White List URL Browser Selector?

malcomvetter asks: "OK, so I'm stuck working in a Microsoft environment. My preference is Firefox for the external 'untrusted' web content out there and our internal 'trusted' web apps require IE, but rather than pick one browser over the other as 'default' I came up with this idea: I want a tool that gets installed as my default browser in Windows, and all URL strings that Windows passes to it can then be simply regex'ed for domain and then routed (re-passed) appropriately. Hence, having the ability to allow admins to maintain a white-list of 'trusted' IE sites (or [insert browser here] sites) and those URLs are passed to IE, all others defaulting to (in my preference) Firefox. And when I thought about it, I was surprised that I hadn't heard of an existing tool to do that. I have used the Firfox extension for 'open in IE', but I'd like a tool that I can configure and forget about. Has anyone seen such an app? Would it be an extremely hard thing to build?"

Comments

Two Possible Suggestions

[digitalvengeance]

As a developer who has been forced to use IE in applications in the past, I can say that the Microsoft "Web Browser Control" is basically the IE rendering engine encapsulated in an OCX. Its extremely simple to include this rendering engine in any windows application. I'd imagine it would be trivial to write a firefox extension* that parses the URL and loads an IE control in a new "empty" frame if the URL is on the white list, then passes the URL to the control to be handled.

We might be able to use one of the tabs modification extensions that already exists as a starting point for usurping default firefox tab behavior, and I'd be interested in helping with a project of this nature.

*I have no experience writing firefox plugins, but the variety that are available show that the architecture is fairly extensible.

A much simpler, but much less integrated approach would be to use a "URL Launcher." Basically, a program that determines if the domain from the URL entered is "IE-only" or not and fires the appropriate browser accordingly. This would be a 5-10 minute project for a good developer, but would be effective.

Josh.

Re:Two Possible Suggestions

[tolan-b]

What you describe regarding embedding the IE renderer in Firefox is basically what AOL are doing with their new experimental Firefox based browser.

Where are you typing in the URI?

[numbski]

If you're typing it into an address bar, then that address bar needs to be located someplace.

If you're talking about seamlessly browing from Site X (external) to Site Y (internal), then I suppose an XPI (possibly an edit to 'open in IE'?) that would detect the regex and spawn IE.

So far as the other way around....I don't see a good reason you'd be typing a URI into IE. So far as clicking links and having them spawn in Firefox, I don't really see a workable solution. :\

What part of the internal site 'demands' IE? I would hope not just the UserAgent string? ActiveX control? Have you tried the ActiveX XPI for Firefox?

Sounds like a job for the new Netscape..

[phaze3000]

Take a look at this article from a couple of days ago on the new Netscape. It can use either Gecko or IE rendering on a per-site basis.

It's still in beta at the moment, but I expect a final version to be out in the not too distant future.

Re:Sounds like a job for the new Netscape..

[booch]

Exactly. You can set the default renderer to be Mozilla's Gecko, and then have settings for individual pages, telling it to use the IE renderer. You can also define other settings for specifically listed sites, just like in Firefox.

Netscape Prototype

[Pan T. Hose]

It is based on Mozilla Firefox 1.0, and can switch between Gecko and IE for rendering the content. See this story for more details: New Netscape Browser Prototype Available.

Work off of the View in IE source.

[a whoabot]

Get the source for the View in IE extension for Firefox/Mozilla. Add to that a list and then when you go to a page on that list it automatically launches it in IE. That would certainly not be hard to build.

For some reason at time of posting, the whole mozdev.org site seems to be down, but otherwise I would have gotten the link to the View in IE extension.

There already is a pretty good blacklist

[Zocalo]

You check traditional DNSBLs like the XBL DNSBL list run by Spamhaus which list compromised systems. A better option however might be to also use the SURBLs that are used by SpamAssassin and similar anti-spam tools. Most of the domains listed have been spamvertised, but there is also a list for sites used in phishes. The next logical step would probably be a list of sites that try and install spyware or other unwanted binaries or scripts (cookies would be a bit much) on a visiting PC.

Since it works just like a DNSBL, you would need your plugin that grabs the URL, does a quick SURBL lookup and open a standard error page if it gets a 127.0.0.x response to the lookup. The option to continue anyway needs to be something that a network administrator can override, naturally. Best of all (and I can't believe I'm typing this), owing to the high level of integration of IE into Windows it might actually stop people from opening HTML spams in Outlook, inadvertantly or otherwise, as well.

Thinking about it, why stop at IE? Anyone care to write a Mozilla Extension?

Why not?

[CokeJunky]

I am seeing alot of people saying that nothing exists and why don't you use browser/tool/etc X, instead of offering useful advice.

No, this tool would not be too hard to write. I have written a protocol handler for windows (years ago). All it takes is a registry entry to point windows to the program, and a program that processes it's command line arguments through a list of greps with actions (hard coded or stored in a config file if you like). The only difficult part is that once in the browser, you can't easily intercept the selected links and check every one.

I think a rudimentry attempt at such a program could be done in 30-40 lines of C code, or with a perl script closer to 10 lines or less. All you have to do is find out what the registry entry for the protocol handler is, and change it. I found it by digging through the registry with regedit, but I suspect that the MSDN knowlege base probably has an article on it.

There is no need to browbeat someone over such a request because it doesn't make sense to us. The true measure of a utility such as that is that someone wants to use it, and someone (probably the same person) is willing to write it -- if it doesn't already exist.

This is what we call the pragmatic approach, eh?

Re:Why not?

[malcomvetter]

Thanks. The goal here is not to create the end-all solution, but to work in the current environment while things are imperfect. I agree that ideally we would just choose one browser and change the web apps that require something else, but in the interest of migrating to that point, I think an interim solution is needed to: + hijack any all all URLs + compare to whitelist + open in an appropriate browser + be scalable and deployable ... not just for my laziness as some would suggest, but for a slew of end-users who haven't a clue ... it just works. Now I heard of an old project where a company wanted to rewrite URLs, so they hijacked them at the http level. Anyone familiar with this?

Perhaps wait for the new Navigator...

[Random Guru 42]

The new and upcoming version of Netscape is supposed to use both the Mozilla and Microsoft HTML rendering engines. If I'm not mistaken, I heard that there will also be a way to have pages automatically use MS's renderer based on content; it's possible to also do that based on domain.

If you can hold on a while longer, you might find it easier to use that rather than jury-rigging something up yourself.