Gee I'm glad I have a Mac! ;)

Microsoft says that Windows users should disable ActiveX and active scripting controls.

The Microsoft Security Respose Advisory # 925444 indicates the following.

At Risk:
Microsoft Internet Explorer on Windows 2000 Service Pack 4, on Windows XP Service Pack 1, and on Windows XP Service Pack 2.

Not At Risk:
Customers who are running Windows Server 2003 and Windows Server 2003 Service Pack 1 in their default configurations, with the Enhanced Security Configuration turned on, are not affected.

For those who still don't know, there is a new browser in town called Mozilla Firefox.
Well, not so new, but so much better...
What are people waiting for?

Today's Firefox security update [webmasterworld.com]. ;)

Any software that achieves significant market acceptance will be subject to hack attempts.

The difference is the Firefox update is a fix to a potential hole while IEs announcement is an unpatched hole.

In addition, from what I'm reading, popularity or high usage of a product does not indicate it will automatically become a target for abuse.

Firefox has had a security update as well

Whats important is not whether you are safe, but whether or not the general public actuallly does disable activeX controls. This has rather huge implications for any flash websites or content.

If memory serves, I don't believe this is the first time we've been told to disable ActiveX on IE. I've had it explicitly turned off for quite some time. Only a select few trusted sites are allowed to run ActiveX on my machines.

At least half the websites I visit regularly are all flash or use flash extensively. Running without activeX is not an option. Firefox has been the answer for me for quite a while now. If Sirius would get their act together I would never use IE other than testing my own sites.

Their have been recommendations to turn off activeX several times in the past. It didn't seem too many people listened in the past.

The whole Internet security system is set up on Windows so that you can allow ActiveX for those sites you regularly visit but deny it for everywhere else. That's the way I've been using IE since the first time they had these problems. You just have to go through the process of adding those sites to the appropriate security group once. After that you're a bit more secure.

Some experts believe the timing of the new attack is no coincidence, suggesting that attackers look to take advantage of a full month before Microsoft is scheduled to release its next bunch of fixes.

And the reason why they can't release a patch in mid-month?

They can, and sometimes do issue patches outside of the regularly scheduled Patch Tuesday. If this vulnerability is being actively taken advantage of on the net you can probably expect to see a patch sooner.