main
Report a problem

Firefox reaches Five, tops vulnerabilities list

Brad Sams   on 10 November 2009 - 18:17 · 35 comments & 5990 views

Advertisement (Why?)
This week marks five years since the public release of Mozilla Firefox 1.0. First available in beta form as "Phoenix" the browser was an open-source evolution of the rendering framework designed for Netscape Communicator and extended with the Mozilla Suite; an all-in-one web communications package that failed to gain the mindshare developers had hoped for.

The idea behind Firefox was to create a browsing experience that was faster, more user friendly, and more standards compliant in comparison to Internet Explorer, which had seen few improvements in quality or feature changes since it had become a de facto monopoly within the segment. With tabbed browsing, popup-blocking, and the ability to integrate add-ons created by third parties, Firefox brought together a number of features that most users had never seen and upon its launch saw an unpredicted amount of success, with 10 million downloads in its first month alone.

The success of Firefox since its launch has affected not only the way browsers are developed and released but also the way sites are coded on a basic level. Up until the surge in Firefox adoption, Internet Explorer was increasingly reliant on idiosyncratic rendering preferences, often ignoring standards and guidelines offered by the World Wide Web Consortium, or W3C. While some developing applications and sites for the internet chose to stick with the rules, many found themselves making sites that could only be properly viewed by IE, since it dominated the browser market so thoroughly. Once Firefox reached a significant presence even among non-technical users, this shift began to turn the other way. Though it had idiosyncrasies of its own, Firefox was so much closer to approved standards that other browsers on the market benefited as well, as sites that can only be viewed by one browser are now few and far between.

Mozilla's VP of Engineering Mike Shaver estimates that there may be as many as 350 million Firefox users, and an October 2009 report from Net Applications puts the product's market share at a little more than 24 percent. While Internet Explorer still has a significant lead with 65 percent, the effects of the competition between the two browsers is notable, with IE having adopted several of the key features made popular by Firefox, including tabbed browsing and a pop-up blocker. The rise of other browsers such as Apple's Safari and Google's Chrome can also be traced to Firefox's inroads.

Some might eat their orange and blue birthday cake with caution, as this week Firefox has been named the browser with the largest share of vulnerabilities for the first half of 2009, according to tech security firm Cenzic. The company performed an analysis of several major error databases to come to its conclusion, which was that Firefox had 44 percent of all browser vulnerabilities, with Safari coming in second with 35 percent and IE next with 15. Lars Ewe, Cenzic CTO, admits to using the browser personally and professionally and says the study does not mean the browser is inherently unsafe. Many of the issues were related to third party add-ons, the report did not differentiate zero-day bugs, and as always exposure to risk is often dependent on individual browsing habits.

Special thanks to RenaissanceMan for his contribution

Post a comment · Send to friend Comments · There are 35 additional comments
(5 replies) #1 +Chrono951 on 10 Nov 2009 - 18:48
It is important to note that the above article states that these problems are mostly related to 3rd party extensions. Not really Firefox's fault.

Anyway, Happy Birthday Firefox!
#1.1 Ci7 on 10 Nov 2009 - 19:37
i guess they should hurry up and sandbox the add-ons

electrolysis project i believe. soon enough hopefully
#1.2 HardSide on 10 Nov 2009 - 20:48
It is important to note that Internet Explorer vulnerabilities are mostly vulnerabilities to users that run ActiveX and turn off all warning messages.
#1.3 still1 on 10 Nov 2009 - 21:19
I would say IE8 is the best... FF has lot of vulnarabilities and people are getting fooled. I am going to switch back to IE8.
#1.4 Sub_Zero_Alchemist on 11 Nov 2009 - 01:43
still1 said,
I would say IE8 is the best... FF has lot of vulnarabilities and people are getting fooled. I am going to switch back to IE8.


IE 8 better than the past IE versions then yes, but being better than FF,Chrome,Opera,Safari then no. #2 Firefox may have a lot of vulnerabilities but Mozilla gets them fixed quicker and sends out the fixes faster depending on the severity of the security. and 3. people getting fooled? then it nobodies fault but their own.
#1.5 M_Lyons10 on 11 Nov 2009 - 02:53
Ci7 said,
i guess they should hurry up and sandbox the add-ons

electrolysis project i believe. soon enough hopefully


Sandboxing the addons sounds like a good idea. Maybe in Firefox 4? I don't know if there are any plans for that at the moment.
(2 replies) #2 Growled on 10 Nov 2009 - 18:58
Happy Birthday, Firefox. Firefox may have more vulnerabilities but I've never had any problems with it.
#2.1 M_Lyons10 on 11 Nov 2009 - 02:53
Growled said,
Happy Birthday, Firefox. Firefox may have more vulnerabilities but I've never had any problems with it.


Well, their vulnerabilities are patched faster than other browsers too. I like Firefox a lot personally.
#2.2 LoveThePenguin on 11 Nov 2009 - 06:56
Vulnerabilities does not mean virus/malware infections. I for one, have never had those problems with firefox, yet I've seen many infected systems due to IE and activex.
#3 Bero on 10 Nov 2009 - 19:45
HBD FF <3
(2 replies) #4 Pikey on 10 Nov 2009 - 21:37
according to tech security firm Cenzic


Who??
#4.1 M_Lyons10 on 11 Nov 2009 - 02:54
I thought I was just behind the times. I've never heard of them either.
#4.2 omni1 on 11 Nov 2009 - 03:06
M_Lyons10 said,
I thought I was just behind the times. I've never heard of them either.


Cenzic are a web application security company who serve much of the fortune 500... unless you are a security professional by trade you aren't likely to hear about the companies like this (though there are a myriad of them and are generally fairly respectable).

Greg Hoglund started the company.. you might have heard of him.

Edited for clarity.
#5 phdem on 10 Nov 2009 - 21:44
@Pikey +1!

However, hope they will consider this for version 3.6 since it's still in beta.. Happy Birthday Firefox!
(4 replies) #6 Raa on 10 Nov 2009 - 21:49
I'll stick to using IE thanks. And don't start bitching, you all love it
#6.1 M_Lyons10 on 11 Nov 2009 - 02:55
Yep. I love waiting 30 + seconds for a new blank tab to open...
#6.2 toadeater on 11 Nov 2009 - 03:10
M_Lyons10 said,
Yep. I love waiting 30 + seconds for a new blank tab to open...


I love the crashes.
#6.3 LoveThePenguin on 11 Nov 2009 - 06:59
Raa said,
I'll stick to using IE thanks. And don't start bitching, you all love it

You must love malware/viruses/key loggers huh?
#6.4 epple on 11 Nov 2009 - 14:33
Are you guys using IE6 or something? Nothing of what you've just said happens to me in IE8 when I use it.
(3 replies) #7 MaJoR on 10 Nov 2009 - 22:00
Neowin can't even celebrate Firefox's birthday without going on about some no name tech firm saying it is evil. Tisk tisk.

Every other tech site has the right idea: If you are going to do a birthday article just be nice. Don't put a "but" and then go on about how wrong it is, at least put that into another article.


Happy Birthday Firefox!
#7.1 omnicoder on 11 Nov 2009 - 01:04
MaJoR said,
Neowin can't even celebrate Firefox's birthday without going on about some no name tech firm saying it is evil. Tisk tisk.

Every other tech site has the right idea: If you are going to do a birthday article just be nice. Don't put a "but" and then go on about how wrong it is, at least put that into another article.


Happy Birthday Firefox!

Well, quite a few otherwise positive articles here about Windows come with a "BUT WAIT! THIS UNKNOWN FIRM VAGUELY STATED THAT MAC IS WAAAAAY BETTER! CAN MICROSOFT EVER RECOVER?" plastered in somewhere so at least everything is getting equal treatment.
#7.2 M_Lyons10 on 11 Nov 2009 - 02:56
omnicoder said,
Well, quite a few otherwise positive articles here about Windows come with a "BUT WAIT! THIS UNKNOWN FIRM VAGUELY STATED THAT MAC IS WAAAAAY BETTER! CAN MICROSOFT EVER RECOVER?" plastered in somewhere so at least everything is getting equal treatment.


Yeah, which I'm getting quite sick of. When did Neowin get like this? I'm getting tired of reading the articles anymore...
#7.3 LoveThePenguin on 11 Nov 2009 - 07:01
I don't see a "FUD" at the end of the title like in the recent MS article. Talk about double standards...
(3 replies) #8 thealexweb on 10 Nov 2009 - 22:11
The reason has fewer vulnerabilities, is one its closed source, harder to find security holes and two when Microsoft finds a flaw it simply doesn't fix fix it for a while and sometimes years.
#8.1 Rodrigo on 10 Nov 2009 - 23:09
thealexweb said,
The reason has fewer vulnerabilities, is one its closed source, harder to find security holes and two when Microsoft finds a flaw it simply doesn't fix fix it for a while and sometimes years.


Stop lying.
#8.2 LoveThePenguin on 11 Nov 2009 - 07:04
Rodrigo said,
Stop lying.

Actually he's right. Greater peer review = more vulnerabilities found. IE can go for years without fixing exploits because MS wont admit they exist.
#8.3 Quikboy on 11 Nov 2009 - 09:11
LoveThePenguin said,
Actually he's right. Greater peer review = more vulnerabilities found. IE can go for years without fixing exploits because MS wont admit they exist.


I think the lie was about how Microsoft manages flaws...
(4 replies) #9 KSib on 10 Nov 2009 - 23:15
I like mah Firefox. NoScript and Adblock Plus have been good friends of mine for quite some time. IE needs to get on the easy to use plugin train. I won't judge

@MaJoR
Yeah what kinda crappy birthday is that? "Oh Brittany you're so cool, if only you didn't have the huge zit and get dumped last weekend, other than that you're great."
#9.1 GreyWolfSC on 11 Nov 2009 - 01:08
I've been saying that for some time now... at least give IE a .NET interface so plugins are easier to write.
#9.2 LoveThePenguin on 11 Nov 2009 - 07:06
GreyWolfSC said,
I've been saying that for some time now... at least give IE a .NET interface so plugins are easier to write.

If it's anything like activex, it'll be one giant security hole for viruses/malware to take over the OS.
#9.3 Quikboy on 11 Nov 2009 - 09:10
There's already similar add-ons for IE8...
#9.4 Atlonite on 12 Nov 2009 - 10:51
yup it's called Maxthon 2.0
(1 reply) #10 HalcyonX12 on 11 Nov 2009 - 00:08
The vulnerabilities thing seems pretty sensational. It has the most vulnerabilities since they're all publicly disclosed, even the minor ones that don't usually get picked up by the public in other closed browsers. It could also be argued that being open also makes it easier to test, so more vulnerabilities are able to be discovered.
#10.1 M_Lyons10 on 11 Nov 2009 - 02:58
Yeah, Mozilla reports EVERY bug and hole fixed. Even the really minor ones. I'd be willing to bet that Microsoft fixes a lot of really minor things and just doesn't report them. Mozilla can't get away with that as it's open source and changes may break add ons...
#11 ajua on 11 Nov 2009 - 16:06
Without bashing Firefox (I love it and use it as my default browser), I must say that I've seen that over time, many open source projects eventually leave vulnerabilities unpatched as they move on and on. That's not the right thing to do when moving from version to version.

Even if that includes addons. Mozilla should remove them until the author (or someone in the open community) fixes/patches the flaw.

This way we can enjoy a more secure browser.

Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!

Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.

Advertisement (Why?)