It's an interesting way of looking at it, but it seems like a stretch to equate it so directly with "security". Who's to say the newest version of Firefox has fewer vulnerabilities than the previous version of Safari, or vice-versa? If Mozilla releases an update to Firefox tomorrow, that will not suddenly make the current version of any other browser more secure than today's version of Firefox.

I'll bet a VERY high percentage of IE for Mac users are using the latest version. That doesn't make it secure.

How current the installed base is more a function of factors other than security. Firefox was pushing for a record number of downloads to speed its adoption plus it still has an air of 'geek cred'. IE has not been updated for the Mac in years so nearly everyone has "the latest version" even though it's not very current. IE7 has been a slow update because (such as at my company) some corporations have not approved it's adoption yet.

I think it's a stretch to assume that, as Mikuro pointed out, latest=most secure. I also think it's a stretch to assume that people update primarily because of security.

Given these two, what I view as unwarranted logical assumptions I'm skeptical of the papers conclusion.

This is a very, very lame analysis. Or rather, the analysis was perhaps thorough, but the original hypothesis is utter garbage. I could propose that the first version of Mosaic from the mid-90's is the most secure web browser and prove it based on the fact that the only thing it could display was text and inline graphics. This would contradict the "latest is most secure" theory, thus proving it invalid.

Ridiculous? Yes. But no more ridiculous that what this paper concludes.

The hypothesis is most certainly not absurd. Remember the pwn to own contest? It utilized a known weakness in Safari that hadn't been patched yet--at least on the computer being used in the contest (I don't remember the specifics at this moment). The premise is that any discovered holes--that attackers would be aware of--are typically fixed in the latest release, thus, by virtue of the plugging of known holes, it is more secure. Of course, the one downside of this approach to security is that no one knows if some cracker/thug already knows about some unpatched hole, and is preparing to deploy something to exploit this unknown hole. However, since most people who do these things are rather lame, and not so technicially capable as that, I suppose it's not so much a worry as it could be.

However, in any case, the hypothesis is _not_ absurd. Read the second paragraph again:

Quote

Now that modern software and hardware firewalls have blocked incoming intrusions via TCP/IP ports, the most favored method of attack on computers connected to the Internet is via data returned to the Web browser that exploits browser code or plug-in vulnerabilities. As a result, keeping the browser updated to the latest version these days is paramount.

It's the rest of the premise that has me curious.... It's more about a critique on the various update methods used by the various browsers. Firefox _has_ to use the update method it uses, because it's not connected with an OS. By virtue of it's being third-party, it will always win such "contests." It was not by design that Firefox is more "secure" in this manner.

-Jon

Browser with unpatched holes can`t be most secure at all. Now all FireFox 2/3 versions have upatched highly critical vulnerability that "can be exploited to execute arbitrary code e.g. when a user visits a specially crafted web page". See Secunia advisory for details at http://secunia.com/advisories/30761/

OK - tell me about these "specially crafted web pages". Where are they? Are there any genuinely malicious ones around? How come I'm not tripping over them all the time?

And when I get there, will my computer spontaneously burst into flames? will my bank account be sucked dry? will my wife leave me for another operating system?

When the breakins exist at a rate of more than one part in infinity, I'll start getting worried.

In the meantime I will continue to practise safe hex. As we all should. But frightened I am not.

Did anyone look at the chart? Opera seems to be in second place, currently.