Firefox Hit by Fewer Flaws Than IE in 2006

According to Symantec, Mozilla's Firefox suffered from 26 percent fewer vulnerabilities in the second half of 2006.
Gregg Keizer, Computerworld
Wednesday, March 21, 2007 01:00 AM PDT


Mozilla Corp.'s Firefox suffered from 26 percent fewer vulnerabilities in the second half of 2006 than Microsoft Corp.'s Internet Explorer, a security company's research said Monday.
According to Symantec's tally, 40 Firefox vulnerabilities were disclosed between August and December 2006; Internet Explorer (IE), meanwhile, was hit with 54 bugs. Opera and Safari -- the browser Apple Inc. bundles with Mac OS X -- had four flaws each.

For all of 2006, however, the numbers were nearly neck and neck: Firefox was nailed by 87 flaws during the 12 months, IE by 92. The trend line also put Firefox in the better light. The open-source browser had 15 percent fewer vulnerabilities in the second half of the year compared to the first, while IE's total increased 42 percent during the period.

"Internet Explorer was particularly affected by concerted efforts to 'fuzz' the browser for new vulnerabilities," said the Symantec report, which cited July's 'Month of Browser Bugs' project as a big contributor. "The majority reported affected Internet Explorer or Windows components accessible through the browser," Symantec said.

To add insult to injury to IE, Mozilla developers patched Firefox five times faster than did Microsoft's. On average, Firefox had an attack exposure window -- the amount of time between the disclosure of a bug and when it was patched -- of just two days based on a sample set of 26 flaws. By comparison, Microsoft took an average of 10 days to patch the sample 15 vulnerabilities. Both vendors' attack windows were a day longer in the second half of the year than in the first six months.

"Web browsers continue to be the big exploit area," said Vincent Weafer, senior director of Symantec's security response team "And they will increasingly be more important as more data reside on the back end, as Web applications become more popular."

The most recent data pegged IE's market share at 79.1 percent and Firefox's at 14.2 percent. Safari and Opera came in third and fourth, respectively, with 4.9 percent and 0.79 percent.
Symantec's twice-annual Internet security threat report can be found on the Cupertino, Calif., company's Web site.

For more enterprise computing news, visit Computerworld.
Story copyright © 2007 Computerworld Inc. All rights reserved.

Computer #2: Google Expands Pay-Per-Action Ads Test

In the new model advertisers would pay only when the ad-click yeilds a specific result.
Juan Carlos Perez, IDG News Service
Tuesday, March 20, 2007 04:00 PM PDT
Source: http://www.pcworld.com/article/id,130013-c,techindustrytrends/article.html

Google Inc. is expanding a test it began last year of pay-per-action ads, an ad format that is similar to pay-per-click ads but that experts say is much less prone to click fraud.
In the pay-per-action (PPA) model, advertisers pay whenever the click on the ad yields a specific result, such as when users purchase something or complete an online form.
On Tuesday, Google opened up its PPA test to more advertisers and publishers and gave them more automated tools for things like designing campaigns and creating ads, said Rob Kniaz, product manager for Google's advertising products.

The PPA ads run only on the AdSense for Content network of partner sites for now, and are only available to U.S. advertisers and publishers. Site publishers can select individual ads, a set of ads or opt to have ads run that are contextually related to their site's content.
Participation in the PPA test is by invitation only. Publishers and advertisers can request to be included by going to the program's Web page.

Unlike PPA ads, the pay-per-click (PPC) model calls for advertisers to pay whenever a user clicks on their ads. PPC ads are vulnerable to click fraud, which occurs when someone clicks on a PPC ad without any intent to do business with the advertiser. Reasons for engaging in click fraud include the desire of a site publisher to increase commission revenue or the attempt by an advertiser's competitor to drive up its ad spending.