>and it's a lot safer
Let's all stop this FUD and give it up.... Let's truly face it, no one is better than the other when it comes to holes.. and it comes down to trust.
===
The Register
Posted: 29/01/2002 at 12:38 GMT A security bug in Netscape and Mozilla browsers could allow a malicious web site operator to access cookies on users' computers.
The vulnerability, which affects Netscape older than 6.2.1 and versions of Mozilla prior to 0.9.7, allows an attacker to steal a user's cookies - if he succeeds in tricking a victim into visiting a particular URL.
Cookies are often used to identify and authenticate users to a Web site. If an attacker can steal a user's cookies, then they can impersonate that user. How much damage could be caused through this is dependent on how a particular site uses the cookies.
Although Netscape states it is not aware of active exploitation of the bug, the issue is a concern because the exploit could be conducted with something as simple as an image tag in a Web page or email pointing at a maliciously crafted URL. There's no requirement for active scripting to be enabled for the vulnerability to work.
Netscape advises users to upgrade to the recently released version 6.2.1 of its browser or Mozilla 0.9.7, which are free of the vulnerability. Netscape Communicator 4.x is also immune from the glitch. ®
Evolt.org 01/29/2002
With all the buzz around these days by the anti-Microsoft crowd
about how insecure Microsoft's Internet Explorer is, it's quite ironic to see a security notice come out about a cookie problem existing in the anti-Microsoft crowds' browser of choice ? Mozilla.
What's even more ironic is that the security hole was reported to Netscape in the middle of November 2001. There wasn't a fix available until the release of Mozilla 0.9.7, approximately 1½ months after it was reported. And there's no mention of this fix in the release notes, though it was reported as fixed to Mark Slemko who discovered the exploit.
A very similar security hole was reported to Microsoft within approximately one week's time and a patch was available within 4 days. There was plenty of noise about how Microsoft wasn't quick enough to address the issue. How come we don't hear the same amount of noise (or, more appropriately, more noise) about Netscape dropping the ball on this issue for so long?
>if you run sh!tty, insecure software you deserve what you get. I would never browse with IE, I don't trust it.
Mozilla didn't give a rat's ass on this hole nor did they care to fix it nor admitting it to their users, telling them to just upgrade the browser when it was ready. It's always nice to trust one's browser isn't.
enough said on this.... for which the conclusion is self evident. Have yourself some happy and safe surfing.