Live data from Hacker News

If you're visiting family over the holiday, turn off Internet Explorer.

f-secure.com

31–40 of 63 posts

Re: If you're visiting family over the holiday, turn off Internet Explorer.

#31
post #7

Current 0-day or no, you'll be doing much more good in the long run if you replace the pre-installed acrobat reader with a 3rd party viewer.

Even just disabling Javascript in Adobe Reader goes a long way to avoiding many exploits. It's pretty rarely used in legitimate PDFs

Re: If you're visiting family over the holiday, turn off Internet Explorer.

#32
post #7

Current 0-day or no, you'll be doing much more good in the long run if you replace the pre-installed acrobat reader with a 3rd party viewer.

Just like IE, sometimes you have to use Adode Reader. I deliberately removed Acrobat from my mom's iMac and set Preview.app as the default. Worked fine for years until I got a call a few days ago about a PDF she needed to open to do some work. Sure enough, it was some sort of interactive PDF that only seemed to work with the Adobe Reader.

I've had this before too. I haven't tested for a few versions, but I know that evince was unable to open USPS shipping labels, and I had to go install Acrobat Reader for Linux on my parents' computers. :(

Re: If you're visiting family over the holiday, turn off Internet Explorer.

#33

Is IE8 really so bad?

The more interesting question: Is IE8 significantly worse than the alternatives?

I think not.

All major browsers on all common operating systems have exploitable vulnerabilities often enough that switching browsers will not solve the problem.

Re: If you're visiting family over the holiday, turn off Internet Explorer.

#34
post #25

1. Remove all shortcuts to Internet explorer from the start menu, mydocuments, desktop, and search menus. 2. Install latest version of firefox, use IE themes. 3. Make a shortcut to start firefox, but change the icon to internet explorer, the retarded blue 'e' symbol. 4. Make sure you get all the bookmarks copied over. 5. Make sure any buttons, keys or special behavior moved to equal features on firefox. 6. Also put s…

And then Firefox will announce a zero-day. What will you have gained?

Re: If you're visiting family over the holiday, turn off Internet Explorer.

#35
post #17

As a developer who's deeply tied into web technologies, I cannot help but grin at this post. Unfortunately, I know where this is going to lead, however. My mother visits a site that embeds WMV-based videos for her Russian TV shows. It was not until she purchased a new MacBook that I realized that this was the site she visits 90% of the time she's on the Internet. I thought installing Flip4Mac would solve her crisis,…

You can install Windows XP on a Macbook.

And install all it's vulnerabilities on your Mac?

Re: If you're visiting family over the holiday, turn off Internet Explorer.

#36
post #34
post #25

1. Remove all shortcuts to Internet explorer from the start menu, mydocuments, desktop, and search menus. 2. Install latest version of firefox, use IE themes. 3. Make a shortcut to start firefox, but change the icon to internet explorer, the retarded blue 'e' symbol. 4. Make sure you get all the bookmarks copied over. 5. Make sure any buttons, keys or special behavior moved to equal features on firefox. 6. Also put s…

And then Firefox will announce a zero-day. What will you have gained?

You'll have gained more time to obtain a fix, because Firefox vulnerabilities are not attacked as swiftly and as broadly as IE vulnerabilities.

Re: If you're visiting family over the holiday, turn off Internet Explorer.

#37
post #33

Is IE8 really so bad?

The more interesting question: Is IE8 significantly worse than the alternatives? I think not. All major browsers on all common operating systems have exploitable vulnerabilities often enough that switching browsers will not solve the problem.

But all major browsers are not targeted with the same vigor. IE is targeted much more vigorously because the criminals stand to gain much more from their efforts than if they target, say, Opera.

Also, Chrome's sandboxing is designed to assume the browser will have exploitable vulnerabilities, so there are two hoops that the exploit must jump through instead of just one. In this latest IE vulnerability there is only the one hoop and then on most machines the exploit has acquired administrator privileges.

Re: If you're visiting family over the holiday, turn off Internet Explorer.

#38
post #5
post #2

Better yet, why not install Google Chrome and replace their Internet Explorer link with a link to Google Chrome? Just make the link have IE's icon so that they don't wonder where the internet has gone. They will marvel about how you "made their internet faster." I like to make it even easier for people by making two different links: one called "Internet" which takes them to Google, the other called "Email" which take…

in my experience, they will marvel at the speed for a little while... until a favorite website doesn't display correctly for whatever reason. Then it becomes my job to play tech support.

Other than Windows Update (which non-technical users shouldn't be running manually anyway), I can't even remember the last site I've been do that didn't work perfectly on Chrome (or Firefox). Examples?

On the other hand, we're getting to the point where some newer sites render poorly in IE, run very slowly, are missing features, or don't work at all. HTML5 and intensive JavaScript may be on the verge of reversing the old conventional wisdom about using IE for widest compatibility.

Re: If you're visiting family over the holiday, turn off Internet Explorer.

#39
post #33

Is IE8 really so bad?

The more interesting question: Is IE8 significantly worse than the alternatives? I think not. All major browsers on all common operating systems have exploitable vulnerabilities often enough that switching browsers will not solve the problem.

Another reason why IE is more vigorously targeted: it is patched the least. Some systems deliberately run downrev versions of IE for various reasons (they are pirated and thus afraid of Windows Update, or they are based on a frozen IT build of Windows which only gets updated quarterly, or whatever).

So, even if Microsoft releases a patch for this latest IE vulnerability today, millions of PCs will remain unpatched for months. Valuable targets -- members of the next botnet.

By comparison, Chrome is much more aggressive about updating itself. For example, consider Chrome 6.0's short lifespan:

http://www.netmarketshare.com/browser-market-share.aspx?qpri...

Re: If you're visiting family over the holiday, turn off Internet Explorer.

#40
post #30

Earlier quoted context omitted.

It's not even preinstalled, so it shouldn't be that difficult. Foxit and Sumatra PDF are both great choices.

If they are a regular computer purchaser (i.e. buy from a manufacturer like hp, dell, etc.) it most certainly is preinstalled along with and old version of java and an old version of flash for their convenience.

Wow, I didn't know this was the case. I always immediately image the hard drive, then wipe it and install Linux. I was under the impression that Java, Flash, and Adobe Reader had to be manually installed. Isn't it bad security-wise to bundle old versions of them? If the user puts off upgrading, they could easily get hit by an old vulnerability.
Post reply on HN