Who cares about encryption & why hard disk cryptography is only part of the solution...

One of my favourite sources of IT news and information is The Register, a UK based IT news related website that is written with style and often makes what can be a dull subject of IT, compelling reading.

I just read an article by Jon Collins which details results of a recent poll asking about general use of encryption and what people thought were the main areas where cryptography should be used to protect sensitive information. Run by research company Freeform Dynamics, Jon points out that their polls typically attract those interested in the subject matter, so its safe to say my Mum wasn't answering the questions.

The first analysis from the article looks at the answers to "Which of the following drivers are likely to influence your organisation when it comes to requirements for encrypting data?" Pretty obvious results with compliance in first place, then protecting the storage of confidential information and protecting information due to an increasingly mobile workforce.

No surprises here, more and more regulatory controls specify that credit card data, patient information, etc needs to be encrypted. Companies with large amounts of sensitive information, such as financial data, intellectual property and trade secrets need to protect the storage of that data and also when it's used on a mobile device, typically a laptop.

However when the poll asked what the most important areas of encryption were, the results revealed concerns of the modern, mobile workplace. The question was "In an ideal world, which of the following do you think should be encrypted and to what degree?"

So the top three ideal-world targets for encrypting everything are, in order:

• Data stored on notebooks used by mobile workers
  
• Data stored on smartphones and other portable/handheld devices
  
• Data stored on desktops/notebooks used in home locations
  

Combine this with the following quote from Jon's article... "The executive who found himself personally responsible for a data breach when his laptop was stolen from his house may have been taken by surprise, as there is a lingering mindset that security is a central infrastructure thing. But rules and regs like PCI are not fussy about which particular part of the IT infrastructure is involved, be it a SAN in the data centre, or an SD card in a phone. It's all just IT."

Information rights management is a perfect solution for these encryption challenges. But it goes beyond just the mobile or home use, IRM uses encryption at the document or email level. So no matter where the information is stored, it's always encrypted. Another really nice feature of IRM is that even when the content is in USE, it is protected. So the file on the hard disk, the file being sent over the network and the file in your Word/Excel/PowerPoint/Adobe Reader/Internet Explorer etc is ALWAYS secured with IRM.

Unfortunately the article ends with some not so good news. The poll finds that one of the main reasons not to encrypt information on notebooks, removable devices (DVD's, CD's, USB drives etc) is the "practicalities around implementation" and "challenges with key management". So people view that deploying an encryption solution for mobile devices is difficult. Yet IRM is actually pretty easy to deploy and use and Oracle IRM has excellent key management.

Finally, and this is the real killer for me, is Jon's closing message, "Meanwhile, the message to end-users is, if you haven't already encrypted your laptop data, you'd best get on with it - or at least ask your IT department how to do it". I would be that most IT departments are going to end up looking at hard disk encryption to secure documents stored on mobile devices. Yet this really doesn't solve the greatest risk.

The advantage of hard disk encryption is it protect every file stored on it, unlike IRM which applies encryption to a limited set of supported file formats. However, that is also one of its main weaknesses... hard disk encryption ONLY protects the information whilst it is stored on the disk. It doesn't do anything to protect against the following challenges.

• Research shows that data loss incidents are usually by accident and by people outside your organization. So basically it's the supplier you sent your trade secret document to that stores it on an unencrypted USB key which gets lost on train. Encrypting your employee hard disks doesn't get close to solving that problem.
• Hard disk encryption only protects the content whilst it is stored on the disk. As soon as that content is attached to an email, copied to a USB key or even just opened in Word, it now exists in an decrypted state. IRM is persistent in its security because the cryptography is applied at the document level and is combined with tight application integration to ensure that you can't even copy and paste sensitive data from a document into a non-encrypted world.

So whilst IRM is not the be all and end all of information security, combined with technologies like DLP, hard disk encryption, network encryption etc, it brings a huge difference in the reduction of the risk and exposure of an organization to losing control of their most sensitive information.

State of the Browsers and ad blocking

Antivirus Product Testing is Changing, Whether Vendors Like it or Not

This week NSS Labs released their Q2 2010 Corporate Endpoint Protection Products report. NSS has only publicly announced the two products it specifically recommends against: Panda's Internet Security 2010 (Enterprise) and AVG's Internet Security Business Edition 9. However, it takes only a quick look at Trend Micro's web site to guess how NSS rated Office Scan (hint: very well). Some vendors have protested NSS's ratings in the past, but like it or not NSS is changing the way security testing is conducted.

Sponsor

As security threats evolve, e-mail has been displaced by the Web as the primary delivery mechanism for malicious code. The old model of virus definition based antivirus software has been increasingly called into question. In 2007, Australia's Computer Emergency Response Team claimed that leading products missed 80% of new viruses. To compensate, companies like Trend Micro and Kaspersky are developing cloud based "reputation services" to evaluate URLs and code.

NSS president, and former VP of marketing at antivirus vendor ESET, Rick Moy explained in a phone interview: cybercriminals now typically use social engineering to trick users into downloading malware from web sites and run it voluntarily. Malware creators run "campaigns" on Twitter and other social media sites baiting users with anything from pornography to free iPads.

Even the most savvy of users can occasionally be tricked by social engineering - we posted our own list of tech savvy Twitter users who fell for phishing scam last year. For an explanation of how such savvy users get fooled, read Cory Doctorow's recent Lotus Magazine piece explaining why he fell for a phishing scam.

Trend Micro recently published an independent report claiming the IT industry is being lulled into a false sense of security by vendors. The report cites an NSS survey which found half of respondents thought their antivirus solutions would protect them from threats 100% of the time, and that another 10% of respondents thought their solutions would protect them 99% of the time.

Moy says there's also a perception in the enterprise that anti-malware products are essentially interchangeable, but that's turning out not be the case: NSS's testing found wild disparities between the efficacy of different products, and found that a company's previous track record is no indication of how well it will perform.

NSS tests differ from most other testers, such as AV-Comparatives for example, in that NSS's test computers that are actually connected to the Internet - something the company calls "live testing." NSS tested PCs, running up-to-date copies of Windows 7 and using Internet Explorer 8 with SmartScreen disabled, by visiting known malicious sites to verify whether each product tested could successfully blocks malware from being downloaded and/or executed.

According to Moy, typical testing involves using malware sets from Wildlist or Antivirus Bulletin - both of which use samples provided by the antivirus protection industry, some of which might be quite old. The results of AV-Comparatives' most recent report, its "Retrospective/Proactive Test," are radically different from NSS's. Trend Micro did fairly poorly in this test, while Panda did quite well. AVG out performed Trend Micro. Peter Stelzhammer of AV-Comparatives confirmed via e-mail that the NSS and AV-Comparatives tests are not comparable, and that AV-Comparatives is working on a test similar to NSS's.

A consensus is forming in the security industry that there's a need for new prevention techniques - and new testing methodologies to evaluate those techniques. The need for new testing methodologies was the theme of the "Measuring The Actual Security Anti-Virus Products Provide Customers" panel at SOURCE 2010 Boston in May, which included Stelzhammer, NSS CEO Vik Phatak, and representatives from CheckVir Labs, Dennis Technology Labs, PC Security Labs and West Coast Labs. Stelzhammer detailed the difficulties involved in doing live, Internet-connected testing and explained the methodologies for AV-Comparatives' future NSS-like tests.

AV-Test has released a test based on methodologies similar to NSS's, with comparable results. According to the report published by Trend Micro: "ICSA and others such as Virus Bulletin state they will be evolving their certification practices in coming months to include real-time testing and/or testing against today's threats."

NSS has a recent history of raising eyebrows in the security industry.

In March of 2009 NSS published the results of a Microsoft sponsored test that found Internet Explorer 8 was more effective in blocking malicious web sites than Firefox, Safarai, Chrome, and Opera. This lead to many skeptical articles and accusations of bias. However, when looking at what was actually being tested, the results aren't particularly radical: NSS found that Microsoft's blacklist blocked more sites than the blacklists used by other browsers. NSS was not tested for other browser vulnerabilities.

In September 2009, Network World reported that NSS was shifting its focus towards conducting self-funded tests instead of vendor sponsored tests. NSS would sell the reports and consult vendors, but would not take money for testing.

One of NSS's first self-funded tests found 3com TippingPoint 10 firewall to be deficient. Moy told TechWorld he thought that Tipping Point must not have been investing enough in improving its products. Some commenters were, shall we say, skeptical about NSS's rating.

That same month, NSS released its first Corporate Endpoint Protection Products test, unfunded and using its new live testing methodology. It ranked AVG, Panda and Moy's former employers ESET at the bottom of the heap. It gave top marks to Trend Micro.

In March of this year NSS released a free report detailing the failure of many commercial products to defeat variants of the infamous Aurora virus that infected Google's computers. McAfee was the only product NSS tested that successfully blocked variants of the virus, and NSS found AVG was the only product tested that didn't block the original exploit.

In an entry on the company blog, AVG protested the results of the Aurora test and called a few things into question. It noted that the report initially indicated that NSS had tested AVG 8 instead of the newer AVG 9, and that NSS later claimed this was a typo and that it had tested version 9. AVG also claimed NSS gave them different information about the results of the testing before the publication of the report and that NSS was slow providing methodology before publication. AVG also provided a screenshot showing AVG blocking the Aurora virus.

ESET also fired back at NSS, claiming that NSS's report didn't comply with two of the Anti-Malware Testing Standards Organization's Fundamental Principles of Testing. ESET also complained that NSS did not provide access to samples used in its testing.

Since NSS has moved ESET out of "caution" category in the newest report, we asked ESET if it had made any changes to its product to improve its ratings with NSS. "ESET was unable to get any useful feedback on its performance in the previous test without paying a substantial sum to NSS for 'consultancy,'" replied David Harley, ESET Research Fellow & Director of Malware Intelligence via e-mail. "Even when ESET offered to pay the agreed-upon sum, the fee kept escalating. To this day, information on the test samples has never been supplied, so we are unable to assess the competence and validity of the test, let alone make any changes that would impact our performance in the more recent test."

Moy answered critics on the NSS blog. First, he addressed AVG's objections. Moy disputed AVG's claims that NSS withheld information and points out that the methodology and steps for reproducing its Aurora testing was available in the published report. He provided a video showing AVG 9 failing to protect against the Aurora exploit, and pointed out that the screenshot AVG provided depicted Firefox, even though Aurora was an Internet Explorer virus.

In a post seemingly in response to ESET, Moy wrote:

Some vendors used the anti-malware testing standards organization (AMTSO) to try to discredit the test. One of their objections was that we recommend against buying products that scored on the bottom third of our test. Sorry, we unabashedly believe malware protection should indeed be the key purchasing criteria for an AV product. And for vendors who claim their anti-spam on the corporate desktop will improve their protection against socially-engineered malware hosted on web sites, that's just stretching it.

Moy told us that all the NSS test methodology is available for free on the company's web site and that ESET was mostly upset NSS didn't release its malware sample set.

Although NSS has received money from vendors for past tests, and does do security consulting, Phatak told us NSS did not receive money from Trend Micro or McAfee before the tests were conducted.

Conclusion

Science is about repeatable, verifiable results. The only way to glean a better understanding of the efficacy of various endpoint protection products is for more labs to employ cutting edge testing methodologies. The more tests released in the future, the more information enterprises will have in making informed decisions.

Quick guide to Oracle IRM 11g: Creating your first sealed document

Quick guide to Oracle IRM 11g index

The previous articles in this guide have detailed how to install, configure and secure your Oracle IRM 11g service. This article walks you through the process of now creating your first context and securing a document against it. I should mention that it would be worth reviewing the following to ensure your installation is ready for that all important first document.

• Ensure you have correctly configured the keystore for the IRM wrapper keys. If this is not correctly configured, creating the context below will fail.
• Make sure the IRM server URL correctly resolves and uses the right protocol (HTTP or HTTPS)

Contents

• Create the first context
• Install the Oracle IRM Desktop
• Seal your first document

Create the first context In Oracle 11g there is a built in classification and rights system called the "standard rights model" which is based on 10 years of customer use cases and innovation. It is a system which enables IRM to scale massively whilst retaining the ability to balance security and usability and also separate duties by allowing contacts in the business to own classifications. The final article in this guide goes into detail on this inbuilt classification model, but for the purposes of this current article all we need to do is create at least one context to test our system out. With a new IRM server there are a set of predefined context templates and roles which again are setup in a way which reflects the most common use we've learned from our customers. We will use these out of the box configurations as they are to create the first context against which we will seal some content.
First login to your Oracle IRM Management Website located at https://irm.company.com/irm_rights/. Currently the system is only configured to use the built in LDAP for users, so use the only account we have at the moment, which by default is weblogic. Once logged in switch to the Contexts tab.
Click on the New Context icon () in the menu bar on the left. In the resulting dialog select the Standard context template and enter in a name for the context. Then just hit finish, the weblogic account will automatically be made the manager. You'll now see your brand new context ready for users to be assigned.
Now click on the Assign Role icon () in the menu bar and in the resulting dialog search for your only user account, weblogic, and add to the list on the right.
Now select a role for this user. Because we need to create a document with this user we must select contributor, as this is the only role which allows for the ability to seal.
Finally hit next and then finish. We now have a context with a user that has the rights to create a document. The next step is to configure the IRM Desktop to get these rights from the server.

Install the Oracle IRM Desktop

Before we can seal a document we need the client software installed. Oracle IRM has a very small, lightweight client called the Oracle IRM Desktop which can be freely downloaded in 27 languages from here. Double click on the installer and click on next... Next again... And finally on install... Very easy. You may get a warning about closing Outlook, Word or another application and most of the time no reboots are required. Once it is installed you will see the IRM Desktop icon running in your tool tray, bottom right of the desktop.

Seal your first document

Finally the prize is within reach, creating your first sealed document. The server is running, we've got a context ready, a user assigned a role in the context but there is the simple and obvious hoop left to jump through. To seal a document we need to have the users rights cached to the local machine. For this to take place, the IRM Desktop needs to know where the Oracle IRM server is on the network so we can synchronize these rights and then be able to seal a document. The usual way for the IRM Desktop to know about the IRM server is it learns automatically when you open an existing piece of content that someone has sent you... ack. Bit of a chicken or the egg dilemma. The solution is to manually tell the IRM Desktop the location of the IRM Server and then force a synchronization of rights.
Right click on the Oracle IRM Desktop icon in the system tray and select Options.... Then switch to the Servers tab in the resulting dialog. There are no servers in the list because you've never opened any content. This list is usually populated automatically but we are going to add a server manually, so click on New.... Into the dialog enter in the full URL to the IRM server. Note that this time you use the path /irm_desktop/ and not /irm_rights/. You can see an example from the image below.

Click on the validate button and you'll be asked to authenticate. Enter in your weblogic username and password and also check the Remember my password check box. Click OK and the IRM Desktop will confirm a successful connection to the server. OK all the dialogs and we are ready to Synchronize this users rights to the desktop. Right click once more on the Oracle IRM Desktop icon in the system tray. Now the Synchronize menu option is available. Select this and the IRM Desktop will now talk to the IRM server, authenticate using your weblogic account and get your rights to the context we created.

	Because this is the first time this users has communicated with the IRM server the IRM Desktop presents a privacy policy dialog. This is a chance for the business to ask users to agree to any policy about the use of IRM before opening secured documents. In our guide we've not bothered to setup this URL so just click on the check box and hit Accept. The IRM Desktop will then talk to the server, get your rights and display a success dialog.
Lets protect a document Now we are ready to seal a piece of content. In my guide i'm going to protect a Microsoft Word document. This mean's I have to have copy of Office installed, in this guide i'm using Microsoft Office 2007. You could also seal a PDF document, you'll need to download and install Adobe Acrobat Reader. A very simple test could be to seal a GIF/JPG/PNG or piece of HTML because this is rendered using Internet Explorer. But as I say, i'm going to protect a Word document. The following example demonstrates choosing a file in Windows Explorer, there are many ways to seal a file and you can watch a few in this video. Open a copy of Windows Explorer and locate the file you wish to seal. Right click on the document and select Seal To -> Context You are now presented with the Select Context dialog.
You'll now have a sealed copy of the document sat in the same location. Double click on this document and it will open, again using the credentials you've already provided.

But before we finish this guide, there is one more article and arguably the most important article of all. Next I discuss the all important decision making surrounding the actually implementation of Oracle IRM inside your business. Who has rights to what? How do you map contexts to your existing business practices? It is the next article which actually ensures you deploy a successful IRM solution by looking at the business and understanding how they use your sensitive information and then configuring Oracle IRM to reflect their use.

Place Your Tweets with Twitter Locations

Twitter has added location to their microblogging service, according to an announcement today on the company's blog.

"Starting today, you can tag Tweets with specific places, including all World Cup stadiums in South Africa, and create new Twitter Places. You can also click a Twitter Place within a Tweet to see recent Tweets from a particular location."

Sponsor

Twitter has "data partnerships" with TomTom and Localeze in order to make Twitter Locations work. Over the coming week, it is rolling Locations out to 65 countries. It is also working to add Twitter Places to Twitter for iPhone, Android, and Blackberry.

Other features of Twitter Locations include the following.

• Foursquare and Gowalla integration. If you click on a Twitter Place, you will see standard Tweets and check-ins from Foursquare and Gowalla
• API. API functionality that lets developers integrate Twitter Places into their applications.
• Support for more browsers. Add location to your Tweets from any browser--Safari and Internet Explorer, in addition to Chrome or Firefox

Twitter has more detailed information on how to use Locations here.

5 Basic Guidelines of Dallas Web Design

Script For Detecting Availability of XMLHttp in Internet Explorer

1. Save the browserCheck.js file into a /js/ directory under your HTML root within your UI project (e.g. ViewController)
   
2. In the template or page, select the object in the Structure window.
3. From the right mouse (context) menu choose Facet and select the metaContainer facet.
4. Switch to the source code view and locate the metaContainer facet. Then insert the following lines (I've included the facet tag for clarity but you'll already have that):

Web Design Basics & Tips

Recommended Firefox Addons, Plugins & Extensions

Migrating to Mozilla Firefox: the Pros, Cons & Installation

Part 1 deals with the pro's and con's of using Firefox in preference to Microsoft's Internet Explorer.

Part 2 is a practical

Part 1: The Pros and Cons

Things change quickly in the world of computers. Just a year ago Microsoft's Internet Explorer seemed to have an unassailable hold on the Internet browser market.

Then all of a sudden through a combination of multiple security vulnerabilities, an aging set of features and the emergence of more modern browsers, Internet Explorer has started to look vulnerable.

So vulnerable in fact that over 100 million users have already switched over to other browsers. And the browser most have switched to is Mozilla Firefox.

Firefox is a fast, lean tabbed browser produced by the Mozilla Corporation. It's the young nimble brother of the original full-featured Mozilla Suite that itself being a spin-off from the ill fated Netscape browser.

The current version of Firefox is 2.0, the first major update since V1.0, the first official release.

Firefox is an impressive product but it's certainly not perfect. A decision to move from Internet Explorer to Firefox is a decision involving trading one set of attributes for another. Each individual will need to weigh the pros and cons and make a decision based on their own needs.

The purpose of this guide is to help you make that choice. And if you decide to go for Firefox I hope to provide you with some tips to make the transition from Internet Explorer as smooth as possible.

Three Good Reasons to Abandon Internet Explorer

1. It's an ongoing security risk.

Even the most one-eyed Microsoft supporter would have to accept that IE has been plagued with security problems.

First, as the world's most popular browser it's a target for hackers. That's because any vulnerability they uncover can be utilized against over 90% of all computers. That's quite a temptation. In fact there have been more attacks against IE than any other Windows component or application and there is no reason to believe this will lesson in the future.

Second it's a security risk because it employs Microsoft's propriety active scripting component called ActiveX. Now ActiveX offers users some real convenience features but those features come at a high cost. Security experts have been concerned about ActiveX right from its introduction and those concerns have proven justified as ActiveX has been at the center of multiple security vulnerabilities including many of the most serious. And it's not only ActiveX, IE also makes use of VBScript and browser helper objects (BHOs) two other convenience technologies that has been heavily exploited by hackers.

The latest version of Internet Explorer, IE7, includes enhancements that address many of these scripting problems but the fundamental problem remains.

Third it's a security risk because IE is too close to the core of the Windows operating system. In fact Microsoft itself argues that it's actually not a browser but part of the operating system. Such closeness is not a good thing; it means that a hacker who breaks into IE may not only have hacked your browser but may also be able to gain access to the operating system itself.

Finally Microsoft's record for responding to reported flaws in IE has been checkered. In several well publicized instances Microsoft have denied the existence of the flaws and instead, gone into "blame the messenger for the message" mode rather than respond. In other cases they have questioned the severity of the claimed flaws. This strange PR-driven stance has meant that patches for a number of critical flaws have been slow to arrive. Indeed even today there are over 20 publicly reported but yet unpatched critical IE flaws. And don't expect things to change much in the future.

Firefox is not exempt from flaws and as it has becomes more popular, these flaws are emerging. Part of this is due to the fact that, unlike IE, the Firefox source code is in the public domain and can be scrutinized for flaws by hackers. However Mozilla has shown itself to be very responsive to fixing reported flaws, often doing so within a few days. This is a far cry from Microsoft's poor track record.

2. If you are not using Windows XP, Microsoft has abandoned you

Internet Explorer 7 is only available to those using Windows XP SP2 or later. Users of earlier versions of Windows have to IE6, a version which has proven highly vulnerable to exploitation. Worse still, the folks at Redmond have announced that any future security enhancements to IE6 offered to Windows XP SP2 users will not necessarily be made available for any Windows operating system prior to XP. The intent is evident; they want everyone to upgrade to Windows XP or the upcoming Vista. The Microsoft announcement will inevitably embolden hackers to target future attacks on IE to versions on non-XP PCs. So if you don't use Windows XP, this alone is sufficient reason to look for an alternative to Internet Explorer.

And it's not only security. IE6 is a dated browser that doesn't even offer tabbed surfing. Yet another reason for users of earlier Windows versions to shift to Firefox.

3. Internet Explorer is less configurable than Firefox

Although IE7 now offers a useful collection of add-ons that allow you to customize your browsing experience the number of such add-ons just can't compare to the 1000+ free extensions available for Firefox.

For example I currently use eleven Firefox extensions, but only one is available for IE7.

To many users, these free extensions are more than niceties; they are integral to the browsing experience. For example the free Adblock extension that eliminates the vast majority of web ads. At the time of writing there is no comparable free extension available for IE7.

IE6 is even less configurable than IE7 and most of the add-ons available are commercial products not free

Three Good Reasons to Stay with Internet Explorer

1. Some web sites won't work properly with Firefox

A number of web sites utilize non-standard, proprietary Microsoft features such as ActiveX in order to provide site navigation and other features. It's probably not a good web design practice but that doesn't stop people doing it.

If you visit one of these non-standard sites using Firefox you will find that some functions won't work or work differently. This could be could be something trivial like the screen colors are wrong or an animation doesn't work or it could be some vitally important function such as a logon box or navigation link.

Luckily there aren't too many such sites and thankfully, their number seems to be reducing. However there are sufficient that you will encounter one sooner or later. If it's an important site such as your internet banking site then you are going to be frustrated.

One site that definitely doesn't work with Firefox is Microsoft Windows Update. Hardly surprising but still an annoyance.

You can of course, simply open IE when you encounter any of these sites. Firefox even has a downloadable extension that allows you to open a page using IE from within Firefox. This significantly reduces the nuisance value but does not of course, solve the basic problem.

If you use Firefox you are going to have to accept that certain sites will be broken and will require you to fire up IE to access them. This is a simple reality.

2. Firefox loads slower than Internet Explorer and takes more memory

Firefox may load web pages faster than IE but the program itself takes longer to load. Much longer, maybe twice as long. Firefox also uses more memory than IE.

IE's better performance here is to some degree an illusion. That's because some of the major components of Internet Explorer are always running on your PC, they are pre-loaded when Windows starts. That means IE has less work to do when it starts so it loads quicker. It also means that IE actually takes up more memory than it appears to.

This Firefox load time inconvenience can be eliminated by always keeping Firefox loaded and simply minimizing it when not in use. In fact it doesn't even need to take up any task bar space as there is a free Firefox extension that allows you to minimize it to the system tray.

Minimizing Firefox also releases some of its memory space so you are killing two birds with the one stone

That said it is a reality that IE loads faster and all potential Firefox users should be aware of this.

3. Firefox has had its own security problems

Firefox may be safer than IE but it has had its own share of security problems. Indeed since V1 was released there have been more than seven new versions containing security enhancements.

This may be so but Mozilla have to be commended how quickly they have released patches for newly discovered flaws, often only a day or two after the flaw was first demonstrated. This is in sharp contrast to Microsoft's tardy response to fixing IE problems.

In fact I have never encountered a hostile website that successfully exploits flaws in the then current version of Firefox. In other words, if you keep your copy of Firefox up to date it is extremely unlikely your browser security will be penetrated. The same cannot be said of Internet Explorer, particularly IE6.

Conclusion

As I said earlier, a decision to move from Internet Explorer to Firefox is a decision involving trading one set of attributes for another. Each individual will need to weigh the pros and cons and make a decision based on their own needs.

If you are not using Windows XP, I think the situation is clear cut. Microsoft has announced that they will not upgrade your Internet Explorer to the latest version 7. Given that, you should move to another browser just on security grounds alone. And if you are going to go to another browser, then THE current browser of choice is Firefox

Windows XP users on the face of it, have a real alternative to Firefox. They can stay with IE by installing XP Service Pack 2 along with IE7.

However experience with IE7 since its release indicates the likelihood of on-going security problems. Yes, Internet Explorer 7 is safer than IE6 but Microsoft's track record for speedily fixing any security problems is poor and bodes ill for the future.

So what do I think?

There is no doubt that Firefox is currently less of a security risk than IE6. In particular it is way less liable to Spyware infection. Every week I get letters from readers who have migrated to Firefox from IE because of recurrent IE6 based spyware infections. Commonly these folks tell me since changing over, they have never had a spyware infection.

This equates with my own experience. Not only have I never had a spyware infection since using Firefox but I have never even seen a circulating spyware exploit for Firefox. By contrast I encounter IE6 based spyware exploits every day.

There is no doubt that IE7 offers better security then IE6 and maybe as good as Firefox 2. However IE7 will remain a target for malware writers simply because of its popularity. That means that there will be more flaws discovered and more exploits released than for Firefox. Combine that with Microsoft's slow response to releasing patches and IE7 security becomes a serious concern.

So to me, security is the bottom line here. Yes, Firefox offers faster browsing. Yes, there are hundreds of free Firefox extensions to customize and optimize your browsing experience. All that is fine and most welcome but the real clincher is that Firefox offers a safer browsing experience and that alone is sufficient warrant to drop IE and make the change right now.

Web Design - Why is it Important to Me?

'Browser Wars 2.0'

Frequently Asked Web Design Questions

Apple To End iPhone 2G Support? Jobs Says So

Apparently Steve Jobs has gone and answered another customer email, this time sending shockwaves through the tech world with two words - "Sorry, no." According to a Mac rumors blog, a German user emailed Jobs asking if Apple was planning on "supporting/updating the iPhone 2G in the Future" and that was Jobs' answer.

We know it's only been a couple of years since the iPhone was originally released, but is this all that surprising?

Sponsor

It has been nearly two years since the iPhone 2G was available for sale, though you can still find plenty of them on Ebay, but the same can be said for other old beasts.

Should we really expect Apple to continue releasing updates for outdated hardware? As it is, the iPhone OS 4.0 isn't going to support the iPhone 3G for half of its functionality - what are we looking for with iPhone 2G support then? After all, with Apple's infamously closed platform, are we looking for much in the way of bug fixes and security holes?

Now, if only Microsoft would do the same for Internet Explorer 6, we could all move on with our lives.