Microsoft says Internet Explorer more secure than Firefox

Jeff Jones, Security Strategy Director at Microsoft's Trustworthy Computing Group, is fond of comparing his company's products with others. Following his recent report putting Windows Vista ahead of Linux and Mac OS X for security, he has now placed Internet Explorer ahead of the open source Firefox browser in a long-term comparative study. Here too the result is no great surprise - according to his analysis, fewer security vulnerabilities needed fixing in Internet Explorer than in the competition.

[bild1] Jones explains in his report Browser Vulnerability Analysis (PDF), that Mozilla has fixed 199 security vulnerabilities since November 2004, when Firefox first appeared, of which 75 were critical, 100 medium and 24 of low importance. Over the same period, a total of 87 security vulnerabilities were fixed in Internet Explorer, of which 54 were critical, 28 medium and 5 of low importance.

And our Microsoft security expert doesn't stop at raw numbers. He notes that security updates are currently only being released for version 2.0 of Firefox. If Mozilla's policy of providing support for earlier versions for just six months following the release of a successor version were to be applied by Microsoft, support for Internet Explorer 6 would have been stopped in May 2007. This has not, however, happened. Likewise, Windows 2000 users who don't want to budge from their Internet Explorer 5.01 SP4 can still rely on support.

Jones cites as an example Red Hat Enterprise Linux Desktop 5, which was supplied in March 2007 together with Firefox. Mozilla stopped supporting this version shortly thereafter. This leaves two options - one can, like Red Hat, port patches for Firefox 2 back to the previous version, or, like Novell, one can urge users to switch to the latest version. Private users have more flexibility in this regard, whereas business users often use browsers modified for their particular purposes and approach a switch with a more long-term perspective.

Jones gives credit to his company, but also to Mozilla, for placing a high degree of emphasis on security matters. Both browsers have been affected by ever fewer security vulnerabilities over time. Mozilla has also appointed its own security specialist, Window Snyder. However, in his opinion, it is clear that the oft-cited view that Firefox is more secure is not tenable. He believes this can be marked down as one of the fruits of the Trustworthy Computing strategy announced by Bill Gates' in early 2002.

Browser share on heise online

(mba)