4 ms·

Cue the chorus of people saying this is because Microsoft sucks etc etc. Ignore the fact that Microsoft has spent more time and resources than any technology c

Cue the chorus of people saying this is because Microsoft sucks etc etc. Ignore the fact that Microsoft has spent more time and resources than any technology company in the world focusing on web related security. Mind you that is not an endorsement of their track record, but a statement with respect to the reality on the ground.

drivebyacct2 15y ago
What? I'd love a citation on that. And I've spent a lot of time trying to make a baby by myself, but that doesn't mean I've been the least bit successful. Seriously, come on. Where is this evidence that Microsoft has "spent more time on web security" than anyone else? Their track record sure doesn't support it. Is there a competition among the big-3 to compare amount of time spent on web security? In fact, the fact that Microsoft supposedly spends so much time on web security and continues to fail so bad makes me feel much worse about their opinions on the security of WebGL. This is also the company, mind you, that introduced the decade-long nightmare of ActiveX.
rbanffy 15y ago
> Microsoft has spent more time and resources than any technology company in the world focusing on web related security. Mostly because they had to. If others spent less it could be because they had a smaller vulnerable surface to begin with, or simpler codebases.
- daeken 15y ago
  You evidently haven't seen the massive codebases from the Mozilla or Webkit camps, or the huge number of vulnerabilities therein in recent years. IE is a huge piece of shit, but MS has done a lot for web security. Mind you, I think Google's efforts have been more fruitful, but writing off MS's effort is silly.
  - rbanffy 15y ago
    The way IE is reliant on Windows and vice-versa, you can't really draw a clear line separating Windows and IE (at least not security-wise). It's very different with Mozilla and Webkit codebases, where the clean separation exists (as they are both multi-platform). I believe IE's base also carries lots of cruft from previous versions, something that complicates matters even more. Microsoft did a lot, quite possibly because they had a whole lot to do. No other company has an OS that large (Windows is huge) so tightly coupled to a browser.
    - daeken 15y ago
      That's pretty much complete BS. IE is no more dependent on Windows than Chrome is, but yes, various bits of the Windows UI are dependent on the Trident engine in IE. Either way, IE is no more inherently insecure than any other browser, despite its many vulnerabilities in the past. In addition, security improvements in the OS itself affect not only IE, but any browser running on top of it, making your claims even more silly. I know you like to hate on MS (how many times have we been over this in the past few months?), but really, your claims here are completely unfounded. IE has a completely shit track record, but they have done a whole, whole lot in recent years to improve its security. Look at the many, many vulnerabilities in other browsers/layout engines compared to IE in recent years -- it's pretty startling. There are many reasons to hate on IE, but the effort put into securing it -- and the way they've gone about securing it -- is definitely not on of them.
      - rbanffy 15y ago
        The part you seem not to get is that if you have a bad engineered product, it's only natural that you have to invest more than those who don't have poorly engineered products, regardless of how bad your track record ends up being. As for your claim IE is no more dependent on Windows than Safari or Firefox, I will have to take your word for it, as it has been a long time (almost a decade) since I last inspected IE and what interfaces it used from the underlying OS. At that time, they both seemed very intimate. And yes. I derive a lot of fun from observing Microsoft. As for investments in an OS affecting all software running on it, it all depends on the fix not being the introduction of an improved API, as software using the old one will remain vulnerable.

drivebyacct2 15y ago

What? I'd love a citation on that. And I've spent a lot of time trying to make a baby by myself, but that doesn't mean I've been the least bit successful. Seriously, come on. Where is this evidence that Microsoft has "spent more time on web security" than anyone else? Their track record sure doesn't support it. Is there a competition among the big-3 to compare amount of time spent on web security? In fact, the fact that Microsoft supposedly spends so much time on web security and continues to fail so bad makes me feel much worse about their opinions on the security of WebGL. This is also the company, mind you, that introduced the decade-long nightmare of ActiveX.

rbanffy 15y ago

> Microsoft has spent more time and resources than any technology company in the world focusing on web related security. Mostly because they had to. If others spent less it could be because they had a smaller vulnerable surface to begin with, or simpler codebases.

daeken 15y ago
You evidently haven't seen the massive codebases from the Mozilla or Webkit camps, or the huge number of vulnerabilities therein in recent years. IE is a huge piece of shit, but MS has done a lot for web security. Mind you, I think Google's efforts have been more fruitful, but writing off MS's effort is silly.
- rbanffy 15y ago
  The way IE is reliant on Windows and vice-versa, you can't really draw a clear line separating Windows and IE (at least not security-wise). It's very different with Mozilla and Webkit codebases, where the clean separation exists (as they are both multi-platform). I believe IE's base also carries lots of cruft from previous versions, something that complicates matters even more. Microsoft did a lot, quite possibly because they had a whole lot to do. No other company has an OS that large (Windows is huge) so tightly coupled to a browser.
  - daeken 15y ago
    That's pretty much complete BS. IE is no more dependent on Windows than Chrome is, but yes, various bits of the Windows UI are dependent on the Trident engine in IE. Either way, IE is no more inherently insecure than any other browser, despite its many vulnerabilities in the past. In addition, security improvements in the OS itself affect not only IE, but any browser running on top of it, making your claims even more silly. I know you like to hate on MS (how many times have we been over this in the past few months?), but really, your claims here are completely unfounded. IE has a completely shit track record, but they have done a whole, whole lot in recent years to improve its security. Look at the many, many vulnerabilities in other browsers/layout engines compared to IE in recent years -- it's pretty startling. There are many reasons to hate on IE, but the effort put into securing it -- and the way they've gone about securing it -- is definitely not on of them.
    - rbanffy 15y ago
      The part you seem not to get is that if you have a bad engineered product, it's only natural that you have to invest more than those who don't have poorly engineered products, regardless of how bad your track record ends up being. As for your claim IE is no more dependent on Windows than Safari or Firefox, I will have to take your word for it, as it has been a long time (almost a decade) since I last inspected IE and what interfaces it used from the underlying OS. At that time, they both seemed very intimate. And yes. I derive a lot of fun from observing Microsoft. As for investments in an OS affecting all software running on it, it all depends on the fix not being the introduction of an improved API, as software using the old one will remain vulnerable.