- Site menu:
- Latest Discussions
- Latest Newswire
- Archives
- Submit Story
- Story HOWTO
- Syndicate
- E-mail Alerts
Spyware: Firefox and IE
|
|
|
Comments (7)
Yep, the first comment is actually way better than the article they should just fail the students and give the comment author a scholarship :)
Another case of stone soup, you ask me.
The problem with this kind of ancedotal "wisdom" is how often I hear it repeated. My own brother, a CS graduate student from Rose Hulman, whom I respect greatly, has made the mistake of saying similar things to the stuff in this article.
The problem with a lie like this (And it's one deliberately put out as FUD from my experience), is that it's half true -- It's like that old joke: Why do people rob banks? Answer: Because that's where the money is. Well, malware writers are actually partially targeting I.E. because the browser does have the highest share of the market.
But Microsoft made that market (the malware one) practically a synch by not thinking about security the way they as a good corporate citizen should have. Instead, they went for features over safety, knowing full well the demons they were leaving their users to fend off as they surfed the web. It was unforgivable, but another sign of their value system: When it comes down to ease of use over what's good for the user, you forget anything that might be percieved as hard so you can grab more market share. Competitors entering the market will be percieved as harder to use (why, for example, do I have to go through all of these approvals just to run some java? I mean, geeze, all those checks and balances for my security really make the web browsing experience so gosh darn aweful _hard_).
Look at all the crap that IIS used to leave turned on by default. Tell me they didn't have similar things going on at the server level -- almost verbatim the same problem, only now it's the company's data that's at risk. Oh, setting up IIS was easy. A child could do it.
Unfortunately, trusting the company data to a computing child is exactly the worst-case scenario you could ask for. Helps explain all of those high-profile data thefts, though, doesn't it?
The problem with this kind of ancedotal "wisdom" is how often I hear it repeated. My own brother, a CS graduate student from Rose Hulman, whom I respect greatly, has made the mistake of saying similar things to the stuff in this article.
The problem with a lie like this (And it's one deliberately put out as FUD from my experience), is that it's half true -- It's like that old joke: Why do people rob banks? Answer: Because that's where the money is. Well, malware writers are actually partially targeting I.E. because the browser does have the highest share of the market.
But Microsoft made that market (the malware one) practically a synch by not thinking about security the way they as a good corporate citizen should have. Instead, they went for features over safety, knowing full well the demons they were leaving their users to fend off as they surfed the web. It was unforgivable, but another sign of their value system: When it comes down to ease of use over what's good for the user, you forget anything that might be percieved as hard so you can grab more market share. Competitors entering the market will be percieved as harder to use (why, for example, do I have to go through all of these approvals just to run some java? I mean, geeze, all those checks and balances for my security really make the web browsing experience so gosh darn aweful _hard_).
Look at all the crap that IIS used to leave turned on by default. Tell me they didn't have similar things going on at the server level -- almost verbatim the same problem, only now it's the company's data that's at risk. Oh, setting up IIS was easy. A child could do it.
Unfortunately, trusting the company data to a computing child is exactly the worst-case scenario you could ask for. Helps explain all of those high-profile data thefts, though, doesn't it?
Koriel, no kidding!
Let's add to the deliberate lie/FUD category "greater ease of use = less security." Lessee, I've been Web surfing for lo these many years now with a variety of browsers- Opera, aieee, netscape, Galeon, Mozilla, Konqueror, Links/lynks/elinks etc., and Firefox, and I can't think of one single instance where having the ability to allow remote code execution, right down to arbitrarily altering the guts of my operating system, would have enhanced my Browsing Experience.
Oh yeah, and let's not forget that the bad guys do not have access to winduhs source code. Wow, is that like dizzyingly counter-intuitive or what! Linux is nekked but it's safe! woa, dood.
Let's add to the deliberate lie/FUD category "greater ease of use = less security." Lessee, I've been Web surfing for lo these many years now with a variety of browsers- Opera, aieee, netscape, Galeon, Mozilla, Konqueror, Links/lynks/elinks etc., and Firefox, and I can't think of one single instance where having the ability to allow remote code execution, right down to arbitrarily altering the guts of my operating system, would have enhanced my Browsing Experience.
Oh yeah, and let's not forget that the bad guys do not have access to winduhs source code. Wow, is that like dizzyingly counter-intuitive or what! Linux is nekked but it's safe! woa, dood.
Security experts, and "AV" people in particular, have never come to grips with the reality of Windows attracting TENS OF THOUSANDS of viruses, while other platforms have TENS of viruses.
Either a technical reason or syndrome of reasons exists (tradition of single-userness, COM complexity, Outlook and IE and ISS coding practices, software and hardware monoculture, file name determining whether it's executable or not, byzantine and baroque system architecture) exist, or a sociological reason or syndrome of reasons exists.
Because no other platform attracts the number and variety of malware that Windows does. All that remains is to conduct an experiment to determine the reason.
Either a technical reason or syndrome of reasons exists (tradition of single-userness, COM complexity, Outlook and IE and ISS coding practices, software and hardware monoculture, file name determining whether it's executable or not, byzantine and baroque system architecture) exist, or a sociological reason or syndrome of reasons exists.
Because no other platform attracts the number and variety of malware that Windows does. All that remains is to conduct an experiment to determine the reason.
How incredibly defeatist for people to use the whole "bigger target = more exploits" argument. The implication is that the assorted bad guys (to include spyware planting companies) are somehow magical beings beyond mere mortal abilities to defend.
Who cares how many people target you? What matters is how many get in. Lock the door and keep them out.
Who cares how many people target you? What matters is how many get in. Lock the door and keep them out.
The eternal academic pursuit... "How many virus can fit on Bill's head?"
Post a comment
A free account is needed to post. Write your comment here first: your text is kept in this browser while you sign up or log in, and is waiting for you when you come back.
Your message:Markdown: **bold**, *italic*, [text](https://link), - lists, > quotes, $x^2$ for math. Formatting help
Sign up and post (it is free) or Log in and post
"I asked whether that was because Firefox is inherently more secure or because its smaller market share makes it a less lucrative target for spyware. He cited the latter -- reflecting the fact that spyware companies want to target the most commonly used configuration."
Moron! Twit! Go back to kindergarten, ya schmuck! Sheesh, and don't sail too far west, or you'll fall off!
Fortunately, an informed comment follows the blog entry that gently corrects the idiot grad student's statement.