Update: Microsoft, Mozilla trade punches over browser security
IE has fewer bugs, says Microsoft; we patch Firefox faster, counters Mozilla
Computerworld - The feud between Microsoft Corp. and Mozilla Corp. over whose Web browser is more secure heated up again as officials for both companies trotted out statistics to show their application is safer.
Jeff Jones, the strategy director in Microsoft's security technology unit, started the latest bug count battle last Friday, when he posted a report (download PDF) that claimed Microsoft Corp.'s Internet Explorer had been affected by fewer than half as many vulnerabilities in the last three years as Mozilla's Firefox had.
"Over the past three years, supported versions of Internet Explorer have experienced fewer vulnerabilities and fewer High severity vulnerabilities than Firefox," said Jones in the report, "a result that stands in contrast to early assertions by Mozilla that Firefox 'won't harbor nearly as many security flaws as those [in] Microsoft's Internet Explorer.'"
Jones counted 199 Firefox bugs that Mozilla has quashed since November 2004: 75 ranked "High" in severity, 100 rated "Medium" and 24 were "Low." In the same period, Microsoft fixed 87 total vulnerabilities: 54 High, 28 Medium and five Low.
He also tallied flaws that have been fixed for the newest versions of each browser -- IE 7 and Firefox 2.0 -- and again concluded that Microsoft's browser is better, although Jones acknowledged that Mozilla, like Microsoft, had improved the security of its application.
Mozilla wasted little time firing back. "When you compare how long it takes Microsoft to fix Internet Explorer vulnerabilities versus how long it takes Mozilla to fix vulnerabilities in Firefox, it becomes clear why he chose to count vulnerabilities in this report instead," Window Snyder, who heads Mozilla's security efforts, charged last week in a blog posting of her own.
Others from the open-source developer chimed in. Mike Shaver, Mozilla's chief evangelist, called Jones' logic baffling. "Jeff is saying that Mozilla's products are less secure than Microsoft's because Mozilla fixed more bugs," said Shaver. "By that measure, IE4 is even more secure, because there were no security bugs fixed in that time frame. Microsoft should be embarrassed to be associated with this sort of ridiculous 'analysis.'"
Mike Schroepfer, Mozilla's vice president of engineering, also took Microsoft to the woodshed, first criticizing the vendor for not providing a public bug database so that Jones' numbers could be verified, then discounting the figures entirely. "Bug counts are meaningless; what matters is whether you are at risk or not," Schroepfer said.
In a telephone interview, Snyder ran with that line of reasoning. "Microsoft only counts the vulnerabilities that have been reported externally," she said, and it doesn't include in its total those found by its own engineers or by penetration testers it hires to hammer on its software. Those bugs, said Snyder -- who once worked at Microsoft as a security strategist and was responsible for signing off on the security aspects of Windows XP SP2 -- are patched in the less-frequently-released service packs or major updates.
- The DDoS Threat Spectrum Bolstered by favorable economics, today's global botnets are using distributed denial-of-service (DDoS) attacks to target firewalls, web services, and applications, often simultaneously.
- Need to Replace MS Threat Management Gateway? Read this article to learn how F5's Secure Web Gateway solution provides a full set of features that can help you successfully migrate...
- The Shortfall of Network Load Balancing Applications running across networks encounter a wide range of performance, security, and availability challenges as IT department strive to deliver fast, secure access...
- Leave No App Behind with Software Defined Application Services F5 Software Defined Application Services (SDAS) is the next-generation model for delivering application services that enables service injection, consumption, automation, and orchestration across...
- Keep Servers Up and Running and Attackers in the Dark An SSL/TLS handshake requires at least 10 times more processing power on a server than on the client. SSL renegotiation attacks can readily...
- On Demand: Mastering the Art of Mobile Content Management Mobile device usage in the enterprise has skyrocketed, and it continues to escalate. IT must answer to users who demand access to their... All Web Apps White Papers | Webcasts