Wednesday, July 11, 2007

"Firefox Is More Secure Than IE" Should be Treated as a Myth by the "Enterprise"

There are evolving factors that in practice make Firefox less of a target for malicious attacks - and these factors have very little to do with strength of code.

Some educated guesses on why Firefox is perceived to be more secure than IE:
  • Brand perception - Firefox is the perceived underdog, the champion of community and open standards, in league with the equally polished and spotless Google. Common perception of Microsoft in the techie world is not quite that. If an ambitious hacker only has time for a well executed attack on one browser, which do you think she'll choose to pursue? Those savvy enough to do damage play nice with Firefox.
  • Different code - Holes in software are a bi-product of the act of coding in of itself. There are very few and largely insignificant similarities (I'm assuming) between Firefox's and IE's code base. Those things that are attack vectors on one browser will most likely pose no threat to the other browser simply by virtue of dissimilarities in implementation. Spend enough time hacking at Firefox, it's possible to bring the vulnerability reports up to par with IE's.
  • Market share - IE dominates the market place and therefore the same Wisdom of Crowds that builds Firefox on one side of the spectrum plays a hand in breaking IE on the other side of the spectrum. Different communities, same principle.
In summary, when Firefox and IE are both on equal footing when it comes to market share, it will be very foolish of Enterprise Adopters to assume anything other than equal footing when it comes to vulnerabilities and exploits.

In fact, this mindset is a healthy one to have now as well.

No comments:

Post a Comment