Mozilla Disputes Bit9's Claim That Firefox is "Most Vulnerable App"
December 18, 2008 8:43 AM
comment(s) - last by
Experts are taking issue to a recent study which warned users of potential risk of using Firefox
A recent security study from Bit9 argued that Mozilla's
Firefox was the most vulnerable application
and thus a major threat to businesses. One of the chief reasons it gave was the lack of a large-network patching system. For this reason, despite
recent security flaws
, it did not consider Microsoft's Internet Explorer software, as it assumed that such a patching system dramatically lowered vulnerability.
Bit9 went as far as to suggest that enterprises block their employees from having access to Firefox and delete it from work computers.
Some firms, including Mozilla, were quick to take issue with Bit9's alarming comments. Representatives from Mozilla's security branch, Human Shield contacted
with remarks on the topic. The company's Johnathan Nightingale states, "While we're always happy to see stories that focus on educating our users about security, there are some problems with Bit9's methodology that hinder its ability to draw any meaningful conclusions."
According to Mr. Nightingale, by raising the "risk" of companies which disclose critical vulnerabilities, Bit9's study punishes openness, a critical key to security. It rewards companies that keep their vulnerabilities secret, he argues.
He also criticizes Bit9's stance on patching, stating that the firm's claims fall short of reality. He states, "Bit9 seems to understand (the need for smarter metrics) in its focus on application support for updates, but again it fails to account for the real world experience. Firefox does not deliver WSUS updates, but our built-in update mechanism requires no user intervention, and we consistently see 90% adoption within six days of a new update being released."
He concludes, "The Firefox vulnerabilities Bit9 discusses are long-since fixed, with the majority of these fixes coming within days of it being announced. That is the real measure of application security: are known vulnerabilities fixed promptly, tested carefully, and deployed thoroughly? Bug counting is unfortunately common because it's easy, but it should not be a substitute for real security measurement."
Similar sentiments were also echoed by various readers on
as well as several sources in the security business. While the Bit9 study certainly takes a controversial and interesting position, according to many its claims are overly broad and flawed. Whether this is the case is largely a matter of opinion, but one thing's for sure -- whether you're on Firefox, Opera, Chrome, or Internet Explorer, security is largely in the
hands of the user
This article is over a month old, voting and posting comments is disabled
RE: Yeah, as the IE exploit raged wild for a few days ...
12/18/2008 10:13:19 AM
Based on what I'm reading the Firefox's built-in update mechanism requires the browser to be running in administrator context.
This whole discussion appeared to aimed at enterprise use and management of browsers. Even Mozilla's response seemed to be geared towards this based on their reference to WSUS.
So... how does it make any sense for a representative of Mozilla to argue that their patching is superior when it relies on the browser running in admin context? That's simply assinine.
I thought the original article they were replying to was pretty weak, but that kind of response is even more pathetic to me.
Regarding your comments. I suspect you have no experience with enterprise desktop maintenance. The patches under security bulletin MS08-078 could easily be deployed to systems within hours using Microsoft's tools like WSUS. You provide no information at all to support your assertion that these deployment tools actually slow down deployments of these patches. In a large enterprise, the limiting factor is typically not the pace at which this can be deployed, but the change controll processes, communications, agreed testing window for internal applications, etc.
RE: Yeah, as the IE exploit raged wild for a few days ...
12/18/2008 6:12:32 PM
It should only require Admin if it was installed someplace the user does not have rights to, like say Program Files. We've had users who install FF themselves despite being 'limited' users, simply by changing the install point to their My Docs folder (XP SP2). I'm not certain, but I assume this would mean that updates function this way as well?
"It's okay. The scenarios aren't that clear. But it's good looking. [Steve Jobs] does good design, and [the iPad] is absolutely a good example of that." -- Bill Gates on the Apple iPad
Critical Vulnerability In Internet Explorer Found, Patch on the Way
December 17, 2008, 12:50 PM
Firefox: Most Risky App to Businesses in New Study
December 12, 2008, 4:00 PM
Woman Succumbs to "Greed", Loses $400K USD to Nigerian Scammers
November 18, 2008, 8:31 AM
Tech's Biggest Loser on Tax Day: eBay Pays Nearly 99 Percent Tax Rate
April 15, 2015, 3:28 PM
Death and Dragons -- Report Claims Game of Thrones Hit by Piracy "Tidal Wave"
April 10, 2015, 8:37 AM
Court Blocks Twitter and YouTube in Turkey After Pro-Communist Attack in Istanbul
April 6, 2015, 10:53 AM
In Graphics and Quotes: $10.4 Billion Charter & Bright House Merger
April 2, 2015, 5:19 PM
WSJ Report Implies That Google Leveraged Lobbying to Kill Antitrust Abuse Probe
March 25, 2015, 5:37 PM
Nationalist Hackers From Turkey Cause Chaos, Deface Dozens of Sites
March 16, 2015, 12:29 PM
Most Popular Articles
Raytheon $1.9 Billion Purchase of Websense Raises Tough Questions
April 20, 2015, 1:57 PM
After Record-Setting Week, Samsung Predicts 70 Million GS6/GS6 Edge Sales
April 17, 2015, 8:39 PM
HBO to VPN HBO Now Users: Prove You Live in U.S. or We Will Terminate You
April 21, 2015, 12:17 PM
Testers Trolled by Promise of Uninstallable Windows 10 Preview Build 10061
April 16, 2015, 2:52 PM
Apple Plans In-Store Workshops to Teach Users How to Use Its Smartwatch
April 17, 2015, 1:02 PM
Latest Blog Posts
Sceptre Airs 27", 120 Hz. 1080p Monitor/HDTV w/ 5 ms Response Time for $220
Dec 3, 2014, 10:32 PM
Costco Gives Employees Thanksgiving Off; Wal-Mart Leads "Black Thursday" Charge
Oct 29, 2014, 9:57 PM
"Bear Selfies" Fad Could Turn Deadly, Warn Nevada Wildlife Officials
Oct 28, 2014, 12:00 PM
The Surface Mini That Was Never Released Gets "Hands On" Treatment
Sep 26, 2014, 8:22 AM
ISIS Imposes Ban on Teaching Evolution in Iraq
Sep 17, 2014, 5:22 PM
More Blog Posts
Copyright 2015 DailyTech LLC. -
Terms, Conditions & Privacy Information