Ready to be published? LXer is read by around 350,000 individuals each month, and is an excellent place for you to publish your ideas, thoughts, reviews, complaints, etc. Do you have something to say to the Linux community?
Firefox, iTunes, and Skype were the top 3 applications in a list of 15 with the most security vulnerabilities, a Cambridge, Mass.-based security company said this week.
The list from Bit9 calls out applications frequently downloaded by individuals (and thus perhaps not sanctioned by the enterprise) which have at least one critical vulnerability, and that rely on the end user, not the corporate IT department, to manually patch or upgrade to fix bugs.
[FUD alert! Notice how the set of "applications" is artificially limited to those "that rely on the end user [...] to manually patch". This leaves out Microsoft Internet Explorer 6.x. I strongly recommend the author take a look at Secunia's Vulnerability Report for Microsoft Internet Explorer 6.x and compare it to Secunia's Vulnerability Report for Mozilla Firefox 1.x. MS IE6.x has 19 unpatched vulnerabilities. Firefox 1.x has 4.Even with all vendor patches applied, MS IE6.x has more unpatched, "moderately critical" vulnerabilities than the total number of unpatched vulnerabilities in Firefox 1.x. None of Firefox's unpatched vulnerabilities reach the level of "moderately critical". Put those numbers in your FUD-pipe and smoke 'em! -- grouch].
It's sad that this hogwash is getting any press. The whole thing is a just-barely disguised marketing ploy.
As grouch says, the "methodology" (to use the term recklessly) explicitly ignores software that IT departments "own"--focusing instead on software that users install. So this virtually guarantees that the list is almost entirely freeware or FLOSS software.
(BTW, just WHY would users be installing Firefox? Oh right, BECAUSE THEY DON'T WANT TO BE OWNED AGAIN!)
Anyway, the versions listed in this sham research are all pretty ancient.
cubrewer: >"It's sad that this hogwash is getting any press. The whole thing is a just-barely disguised marketing ploy."
That's what it smells like to me, too. If the purpose was to make the "enterprise" more secure, all software that is likely to appear within such an organization would be considered in the analysis. In that case, IE 6.x would be banned or at least totally isolated.
Post a comment
A free account is needed to post. Write your comment here first: your text is kept in this browser while you sign up or log in, and is waiting for you when you come back.
Your message:
|||||
10
Markdown: **bold**, *italic*, [text](https://link), - lists, > quotes, $x^2$ for math. Formatting help
As grouch says, the "methodology" (to use the term recklessly) explicitly ignores software that IT departments "own"--focusing instead on software that users install. So this virtually guarantees that the list is almost entirely freeware or FLOSS software.
(BTW, just WHY would users be installing Firefox? Oh right, BECAUSE THEY DON'T WANT TO BE OWNED AGAIN!)
Anyway, the versions listed in this sham research are all pretty ancient.