Sneaky Microsoft plug-in puts Firefox users at risk

"Computerworld - An add-on that Microsoft silently slipped into Mozilla's Firefox last February leaves the browser open to attack, Microsoft's security engineers acknowledged earlier this week.

One of the 13 security bulletins Microsoft released Tuesday affects not only Internet Explorer (IE), but also Firefox, thanks to a Microsoft-made plug-in pushed to Firefox users eight months ago in an update delivered via Windows Update.

"While the vulnerability is in an IE component, there is an attack vector for Firefox users as well," admitted Microsoft engineers in a post to the company's Security Research & Defense blog on Tuesday. "The reason is that .NET Framework 3.5 SP1 installs a 'Windows Presentation Foundation' plug-in in Firefox."

The Microsoft engineers described the possible threat as a "browse-and-get-owned" situation that only requires attackers to lure Firefox users to a rigged Web site."

Read the full story by Gregg Keizer

Microsoft may have known about critical IE bug for months

Researchers uncovered latest bug in 2007; Microsoft mum on timing

The vulnerability that sent Microsoft scrambling yesterday and is being used by hackers now to attack Internet Explorer (IE) users may have been reported 18 months ago or more.

In the security advisory it issued yesterday, Microsoft credited a pair of researchers -- Ryan Smith and Alex Wheeler -- with reporting the bug. Smith and Wheeler once worked together at IBM's ISS X-Force, although Wheeler now is at Texas-based 3Com's TippingPoint DVLabs.

Wheeler confirmed that he and Smith uncovered the vulnerability, but he gave most of the credit to Smith. Wheeler declined, however, to say when the bug was reported to Microsoft. "I don't feel comfortable talking about that," he said, citing a non-disclosure agreement related to the vulnerability that he signed at the time. Instead, he steered questions to his former employer, ISS X-Force.

Wheeler suggested switching browsers. "Unless they're specially configured, other browsers will face substantially lower risk," said Wheeler. Browsers such as Mozilla's Firefox, Google's Chrome and Apple's Safari don't rely on ActiveX technology to drive add-ons, as does IE.

Read the full Computerworld story by By Gregg Keizer

Firefox 3.5 released, ready to "upgrade" the Web

"Mozilla has officially released Firefox 3.5, the next major version of its popular open source Web browser. Ars takes a close look at the new version and evaluates its enhancements. Support for HTML 5 video and other important emerging Web standards make this one of the most significant Firefox releases ever.

Mozilla has announced the official release of Firefox 3.5, the next major version of its popular open source Web browser. The new version boosts performance, introduces useful new features, and delivers strong support for emerging Web standards.

Mozilla aims to "upgrade the Web" by improving the Firefox user experience and expanding the range of tools that are available to Web developers. The company boasts that Firefox 3.5 includes over 5,000 enhancements that span nearly every aspect of the browser's functionality and behavior. Among the most compelling advancements in this release is support for the HTML 5 video element, which enables native video playback in the browser without requiring proprietary plugins such as Flash."

Read the full story at arstechnica.com.

A desperate Microsoft preps auto IE8 update amidst dramatic usage share decline!

As IE8’s adoption rates lag far behind initial expectations, Microsoft prepares its most powerful tool to push the browser out to user computers. The company said that it is preparing an Automatic Update/Windows Update targeting IE6 and IE7 users, which make currently make up about 93% of the IE user base. The update will be published in the third week of April. And we wonder: Can it slow the rapid decline of IE market share?

read more | digg story

IE 8 is sloooooow!

"In the interest of broadening my horizons, I promised Microsoft I'd give Internet Explorer 8 a fair shake by trying the browser as my default for a week.

And, boy, am I glad that week is over.

Microsoft's browser rules the roost with about two-thirds of the market, according to Net Applications, which collects a broad set of data on which browsers people use. There's nothing like being built into the dominant operating system for winning a popularity contest."

Read the full CNET review

Browser Battle: Nine Browsers of Today and Tomorrow Compared

Anyone who may have thought the death of Netscape would signal the end of the browser wars, boy were they mistaken. In fact, it could be argued that it was at that point it all began. It didn't take long for Mozilla's Firefox to emerge from Netscape Navigator's ashes, and over time, Firefox would win over enthusiasts with a potent combination of speed, security, and an unprecedented level of customization.

But what started as a two-man battle is quickly growing into all-out warfare. Prepare to be overwhelmed by an onslaught of new browser releases in the coming months as Microsoft, Mozilla, Apple, Opera Software, and Google all vie to provide your vehicle for navigating the web. Each one brings something new to the table, whether it be blazing fast performance or a unique feature-set. Don't worry if you haven't been paying attention - we jump in the trenches with whole lot of them and get to know each one on a personal basis.

read more | digg story

Apple Announces Safari 4 - The World's Fastest Browser

CUPERTINO, Calif., Feb. 24 /PRNewswire-FirstCall/ -- Apple® today announced the public beta of Safari® 4, the world's fastest and most innovative web browser for Mac® and Windows PCs. The Nitro engine in Safari 4 runs JavaScript 4.2 times faster than Safari 3.* Innovative new features that make browsing more intuitive and enjoyable include Top Sites, for a stunning visual preview of frequently visited pages; Full History Search, to search through titles, web addresses and the complete text of recently viewed pages; Cover Flow®, to easily flip through web history or bookmarks; and Tabs on Top, to make tabbed browsing easier and more intuitive.

"Apple created Safari to bring innovation, speed and open standards back into web browsers, and today it takes another big step forward," said Philip Schiller, Apple's senior vice president of Worldwide Product Marketing. "Safari 4 is the fastest and most efficient browser for Mac and Windows, with great integration of HTML 5 and CSS 3 web standards that enables the next generation of interactive web applications."

Safari 4 is built on the world's most advanced browser technologies including the new Nitro JavaScript engine that executes JavaScript up to 30 times faster than IE 7 and more than three times faster than Firefox 3. Safari quickly loads HTML web pages three times faster than IE 7 and almost three times faster than Firefox 3.*

Safari 4 is a public beta for both Mac OS® X and Windows and is available immediately as a free download.

read more | digg story

IE slips further as Firefox, Safari, Chrome gain

Internet Explorer now has 67.55 percent of global browser market share, a drop of over seven percentage points in a year, according to figures from Web metrics company Net Applications, released Monday. Mozilla's Firefox browser, meanwhile, has gained market share in the same time frame, climbing over three percentage points to 21.53 percent.

Microsoft's browser has steadily lost ground to its competitors in the past year. Its share dropped sharply in both October and November 2008, when it lost over one percentage point in each month.

Apple's Safari browser now stands at 8.29 percent, up from 7.13 percent in November, when IE dipped. Safari has gained share more quickly than Firefox in that period: Mozilla's browser accounted for 20.78 percent of browser use three months ago, and now has 21.53 percent.

read more | digg story

Convenience is number one factor in keeping browsers updated

A crawl through Google's search logs reveals that end users are generally oblivious to security alerts, and largely update to secure browser versions based on the convenience of doing so.
By John Timmer

The security community has long had a tendency to focus on the identification and repair of vulnerabilities. There have been significant public debates about the ethics of publicly discussing unpatched vulnerabilities, and coders will happily brag about their ability to have a fix ready immediately after a vulnerability is disclosed. A new study by a pair of Swiss academics and a Googler, however, suggests that much of this focus has been misdirected. They argue that the ergonomics of the end-users' update process has a far more significant effect on the adoption of secure web browsers than any discussion of the severity of a vulnerability.

The authors reached their conclusions thanks to the presence of the Google employee on their team. That got them access to the anonymized search logs for use as their base data set. Since many of these requests come from shared IP addresses and proxies, the authors combined them with a unique ID in Google's PREF setting to distinguish individual end users. Although this ignores users of other search services, three of the four browsers sampled default to using Google. The authors also realize that this probably eliminates the most security conscious of web browsers--those searching anonymously and with cookies disabled--and those with User Agent strings that identify their browsers as something other than what they are. They suspect that this is a small minority.

Read On

Firefox to get massive JavaScript performance boost

Mozilla is leveraging an impressive new optimization technique to bring a big performance boost to the Firefox JavaScript engine. They are "getting ready to take JavaScript performance into the next tier" with a radically innovative optimization tactic called tracing that has already produced performance improvements ranging between 20 and 40 times faster in some cases. The code was merged today (but is not yet ready to be enabled by default in the nightly builds) and is planned for inclusion in Firefox 3.1, the next incremental update of the open-source web browser.

read more | digg story

IE To Get Privacy Mode

Microsoft is planning a "privacy mode" for the next release of its Internet Explorer (IE) web browser. By clicking a button, users of IE8 will be able to limit how much information is recorded about where they go online and what they do. By comparison Apple's Safari browser already has a privacy mode and developers working for Mozilla, creators of Firefox, are reportedly working on a similar feature for future versions.Other browsers, such as Xerobank, take a more thorough approach to privacy and try to anonymise all web use.

read more | digg story

What Actually Happens When You Hit Those StumbleUpon Buttons

Have you ever wondered what is going on in the backend when you click on that tempting little blue and green StumbleUpon button in your toolbar? Chief architect and co-founder Garrett Camp lets on to the SU algorithm and hints at a couple of upcoming changes. StumbleUpon is all about site discovery. I used to click on the “Stumble!” button and figured it would return me some random site based on the categories I said I was interested in. But then I noticed that the more I used it, better sites were being sent my way. This is because it’s not actually random, but rather sites are served up based on a series of processes that go on within the StumbleUpon Recommendation Engine.

read more | digg story

Firefox Users Most Secure on Internet, Study Reveals

"Mozilla Firefox fans might rest a little easier these days after a study released Tuesday revealed that its users are most secure on the Internet. Altogether, the study found that less than 60 percent (59.1) of people use up-to-date, fully patched Web browsers. Failure update browsers exponentially increases the chance for remote attacks executed by hackers, the study found. Firefox users were far and away the most likely to use the latest version, with an overwhelming 83.3 percent running an updated browser on any given day. However, despite Firefox's single click integrate auto-update functionality, 16.7 percent of Firefox users still continue access the Web with an outdated version of the browser, researchers said.The study also revealed that the majority of Safari users (65.3) percent were likely to use the latest version of the browser between December 2007 and June 2008, after Safari version 3 became available. Meanwhile, Microsoft (NSDQ:MSFT)'s Internet Explorer users ranked last in terms of safe browsing. Between January 2007 and June 2008, less than half of IE users -- 47.6 percent -- were running the most secure browser version during the same time period. Opera ranked slightly higher than IE, with about 56 percent of users who said that they have applied the latest version of the browser to their computer. Of the four browsers surveyed, Opera ranked last in popularity, with a just 11 million users that comprise .8 percent of the marketshare."

read more | digg story

Why You Should Download Firefox 3 Right Now

"Firefox 3 — the culmination of a two-year quest to build the best browser ever. And while it’s not perfect, it comes pretty close. It’s faster than Microsoft Internet Explorer, but it’s not the fastest browser in the world — depending on who you ask, either Safari on the Mac or Opera 9.5 claims that crown. Firefox 3 is also incomplete by design — users can customize the browser, adding additional bells and whistles through downloadable extensions (see our list of recommended extensions for some ideas). "

read more | digg story

Chris | Live Tech Support | Video Help | Add to iTunes

Hackers Now Target Firefox and Safari

Many people are switching from Internet Explorer to alternative browsers such as Firefox and Safari. Though that might make them feel more secure, the shift has also opened new doors for bad guys. In a somewhat dubious recognition of Firefox's growing popularity, hackers have focused their attention on it, leading to a rash of newly discovered holes. The folks at Mozilla recently released two Firefox updates in less than six weeks, fixing a total of five critical security vulnerabilities. All five can be exploited by planting a poisoned JavaScript file in a Web site and waiting for you to stumble across it.

read more | digg story