It's very very complicated and to this day the answer still pretty much depends on whether you buy into the opensource development paradigm or the closed source paradigm.Mirrormere wrote:But isn't FF open source? Are you not more vulnerable to malicious code using FF?
Opensource code is publicly viewable so in theory any holes in it have just as much chance as being spotted legitimately as by people looking to cause mischief, the holes can also be fixed by anyone with sufficient knowledge. That leads to more flaws being found as oppose to closed source products which skews results to make the software look buggy.
This leads to flaws/exploits having to be weighted as to how severe they are and how quickly they're patched by the supplier to try and make a comparison, and those rules are highly subjective.
Microsoft software usually comes out on top but most people agree that finding flaws in code is not a problem, it's getting them fixed and dealing with holes in the code that nobody knows about but crackers/criminals.
Conversely closed source products are more prevalent so are a more obvious vector of attack, hence whilst there are faults in for example Firefox IE is a far more juicy target due to its user base.
However Apache tends to disprove that line, since it has the market share in web servers and yet IIS (Microsoft web server) is attacked more often.
You makes you choice and takes your chances.
