Update: Microsoft, Mozilla trade punches over browser security

Computerworld - The feud between Microsoft Corp. and Mozilla Corp. over whose Web browser is more secure heated up again as officials for both companies trotted out statistics to show their application is safer.

Jeff Jones, the strategy director in Microsoft's security technology unit, started the latest bug count battle last Friday, when he posted a report (download PDF) that claimed Microsoft Corp.'s Internet Explorer had been affected by fewer than half as many vulnerabilities in the last three years as Mozilla's Firefox had.

"Over the past three years, supported versions of Internet Explorer have experienced fewer vulnerabilities and fewer High severity vulnerabilities than Firefox," said Jones in the report, "a result that stands in contrast to early assertions by Mozilla that Firefox 'won't harbor nearly as many security flaws as those [in] Microsoft's Internet Explorer.'"

Jones counted 199 Firefox bugs that Mozilla has quashed since November 2004: 75 ranked "High" in severity, 100 rated "Medium" and 24 were "Low." In the same period, Microsoft fixed 87 total vulnerabilities: 54 High, 28 Medium and five Low.

He also tallied flaws that have been fixed for the newest versions of each browser -- IE 7 and Firefox 2.0 -- and again concluded that Microsoft's browser is better, although Jones acknowledged that Mozilla, like Microsoft, had improved the security of its application.

Mozilla wasted little time firing back. "When you compare how long it takes Microsoft to fix Internet Explorer vulnerabilities versus how long it takes Mozilla to fix vulnerabilities in Firefox, it becomes clear why he chose to count vulnerabilities in this report instead," Window Snyder, who heads Mozilla's security efforts, charged last week in a blog posting of her own.

Others from the open-source developer chimed in. Mike Shaver, Mozilla's chief evangelist, called Jones' logic baffling. "Jeff is saying that Mozilla's products are less secure than Microsoft's because Mozilla fixed more bugs," said Shaver. "By that measure, IE4 is even more secure, because there were no security bugs fixed in that time frame. Microsoft should be embarrassed to be associated with this sort of ridiculous 'analysis.'"

Mike Schroepfer, Mozilla's vice president of engineering, also took Microsoft to the woodshed, first criticizing the vendor for not providing a public bug database so that Jones' numbers could be verified, then discounting the figures entirely. "Bug counts are meaningless; what matters is whether you are at risk or not," Schroepfer said.

In a telephone interview, Snyder ran with that line of reasoning. "Microsoft only counts the vulnerabilities that have been reported externally," she said, and it doesn't include in its total those found by its own engineers or by penetration testers it hires to hammer on its software. Those bugs, said Snyder -- who once worked at Microsoft as a security strategist and was responsible for signing off on the security aspects of Windows XP SP2 -- are patched in the less-frequently-released service packs or major updates.