Red Hat and Firefox more buggy than Microsoft
11292
Secunia has found that the number of security bugs in the open source Red Hat Linux operating system and Firefox browsers far outstripped comparable products from Microsoft last year.In a report released this week, Secunia also criticized CA for the quality of the code in its anti-virus products, saying that "inherent" code problems are exposing CA products to ongoing security vulnerabilities.On the other hand, "zero-day" security bugs in Firefox were patched more quickly than in Microsoft Internet Explorer, according to the Secunia 2007 Report, released this week.In a review of the number of vulnerabilities found in enterprise anti-virus vendors' products, Secunia found that CA was by far the leader, with 187 vulnerabilities, followed by Symantec with 73. Trend Micro (34), ClamAV (15), McAfee (13) and F-Secure (6) ranked lower on the list.The high figures for Symantec and CA are partly due to their wide range of products, some of which cover areas other than anti-virus, Secunia said.However, the majority of the CA bugs were due to "inherent code problems with some CA products", Secunia said in the report.Of particular concern is CA's range of ARCServe Backup products for laptops and desktops, which Secunia submitted to its Binary Analysis process after several bugs were reported and fixed. The bugs involved errors in processing particular arguments and requests.The analysis found that about 60 reported bugs were still present in the supposedly patched versions.What's more, the analysis found that the vulnerabilities were partly due to "the nature of the product code itself", Secunia said."Unless an overhaul of the code is undertaken, then the product remains susceptible to similar types of vulnerabilities," Secunia said.However CA said in a statement that it has rigorous quality-control measures in place for its software and continues to improve those measures.A number of the vulnerabilities found in Symantec products were due to their use of vulnerable software from third-party developers, Secunia said.One of these is the Autonomy Keyview SDK (software development kit), used in Symantec Mail to view Lotus 1-2-3 files. The component was reported to have a "highly critical" flaw on 12 December, but hasn't yet been patched, leaving some Symantec products vulnerable.Symantec said in a statement that it has published instructions for mitigating the problem and has issued product updates for some affected vendors. IBM, whose Lotus Notes was also affected by the Autonomy bug, has issued its own patch.Operating systems and browsersOut of the operating systems monitored by Secunia -- Windows (98 and onwards), Mac OS X, HP-UX 10.x and 11.x, Solaris 8, 9, and 10 and Red Hat (excluding Fedora) -- Red Hat was found to have by far the most vulnerabilities, at 633, with 99 percent found in third-party components. (Linux distributions are generally composed mostly of third-party software, which is integrated by the distributor.)Red Hat has taken issue with the figures, claiming the accurate number should be 404 vulnerabilities for last year.Solaris came next, with 252 bugs, 80 percent of which were in third-party components. Mac OS X came after that with 235, 62 percent of which were third-party.Windows had only 123 bugs reported, but 96 percent of those were found in the operating system itself. HP-UX had 75 bugs reported, 81 percent of which were in third-party code.Last week, a US Department of Homeland Security (DHS) bug-fixing scheme uncovered an average of one security glitch per 1,000 lines of code in 180 widely used open source software projects.The large number of Red Hat flaws is partly due to the large number and wide variety of components it includes."Red Hat contains two different browsers and graphic interfaces, a number of PDF readers and image editors, and so on," the report said. "Red Hat, HP-UX, and Solaris can easily be used as servers, and as such include and support a large number of third party components, while the same cannot be said of all versions of Windows and Mac OS X."Any consideration of relative OS security should look at factors not covered by the report, such as average patching time for vulnerabilities, Secunia said.In the browser field, Firefox led the way with 64 bugs, compared to 43 for Internet Explorer, and 14 each for Opera and Safari.However, in an examination of zero-day flaws - reported by third parties before a patch was available - Secunia found that Firefox tended to get more patches, sooner, compared to IE.Out of eight zero-day bugs reported for Firefox in 2007, five have been patched, three of those in just over a week. Out of 10 zero-day IE bugs, only three were patched and the shortest patch time was 85 days.ActiveX was hit by the largest number of browser add-on bugs in 2007, with 339 (compared to 45 last year), Secunia said.The figure was propped up by the Month of ActiveX Controls Bugs in May 2007, and by Secunia's discovery of a vulnerable ActiveX component that was used in 40 different products.QuickTime followed with 35 bugs and Java with 21 bugs.
510779
CNET News.com has a special section about the launch of Mozilla Firefox 1.0. First up is a two-page article about the release, which includes some factual errors (for example, the article says the success
481653
I'm back, with a very interesting topic too!  Joel Spolsky, ex-Microsoft Manager and software engineering guru has a new essay, How Microsoft Lost the API War that is creating quite a big storm in the blogging communitiy.  Joel posits that the priests in the holy Temple of Microsoft have lost their way, because it has split into two factions, and the wrong faction is winning. One faction worships on the alter of backward compatibility, while the other is led by fervent priests who are proselytizing to raise up the new gods of .NET and Longhorn. Joel suggests that the new gods will cause the destruction of the holy Temple because Microsoft's great victories were built on the altar of keeping customers happy with backward compatibility. Furthermore the old gods of the Windows API continue to grow more grotesque and cruel with the passing of time, driving former worshipers into the arms of the friendlier gods of World Wide Web.  This story sounds extremely plausible. I must admit that i fit the profile of the developer who used to develop on the Window's API, is familiar with COM and Win32 who now develops mostly using PHP and Python. However I continue to develop and maintain Windows apps that keep our customers happy, and we still plan to develop new Windows apps. Some points:  Temple of the Blind? Firstly, Microsoft is still a compelling place to work for to people who feel that they can make a difference. The Temple continues to attract talented people with a Unix background. For example we have the recent hiring of Ward Cunningham, author of the Wiki.  Microsoft is still able to keep talented people like Raymond Chen, and others like him who continue to look after the Windows API, and Longhorn apparently will still give high priority to backward compatibility. Open sourcerers like Miguel Icaza are sufficiently attracted to the .NET vision to stake their careers on Mono. Longhorn and .NET are compelling technologies, so even if Win32 is not so cute anymore, M'soft is providing something that remains very attractive.  What i do see M'soft doing wrong is that they aren't disseminating the .NET runtime fast enough. It remains an optional install in XP Service Pack 2 for example. Also their IE dev team appears to be hog-tied due to political reasons; nevertheless IE remains good enough, particularly when I can embed IE as an activeX control, something I cannot do with Mozilla (AFAIK) - Update: I'm wrong.  Temple of the Spider?  Secondly, people don't merely use a web browser. They run the web browser in the OS.  So let me ask you, if you are using DreamWeaver or HomeSite or Photoshop or vi or emacs or Gimp, how many of you are willing to give it up for a java applet (or whatever your favorite technology is) running in your web-browser? Precisely.  Temple of the Abandoned?  Third, Joel makes the claim that developers are not developing to the Windows API. Well he could be right. But I bet a lot of them are still calling Win32.  If you are using a framework or IDE like Delphi or wxWindows (or .NET or VB) then you certainly are insulated from the Windows API, but that doesn't mean that you're not calling the Windows API all the time. I don't see Borland dropping their Windows version of Delphi at any point in time.   In fact, the fact that many developers are using some form of framework is a compelling argument for Microsoft to enhance the .NET framework to attract developers who are using other frameworks.  Today, not that many students learn x86 assembler, but that doesn't mean that Intel lost the CPU wars. Just because fewer people are learning Win32 doesn't mean Microsoft has lost the API wars, if the frameworks run predominantly on Win32.  Temple of the Lost  Joel even warns you in the beginning that "because I'm talking about big trends, I need to exaggerate and generalize". But you still get sucked in because Joel Spolsky is a first-class writer, in the same order as Philip Greenspun or Eric Raymond. That makes him so persuasive and plausible. But this is not Indiana Jones and doomed temples, but Steve Jobs and reality distortion fields.  Other opinions:  Harry Fuecks (PHP is ASP's upgrade path),  Dennis Hamilton (M'soft is just covering all bases), Robert McLaws (Joel is wrong in 7 points), Oliver Travers (the web is not good enough), One Run-time to Rule them all....
398797
update A top Red Hat executive has attacked the open-source credentials of its sometime business partner Sun Microsystems. In a Web log posting Thursday, Michael Tiemann, Red Hat&#39;s vice president of open-source
504112
Be careful, kids Firefox suffers from a flaw that allows attackers to manipulate the authentication cookies of virtually any website, a vulnerability Bugzilla has deemed severe. It's the second major security lapse for the open-source browser in as many days.â¦
657189
Success of alternative apps like Firefox may be putting pressure on the software giant.
752790
The latest beta release from Firefox fixes more than 900 hundred bugs and 300 memory leaks, and improves performance overall. It shows the open-source browser is on track to be one of the biggest releases of the new year.
250638
Windows, Linux and Java each fail some basic integrity rules.
335763
Few people get excited when some new software is released, especially when the program is not a game or a music or movie player. But the release of the first full version of a web browser called Firefox has
3540
If you can't get Firefox to use the new version of the Flash player, you've come to the right place. I just got finished fighting with Flash and Firefox. It was a long fight, but I won.
474020
The latest beta of Mozilla's browser has been up and running for
572892
Four new unpatched vulnerabilities have been published for Internet Explorer and Firefox, with two coming for each browser.
238632
The future appears rosy for Firefox. Just two years after its start, and even before reaching version 1.0 (now imminent), the little open source browser has already left behind its elder
236907
Firefox 3 Beta 2 is more stable and polished than Beta 1, but while it's not quite ready for prime time, it does show some of the nifty new tools we can expect when Mozilla's browser ships.
688948
(InfoWorld) - Leaders of Microsoft's strategy to make its products more interoperable with competitive technologies said the company still hopes to strike a Linux pact with Red Hat similar to the partnerships it's forged with Linux vendors Novell, Xandros, and Linspire. "We'd love to do the same deal with Red Hat," said Tom Robertson, general manager of corporate interoperability and standards at Microsoft in an interview Friday. "We're always open to talking with them." That sentiment so far has not been the same on Red Hat's end, as the company has said it's not interested in a deal. Red Hat spokeswoman Leigh Day said Friday that is still the case. "We continue to believe that open source and the innovation it represents should not be subject to an unsubstantiated tax that lacks transparency," she said in an e-mail. Still, some wonder -- as Microsoft lines up the other Linux ducks in a neat little row -- if Red Hat might be next, and rumors suggest a pact might be imminent. Microsoft's latest Linux deal came Thursday in an intellectual property-sharing and interoperabilityÂ agreement with LinspireÂ that would shield the company's customers from Microsoft patent-infringement claims. The deal follows oneÂ struck by Microsoft and Linux distributor XandrosÂ last week, as well asÂ a high-profile and financially significantÂ deal with NovellÂ late last year. Microsoft has said it is seeking these partnerships for a couple of reasons. The one Robertson is most interested in is interoperability, as he -- along with Jean Paoli, general manager, interoperability and XML architecture -- is in charge of Microsoft's 18-month company-wide strategy in this area. Robertson said Microsoft customers have demanded the company address interoperability issues with other companies' software, including open source, and that IP (intellectual property) in those products is a concern for them. "If you look across the industry, you see companies working together to address IP on behalf of their customer base," he said. Microsoft has publicly said that Linux and other open source softwareÂ violates 235 of the company's patents. But rather than seek litigation as a way to settle these IP claims, Microsoft is striking these individual deals, Robertson said. However, much has been made of the fact that the company has not publicly disclosed any of the patents it claims open source software is violating. Robertson would not address why Microsoft will not show its patents and stopped short of claiming the deals with Novell, Linspire, and Xandros prove those companies are indeed violating Microsoft IP. None of the Linux companies will say so, either, and Novell in fact has vehemently denied infringement. This discrepancy is one reason some feel Red Hat will never sign up for an indemnification deal with Microsoft. The size and business viability of the companies that have signed on is another. Novell was flagging when its deal was struck -- and the company has continued to wane even since -- and some familiar with how it happened said it was a bailout to save the vendor from being split up and sold piecemeal. Indeed, Novell's U.S. Securities and Exchange Commission filing about the deal revealed that Novell got $348 million up front from Microsoft for patent cooperation and Linux coupons, while having to shell out only $40 million to Microsoft in return. Though Microsoft will not comment on the financial terms of deals with Xandros and Linspire, those familiar with the agreements said those companies also received financial compensation from Microsoft. This begs the question that if interoperability and protecting customers are Microsoft's ultimate goals for the deals, as Robertson said, why is the company so interested in Linux companies that ultimately don't affect that many customers? Many -- particularly those in the Linux camp -- suspect Microsoft is trying to make it appear that open source distributors are violating Microsoft IP to vilify them in an effort to dissuade customers from using Linux and other open source technologies. Bruce Perens, a longtime Linux and open source advocate, said Microsoft is giving Linux companies that are on the edge of going out of business money to create the illusion that Linux vendors are stealing its IP. Perens is a vice president at SourceLabs, a company that provides testing, management, and certification of open source software to users. "Here is Microsoft out collecting the losers in the Linux business and paying them money so they can ... paint open source as music pirates out there using Microsoft technology without a license," he said. "I think they're out to scare people." Even if this is the case, it take two to tango, and it's important to note that companies such as Novell, Linspire, and Xandros benefit in various ways from their deals with Microsoft. Aside from any financial compensation, the companies also gain access to Microsoft technology that would make their own Linux products more viable in the marketplace, analysts said. "These companies want the deals with Microsoft because it will make the products more attractive and more compatible with the Windows world," said Michael Silver, an analyst with Gartner. "It's pretty clear that there is definitely value for these companies."
584817
Will a trifecta try at fixing Internet Explorer patch be the charm?
355465
Unload update stars in weekend patch release Firefox users need to update their browser software following the discovery of multiple vulnerabilities.â¦