Question

Perhaps not directly programming related, but definitely product / commercially related. And I can’t find a dupe, so I thought I would ask.

I have had a bit of trouble trying to figure out what best to say to people who have called and asked for advice. The Microsoft message is a bit worrying – basically, be worried, lock up everything and hold on tight. Some of the people I have directed towards that route have objected because of what it does to their browsing experience.

The ‘go get Firefox’ message seems to be going down a bit better. What is the real story and what is the best advice to give?

How much actual risk does it pose between now and when MS patches it?

Edit: here are the links that my community seem to be reading… WSJ NP BBC

Answer 1

• Use Firefox
• Use NoSript (if you want proper defence in depth). I can simply say 95+% of all client-side exploits requires JavaScript and 90% of the time these are loaded from a 3rd party website. Therefore switching FF and using NoScript is a really good solution.

How much actual risk does it pose between now and when MS patches it?

If you look at 0days in IE there are bunch of them, and IE got the worst security track. Also it’s one of the most targeted application for attackers because there is clear profit in it. Therefore using IE generally not a good idea.

If you have to use IE,

• Use protected mode
• Use the latest stable version
• Keep your windows updated
• Run it as least priviliged user
• Use a process control and personal firewall application such as Comodo Firewall (process control application if you can use them right can solve many of these problems, but got a massive overhead in user)

Details of previous IE issues, there are lots of them!

• http://secunia.com/advisories/product/11/?task=advisories (IE 6)
• http://secunia.com/advisories/product/12366/?task=advisories (IE 7)

You can inform them to patch by following some workarounds but as you notice it’s not going to save them on the long run.