Slashdot Mirror
IE Shines On Broken Code
mschaef writes "While reading Larry Osterman'a blog (He's a long time Microsoftie, having worked on products dating back to DOS 4.0), I ran across this BugTraq entry on web browser security. Basically, the story is that Michael Zalewski started feeding randomly malformed HTML into Microsoft Internet Explorer, Mozilla, Opera, Lynx, and Links and watching what happened. Bottom line: 'All browsers but Microsoft Internet Explorer kept crashing on a regular basis due to NULL pointer references, memory corruption, buffer overflows, sometimes memory exhaustion; taking several minutes on average to encounter a tag they couldn't parse.' If you want to try this at home, he's also provided the tools he used in the BugTraq entry."
There's a good phrase I can use to explain this one:
If you work in a monkey house, you expect to be pelted with shit.
I'd love to read the article, but the page seems to contain malformed HTML...
They didn't say that IE also started randomly installing Bonzi Buddy et al during the test, the users' credit card numbers were automagically emailed to Romania, there was an sudden increase in outbound port 25 traffic from the system, and they ended the session with about 37 momre toolbars installed then they started with.
Does the fact that most of the browsers crash mean that they are vunerable in some way? or does the fact that they do crash a good thing?
... the broken app is the king!
...a benchmark that actually measures real-world performance.
He starts sending bad data...data the program wasn't intended to read...it crashes...and this make them just as bad as IE? I tried to cat a binary once. My screen shat.
Thats the thing about randomness. You can never be sure.
/. is a bunch of nerds at a million typewriters. It's not a political conspiracy determined to undermine your beliefs.
Tell me, Mr. Anderson, what good is a browser when you are unable to access the net?
Yep, the first mozilla_die entry crashes Mozilla 1.8a4 for me, too. Sounds like the tests are repeatable enough. Now quick, everybody rush to file bug reports and the winners can collect their $500!
What a fool believes, he sees, no wise man has the power to reason away.
$ badhtml.o | /dev/null
hey, my script doesn't crash either, and it's only one line! of course, the caveat is that it only displays GOOD tags about as well as IE, too...
As a web developer, I find it infuriating that users use a proprietary browser which takes standards-compliant code that results in perfectly good, beautiful pages in every other browser... and mangles it.
The World Wide Web is dying. Soon, we shall have only the Internet.
I have a worse CD.. if you put it in the drive then it starts to install Windows 98 :(