How Can I Trust Firefox?

bachviet · 12-22-2004, 11:06 PM

From a M$ program manager: http://blogs.msdn.com/ptorr/archive/...20/327511.aspx

Got the link from www.dslreports.com.

eSDee · 12-23-2004, 12:00 AM

I got about half way through it and then I passed out. So dude doesn't like Firefox I guess?

Kevster · 12-23-2004, 12:06 AM

Quote:

Originally Posted by eSDeeLoco

I got about half way through it and then I passed out. So dude doesn't like Firefox I guess?

I think I need to get the torrent for the cliffnotes to this weblog.

Working for m$, why would he not like Firefox?

/sarcasm

Jeffbx · 12-23-2004, 07:04 AM

I can kinda see his point - Firefox doesn't employ many security or authentication features in the installation. It would be an extremely trivial thing for a hacker to exploit this & install just about anything on a PC.

However, it wasn't too long ago that IE was like this too, so I think it's just sour grapes.

bbrian · 12-23-2004, 07:25 AM

IE has had a signed installation executable for quite a while. I think the last non-signed version was IE4.

For those of you that didn't want to read the whole thing his primary point is this:

Quote:

I personally don't care if people choose to run Firefox or Linux or any other software on their computers -- it's their computer, after all -- but we'll never get past the spyware / adware problem if people continue to think that installing unsigned code from random web sites is A Good Idea.

So, at this point in time, installing (and using) Firefox encourages exactly the sort of behaviour we are trying to steer people away from, and to me that makes it part of the problem, not the solution.

bbrian · 12-23-2004, 07:35 AM

Here's a long post from a non-microsoft employee on browser QA testing:
http://www.securityfocus.com/archive...5/2004-10-21/0

He built a simple tool to test to see how the browsers handle bad input, which is something that happens on 90%+ of the sites out there.

His primary point:

Quote:

It appears that the overall quality of code, and more importantly, the
amount of QA, on various browsers touted as "secure", is not up to par
with MSIE; the type of a test I performed requires no human interaction
and involves nearly no effort. Only MSIE appears to be able to
consistently handle[*] malformed input well, suggesting this is the
only program that underwent rudimentary security QA testing with a
similar fuzz utility.

This is of course not to say MSIE is more secure; it does have a number
of problems, mostly related to its security architecture and various
features absent in other browsers. But the quality of core code appears
to be far better than of its "secure" competitors.

OC · 12-23-2004, 08:01 AM

Riiiiiight. IE + ActiveX + popups = a cottage support industry popping up to battle spyware.

Idiot.

bbrian · 12-23-2004, 08:07 AM

ActiveX: only if you allow it. Pop-ups: pop-up blockers have been out for ages now.

I have Opera, Mozilla, and FireFox installed, but I still use IE. Never had spyware (other than tracking cookies, which firefox etc get too) and never been hyjacked. It's all about saying 'No' the to warnings or disabling the features in the first place.

It's only a matter of time before FireFox has a lot of problems. My second post above is proof of that.. tons of holes just waiting for exploits.

OC · 12-23-2004, 08:40 AM

Quote:

Originally Posted by bbrian

ActiveX: only if you allow it. Pop-ups: pop-up blockers have been out for ages now.

I have Opera, Mozilla, and FireFox installed, but I still use IE. Never had spyware (other than tracking cookies, which firefox etc get too) and never been hyjacked. It's all about saying 'No' the to warnings or disabling the features in the first place.

It's only a matter of time before FireFox has a lot of problems. My second post above is proof of that.. tons of holes just waiting for exploits.

If you know what the hell you're doing, the security risk is small no matter what broswer you're using.

g222leav · 12-23-2004, 09:12 AM

that author of that article is like my girlfriend...==>overdramatic

BrewMaster · 12-23-2004, 09:47 AM

the guy has to realize that if he works for MS then no one is going to take him that seriously, regardless of how right he may be.

12-22-2004, 11:06 PM	#1
bachviet What's Da Pho*? Join Date: Aug 2001 Location: SoCal (714) Posts: 13,296	How Can I Trust Firefox? From a M$ program manager: http://blogs.msdn.com/ptorr/archive/...20/327511.aspx Got the link from www.dslreports.com. __________________ Dell Dimension 9200 \| Intel Core 2 Quad Q6600 (2.4GHz) \| 4x1GB DDR2 \| 256MB nVidia GeForce 8800GT Dell Studio 17 \| Intel Core i7-720QM (1.6GHz) \| 2x2GB DDR3 1066MHz \| 1GHz ATI Mobility Radeon HD 4650 Intel P4-C 3.0GHz \| ECS 865PE-A \| 3x512MB PC3200 \| 128MB PNY GeForce 6600GT

12-23-2004, 12:00 AM	#2
eSDee Old Skooler Numba 1 Join Date: Nov 2000 Location: Diego Posts: 10,063	I got about half way through it and then I passed out. So dude doesn't like Firefox I guess? __________________ ~~~~~~~~~~~~ 3 days ~ Willie Nelson 3 days I dread to see arrive 3 days I hate to be alive 3 days filled with tears and sorrow yesterday today and tomorrow

12-23-2004, 08:01 AM	#7
OC the admiral formerly known as overclocked Join Date: Aug 2000 Location: Outside the mainstream Posts: 5,922	Riiiiiight. IE + ActiveX + popups = a cottage support industry popping up to battle spyware. Idiot. __________________ But what is adulthood except a delayed end-run around our parents' better judgment? -- Peter Egan cough

12-23-2004, 09:12 AM	#10
g222leav Rear Admiral Lower Half Join Date: Dec 2000 Location: halfway between lost and found Posts: 2,948	that author of that article is like my girlfriend...==>overdramatic __________________ "it's more fun than it looks" - Red Foreman "trying is the first step in failing" - Homer J. Simpson "the world needs more dumb people...dumb people can't start wars" - mike lam

12-23-2004, 09:47 AM	#11
BrewMaster Ruler-Of-All-Things-Beer Join Date: Dec 2000 Location: Pasadena, CA Posts: 10,249	the guy has to realize that if he works for MS then no one is going to take him that seriously, regardless of how right he may be. __________________ respect beer.

12-23-2004, 07:04 AM	#4
Jeffbx Fleet Admiral Join Date: Mar 2000 Location: Michigan Posts: 9,390	I can kinda see his point - Firefox doesn't employ many security or authentication features in the installation. It would be an extremely trivial thing for a hacker to exploit this & install just about anything on a PC. However, it wasn't too long ago that IE was like this too, so I think it's just sour grapes.

12-23-2004, 08:07 AM	#8
bbrian Lieutenant Commander Join Date: May 2000 Location: La-La Land Posts: 676	ActiveX: only if you allow it. Pop-ups: pop-up blockers have been out for ages now. I have Opera, Mozilla, and FireFox installed, but I still use IE. Never had spyware (other than tracking cookies, which firefox etc get too) and never been hyjacked. It's all about saying 'No' the to warnings or disabling the features in the first place. It's only a matter of time before FireFox has a lot of problems. My second post above is proof of that.. tons of holes just waiting for exploits.

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

User Name
Password
Remember Me?