linuxgeek
Rogue Scholar
- Joined
- Feb 1, 2004
- Posts
- 32,718
src
Face it: There is no 'safe' Web browser
Netscape’s turn from wonderful to woeful last week set a new Internet speed record for embarrassment.
Hours after the once-proud Web browser’s Version 8 upgrade hit the streets, it limped back into the garage for an overhaul. Turns out the new browser had old parts from a rival browser, Firefox, and those parts were faulty. The flaws allowed dishonest types to sneak into computers through online connections and snatch user passwords and other personal information.
We’ve all heard reports of browser security trouble before; they’re as frequent as rain clouds over St. Louis in summer. But somewhere close to the problem’s description usually are the words “Microsoft” and “Internet Explorer.”
That’s what made the Netscape-Firefox mess-up so significant: This time, Microsoft’s once and future rivals for the online market were the ones encountering trouble, not its own quirky Web tool. After all, Netscape and Firefox had pinned their reputations on being more secure than Internet Explorer, the dominant browser since 1998.
Netscape recovered quickly from its stumble; a revised Version 8 appeared within 24 hours. Firefox, too, had fixed its flaws in short order. But the message to Internet users now must be abundantly clear: There is no such thing as a totally safe and secure Web browser.
The Netscape-Firefox bond
The continuing search for a better browser is why Netscape’s developers “borrowed” from Firefox. In fact, the two have close ties. You see, deep down, Netscape and Firefox are virtually identical. Key developers of the first later built the second using the same basic blueprint.
At their core is something called “Gecko,” what tech types refer to as a “layout engine.” Imagine Web page programming code as paint and the browser window as a canvas. Gecko, then, basically is the brush; it “paints” Web content onto the browser window.
Variations on Gecko, a very stable and versatile tool, also perform artistry inside other browsers such as Mozilla. The Mozilla browser and Firefox both come from The Mozilla Foundation, a nonprofit software development group founded by some of the same people who developed the first version of Netscape back in the mid-1990s.
Firefox grew out of the former Netscape developers’ build-a-better-mousetrap mind set. It first appeared as “Phoenix” in 2002, then “Firebird” a few months later. But copyright issues dogged those names, so the browser became Firefox in early 2004. The first full-blown, we’ve-got-the-worst-of-the-bugs-worked-out Firefox, Version 1.0, arrived in November.
Or so the developers thought.
Reality bites
Internet browsing as we know it began with Netscape in 1994. Before that, surfing the infant Web required something just short of a degree in computing (although Netscape’s predecessor, Mosaic, did simplify things). Netscape, however, was remarkable for being intuitive; even computing neophytes figured out how to get online with it.
This irked Microsoft Corp., which by then had made a name for itself with productivity software. But it was slow to catch a ride onto the information superhighway. So in 1995, the company licensed browser technology developed by Spyglass Inc. of Champaign, Ill. From that came Internet Explorer.
Microsoft quickly made up ground on Netscape in part by integrating Internet Explorer with the company’s Windows 98 operating system. Internet Explorer grew to constitute over 95 percent of all browser use about a year ago.
Firefox cut into that number, fast. The Mozilla Foundation didn’t just promote Firefox as an alternative to Internet Explorer; the foundation touted Firefox as much more resistant to electronic germs and hacks than Microsoft’s browser, and the browser market — frequently stung by flaws in Internet Explorer — responded.
Firefox managed to deflect the worst of the Web bugs — for a while.
It was only a matter of time
Firefox’s first major flaws turned up earlier this month. Its Version 1.0.3 exhibited at least two errors that, when manipulated together, enabled hackers access to the user’s computer. The flaws prompted a Version 1.0.4, which was issued three days later.
Netscape 8.0’s developers, it turned out, had used components of Firefox 1.0.3 in their framework.
That Firefox sported cracks in its shining veneer seemed inevitable, browser experts warned. The browser garnered 50 million downloads by late April, and is approaching 60 million — about 10 percent of the browser market. Experts believe that kind of popularity will attract hackers trying to find ways to exploit as-yet-unseen weaknesses.
Until now, hackers have concentrated on Internet Explorer because so much of the market depended on it.
Hacking happens
So if it sounds as if we’re all at the mercy of hackers just looking for some new challenge, that’s partially true. As law enforcement officers will tell you, crime finds you if it wants you bad enough, no matter what preventative measures you take. But the vast majority of criminals have an Achilles’ heel: They prefer convenience to challenge. For now, it’s more convenient for them to pick on Internet Explorer.
We rely on alarms and fences to minimize threats to our physical selves, yet most of us still don’t extend the same protection to our computers. It’s believed that today, even with thousands of computer viruses floating around — threats can enter a new computer within four minutes of first getting online — fully 70 percent of computer users still don’t employ antivirus measures or firewalls, or don’t maintain the ones they have.
Clearly, hackers wouldn’t be so successful if they didn’t have so many potential targets.
Of course, it’s up to software makers to hold up their end, too. But they’re no less susceptible to market forces, deadlines and bureaucracy than anyone else. Mistakes happen. Hacking happens. To assume you won’t fall prey to either fairly begs for trouble.
Of the thousands of computer viruses now available, most are variations on an earlier theme, a “Version 1.0” of their own. Antivirus and firewall programs are effective largely because they recognize this. Too bad most computer users don’t.
If they did, Netscape’s and Firefox’s problems wouldn’t have been such big news.
Face it: There is no 'safe' Web browser
Netscape’s turn from wonderful to woeful last week set a new Internet speed record for embarrassment.
Hours after the once-proud Web browser’s Version 8 upgrade hit the streets, it limped back into the garage for an overhaul. Turns out the new browser had old parts from a rival browser, Firefox, and those parts were faulty. The flaws allowed dishonest types to sneak into computers through online connections and snatch user passwords and other personal information.
We’ve all heard reports of browser security trouble before; they’re as frequent as rain clouds over St. Louis in summer. But somewhere close to the problem’s description usually are the words “Microsoft” and “Internet Explorer.”
That’s what made the Netscape-Firefox mess-up so significant: This time, Microsoft’s once and future rivals for the online market were the ones encountering trouble, not its own quirky Web tool. After all, Netscape and Firefox had pinned their reputations on being more secure than Internet Explorer, the dominant browser since 1998.
Netscape recovered quickly from its stumble; a revised Version 8 appeared within 24 hours. Firefox, too, had fixed its flaws in short order. But the message to Internet users now must be abundantly clear: There is no such thing as a totally safe and secure Web browser.
The Netscape-Firefox bond
The continuing search for a better browser is why Netscape’s developers “borrowed” from Firefox. In fact, the two have close ties. You see, deep down, Netscape and Firefox are virtually identical. Key developers of the first later built the second using the same basic blueprint.
At their core is something called “Gecko,” what tech types refer to as a “layout engine.” Imagine Web page programming code as paint and the browser window as a canvas. Gecko, then, basically is the brush; it “paints” Web content onto the browser window.
Variations on Gecko, a very stable and versatile tool, also perform artistry inside other browsers such as Mozilla. The Mozilla browser and Firefox both come from The Mozilla Foundation, a nonprofit software development group founded by some of the same people who developed the first version of Netscape back in the mid-1990s.
Firefox grew out of the former Netscape developers’ build-a-better-mousetrap mind set. It first appeared as “Phoenix” in 2002, then “Firebird” a few months later. But copyright issues dogged those names, so the browser became Firefox in early 2004. The first full-blown, we’ve-got-the-worst-of-the-bugs-worked-out Firefox, Version 1.0, arrived in November.
Or so the developers thought.
Reality bites
Internet browsing as we know it began with Netscape in 1994. Before that, surfing the infant Web required something just short of a degree in computing (although Netscape’s predecessor, Mosaic, did simplify things). Netscape, however, was remarkable for being intuitive; even computing neophytes figured out how to get online with it.
This irked Microsoft Corp., which by then had made a name for itself with productivity software. But it was slow to catch a ride onto the information superhighway. So in 1995, the company licensed browser technology developed by Spyglass Inc. of Champaign, Ill. From that came Internet Explorer.
Microsoft quickly made up ground on Netscape in part by integrating Internet Explorer with the company’s Windows 98 operating system. Internet Explorer grew to constitute over 95 percent of all browser use about a year ago.
Firefox cut into that number, fast. The Mozilla Foundation didn’t just promote Firefox as an alternative to Internet Explorer; the foundation touted Firefox as much more resistant to electronic germs and hacks than Microsoft’s browser, and the browser market — frequently stung by flaws in Internet Explorer — responded.
Firefox managed to deflect the worst of the Web bugs — for a while.
It was only a matter of time
Firefox’s first major flaws turned up earlier this month. Its Version 1.0.3 exhibited at least two errors that, when manipulated together, enabled hackers access to the user’s computer. The flaws prompted a Version 1.0.4, which was issued three days later.
Netscape 8.0’s developers, it turned out, had used components of Firefox 1.0.3 in their framework.
That Firefox sported cracks in its shining veneer seemed inevitable, browser experts warned. The browser garnered 50 million downloads by late April, and is approaching 60 million — about 10 percent of the browser market. Experts believe that kind of popularity will attract hackers trying to find ways to exploit as-yet-unseen weaknesses.
Until now, hackers have concentrated on Internet Explorer because so much of the market depended on it.
Hacking happens
So if it sounds as if we’re all at the mercy of hackers just looking for some new challenge, that’s partially true. As law enforcement officers will tell you, crime finds you if it wants you bad enough, no matter what preventative measures you take. But the vast majority of criminals have an Achilles’ heel: They prefer convenience to challenge. For now, it’s more convenient for them to pick on Internet Explorer.
We rely on alarms and fences to minimize threats to our physical selves, yet most of us still don’t extend the same protection to our computers. It’s believed that today, even with thousands of computer viruses floating around — threats can enter a new computer within four minutes of first getting online — fully 70 percent of computer users still don’t employ antivirus measures or firewalls, or don’t maintain the ones they have.
Clearly, hackers wouldn’t be so successful if they didn’t have so many potential targets.
Of course, it’s up to software makers to hold up their end, too. But they’re no less susceptible to market forces, deadlines and bureaucracy than anyone else. Mistakes happen. Hacking happens. To assume you won’t fall prey to either fairly begs for trouble.
Of the thousands of computer viruses now available, most are variations on an earlier theme, a “Version 1.0” of their own. Antivirus and firewall programs are effective largely because they recognize this. Too bad most computer users don’t.
If they did, Netscape’s and Firefox’s problems wouldn’t have been such big news.
