RE: [Full-Disclosure] (IE/SCOB) Switching Software Because of Bugs: Some Facts About Software and Security bugs

["Drew Copley" <dcopley@xxxxxxxx>]

Look, it was a long paper, and some people may get the
wrong idea about what I am saying, so let me briefly note:

-> You probably should change browsers because of the way
Microsoft is fixing their bugs right now
-> All applications have bugs, yes, Internet Explorer has
a huge "landscape", but so does Mozilla, remember
-> All I am saying is: Don't think other software is
secure just because its' competition had bugs found in
it. 

I often see people recommending this when large bugs
are found in competing software. It totally bypasses
the fact that people find these bugs, the software does
not make it easy. It may appear easy to find these bugs,
the researchers may make it look easy: but, why then can
not anyone else find them.

The researchers should get some credit, even if they
tend to not give themselves any.

The whole concept of bugfinding as the core of security
is completely removed from the public's understanding
of research. When they do think of a "hacker", they think
of script kiddies that run things others made.

That is my motivation for saying these things. Educational
references. 

> -----Original Message-----
> From: Ron DuFresne [mailto:dufresne@xxxxxxxxxxxxx] 
> Sent: Wednesday, June 30, 2004 3:14 PM
> To: Drew Copley
> Cc: ntbugtraq@xxxxxxxxxxxxxxxxxxxxxx; 
> bugtraq@xxxxxxxxxxxxxxxxx; full-disclosure@xxxxxxxxxxxxxxxx
> Subject: Re: [Full-Disclosure] (IE/SCOB) Switching Software 
> Because of Bugs: Some Facts About Software and Security bugs
> 
> 
> 
> The mere fact that mozilla or firefox or netscape are not 
> core components
> of the windows OS is actuallky reason enough to choose to change
> browsers, despite the bad hype and bug researchers with a 
> thing against m$
> and all the rest of the gunk.
> 
> Thanks,
> 
> 
> Ron DuFresne
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> "Cutting the space budget really restores my faith in humanity.  It
> eliminates dreams, goals, and ideals and lets us get straight to the
> business of hate, debauchery, and self-annihilation." -- Johnny Hart
>       ***testing, only testing, and damn good at it too!***
> 
> OK, so you're a Ph.D.  Just don't touch anything.
> 
> 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html