Over the last few days I've seen several stories around the release of the Firefox 1.0.3 update with ridiculous headlines like "Firefox Comes Under Attack", "Firefox Singed By Security Holes", and "Security Holes Bite Firefox".
I understand that sensational sells, and I'm sorry to be the bearer of bad news for all of the lazy journalists out there, but Firefox wasn't hit, or attacked, or bitten, or singed, by anything.
The lazyman's story seems to be that as Firefox's popularity grows, so will the attacks, bites, singes, hits, etc. This is not at all what we're seeing here. What we're seeing here is that as Firefox's popularity grows, so does the Firefox community. That community has grown to include tens of millions of new users, almost 100,000 Firefox evangelists, tens of thousands of new bug reporters and testers, and quite a few new and very capable security investigators. We're pleased to have more people developing, testing, and thinking about Firefox -- and most importantly, working directly with the Firefox team to help us improve our world-class browser.
See, that's a major difference between our open process and the closed processes of our competitors. When security experts, many of whom are are in it for the thrill of solving these kinds of complex problems, are ignored or slighted, or attacked by a vendor, they are left with little recourse except to post the exploits publicly in the hope that doing so will shine a bright spotlight on the problem and force the hand of the vendor. With Firefox, those same security researchers and experts can engage directly with our development team, participating in the tasks of investigating, solving, and testing the problems and be rewarded for it with public recognition (and in cases of the most serious issues, financial recognition).
Our open development process welcomes the growing community of experts who are willing to contribute their skills to our project. The more popular the Firefox project gets, the more likely we are to continue attracting these high-value contributors and the result will be a better Firefox web browser and a faster, safer, and more secure internet experience for our users.
So, what should these headlines have read? Well, how about "Firefox Project Attracts More Security Experts" or "Firefox Security Community Grows" :-)
Cross-posted from adot's notblog*, my primary weblog. |
By Fred Langa @ InformationWeek
Posted on: 2005-04-20 18:33:23