Not very CLICKY

Safari was the first to fall, then IE8, then FF.
And the iPhone isn't secure either. No mention of Opera though.

So how safe do you feel online?

I feel safe enough. Vulnerabilities should only become problems if you put yourself at risk.

this, having a secure browser is one thing, but the best form of anti-malware is common sense

How many exploits are killed by NoScript?

I don't know, it doesn't say. But I do feel safer online sitting behind NoScript.

I feel fairly safe. I avoid dodgy sites if possible. It is just as people say common sense. Though I do try and use as much protection as possible.

Good to see some balanced coverage over at Macworld.

Not a single mention in that article that Safari was hacked.
Unbelievable, and I'm a Mac user. I don't need to be protected from finding out that Safari can be hacked.

So how does it all work?

How does he get past the firewall or whatever it is that stops them getting in? Do they have to have physical access to the machine?

I don't know the first thing about this sort of stuff.

There is a mention of him hacking it last year.

They aren't allowed physical access to the machines.

They have to remotely execute code.

The iPhone hack "took 20 seconds", at CanSec West... It tool another 2.6 million seconds to set up the hack, ready for those 20 seconds. It uses social engineering to get the gullible user to visit a pre-prepared website.

The firewall is irrelevant, as the attack is started at the users request (they have to go to the infected website and tell it to download the exploit). Therefore the firewall won't do anything to stop it. Same for anti-malware tools, if it is a new exploit, chances are it won't even raise its eyebrows, let alone an alarm...

You need to be tricked into visiting a prepared site, or the hackers need to take over a safe site (like the New York Times and Digg advertising hacks last year and last week respectively).

It is the reason that I always use Firefox with NoScript installed and FlashBlock... I only use Safari, Chrome and IE as second string browsers, for visiting trusted sites. I'd switch to Safari or Chrome tomorrow, if they had an add-on to allow me to selectively run scripts, like NoScript does.

Edit: One other thing to note, a lot of the new attacks are "spear phishing" attacks, where they go after a specific target or targets, like the Google and 20 other targeted companies back at the end of last year, beginning of this year.

The fact that they complemented the IE8 attacks shows that Microsoft have seriously upped the defences. Good for Microsoft.

A lot are probably Flash based....so if you allow flash... quite a few

Anyone for a Vi based internet browser? No risk of vulnerabilities as it can only display text!

I have click to flash and that blocks a lot of flash, particularly those annoying noisy ads. I have not managed to go NoScript running yet.

Flashblock FTW.