4 ms·
Chrome: 6, Firefox: 5, IE: 4, Safari: 7 I suspect sample sizes are too small to really make strong claims about which browsers are least/most exploited.
by fouc 6y ago
Chrome: 6, Firefox: 5, IE: 4, Safari: 7
I suspect sample sizes are too small to really make strong claims about which browsers are least/most exploited.
- berkes 6y agoDo you mean that there are simply too few 0-days to make this claim? Because in that case I disagree: a 0-day is an important event, every single one counts. It's like nuclear bombs: statistically, it indeed makes no sense to say "amount of employed nukes per capita" or so, but it still makes sense to say "The US employed the most nuclear bombs" and "Japan has seen the most nuclear attacks on it's citizens". Or am I missing your point entirely?
- saagarjha 6y agoMost software sees many more zero days; usually you'll look at these kinds of things over tens or hundreds of exploits. It only takes one zero day to hack someone, of course, but by their nature they are perishable items and often single-use.
- bawolff 6y agoSure, but it would be silly to imply that therefore japan is the most dangerous place to live due to risk of nuclear bombs, like how the website is subtly implying that chrome is the least secure. I would also point out that the website is only tracking vulnerabilities in the last 2 years. I bet IE's number would go way up if you included IE6 (not that that would mean anything). I suppose you could also say that "Japan has seen the (tied for) least nuclear attacks on its citizens in the last 2 years", but i'm not sure what the point would be.
- 411111111111111 6y agoYou can't really have 0 days in software that has been eol for years... That would make the term useless. And I'm pretty sure chrome actually is the most "dangerous" browser wrt 0days. If they're going to exploit them, it's surely going to be the one with the largest market share. But yes, the quantity of bugs doesn't necessarily translate to the actual security of the browser.
- aljgz 6y agoFor anyone in the position to be a victim of a targeted attack (like an activist in a suppressing regime) the unexploited 0days can be important. It can be argued that for personal decision making for the general public, the number of exploited ones can be more meaningful.
- bawolff 6y agoThey could have had 0-days at the time. That would help to determine if chrome is just having a bad year due to luck (albeit i think this entire thing is BS)
- xenocratus 6y agoAgree, and it's also based on the number of 0 days _that have been found_. If more researchers are looking for them and disclosing them for Chrome (and it makes sense, since so much of web traffic goes through Chromium-based browsers and also because Google has a lot more people doing that), then you'll see more.
- paulryanrogers 6y agoChrome is also changing very rapidly. I imagine Firefox's ESR branch may be safer just because less change means less new code in need of review over time.
- dubcanada 6y agoComparing nukes which killed millions to a zero day in a browser is a bit much.
- mulmen 6y agoNukes have not killed millions. Web browsers are used in hospitals.
- dubcanada 6y agoOkay half a million, it’s still a lot of deaths. Has a zero day in a web browser directly resulted in anyone’s death?
- berkes 6y agoWhile this is interesting on itself, it does not make any claim valid or invalid. Proving that A is worse than B does not prove that A is good or that B is bad. Or, if you are more mathematical: a > b does not prove that b < 0 or a > 0, where 0 is neutral. And as I point out above: this was not meant as comparison but as analogy. If my analogy affected anyone, I sincerely apologise.
- mulmen 6y agoNot half a million either. Patients have died in ransomware attacks. Not half a million patients or even a quarter million but still, a browser zero day can be a threat to human life.
- dubcanada 6y agoNow you’re just arguing for the sake of arguing. There was 150,000 + 200,000 reported deaths. Those are also rounded figures. So 350,000.
- mulmen 6y agoI am using the numbers from the Wikipedia summary. I also checked to see if those numbers include long-term effects which is unclear from my cursory review. I don’t know how many people are in hospitals with life threatening conditions but I suspect it is more than a quarter million, or even half. Based on personal experience in deskside hospital IT browser vulnerabilities are a significant vector. We spent a lot of time re-imaging machines. There have been ransomware attacks at hospitals including deaths. A coordinated attack using this vector could easily cause as many deaths as nuclear weapons have. https://en.m.wikipedia.org/wiki/Atomic_bombings_of_Hiroshima_and_Nagasaki https://en.m.wikipedia.org/wiki/Atomic_bombings_of_Hiroshima... https://www.washingtonpost.com/national-security/hospitals-being-hit-in-coordinated-targeted-ransomware-attack-from-russian-speaking-criminals/2020/10/28/e6e48c38-196e-11eb-befb-8864259bd2d8_story.html https://www.washingtonpost.com/national-security/hospitals-b...
- mannykannot 6y agoYes, I think you have missed the point, as the severity of the problem is orthogonal to the issue of whether we have enough information to rank browsers. If they were not orthogonal, then severity of consequences would be a parameter in formal statistical methods for evaluating our confidence in the ranking. Let's take your analogy a step further. Does it follow that the US is the most likely to be the next user of nuclear weapons? Does it follow that Japan is most likely to be the next target? (I'm sure someone is thinking that at least one of those outcomes is quite likely, but note that I wrote "does it follow...", not "how likely is it..." because the issue is what one can deduce from the evidence presented in the above post.)