Information Security & US & Life & Love & Fashion & Hacking & Passion

It's probably the most important and debated piece of software on the modern computer. See how your fellow readers get around the net, and vote for your favorite web browser, in this week's Hive Five.

Picture background created with WEB2DNA Art Project.

The only proper way to follow up on the passionate flurry of voting that last week's Hive Five Best Linux Distributions created was to ask you about your favorite web browser. You didn't disappoint—Lifehacker readers came out in force, logging nearly a thousand votes to support their favorite browsers. We've tallied up the votes and we're here to share the top five browsers.

Chrome

Windows only (for practical purposes, but soon on Mac and Linux, if we're lucky): Some browsers have roots going back to the early 1990s—Chrome, on the other hand, is the new kid on the block. Although Chrome has a distant relationship to Konqueror and is a cousin to the Safari web browser—both share the speedy WebKit rendering engine—Google's browser is less than a year old. Despite its youth, it's already garnered praise for its minimalist interface and snappy page rendering. Chrome also handles site errors and quirks well, and each individual tab is a unique process, so a crash or lag in one shouldn't pull down or crash the others. In general, though, Chrome has caught attention for running a performance-focused JavaScript engine in a lightweight GUI. Also worth noting, Chrome has been holding its own in the recent Pwn2Own security challenge, with the distinction of being the only browser left standing after the first day of security exploits and attacks. For a closer look at Chrome, check out our screenshot tour.

Opera

Windows/Mac/Linux: Opera is a rock-solid browser with roots stretching back to 1994. Many of the features baked right into Opera are either not implemented in other browsers, or require multiple extensions at the cost of system resources—navigation by mouse gestures is one of the flashier examples. Despite being feature-packed, Opera has a fairly small market share, due largely in part to being trialware up until 2000 and advertisement-supported until 2005—many people were turned off by the expense, if not the ads. Still, Opera proponents have long claimed that Opera beats Internet Explorer and Firefox when it comes to speedy rendering. Another selling point for Opera is the quality of the built-in tools. For many users, the built-in RSS reader, email client, and BitTorrent client do their jobs admirably, cutting down on the number applications they need running at once. Opera is extensible, but the pool of available extensions is radically smaller than that available for Firefox. More screenshots and details on Opera's features are available here.

Firefox

Windows/Mac/Linux: Firefox is the grandchild of the venerable Mosaic browser and free-roaming son of Netscape. Although Firefox has a myriad of user-friendly, forward-thinking features, a decently secure framework, and an open-source ideology, its most prominent is extensibility. When convincing a Firefox user to abandon Firefox for anything else, even temporarily, you won't have to fight them over giving up the AwesomeBar or about:config tweaks—you'll hear a common, understandable refrain: "What about my extensions?" The repository of extensions maintained by Mozilla currently has over 6,000 entries, covering everything from blocking advertisements, to managing your clipboard, to allowing you to further customize your browsing experience with scripts a la Greasemonkey (here's 10 of our must-have picks). Combine the passion people have for extensions and the ability to sync those extensions across multiple computers and portable installations, and you've got a force to be contended with. For a closer look at Firefox, make sure to check out our power user's guide to Firefox 3 and the top 10 Firefox 3 features.

Internet Explorer

Windows only: Internet Explorer still commands a healthy chunk of the browser market, mostly because it ships with the most popular operating system on Earth and fits, if not exactly elegantly, into corporate computer plans. While many or most IE users stick with it for lack of wanting to try something else, Lifehacker readers definitely don't fall into that crowd—the majority of readers who voted in favor of Internet Explorer are sporting Internet Explorer 8. By contrast, nearly 20 percent of those surfing the web right now are using Internet Explorer 6, which had its initial release in 2001. Version 8 could mark a resurgence for the brand, though. It's the first version of Internet Explorer to have a strong focus on web standards compliance, as well as increasing rendering speed. And like Chrome, Internet Explorer 8 maintains a separate process for each tab to increase stability and security. Internet Explorer 8 has also beefed up its security measures from previous versions, including active filtering against malicious cross-site scripting and ActiveX isolation from the core of the browser. For more information about what's new in Internet Explorer 8 check out our screenshot tour and overview.

Safari

Windows/Mac: Safari is Apple's contribution to the web browsing world, built originally to fit snugly inside OS X. Like Chrome, Safari runs the speedy WebKit rendering engine for snappy page loads. In addition to its WebKit core, Safari also has the Nitro JavaScript engine, which lays claim to radically faster JavaScript execution than Internet Explorer and Firefox (in its own testing reports, anyways). Safari sports Apple's Cover Flow browser for perusing your history and bookmarks and an eye-catching display of the top 24 sites you've visited as the default page when Safari is loaded. For more features, check out our screenshot tour.

You've seen the top contenders. Now it's time to log your vote for the best browser:

TITLE:
Microsoft Internet Explorer Two Code Execution Vulnerabilities

SECUNIA ADVISORY ID:
SA33845

VERIFY ADVISORY:
http://secunia.com/advisories/33845/

CRITICAL:
Highly critical

IMPACT:
System access

WHERE:
From remote

SOFTWARE:
Microsoft Internet Explorer 7.x
http://secunia.com/advisories/product/12366/

DESCRIPTION:
Two vulnerabilities have been reported in Microsoft Internet
Explorer, which can be exploited by malicious people to compromise a
user's system.

1) An unspecified error exists due to the use of a previously deleted
object. This can be exploited to corrupt memory and execute arbitrary
code when a user e.g. visits a malicious web site.

2) An unspecified error exists within the handling of Cascading Style
Sheets (CSS). This can be exploited to cause a memory corruption and
execute arbitrary code when a user e.g. visits a specially crafted
web site.

SOLUTION:
Apply patches.

Windows XP SP2/SP3:
http://www.microsoft.com/downloads/details.aspx?familyid=8cd902ec-e018-4b61-80f9-825d973f998e

Windows XP Professional x64 Edition (optionally with SP2):
http://www.microsoft.com/downloads/details.aspx?familyid=dd3e2236-9cc0-478e-a46c-981ef685c0e3

Windows Server 2003 SP1/SP2:
http://www.microsoft.com/downloads/details.aspx?familyid=e52aa1fd-e694-4322-b3ff-6abc1b4a16fe

Windows Server 2003 x64 Edition (optionally with SP2):
http://www.microsoft.com/downloads/details.aspx?familyid=edbf1566-b96b-4c7d-98fe-b15f8e766792

Windows Server 2003 with SP1/SP2 for Itanium-based systems:
http://www.microsoft.com/downloads/details.aspx?familyid=5ce78797-d1c0-40d4-84e1-1004389833be

Windows Vista (optionally with SP1):
http://www.microsoft.com/downloads/details.aspx?familyid=5f9fa4b6-85a4-43bc-b84f-6bd847799650

Windows Vista x64 Edition (optionally with SP1):
http://www.microsoft.com/downloads/details.aspx?familyid=e9a8c94b-b9d2-4d64-855f-b5f02ce3dfb5

Windows Server 2008 for 32-bit Systems:
http://www.microsoft.com/downloads/details.aspx?familyid=2491dbf2-7cd3-44f1-bfad-77e6f760a25c

Windows Server 2008 for x64-based Systems:
http://www.microsoft.com/downloads/details.aspx?familyid=794373cc-2dce-4ef5-af50-7804c622c230

Windows Server 2008 for Itanium-based systems:
http://www.microsoft.com/downloads/details.aspx?familyid=11985325-4b33-4077-82cf-6afc7a71c510

PROVIDED AND/OR DISCOVERED BY:
The vendor credits:
1) Zero Day Initiative
2) Sam Thomas via Zero Day Initiative.

ORIGINAL ADVISORY:
MS09-002 (KB961260):
http://www.microsoft.com/technet/security/bulletin/ms09-002.mspx

----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


                   National Cyber Alert System

                 Cyber Security Alert SA08-352A


Microsoft Internet Explorer Data Binding Vulnerability

  Original release date: December 17, 2008
  Last revised: --
  Source: US-CERT


Systems Affected

    * Microsoft Internet Explorer
    * Microsoft Outlook Express
    * Other software that uses Internet Explorer components to render documents


Overview

  A vulnerability in Internet Explorer could allow an attacker to
  take control of your computer.


Solution

  Apply an update

  The updates to address these vulnerabilities are available on the
  Microsoft Update site. We recommend enabling Automatic Updates.

  Disable Active Scripting  This vulnerability can be mitigated by
  disabling Active Scripting in the Internet Zone, as specified in
  the Securing Your Web Browser document. Note that this will not
  block the vulnerability, but it will help to protect your computer
  against a common method used to execute this vulnerability.
  Enable DEP in Internet Explorer 7  Enabling DEP in Internet
  Explorer 7 on Windows Vista can help mitigate this vulnerability by
  making it more difficult to achieve code execution using this
  vulnerability.


Description

  When rendering certain documents, Internet Explorer may crash or
  allow an attacker to run code on your computer. The attacker could
  install malicious software or access sensitive personal
  information. Attackers are actively exploiting this vulnerability.

  For more technical information, see US-CERT Technical Alert
  TA08-352A and US-CERT Vulnerability Note VU#493881.


References

 * US-CERT Technical Cyber Security Alert TA08-352A -
  <http://www.us-cert.gov/cas/techalerts/TA08-352A.html>

 * Microsoft Security Bulletin MS08-078 -
  <https://www.microsoft.com/technet/security/bulletin/ms08-078.mspx>

 * US-CERT Vulnerability Note VU#493881 -
  <http://www.kb.cert.org/vuls/id/493881>

 * Securing Your Web Browser -
  <https://www.us-cert.gov/reading_room/securing_browser/#Internet_Explorer>

 ______________________________