Firefox Security?????

Paul K · 01-03-2005, 07:33

From PCWorld.com

Quote:

Mozilla Warns of Firefox Security Holes
Several security vulnerabilities in Firefox and the Mozilla Suite of Internet software put users of the open-source products at risk of hacker attacks, the Mozilla Foundation is warning.
The organization released Firefox 1.0.1, which fixes 17 security flaws in the popular Web browser. The most serious flaws could allow an attacker to gain full control over a victim's PC, the Mozilla Foundation says in a statement. Firefox 1.0 was released in November and has since been downloaded more than 27 million times.
Firefox 1.0.1 also includes several fixes to guard against spoofing of Web addresses and the security indicator on Web sites. These vulnerabilities could be exploited for phishing scams, which typically use spam e-mail messages to drive people towards fraudulent Web pages that look like legitimate e-commerce sites.
One of the changes made in Firefox 1.0.1 is in the way the browser handles international domain names (IDNs). These names are now displayed differently to make it easier to spot spoofed Web sites. Because of the way Firefox displayed IDNs, it was possible to register domain names with international characters that resembled other common characters, thus tricking users into believing they were on a trusted Web site.
For protection against possible exploitation of the security flaws, users should download and install the latest version of Firefox, the Mozilla Foundation says. The organization does not offer patches to fix the problems without having to install a new browser.
Most of these flaws also affect the Mozilla Suite, which includes a Web browser, an e-mail client, Internet Relay Chat client, and Web page editor. However users of the suite are left vulnerable because no fixes are yet available. Mozilla 1.7.6, the update that fixes the issues, is due out in "a couple of weeks," according to a Mozilla Foundation spokesperson.
False Sense of Security?
The public warning of the security vulnerabilities is evidence that the Mozilla Foundation's products give a false sense of security, says Thor Larholm, a senior security researcher with PivX Solutions in Newport Beach, California.
"The only reason Mozilla and Firefox have a good track record in security with a low number of security vulnerabilities is simply because they don't tell anyone about them," Larholm says via e-mail.
"The Mozilla Foundation has fixed hundreds if not thousands of security vulnerabilities over the last few years without notifying the world and without providing security patches, instead they have simply just told their users to upgrade," he says. "We have to remember that all software has security vulnerabilities, the only difference is in how we anticipate them and inform the world about their existence."

Looks like someone isn't impressed

01-03-2005, 07:51

I knew there was something up their sleeve. No browser could have such high security as they stated

ikthius · 01-03-2005, 08:04

Well,

all of this will still not deter me from Firefox.

IE takes months to fix things, and all you get is a patch, so at least the mozilla foundation is giving you a complete browser again, maybe not the best, they could make extensions for security, but it lets people new to internet that you get a brand new full browser.

that probably made no sense, after all it is early!!!!!

But what I am trying to say is, Firefox have updated their software continually since I started using it at Firefox 0.7, and I am very happy with the way they upgrade, I have seen more upgrades for firefox than with IE, even when there is/was big flaws with IE it would take ages for a patch. I have not had an upgrade for months with IE.

I think it is just a case of people being philistines.

ik

01-03-2005, 08:08

Quote:

Originally Posted by ikthius

takes months to fix things, and all you get is a patch, so at least the mozilla foundation is giving you a complete browser again, maybe not the best, they could make extensions for security, but it lets people new to internet that you get a brand new full browser.
ik

So you would rather have a high security risk from your browser for a few weeks, even months before they release a newer version than getting a patch in days to weeks?

ikthius · 01-03-2005, 08:16

to be honest, I have found firefox to be brilliant.
and I have found IE not so good.

yes, I would not have much of a problem with it, because IE is roughly the same, maybe not with the IDNS thing, I don't know too much on IDNS to say, but I have never had any probs.

remember it is a chance I take no one else.

ik

Jon M · 01-03-2005, 08:17

IE vs. Firefox again [img]Download Failed (1)[/img]

01-03-2005, 08:18

I would say Avant is probably the browser that is updated the most, new builds for version 10 come out almost every week. At least I know there being fixed quickly

TheBlueRaja · 01-03-2005, 09:38

Love this bit...

Quote:

"The only reason Mozilla and Firefox have a good track record in security with a low number of security vulnerabilities is simply because they don't tell anyone about them," Larholm says via e-mail.

Oh hello Mr robber, how can i help you today - well, Mr Security guard I was hoping to grab some loot from the house if you dont mind.
No Problem Mr Robber, if you nip round the back the owner has left their window open. Oh Thank you Mr Security guard.

How much more secure is that....?

Idiot.

Paul K · 01-03-2005, 09:50

Quote:

Originally Posted by s1lv3r

IE vs. Firefox again

Actually I posted the article as a way of demonstrating that no browser is perfect and that faults can be found in any tool if you look hard enough

Let's face it IE7 when it appears isn't going to be a bulletproof browser

but it may be close enough to FF etc to force the developers to start working harder to provide better software/ extensions/ features. Nothing like competition to give the general public better services

Stuart · 01-03-2005, 10:29

Quote:

Originally Posted by TheBlueRaja

Love this bit...

Oh hello Mr robber, how can i help you today - well, Mr Security guard I was hoping to grab some loot from the house if you dont mind.
No Problem Mr Robber, if you nip round the back the owner has left their window open. Oh Thank you Mr Security guard.

How much more secure is that....?

Idiot.

OK. Turn the tables. How would you react if Microsoft were doing the same thing? I am not saying they don't, but if they did, can you imagine the reaction? At the very least, all the Firefox users on the board would be crowing about how the Mozilla foundation would never do this.

I am not defending Microsoft, but it does seem that in the computing world, there is one rule for them and one for everyone else. I seem to remember that Mac users were strangely silent when Apple sat on a patch for a major TCP/IP vulnerability in Mac OSX for nearly two months.

Anyway, I thought part of the advantage of open source software is vulnerabilities should be spotted and corrected quickly?
__________________

Quote:

"We have to remember that all software has security vulnerabilities"

That, for me, is the most important part of Paul's first post. We, as users, should remember that. We should do the following

Make sure the machine is behind a firewall: If your router has a firewall, use that. Also install Zonealarm or another software firewall
Make sure any software is fully up to date. IMO, this includes checking Windows update (or Apple's software update) and downloading any patches.
Make sure that any users that don't need admin priviliges don't have admin priviliges. Be careful when doing this though, as some software has trouble running on a non admin account. If you do have trouble with this, PM me as I have a lot of experience getting software to run on non-admin accounts.
Make sure you use anti-spyware software, and also antivirus software.

If you do the above, the impact of any vulnerabilities should be minimized.

**Paul** · 01-03-2005, 10:31

All browsers have security holes - the more popular FF becomes, the more it will be attacked and holes found.

.. and how is releasing a new version better than releasing a patch ????? - it's just a bigger download to achieve the same result.

Paul K · 01-03-2005, 10:34

Quote:

Originally Posted by Paul M

All browsers have security holes - the more popular FF becomes, the more it will be attacked and holes found.

.. and how is releasing a new version better than releasing a patch ????? - it's just a bigger download to achieve the same result.

Releasing a new version instead of a patch would (to me at least) point to more than a couple of little holes being plugged :erm
I totally agree with the last two posts, well said both of you

Stuart · 01-03-2005, 11:06

Quote:

Originally Posted by Paul

Releasing a new version instead of a patch would (to me at least) point to more than a couple of little holes being plugged :erm
I totally agree with the last two posts, well said both of you

It depends. I read an interview with one of the Project managers for Windows XP Service Pack 2 (v. nice looking woman, the interview had a picture). They asked her about the size of Service Pack 2, and apparently, the bulk of it was due to stuff that needed to be changed because they had patched other stuff.. It might be the same with firefox. If they patch a core function within the program, they may need to patch all the parts of the program that rely on that core function.

Gareth · 01-03-2005, 17:19

Quote:

Originally Posted by Electrolyte

So you would rather have a high security risk from your browser for a few weeks, even months before they release a newer version than getting a patch in days to weeks?

I can't actually remember a time when Microsoft have been able to release a patch within days.

Personally, I hate having patches released for a bug. Working in the software industry, I feel qualified to comment on this. Releasing a patch causes issues because it means that you have multiple branches of a release of your product out in the wild. It then becomes very difficult to maintain, because there are so many permutations. When we have to fix a bug, it can mean having to implement that one fix in many, many different branches of the same release. Having only one version of a release makes it very easy to know exactly what is out there, and just what needs to be fixed (and what is involved in terms of resources required to write, test, etc...)

Personally, I prefer having a new release issued, and failing that, having cumulative patches issued as opposed to individual fixes. The size of a cumulative patch need not necessarily be much smaller than an entire new release. This approach really does make life much easier in the long term.

01-03-2005, 18:13

Quote:

Originally Posted by Paul

From PCWorld.com
Looks like someone isn't impressed

lol. So now Firefox users can join the club with the IE users on those regular security patches!