Microsoft may have known about critical IE bug for months

Researchers uncovered latest bug in 2007; Microsoft mum on timing

The vulnerability that sent Microsoft scrambling yesterday and is being used by hackers now to attack Internet Explorer (IE) users may have been reported 18 months ago or more.

In the security advisory it issued yesterday, Microsoft credited a pair of researchers -- Ryan Smith and Alex Wheeler -- with reporting the bug. Smith and Wheeler once worked together at IBM's ISS X-Force, although Wheeler now is at Texas-based 3Com's TippingPoint DVLabs.

Wheeler confirmed that he and Smith uncovered the vulnerability, but he gave most of the credit to Smith. Wheeler declined, however, to say when the bug was reported to Microsoft. "I don't feel comfortable talking about that," he said, citing a non-disclosure agreement related to the vulnerability that he signed at the time. Instead, he steered questions to his former employer, ISS X-Force.

Wheeler suggested switching browsers. "Unless they're specially configured, other browsers will face substantially lower risk," said Wheeler. Browsers such as Mozilla's Firefox, Google's Chrome and Apple's Safari don't rely on ActiveX technology to drive add-ons, as does IE.

Read the full Computerworld story by By Gregg Keizer

IE 8 is sloooooow!

"In the interest of broadening my horizons, I promised Microsoft I'd give Internet Explorer 8 a fair shake by trying the browser as my default for a week.

And, boy, am I glad that week is over.

Microsoft's browser rules the roost with about two-thirds of the market, according to Net Applications, which collects a broad set of data on which browsers people use. There's nothing like being built into the dominant operating system for winning a popularity contest."

Read the full CNET review

Browser Battle: Nine Browsers of Today and Tomorrow Compared

Anyone who may have thought the death of Netscape would signal the end of the browser wars, boy were they mistaken. In fact, it could be argued that it was at that point it all began. It didn't take long for Mozilla's Firefox to emerge from Netscape Navigator's ashes, and over time, Firefox would win over enthusiasts with a potent combination of speed, security, and an unprecedented level of customization.

But what started as a two-man battle is quickly growing into all-out warfare. Prepare to be overwhelmed by an onslaught of new browser releases in the coming months as Microsoft, Mozilla, Apple, Opera Software, and Google all vie to provide your vehicle for navigating the web. Each one brings something new to the table, whether it be blazing fast performance or a unique feature-set. Don't worry if you haven't been paying attention - we jump in the trenches with whole lot of them and get to know each one on a personal basis.

read more | digg story

IE slips further as Firefox, Safari, Chrome gain

Internet Explorer now has 67.55 percent of global browser market share, a drop of over seven percentage points in a year, according to figures from Web metrics company Net Applications, released Monday. Mozilla's Firefox browser, meanwhile, has gained market share in the same time frame, climbing over three percentage points to 21.53 percent.

Microsoft's browser has steadily lost ground to its competitors in the past year. Its share dropped sharply in both October and November 2008, when it lost over one percentage point in each month.

Apple's Safari browser now stands at 8.29 percent, up from 7.13 percent in November, when IE dipped. Safari has gained share more quickly than Firefox in that period: Mozilla's browser accounted for 20.78 percent of browser use three months ago, and now has 21.53 percent.

read more | digg story

Convenience is number one factor in keeping browsers updated

A crawl through Google's search logs reveals that end users are generally oblivious to security alerts, and largely update to secure browser versions based on the convenience of doing so.
By John Timmer

The security community has long had a tendency to focus on the identification and repair of vulnerabilities. There have been significant public debates about the ethics of publicly discussing unpatched vulnerabilities, and coders will happily brag about their ability to have a fix ready immediately after a vulnerability is disclosed. A new study by a pair of Swiss academics and a Googler, however, suggests that much of this focus has been misdirected. They argue that the ergonomics of the end-users' update process has a far more significant effect on the adoption of secure web browsers than any discussion of the severity of a vulnerability.

The authors reached their conclusions thanks to the presence of the Google employee on their team. That got them access to the anonymized search logs for use as their base data set. Since many of these requests come from shared IP addresses and proxies, the authors combined them with a unique ID in Google's PREF setting to distinguish individual end users. Although this ignores users of other search services, three of the four browsers sampled default to using Google. The authors also realize that this probably eliminates the most security conscious of web browsers--those searching anonymously and with cookies disabled--and those with User Agent strings that identify their browsers as something other than what they are. They suspect that this is a small minority.

Read On

Chrome gets a Mac deadline!

Stephen Shankland of CNET is reporting that "Showing signs that it's working to meet requests for new developments to its Chrome browser, Google on Friday said it hopes to release versions for Mac OS X and Linux by the first half of the year, and it released a new version Wednesday that paves the way for the most requested feature: extensions.

Google has high hopes for Chrome--in particular, the Internet giant wants better performance, so browsing the Web is faster and Web-based applications are more powerful. Now Google is filling in some missing pieces Chrome needs in order to attain wider usage.

Brian Rakowski, Chrome's product manager, said the company wants to release Chrome for Mac and Linux before the first half of 2009 is up."

Read the full article

Think Firefox 3 is fast? Try Firefox Minefield

After spending some time with Minefield, one thing is clear: the future of Firefox is fast. Lightning fast.

How fast? Some claim that it has the fastest javascript engine on the planet, which means it leaves Google's Chrome browser in the dust. In my own unscientific tests, I'd say that this assertion is correct. Ars Technica pegs Minefield as 10 percent faster than Chrome.

You can download the latest nightly build for Mac OS X, Linux, or Windows, but be warned: it's alpha code.

read more | digg story