An interesting fact to keep in mind regarding browsers is that while Mozilla
and Firefox make new builds available daily Microsoft hasn't released a new
version of IE snce October of 2001 - over 3 years ago. So in large part the difference
between IE and the gecko based browsers (Mozilla, Firefox, etc.)
is one of legacy software versus a modern implementation.
Those who think that IE has so many security problems simply because
it's used by most newbies and is therefore a good target don't understand
anything about how any major browser is programmed. Microsoft wasn't kidding
when the repeatedly told the court that IE was deeply intertwined with
the core of their operating system and couldn't be completely removed without
removing Windows itself. Around 1995-96 Microsoft realized that they couldn't stop
the internet explosion so they decided that "the system is the net".
They integrated local file management (Windows Explorer)
with Internet retrieval (Internet Explorer).
They made it so URLS could be used wherever pathnames
were expected (as best they could).
The desktop became a web page, rendered by IE.
All of your Explorer views like My Computer and customized
folder views are web pages, with lots of VBScript.
This was a revolutionary idea, blending the net with the local system
in such a way that whenever possible the two were indistunguishable.
It was incredibly powerful idea. It allowed programmers
to do all sorts of things. Most of those were bad things, unfortunately.
You really _DO_ need to disnguish between whether an
executable is located on the local system or if it's on same
strange web site before you run it. You don't want an imperfection
in the browser to give a web page unfettered access to
"the core of the Windows system". Since 1996 Microsoft has been
trying to find ways to detect and stop abuses of this "the net is the system"
concept. The hackers have been winning that game.
Firefox, Mozilla, etc. just display web pages. They aren't "the system".
A bug in Mozilla means that a hacker might be able to take
over a web page. A bug in IE strikes at the core of the OS,
as Microsoft representatives testified to repeatedly, and allows the
attacker to take over the system.
|