When Symantec reported serious vulnerabilities were being found faster in Firefox than in IE, many in the tech world anticipated a strong response to the report.
In the Symantec report, the security company said that Firefox had almost twice as many vulnerabilities than IE, and had more serious vulnerabilities during the first six months of 2005. Symantec noted that IE problems had greater impact due to the product’s widespread usage, and that Mozilla patched flaws faster than Microsoft.
Mozilla Europe president Tristan Ninot said in a ZDNet UK article that his organization does a better job at reacting to a problem and getting that solution to users. “If you look at our ability to respond, we are in much better shape,” he said. Regarding the IDN overflow problem: “Within ten days we had a newer version (of Firefox) that was fixed completely.”
“With Firefox – yeah, you have holes, but they’re much less serious. Which would you prefer, to have a broken finger, or your head ripped off?” Mr. Ninot said in the article, giving the tech world the quote of the day.
He further noted in the interview how many Microsoft vulnerabilities have languished in eEye’s database, which reports on the length of time between when a vulnerability gets reported and when it is patched. Microsoft addressed that issue during its monthly security webcast.
Mike Nash, Microsoft’s vice president for security business, discussed that topic:
“There are many factors that impact the length of time between the discovery of a vulnerability and the release of a security update, and every vulnerability presents its own unique challenges. Once the update is built, it must be tested with the different operating systems and applications it affects, then localized for many markets and languages.”
David Utter is a staff writer for Murdok covering technology and business. Email him here.
