Re: Newsgroup

From: Wirt Atmar (atmar_at_aics-research.com)
Date: 01/30/05


Date: Sun, 30 Jan 2005 15:30:10 -0500 (EST)

Phil writes:

> I've used Netscape and its newsreader for over a decade now, and one of
> the benefits is that its based on Mozilla, an open source program which
> many very smart programmers have collectively worked on over the years.
> The result is that, at least according to my computer geek friend, it
> is far more immune to viruses and the like than Microsoft programs.

And in that same regard, dkomo writes:

> I caught a major adware infection this week surfing the Web with
> Internet Explorer. That program is a piece of crap in terms of
> security. It allows "drive-by installs" of some very noxious malware.
> If you are unlucky enough to surf to an unfriendly web site, your
> computer is infected in a matter of seconds before you can even react.
>
> As I clean up my computer, I've continued to web surf using the
> Netscape browser and bypassing the installed adware.

As odd as these comments sound to the topic of the group, they're
actually very much on-topic. You hear these kinds of things constantly
among users, and while they're true to an extent, it's also important to
understand their context because they're not true as to their general
thrust: that is, IE is more poorly engineered than the other browswers.

Up until recently, Internet Explorer represented well over 80% of the
browser population in use, and as a consequence it suffered the same
slings and arrows of all monocultures: a vigorous attack by pathogens.

It is my understanding that all of the popular browsers (IE, Netscape,
Mozilla, Firefox, Safari, etc.) share a common phylogenetic history.
That is, they're all based on the original Mozilla project. But because
of the popularity of IE, it has been singled out for special attack.
Where there are eyeballs, it's believed that there's money to be made,
and in that regard, venture capital organizations in Silicon Valley have
invested more than $140 million dollars in developing adware (what you
call "malware") to worm its way into Internet Explorer.

A list of some organizations investing in this adware/spyware can be
found at:

      http://www.benedelman.org/spyware/investors/

We develop software here, but our most expensive project to date has
consumed only $4 million investment over a 15-year time span. The
majority of our projects are completed for a few hundred thousand
dollars. I can say with some certainty that if we had $140 million
dollars to develop similar software we could bring anything to its knees.

Software is the most complex machinery we as a society have ever built,
and if there are complexities in any process, there are inherent
vulnerabilities as well. You can be assured that the other browsers are
just as vulnerable. They've been spared this level of intense interest
only because of their relative rarity up to now, but as their frequency
rises they too will become targets of interest and thus will become
subject to this same form of density-dependent selection. It's exactly
this process that has been argued by Wills et al. (1997) to maintain
species diversity in the tropical forest:

"Strong density- and diversity-related effects help to maintain tree
species diversity in a neotropical forest." Wills et al. (Proc. Natl.
Acad. Sci. USA Vol. 94, pp. 1252-1257, February 1997 Ecology)

      http://www.pnas.org/cgi/content/full/94/4/1252

In this argument, no single species can come to be dominant simply
because once it does, it is attacked by a "rain of pathogens," thereby
reducing or curtailing its capacity to spread, allowing secondary and
tertiary species, which are not yet under attack, to temporarily prosper
in the wake of the troubles of the primary species.

Wirt Atmar



Relevant Pages

  • OT: question about HTTP headers
    ... I also tried installing the Win32 Mozilla in WINE, ... WINE and the site would actually believe that it was a Win32-base browser. ... I used wget to download the two .asp scripts that run when you first bring up the page, but I could not find in the browser identification code where this particular information was pulled from. ...
    (Debian-User)
  • Re: Inexpensive WYSIWYG HTML editor?
    ... principal driving force behind Mozilla's Composer. ... abandoned further development of the Mozilla Suite, ... to code validation. ... a properly designed browser is NOT what you get in Internet Explorer. ...
    (comp.sys.mac.apps)
  • Re: Mozilla Firefox
    ... I tried it and quickly realised it is the best browser around. ... > isn't as feature rich as Mozilla, ... Like I said, I don't like Firefox, I just use it ... - The vulnerability has been confirmed in Mozilla 1.7.3 and Mozilla ...
    (microsoft.public.windows.inetexplorer.ie6.browser)
  • [Full-Disclosure] Race conditions in security dialogs
    ... I discovered arbitrary code execution holes in Mozilla, ... and Opera that involve human reaction time. ... Another form of the attack involves convincing the user to double-click ... but it's frustrating for users who install extensions often. ...
    (Full-Disclosure)
  • RE: [Full-Disclosure] Re: shell:windows
    ... After my initial question I see that IE isn't a big issue like Mozilla was. ... I think it could be used in an attack. ... Maybe it's not the shell: command itself that is an issue. ... Full-Disclosure - We believe in it. ...
    (Full-Disclosure)