Update: Microsoft, Mozilla trade punches over browser security
IE has fewer bugs, says Microsoft; we patch Firefox faster, counters Mozilla
December 5, 2007 12:00 PM ETComputerworld - The feud between Microsoft Corp. and Mozilla Corp. over whose Web browser is more secure heated up again as officials for both companies trotted out statistics to show their application is safer.
Jeff Jones, the strategy director in Microsoft's security technology unit, started the latest bug count battle last Friday, when he posted a report (download PDF) that claimed Microsoft Corp.'s Internet Explorer had been affected by fewer than half as many vulnerabilities in the last three years as Mozilla's Firefox had.
"Over the past three years, supported versions of Internet Explorer have experienced fewer vulnerabilities and fewer High severity vulnerabilities than Firefox," said Jones in the report, "a result that stands in contrast to early assertions by Mozilla that Firefox 'won't harbor nearly as many security flaws as those [in] Microsoft's Internet Explorer.'"
Jones counted 199 Firefox bugs that Mozilla has quashed since November 2004: 75 ranked "High" in severity, 100 rated "Medium" and 24 were "Low." In the same period, Microsoft fixed 87 total vulnerabilities: 54 High, 28 Medium and five Low.
He also tallied flaws that have been fixed for the newest versions of each browser -- IE 7 and Firefox 2.0 -- and again concluded that Microsoft's browser is better, although Jones acknowledged that Mozilla, like Microsoft, had improved the security of its application.
Mozilla wasted little time firing back. "When you compare how long it takes Microsoft to fix Internet Explorer vulnerabilities versus how long it takes Mozilla to fix vulnerabilities in Firefox, it becomes clear why he chose to count vulnerabilities in this report instead," Window Snyder, who heads Mozilla's security efforts, charged last week in a blog posting of her own.
Others from the open-source developer chimed in. Mike Shaver, Mozilla's chief evangelist, called Jones' logic baffling. "Jeff is saying that Mozilla's products are less secure than Microsoft's because Mozilla fixed more bugs," said Shaver. "By that measure, IE4 is even more secure, because there were no security bugs fixed in that time frame. Microsoft should be embarrassed to be associated with this sort of ridiculous 'analysis.'"
Mike Schroepfer, Mozilla's vice president of engineering, also took Microsoft to the woodshed, first criticizing the vendor for not providing a public bug database so that Jones' numbers could be verified, then discounting the figures entirely. "Bug counts are meaningless; what matters is whether you are at risk or not," Schroepfer said.
In a telephone interview, Snyder ran with that line of reasoning. "Microsoft only counts the vulnerabilities that have been reported externally," she said, and it doesn't include in its total those found by its own engineers or by penetration testers it hires to hammer on its software. Those bugs, said Snyder -- who once worked at Microsoft as a security strategist and was responsible for signing off on the security aspects of Windows XP SP2 -- are patched in the less-frequently-released service packs or major updates.
Microsoft
Additional Resources



Learn the important issues you must consider before starting your next mobility initiative. Get your mobility white paper from IDC now, compliments of Sybase.
White Papers & Webcasts
Moving Beyond Monolithic White Paper
What's next for enterprise application architecture? Learn Now.
The Workday User Experience Video
Watch Workday's Creative Director, Scott Lietzke, discuss the business-centered design philosophy at Workday.
The ROI of Software-As-A-Service - Forrester Research
Learn if SaaS has a long-term value. Read now.
Virtualize Microsoft Applications on VMware
Register for this live webcast now!
Global at the Core White Paper
Learn the business and technology benefits of Workday's global approach to enterprise applications.
A Unified Approach to Application Performance
Watch this webcast today!
The Workday User Interface White Paper
Read how Workday re-invents the user experience in enterprise applications.
Aligning IT to Business: The Rising Importance of Application Delivery Networks
Application Delivery Networking (ADN) will play a vital role in helping enterprises incorporate strategic technologies to achieve business initiatives.
Measurement Specialties
Download this case study!
Preparing Your Business Services for the Future
Would you trust your network monitoring tools enough to know when something is truly halting a business service?

