Secunia have reported that more flaws were found in Redhat Linux (633) than in Windows (123), but even a blind man can see it is nowhere near a fair comparison.

Redhat is made up of the core operating system, and thousands of third party applications that people can choose to install. (or not). 99% of the 633 security flaws found in Redhat Linux were in the third party applications, only 1% were in the core OS.

Windows however, only had 123 bugs, but 96% of them were in the core operating system. Since 3rd party apps are not supplied or supported by Microsoft however, all of their bugs did not get added to the total as they did in Redhat’s case.

Does anyone else think that this is perhaps not a fair comparison? I can tell you one thing, I’d rather have a core OS with 1% of 633 flaws (6.33), than one with 96% of 123 flaws 118.08. The OS results could just have easily been put “Windows had 118.08 more OS security flaws than Redhat Linux.”

With regards to Firefox, they also seem to be counting flaws that Mozilla have found themselves. We know they are not doing the same for IE, because Microsoft don’t announce flaws they find themselves. Again, not really a fair comparison.

Interesting however, is the patching statistics for IE and Firefox.

Out of eight zero-day bugs reported for Firefox in 2007, five have been patched, three of those in just over a week. Out of 10 zero-day IE bugs, only three were patched and the shortest patch time was 85 days.

(taken from here)

Microsoft’s best patch result was 85 days to release and only 3 out of 10 flaws patched, verses 5 out of 8 and just over a week for Firefox.

Statistics are all good and interesting, but taken in the wrong light, can paint a picture that is dangerously incorrect.

Microsoft risks alienating web developers with their unwillingness or inability to conform to standards and their secrecy surrounding Internet Explorer 8. I must admit to some amazement that they got to version 8 without web developers realizing that this is SOP for Microsoft and something they have done from the beginning. It seems that the only time you can really expect any openness, is when they are coming from behind and need some traction. When defending monopoly market share, they don’t seem to be able to do more than talk about interoperability, standards and the like. (ODF anyone?). Luckily for us, due to the ongoing success of Apple Safari & Mozilla Firefox, not to mention the growing range of Linux PC’s and laptops sold by giants like Asus and Walmart, Microsoft’s monopoly of the web browser is rather quickly being whittled away. That is great news as the Internet was designed to be useful to everyone, not to be held hostage by a commercial entity seemingly concerned with nothing but their own profits. (There is nothing wrong with being concerned about profits, as long as the actions stemming from such concern doesn’t prevent everyone else from striving to the same position.)

In other Microsoft news, apparently their hardware is just as vulnerable as their software has proven to be over the years. Using a Microsoft wireless keyboard can get your machine and all passwords used on it handed over to people some distance from you. Worse your machine need not even be connected to any network to be vulnerable. Apparently all you need do is use a Microsoft wireless keyboard and you are vulnerable.

In hardware news, Western Digital has released a fashionable range of external (and NAS) hard drives called “My Book”. They look cool, but apparently Western Digital has assumed that you want to pay them to police your files on your network. The client software (WD Anywhere Access) for the drives will not let you share a wide range of multimedia files on your network. Apparently you are to pay them handsomely for the privilege of the software you purchased presuming you are a criminal.

Lastly, could this finally be the time for of Desktop Linux getting widespread adoption? First we had Tivo running Linux, now we have a range of Linux PC’s showing up in huge shopping chains, then Google makes a bid to have Linux become the standard in mobile communication Operating Systems. Linux seems to be popping up everywhere. The majority of the top 500 super computers are running Linux (including #1) and now it’s going for the low end as well. It doesn’t matter if you are a fan of Windows, Linux or Apple, this is good news, because it means that Microsoft and possibly Apple will have to lower prices and compete when Linux gains widespread acceptance from the newbie crowd. In addition, everyone is looking to a future where software runs over the Internet, and for the underlying Operating System to be less and less significant. For that to happen no one company can be allowed to steer the direction by using existing market share. The rise of Apple, the growth of Linux and the innovation of Google are going to see that the future of personal (and mobile) computing is not steered by any one company.

Apple has announced that they are releasing a version of the Safari web browser for Windows. Apple say that Safari for Windows is twice as fast as Internet Explorer (is that saying much?) and that a beta release is available for XP and Vista.

It will be interesting to see if the Windows and Mac versions render the same (unlike MS IE on Windows and Mac). Also interesting is the fact that Safari’s rendering engine is in part based on KHTML the Linux/*nix GUI, which will hopefully help raise the status of Open Source code even more.

Many people (myself included) were not terribly impressed with the layout of Windows Itunes, hopefully Safari will be a more intuitive experience. If we (as web developers) are really lucky, Safari will end up with 25% market share (who knows, perhaps the Iphone will drive that since it comes with Safari.) and the rest is divided between Firefox, IE and Opera. That way it will be impossible for any one browser to drive developers away from W3C standards ever again.

See Apple/Safari for more details.

Last month I posted a short rant entitled Unusual CSS Reference after noticing that a W3C page called Learning CSS reported CSS and HTML errors when I attempted to validate it. The page’s hover effects also looked better in IE6 than in Firefox and Opera.

This drew comment from W3C representative Bert Bos, who wrote to me. His message reads:

(more…)

I was working away on a new web page tonight, checking that my CSS mark-up was valid. Once I got the good news I became distracted and started following links on the World Wide Web Consortium (W3C) site. I stumbled across a reference guide to Learning CSS.

I was quite surprised by the ugly hover effect assigned to links on the page; gray with a heavy red border. I was then further surprised to discover just how differently this page acts between Firefox / Opera and Internet Explorer 6. The page appears to have been written to look appealing in IE6, and appalling in FF and Opera! I would have expected the W3C to set a good example by presenting its own CSS pages using CSS code that works well in both of these browsers.

But the fun doesn’t stop there! I tried to validate the CSS on this CSS resource only to discover that the W3C’s own validator detected 3 errors and 90 warnings in the code! Furthermore, the HTML on the page suffers from 5 mark-up errors and no Doctype!

Who would have thought that the body responsible for the promotion of compliant CSS and HTML code would set such a poor example???

Earlier this year I waffled on about a Windows Update utility for Firefox, called WindizUpdate. I was pretty impressed at the time and used the utility for a few months, but I was left wanting due to a lag between Microsoft releasing updates and finding that they were available for WindizUpdate. Now I’ve found something I like even more.

IE Tab is an extension for Firefox which embeds Internet Explorer in a Firefox tab. Unlike the IE View extension which simply opens selected pages in a separate Internet Explorer window, IE Tab displays selected pages using the IE engine but contained wholly within a Firefox tab.

So, why might this be useful? I currently use Internet Explorer exclusively for two reasons:

1. To run Microsoft Update / Windows Update, which won’t otherwise work in any other browser.
2. To check web pages as I develop them, to ensure that my pages look consistent between browsers.

Now with IE Tab I can do both of these things from within Firefox, simply by right-clicking and selecting “View Page in IE Tab”. And to mark the happy occasion of first running Microsoft Update within Firefox I snapped this celebratory picture for you:

Yes, I realise that using IE Tab really means that I’m using IE. But if nothing else I’m enjoying the convenience of doing it all from within a Firefox window.

Internet Explorer 7 has been available for download for about a fortnight, but it wasn’t until today that I received my first task-bar prompt to update from IE6 to IE7 via Microsoft Update / Windows Update. As Don mentioned in an earlier post folks who develop and test web pages would be wise to run both IE6 and IE7 (on different PCs) until IE6 usage drops away, and this High Priority Update is the first step towards that goal.

In the interests of dumping the dud that is IE6, my guess is that this High Priority Update will see most personal Windows users migrate over the next few weeks via Microsoft Update. This would leave corporate and small business users at the mercy of system administrators to update SOEs in their own sweet time. And with IE7 only able to run on Windows XP (or higher) and many businesses still running Windows 2000, this will be “a journey” for many. Point in case is my employer, who only recently rolled out XP nearly 5 years after I first started running it on my home PCs. The other group of users, unable to update from IE6 at all, will be those people running an ancient version of Windows or one that fails the “genuine Microsoft product” test.

After all of this, the next round of IE7 converts will probably come from people buying new PCs or otherwise upgrading to Windows Vista from early 2007.

As a fan of Firefox and Opera I only run Internet Explorer (6 & 7 now) as a tool to check web pages as I develop them. But I’m certainly looking forward to the day when IE6 usage statistics reflect those of IE5 and earlier versions, and then I can trash it forever!