There’s been a lot of discussion lately on whether Firefox is really more secure than Internet Explorer, or whether it’s only security is because it’s a less targetted browser.

It will take a lot of evidence for someone to ever convince me that Internet Explorer is more secure. There’s a lot of studies that try to accurately measure the security based on the number of patches, the time it takes for a vulnerability to be patched, etc. There’s a couple of factors that are almost always overlooked:

1. Microsoft patches are usually for multiple vulnerabilities — If you look at the details of most microsoft IE patches, you’ll see a single patch rolls up fixes for a half dozen or so vulnerabilities usually. Many studies never bother to crack the seal and only count that as one vulnerability.
2. Microsoft has a history of long patch times — Don’t take my word for it, go look at eeye’s unpatched vulnerability page. In case Microsoft actually fixes some of the patches, let me highlight for you the top few items on that page:
3. Internet Explorer and Outlook
   • Remote exploit - minimal user interaction - 188 days
   • Remote exploit - minimal user interaction - 151 days
   • Remote exploit - minimal user interaction - 146 days
4. Windows
   • Priviledge escalation - not so serious - 133 days
   • The mother of all of them, the holy grail, remote exploit in default installations of Win2k, XP, and 2k3 - 87 days

Yup, that’s right. For nearly three months there has been a remote vulnerability of the sort to for ISC drop to Infocon Purple. And that’s just ONE security research company. Granted, they’re one of the most knowledgeable and skilled, but I find it hard to believe there aren’t other companies with similar vulnerabilities just waiting announcement.

You find me a single remote exploit in a default install of any of the BSD’s that remained unpatched for more than 30 days and I’ll buy you a lunch.

Posted by Jordan on Monday, October 3rd, 2005 at 11:35 am.