Firefox gets cleverer vs. malicious types

3 Responses to “Firefox gets cleverer vs. malicious types”

1. Comment by http://ww.jonty.me.uk/ Jonty

   August 18th, 2004 at 1:17 pm 2004-08-18PDT13:17:12-0700

   It’s a good sign that the development teams of these smaller browsers (no disrespect intended) are able to respond to these important problems.

   Sadly as these browsers grow in popularity, it perhaps stands to reason that they will become a more prominent target. I daresay that Microsoft’s coding isn’t particularly bad, merely that having such market dominance makes them the ideal target. Another good reason against monopolies :)

   It is intersting that of late, Firefox has had more bug fixes than IE (7 v 4, not that that means much, the problems being general rather than specific, and IE being patched to the teeth as it is).

   Here’s hoping the reinvigorated Internet Explorer development team get the go ahead for IE7 pre-Longhorn (although whether developer suggestions, to which Microsoft welcome (get posting them!), will get implemented over end-user nicities, as per SP2).

   Kind Regards

2. Comment by http://blog.fatbusinessman.com Fatty

   August 18th, 2004 at 5:47 pm 2004-08-18PDT17:47:52-0700

   I daresay that Microsoft’s coding isn’t particularly bad, merely that having such market dominance makes them the ideal target

   I would have to say that, while this has a bearing, it most certainly isn’t the only reason why Microsoft products seem to get h4×0red more often. The most obvious counter-example for this is Apache which, despite having a 60% market share on Web servers, tends to have fewer security issues than Microsoft’s IIS.

   However, you are correct that all software of any size will have bugs and vulnerabilities and, failing that, you can always rely on the user’s ability to do something stupid.

3. Comment by http://ben-ward.co.uk Ben

   August 18th, 2004 at 9:16 pm 2004-08-18PDT21:16:57-0700

   The eternal size vs. security target argument is always interesting and certainly true to some degree (both in terms of blast radius for your little virus you wrote in your bedroom, and also for the actually software and development platform experience of script kiddies themselves).

   MS are somewhat criticised at the moment for bad coding in places. Not necessarily in the efficiency or quality of the code itself, but in terms of the complete disregard for security when they designed IE. ActiveX is the prime example.
   One thing that will be interesting to see is whether IE on Service Pack 2 actually remains more secure – implying that they’ve actually gone into the core of it and sorted it out – or if the new security model is just hacked on top and vunerable to attack itself, so exposing the underlying holes of old. We’ll see I guess.

   As for “number of patches”... I don’t think that’s a fair indicator. In fact, I would argue that “number of patches” being greater is a good thing, given that we know as fact that web browsers will have holes, will be attacked and in situations where Microsoft have had issues found in IE, they’ve taken an age to fix it. Mozilla are priding themselves in having fixes released within days/a week of the initial report, before it’s ever implimented in the wild. The figure that should be given more attention is that of “Firefox security holes/bugs within 12 months of 1.0” vs. “IE5/6 security holes/bugs within 12 months of release”. While patches make security holes publicly visible, that does not mean that there are actually more holes, just more patches.

© Ben Ward 2004–2007