IE8-Get_240x108 At first I intended to ignore the new IE bashing wave that surged after the Google hack of December 2009. But then I read Deb Shinder’s article about the topic. Even though her analysis is quite correct, I can’t help from adding a few of my own thoughts.

As noted a few weeks ago, I have a serious problem with all kinds of mass hysteria phenomena. The age old-IE bashing campaigns definitely fall into this category. Shortly after it became public that Internet Explorer played a major role in the Google hack, countless self-styled security experts, exhorting journalists, and even clueless governments felt obliged to recommend switching to an alternative browser.

Firefox certainly earned its market share due to its plug-in eco system. However, I think a significant part of this market share is based on these irrational warnings in IT tabloids. Every time a new serious IE vulnerability is found, new finger waving articles pop up warning people how insecure it is to use Internet Explorer and that the Open Source browser is by far the better choice.

As Deb Shinder correctly notes, Firefox and all other browser are also prone to security holes. Now, I am asking you, did you ever read a warning not to use Firefox because of a serious vulnerability, even if only temporarily until a patch is available? I regularly read the feeds of all major news sites and a ton of IT blogs, but I have never seen such a warning.

Did you ever wonder why? Because it is a matter of fact that Firefox is a secure browser? Did you know that Firefox is the most vulnerable browser? It is quite probable that you don’t know this because this news has mostly been neglected by the media. It is simply not popular to bash Firefox. IE bashing on the other hand has a tradition and as an callow IT journalist you can’t do much wrong by publishing another IE warning.

This works exactly as it did in the Vista bashing campaigns. After a while readers become used to such articles and start nodding automatically while reading. It is this “everyone agrees” attitude that makes most people vulnerable to false beliefs. Yes, we all know that our planet only recently became a sphere because in the Middle Age everyone agreed for over a thousand years that the earth is a disk.

So what are the facts? As a matter of fact, there are no solid facts that would justify any kind of assessment regarding the security of Internet Explorer or Firefox. Yes, there are quite a few statistics that count vulnerabilities and measure publisher’s response times. Some are in favor of alternative browsers and some are in favor of Microsoft. As with most statistics it depends mostly on the results the corresponding researcher wants to get.

This is all very interesting. However, when it comes to security the vulnerabilities of a piece of software are absolutely unimportant. Most self-styled security experts make the mistake of confusing “vulnerable” with “insecure.”

A simple analogy will make this profound difference clear. Most people are vulnerable to the rabies virus. Rabies is a serious disease and can be fatal. But does this mean that people who are not vaccinated live an insecure life? Yes, if you live in a slum somewhere in Southeast Asia, then being not vaccinated indeed poses a certain security risk. But no New York journalist in his right mind would recommend a rabies inoculation to his fellow citizens because the side effects are severe and the risk of getting infected in Manhattan is relatively low.

Why is it so different with Internet Explorer? Moving a whole corporate network to a new browser also has serious side effects, which doesn’t stop journalists and even governments from recommending this step. The point is that nobody really knows how dangerous it is to use a browser that has certain vulnerability. The fact that a popular company such as Google was hacked because some of their employees were still using Internet Explorer 6 says really nothing about the risks for your own company. Obviously, those guys were not only using a hopelessly outdated browser version (and operating system), but they also had been surfing in highly infectious waters somewhere in Asia.

When it comes to browser security, the only fact that counts is how many sites are infected by a certain exploit and how likely it is that your users will access those sites until you have deployed the corresponding update. There is no such data available for the Google hack vulnerability, but self-styled security experts know anyway that you should “inoculate” all your PCs with another browser regardless of the costs and side effects. This is highly irrational. E pur si muove.