Feeds

Mozilla security takes axe to redundant code

Slim is in

SANS - Survey on application security programs

Mozilla Corporation has hired a former security strategist from Microsoft as part of its efforts to improve the security of its software, in particular its flagship Firefox web browser software.

Window Snyder (sic), Mozilla's new Chief Security Something, an unusual job description but one not out of keeping for an organisation that used to to be run by someone who rejoiced under the title of Chief Lizard Wrangler, has pledged to trim redundant code in a bid to bolster security.

"We want to reduce the overall risk [to Firefox] by evaluating where there are unused features, and then getting rid of that old code... We want Firefox to have a tighter code base," she told Techworld. Snyder founded security consultancy @stake before joining Microsoft, where she was involved in signing off the code for Windows XP SP2 and Windows Server 2003, before leaving to found Matasano Security. She joined Mozilla last week.

Snyder's plans to cut Firefox down to size don't necessarily imply that future versions of the browser will be designed from scratch or that older features will disappear entirely. Features stripped from the general code base might be offered in the form of optional installs. After something of a honeymoon period, Firefox has come under fire form security firms such as Symantec in comparisons of the number of security flaws in Firefox compared to IE.

"Just counting up the bugs is not a good measure of how secure an application is," Snyder said, arguing that the severity of identified bugs needs to be taken into consideration. Mozilla produces patches for security vulnerabilities far more quickly than Redmond can manage, she added.

The next version of Firefox, in common with Microsoft upcoming IE 7 browser, will include anti-phishing technology. Further ahead, Snyder said Mozilla is evaluating the inclusion of memory management, managed code, and improved sandbox technology into the browser.

In related news, Mozilla released a security update for Firefox on Thursday. Firefox 1.5.0.7 contains a number of security and stability updates as explained by Secunia here. ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Arts and crafts store Michaels says 3 million credit cards exposed in breach
Meanwhile, Target investigators prepare for long process in nabbing hackers
prev story

Whitepapers

SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.