases. My guess is they won't tell you. And even if they did, I'm sure they'd be just as misleading about this as about
Re: (Score:2)
I'm surprised that Snyder ignored a crucial argument in the PDF: that Microsoft supports their products for a lot longer than Firefox. He didn't rebut that point, which was actually pretty reasonable. I'd be interested to see what he has to say about that. In this regard, Microsoft seems far ahead of Mozilla.
The earliest version of IE you can get support for is 5.0, released in 1998. InfoSpan, the leading company providing Firefox support, will do phone support for version 0.9, released in 1999. So IE has about a year on them. However, MS will not actually do bug fixes to IE 5, which in my mind is a critical part of support. With Firefox, you can not only get bug fixes to any version, you can take bids on the fix from multiple vendors or use internal resources. Not only that, but the cost is often not even ve
Obviously MS is just covering their OS... (Score:4, Funny)
Microsoft wants what's best for you (Score:4, Funny)
Remove it immediately to prevent harm to your computer and protect your privacy!
Re: (Score:2)
Remove it immediately to prevent harm to your computer and protect your privacy!
A convicted monopolists' anti-spyware program marking the competitions' web browser as spyware/a security risk? Wow. They just have no fear, do they?. If they have the Justice Department and the politicians that well-bought that they feel they can get away with things like this, one has to wonder how long it
Re: (Score:2)
Re: (Score:2)
D'OHH!!!
Firefox and Windows (Score:3, Funny)
OSholes?? (Score:2)
*rimshot*
Thank you thank you
The problem with buggy security patches... (Score:2)
You really only get to screw up a few times, before the risk of broken patches exceeds the risk of getting hit by a non-public vulnerability. Then, people won't install patches, even when the exploit is public!
One real problem is that this entire engineering model is very, very new. The rules of physics do not change, day to day, but what's happening on the Internet transforms remarkably, moment to moment. It really is a war out there, and the bad guys
Prove It (Score:3, Insightful)
Attacks on other software packages, including Office and Firefox, have risen dramatically. If Windows and IE were still so easy to exploit, why would that be the case?
What this suggests is that hackers are having a harder and harder time exploiting these more traditional attack vectors. If there was such a huge library of holes that Microsoft patches silently, one would think that those would continue to be a great attack vector, and hackers wouldn't bother researching other vectors.
One could surmise that the bad guys just don't happen to know about these stealth-patched holes, and that's why they're turning to other attack vectors.
But guess what: if the bad guys don't know about them, they do no damage. Security through obscurity works great if the holes stay hidden. And, as I mentioned before, it appears that they are staying hidden, if they exist it all.
This guy has great motivation to make shit up, as does Microsoft. I know virtually everybody here will assume he is telling the truth, but that's an assumption. There is no evidence to back it up.
Re: (Score:2)
Re: (Score:2)
Re:Anybody surprised? (Score:4, Insightful)
Prior to MS, there were several flavors of DOS, preventing different brands of computer from talking. There were 10 or so major players in the word processing market, preventing organizations from sharing documents from one sector to another, not to mention different companies. They, and other companies, ripped of visi-calc and the desk-top graphical user interface, but none were compatible with other brands.
MS came along and everyone could talk, and thanks to IBM, run the same programs on any brand of computer.
I think MS modeled itself after McDonald's. Want a good hamburger go to a good restaurant. Want a hamburger that will satisfy your hunger, taste ok at best, but most important, be exactly the same all over the world, go to McDonald's.
Re: (Score:3, Insightful)
No, there wasnt prior to MS. The several flavours came about after MS started selling DOS. Most of the other flavours was much better than MS Dos. NCR Dos 3.2 was the best DOS version of them all because of all the bughunt NCR did on it. MS-DOS was a dead dog in comparison, funny thing was all MS apps ran much better on other DOS versions than their own. Hence the need for artificially make win not work on
Re: (Score:2)
Re: (Score:2)
Re:Pot, kettle, black (Score:4, Interesting)
Accept it from vulnerability-scanning company Qualys then.
"We have seen a huge jump in the vulnerabilities in Microsoft Office products," said Amol Sawate, manager of Qualys's vulnerability-management lab. "These charts show growth of nearly 300 percent from 2006 to 2007
Re: (Score:2)
It seems unfair to claim that there is a 300 percent vulnerability increase between two versions (fairly dramatic differences) without mentioning that as the cause. Further, Office != IE, anymore than OpenOffice's problems can be laid at FireF
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Informative)
Actually, Firefox is
Re: (Score:2)