Security threats Toolkit

Story: Firefox flaw sparks a fiery debate

Posted by: Arthur B. (Friday 7 January 2005, 9:51 PM)

According to http://www.securityfocus.com/bid the Vendor Mozilla with Title FireFox of Version 1.0 scores 3 vulnerabilities whereas Vendor Microsoft with Title Internet Explorer of Version 6.0SP2 (which means you run Internet Explorer on XP with SP2 fully installed; how many actually do?) scores 20 vulnerabilities.

For those of us who are interested in it. There's also the Open Source Vulnerability Database to research at http://www.osvdb.org

Or the US-CERT Vulnerability Notes Database at http://www.kb.cert.org/vuls

And there's also http://secunia.com/ which simply list Mozilla FireFox 1.x (http://secunia.com/product/4227/) with 5 Secunia Advisories rated as Moderately Critical and Microsoft Internet Explorer 6 (http://secunia.com/product/11/) with 75 Secunia Advisories rated as Extremely Critical.
Do compare the various pie charts that can be found there. And, for example, Secunia Advisory Release Date 2004-10-20 for both products.

Then remember the amount of R&D budget both vendors have available and how many years they've already been working on their own product (complete with user responces, test labs, etc). Then ask yourself the question: which product is more likely to give me the best overall security, availability, functionality, stability, etc compared to "value for money" today, next year, the year thereafter.

In my book the above means that FireFox is two steps ahead of IE in everything that matters. The price is right (I don't have to buy XP and then install SP2 to get the latest fix for IE; not even mentioning hardware and third-party product upgrades as a result of that), security problems are not only less but also less severe and resolved quicker, stability is way better as is performance and innovation speed is picking up speed. Clearly having the source available to many eyes has it is advantages.

As a tax payer I would hope (the above would be just one example of the reasons why) that the networks of various public services and government sites will opt for FireFox (or similiar; keep in mind the benefits of diversity) rather then an expensive upgrade to XP SP2 (only to be followed by yet another expensive upgrade to who-knows-what who-knows-when given Microsoft's actual release dates). I will certainly question the common sence (and personal agenda) of any political figure opting for the latter.