Myth's v. Reality ...
Does Firefox have less security issues due to popularity? Sure!
But if Firefox was just as popular as MS IE, which would have more issues?
MS IE, by far!
In fact, Microsoft often classifies many MS IE security issues as general Windows platform or MS Outlook/Outlook Express issues. That's because it's inherit flaws with the Windows executive or Outlook automation that are the ultimate culprit.
One thing I have to consistently point out is not only how fast the Mozilla team addresses Firefox issues, but they do not consider a single issue not worth fixing. Microsoft is horrendous when it comes to "downplaying" an issue or "passing the buck" to something they can't fix or change.
The other thing I point out is that with Firefox, you can turn off Java, Javascript and countless other things and completely remove various points of script entry (and Extensions like PrefBar make that easy with a checkbox). With MS IE, even if you disable Java, Javascript or ActiveX, you still don't actually disable it. Even MS IE 7 still allows various Java, Javascript and ActiveX components to run because they are required for basic Windows/Outlook functionality/automation -- and they would break the OS and/or MS Office Suite if they didn't.
MS IE has been an issue ever since Microsoft embedded MS IE in the core components of Visual Studio 5 on-ward. I.e., every single Windows program built with Visual Studio since the mid-to-late '90s has required select MS IE components to function. And the majority of these capabilities were built on the assumption that the user has complete access and control over the OS -- 0 privilege separation. That was a no-no in the 1970s on UNIX, but apparently Microsoft considered it optional in the 21st century (until 2002, and even then it took several major outbreaks and Fortune 100 companies to go down in 2003 before they actually changed their attitude).
Of course Firefox is best when run on Linux and not Windows. But even Firefox on Windows separates the browser from the OS. Sure, if you click something through and Firefox passes it onto the OS or some Windows association, you can still get into the exact same trouble as MS IE. But in almost every case, that either requires you to have select components enabled (e.g., Javascript) or, in the majority of cases, manually approve the handoff from Firefox to Windows -- as Firefox does its best to save you from doing something stupid in the Internet age.
Windows was never designed for the Internet, and its inherit design is to constantly and consistently do stupid things. Otherwise its standalone or LAN-focused features don't work, and things just don't work in the OS itself. Hence why MS IE -- as a part of that attitude -- continues the tradition. NT 6.0 Longhorn/Vista is a joke, because it hasn't change from its development roots. The .NET security model has been utterly ignored in NT 6.0 Longhorn/Vista.
Are there Myth's of Firefox? Sure!
Does Firefox have less security issues due to popularity? Sure!
But if Firefox was just as popular as MS IE, which would have more issues?
MS IE, by far!
In fact, Microsoft often classifies many MS IE security issues as general Windows platform or MS Outlook/Outlook Express issues. That's because it's inherit flaws with the Windows executive or Outlook automation that are the ultimate culprit.
One thing I have to consistently point out is not only how fast the Mozilla team addresses Firefox issues, but they do not consider a single issue not worth fixing. Microsoft is horrendous when it comes to "downplaying" an issue or "passing the buck" to something they can't fix or change.
The other thing I point out is that with Firefox, you can turn off Java, Javascript and countless other things and completely remove various points of script entry (and Extensions like PrefBar make that easy with a checkbox). With MS IE, even if you disable Java, Javascript or ActiveX, you still don't actually disable it. Even MS IE 7 still allows various Java, Javascript and ActiveX components to run because they are required for basic Windows/Outlook functionality/automation -- and they would break the OS and/or MS Office Suite if they didn't.
MS IE has been an issue ever since Microsoft embedded MS IE in the core components of Visual Studio 5 on-ward. I.e., every single Windows program built with Visual Studio since the mid-to-late '90s has required select MS IE components to function. And the majority of these capabilities were built on the assumption that the user has complete access and control over the OS -- 0 privilege separation. That was a no-no in the 1970s on UNIX, but apparently Microsoft considered it optional in the 21st century (until 2002, and even then it took several major outbreaks and Fortune 100 companies to go down in 2003 before they actually changed their attitude).
Of course Firefox is best when run on Linux and not Windows. But even Firefox on Windows separates the browser from the OS. Sure, if you click something through and Firefox passes it onto the OS or some Windows association, you can still get into the exact same trouble as MS IE. But in almost every case, that either requires you to have select components enabled (e.g., Javascript) or, in the majority of cases, manually approve the handoff from Firefox to Windows -- as Firefox does its best to save you from doing something stupid in the Internet age.
Windows was never designed for the Internet, and its inherit design is to constantly and consistently do stupid things. Otherwise its standalone or LAN-focused features don't work, and things just don't work in the OS itself. Hence why MS IE -- as a part of that attitude -- continues the tradition. NT 6.0 Longhorn/Vista is a joke, because it hasn't change from its development roots. The .NET security model has been utterly ignored in NT 6.0 Longhorn/Vista.
**** back for you :glugglug: