RE: [Full-Disclosure] IE is just as safe as FireFox

From: Todd Towles (toddtowles_at_brookshires.com)
Date: 11/16/04

  • Next message: Gadi Evron: "Re: [Full-Disclosure] IRC spying on EEYE!" 
    To: "joe" <mvp@joeware.net>, <full-disclosure@lists.netsys.com>
Date: Tue, 16 Nov 2004 08:19:06 -0600

    I agree with you, maybe good coding was the wrong word. But you got the
    idea.

    IE isn't part of the OS in Microsoft mind...but it is in the customers.
    You get a new computer and you hear on the TV, not to use IE...because
    it has holes. A good customer does the right thing and gets another
    browser and uses that. Not knowing that Outlook and IE problem can hurt
    them anyways. Microsoft doesn't show separate to the customer - why?
    Because they people believe want stuff all connected together, which is
    true. Most of the customers don't see what is happening and it takes
    professional like us to get the ball rolling...to protect them and us.

    Microsoft made a bold step by changing security in SP2. It was going to
    break stuff...and it was stupid to see people yell about that. They told
    us it would, we knew it would. I am glad to see they are starting to
    take steps toward a better systems, but Microsoft has room for
    improvement to say the least.

    > -----Original Message-----
    > From: full-disclosure-admin@lists.netsys.com
    > [mailto:full-disclosure-admin@lists.netsys.com] On Behalf Of joe
    > Sent: Monday, November 15, 2004 1:26 PM
    > To: full-disclosure@lists.netsys.com
    > Subject: RE: [Full-Disclosure] IE is just as safe as FireFox
    >
    > > Everytime a Firefox exploit comes out..there is already a fix...
    > > is that magic? No..it is good coding...
    >
    > What?
    >
    > Having a quick fix out is due to low complexity of issue and
    > assisted by a lack of dependencies so you have reduced time
    > for patching and testing. It has nothing to do with code
    > quality. I have seen some extremely good code that hit an
    > issue that took long periods of time to correct due to the
    > complexity of the issue with all of the requirements that had
    > to be stacked up to cause an issue. I have also seen crappy
    > code that could be pretty quickly patched up for various
    > things and often contributed to how crappy it was. Again,
    > code quality and time to patch has nothing to do with each
    > other except if you had great code you wouldn't even have to
    > worry about exploits and patching. Great code, IMO, requires
    > 100% assertions of all incoming data and NO ONE does that.
    > Programmers assume that incoming data will fit in a specific
    > range and go with it. At some point we as developers (some
    > earlier than others) learned that we should at least be
    > checking for data length though that still isn't the full
    > assertion that should be done on the quality and state of the
    > data. One reason for not doing a full assertion is for future
    > flexibility, don't check the data too close so you don't have
    > to recompile for a new use. Mostly it is done because coders
    > just don't think someone will do something so off the wall or
    > are too lazy or too pressed for time to care.
    >
    >
    > Saying that, I agree, as I have stated many times on this
    > list, that IE needs to be backed down. If there has to be
    > some piece of it that absolutely has to be in the OS it
    > should be a very basic very small very simple hello world
    > basic HTML only rendering capability - you get fonts and
    > anchors and not much more - it isn't even possible to execute
    > anything even if the user agrees with a signature in blood.
    > The code being tiny and truly a part of the OS in that it
    > isn't possible to upgrade it to IE version x. It is updated
    > with OS updates. Code so small and tight and well controlled
    > and understood and practically memorized by the developers
    > that MS could put a monetary guarantee behind the ability to
    > exploit it. Say HTTP-EQUIV gets $10 million if he finds a way
    > to crack it and run remote exploit code with a realistic POC.
    >
    > If someone wants a full function IE, they load that
    > separately an dit runs in a sandbox as guest. Personally I
    > never agreed that IE was truly part of the OS. There are some
    > artificial dependencies built in for some of the display
    > stuff like help, etc but NTFS and threading and all of that
    > works just fine without IE.
    >
    > If pulling IE out of the Explorer shell is too difficult.
    > Then I for one would be fully behind a new secure type shell
    > replacement for the Explorer Shell. We had ProgMan Shell for
    > several years then we got the Explorer Shell. Maybe it is
    > time to get a new shell, at least for servers.
    >
    > I was recently in Redmond and the message I kept feeding back
    > over and over again was that we needed a way to not have to
    > load IE onto machines. I am looking to moving forward ideas.
    > If they give me the ability, I am not going to whine why I
    > can't do the same on Win9x or 2K or even XP. So many people
    > bitch on this list about MS supporting legacy stuff and then
    > they or someone else starts bitching that MS isn't back
    > porting the changes. Pick one or the other but keep in mind
    > if things have to keep getting back ported, resources for
    > that aren't moving us forward. I myself, would rather move forward.
    >
    > joe
    >
    >
    >
    > -----Original Message-----
    > From: full-disclosure-admin@lists.netsys.com
    > [mailto:full-disclosure-admin@lists.netsys.com] On Behalf Of
    > Todd Towles
    > Sent: Friday, November 12, 2004 10:10 AM
    > To: Rafel Ivgi, The-Insider;
    > full-disclosure@lists.netsys.com; Colin.Scott@csplc.com
    > Subject: RE: [Full-Disclosure] IE is just as safe as FireFox
    >
    > <SNIP>
    > Everytime a Firefox exploit comes out..there is already a
    > fix...is that magic? No..it is good coding...
    > <SNIP>
    >
    > _______________________________________________
    > Full-Disclosure - We believe in it.
    > Charter: http://lists.netsys.com/full-disclosure-charter.html
    >

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Gadi Evron: "Re: [Full-Disclosure] IRC spying on EEYE!"

    Relevant Pages

    • Re: needs automated clean-up tool [Re: Office 2007 beta uninstall]
      ... for both us and the customers. ... to get rid of every trace of Office 2007 beta, but that wastes a great deal ... We really have to wonder if any of those representing the Microsoft line on ... Why is it so hard to understand that we expect the Microsoft installation ...
      (microsoft.public.office.setup)
    • Re: How much is to much? Why should my clients have to pay again?
      ... > clients have had a problem with this new fangled validation tool. ... Microsoft, hear me: MOST PEOPLE DO NOT READ THE NEWS ABOUT PC ... > I assume you mean you have had customers complaining they could not ... > I don't know how you billed each one $200 (what did you do to fix the ...
      (microsoft.public.windowsupdate)
    • A vote for bringing back classic menus as an option
      ... the power of a PC and result in a nice ROI for my small business customers. ... but I feel strongly that the Ribbons are NOT easier to ... If Microsoft cares, my findings amongst family, friends, and customers is ... Ribbons are easier/slicker/wonderful for some folks, but for us folks here in ...
      (microsoft.public.office.misc)
    • Re: Internal GameStop memo all but confirms 360 price drop coming August 8th 2007.
      ... "That's a Sony parlor trick and Microsoft doesn't bullshit their ... I didn't say Microsoft was a good guy.... ... bullshit their customers. ...
      (alt.games.video.xbox)
    • Re: lets vote for better security
      ... How many times have you been said linux ... this is a ploy to lie to customers. ... > A frequent Microsoft explanation for why they did something a certain way ... It was found that all browsers except IE ...
      (microsoft.public.security)
    • Quantcast