Dark Bilious Vapors

Home » Archives » September 2005 » In re Firefox: facts or FUD?

[« Gem o'the Day:] [Thought for the Day: »]

09/21/2005: In re Firefox: facts or FUD?

I subscribe to a number of techie mailing lists. One of the headlines in this afternoon's list (linked to one of ZDNet's blogs) immediately caught my eye: Is the Firefox honeymoon over?

Now that Firefox has become the first viable contender to Microsoft Internet Explorer in years, its popularity has brought with it some unwanted attention. Last week's premature disclosure of a zero-day Firefox exploit came a few weeks after a zero-day exploit for Internet Explorer appeared on the Internet. Firefox not only has more vulnerabilities per month than Internet Explorer, but it is now surpassing Internet Explorer for the number of exploits available for public download in recent months.

This paragraph is followed by a number of graphs purporting to show how Firefox is being attacked more and more every month.

My first reaction when I see one of those pieces is to ask myself how much Micro$oft paid that particular shill to write that. Once I got past that, I started mentally to compose my defense of Firefox (more as an exercise), when I began reading some of the comments to that post, and I realized that (of course), someone else had said it better than I could, and pointed me to some data I didn't know (or, if I knew it, didn't know where to back it up).

Before one runs screaming in horror to Internet Exploder as one's default web browser, let's examine two webpages from Secunia, the software security firm.

First, Vulnerability Report--Microsoft Internet Explorer 6.x:

Vendor: Microsoft
Product Link: View here
Product Affected By: 85 Secunia Advisories

Microsoft Internet Explorer 6.x with all vendor patches installed and all vendor workarounds applied, is currently affected by one or more Secunia advisories rated Highly critical

This is based on the most severe Secunia advisory, which is marked as "Unpatched" in the Secunia database. Go to Unpatched/Patched list below for details.

Currently, 19 out of 85 Secunia advisories, is marked as "Unpatched" in the Secunia database.

Now, let's look at Vulnerability Report--Mozilla Firefox 1.x

Vendor: Mozilla Organization
Product Link: View here
Product Affected By: 23 Secunia Advisories

Mozilla Firefox 1.x with all vendor patches installed and all vendor workarounds applied, is currently affected by one or more Secunia advisories rated Less critical

This is based on the most severe Secunia advisory, which is marked as "Unpatched" in the Secunia database. Go to Unpatched/Patched list below for details.

Currently, 3 out of 23 Secunia advisories, is marked as "Unpatched" in the Secunia database.

So... Let me see here.

Internet Explorer: 85 known vulnerabilities. 19 of them are still unpatched. And the worst of those unpatched vulnerabilities is considered "highly critical" by Secunia.

Firefox: 23 known vulnerabilities. 3 of them are still unpatched. And the worst of those unpatched vulnerabilities is considered "less critical" by Secunia.

Well, I don't know about you, but I know which of those two browsers I think is more secure. HINT: it's most certainly not the one you'd associate with Bill Gates.

Below the fold, a few pertinent comments from a ZDNet commenter:

IE 6 was released in October 25, 2001. Firefox 1.0 was released November 9, 2004. Firefox is LESS THAN 1 YEAR OLD! Internet Explorer 6 has been floating around for 4 years and hasn't been actively developed in over a year and a half. It's a 1.0 version, people! Security patching near the beginning will spike, then trail off, naturally, as the browser has a chance to steep. Firefox is in that spike period. IE 6.0 is in coast mode of near zero development.

==================
IE 6 - 222 security patches since release

Firefox - 52 patches since release, only 13 critical
==================

As of this month [September, 2005], SecurityFocus reports 2 unpatched vulnerabilities in Firefox 1.0.6, versus 56 unpatched vulnerabilities in Internet Explorer 6 on Microsoft Windows XP SP2.

I'd say the IE 7 team has their work cut out for them. It's also clear that the Mozilla team patches the holes immediately. The IE team has left known critical vulnerabilities lie for over a year. Unacceptable!

I also see conflicting reports of IE's exact number of patched and unpatched vulnerabilities. That's because MS buries their bug list. At least, with Firefox, they are made publically available. There is nothing to hide. We can log on at any time and see all outstanding bugs. What a fantastic way to develop software! Who can actually say, with all certainty, that IE's unpathced vulnerabilities lie at any given number. That's only the number the public knows about.

Len on 09.21.05 @ 09:45 PM CST

[ | ]