Slashdot Mirror
IE Developer Responds to Mozilla Accusations
sriram_2001 writes "Dave Massy, a Microsoft employee who works on the Internet Explorer team has a response to the Mozilla Foundation's Mitchell Baker's comments. Specifically, he responds to the claim that IE is a part of the operating system. 'IE is part of the Windows Operating System so that parts of the OS and other applications can rely on the functionality and APIs being present. To be clear there are no Operating System APIs that IE uses that are not documented on MSDN as part of the platform SDK and available to other browsers and any other software that runs on Windows..'
No one is ready to pay what really bug-free code would cost. We accept a few bugs. Please note that we even accept some airplane crashes (not to mention car accidents), but, naturally, different industries and software components pose different levels of "reasonable" bug count.
And therein lies the heart of the MS development philosophy. Strictly speaking, that's true, but take something like Windows XP. It's is the ultimate case of the kid who cleans his room, ostensibly, but when his mother checks the closet, an avalanche of dirty clothes and assorted toys and things exlpodes from the doorway. I think MS could learn a lot from Apple, as they always have, and should look into utilizing something like BSD to start over. Obviously, they can't come out and say "our products suck; it takes half a gig of ram just to appease the system tray icons in Windows XP...sorry about that." But some way, some time they will have to move away from Windows as it is today.
I Want To Believe
Read the source code if you even bother. It was ejected by WMP not IE nor the KERNEL.
appended to the end of comments you post, 120 bit floating point
IF there are no operating system API's used by the browser, then why did MSFT fight so hard not ot have to remove it from the browser. IT might not use the OS API's, but im fairly sure it works the other way round. Has he ever tried to remove IE cleanly from a windows install?
I can't figure it out. Is Dave playing dumb, or is he really dumb?
The guy works for Microsoft, so maybe it is willful ignorance. How else can you explain someone that works on IE from trying to claim it is not part of the OS? Oh, we're going to get down to nit picking. Yes, yes, yes IE is not part of the kernel.
However, Microsoft wasn't too interested in this argument when it was fighting for its life in court, arguing that IE was embedded and could not be removed from the OS.
And now we see, they were right. IE may not be part of the kernel, but due to its use (and trust) by many core applications in Windows, it presents many more security challenges when compared to a standalone app like Firefox.
Ironically, the word ironically is often used incorrectly.
Uh, if mozilla supports vbscript then it would be allowed in mozilla or any other web browser for that matter. That does not make use of any unknown undocumented APIs. Try this, paste this code into a text file (hint: it came straight from your website):
Set oWMP = CreateObject("WMPlayer.OCX.7" )
Set colCDROMs = oWMP.cdromCollection
if colCDROMs.Count >= 1 then
For i = 0 to colCDROMs.Count - 1
colCDROMs.Item(i).Eject
Next ' cdrom
End If
wscript.echo "Automatic Cup Holder."
Then run "cscript filename". Oh my god, Microsoft tied vbscript into a stand alone application on your system!!! Give me a break, mod the parent down please
-dk
Eh no, this is an issue will allowing scripts run with unfettered access to the system. Made IE great for intranet applications but a security disaster on the web.
Do not try to read the dupe, thats impossible. Instead, only try to realize the truth
What truth?
There is no dupe
I would never use I.E. again if Firefox could do one thing (more), to be able to navigate to other (windows) boxes using my browser (like i can in I.E.)
by typing \\servername or \\ip address
my understanding was that this functionality was part of the API that is not available? this is the only thing keeping I.E. on my windows desktop.
This is not meant to be read by geeks, it's for PHBs. Either that or I'll have some of what he's smoking.
Justin.
You're only jealous cos the little penguins are talking to me.
"But Mr Dent, the plans have been available in the local planning office for the
..."
last nine month."
"Oh yes, well as soon as I heard I went straight round to see them,
yesterday afternoon. You hadn't exactly gone out of your way to call attention
to them had you? I mean like actually telling anybody or anything."
"But the plans were on display
"On display? I eventually had to go down to the cellar to find them."
"That's the display department."
"With a torch."
"Ah, well the lights had probably gone."
"So had the stairs."
"But look, you found the notice didn't you?"
"Yes," said Arthur, "yes I did. It was on display in the bottom of a locked
filing cabinet stuck in a disused lavatory with a sign on the door saying
Beware of the Leopard."
That's the sound lusers make as they get their so-called browsers hijacked and spywared to death.
They're working on that. It's called Longhorn. Maybe you've heard of it?
Whether or not they'll achieve any or all of their goals for Longhorn is, of course, open for debate based on past events. But the goal from the beginning has been to de-cruft Windows (and "improve" the user interface by making even more of it task-based. Joy!).
But frankly, my money at this point is on Longhorn being another Windows ME. Big on promises, half-assed changes, and lots of bugs. Maybe I'll be pleasantly surprised.
If a packet hits a pocket on a socket on a port,
And IE is interrupted as a very last resort,
And the address of the memory makes your FireFox abort,
Then the socket packet pocket has an error to report.
If your cursor finds a IE link followed by a dash,
And the VBScript code puts your windows in the trash,
And your data is corrupted because IE and Firefox clash,
Then your situation's hopeless and your system's gonna crash!
Uh, if mozilla supports vbscript then it would be allowed in mozilla or any other web browser for that matter
Er...isn't that sorta the point?
Mod me down with all of your hatred and your journey towards the dark side will be complete!
People just love to makethe definition of "OS" whatever is best for them to bash MS.
The MS guy is right. Microsoft was right in court. It's not rocket surgery, haters.
IE is part of the business component "Microsoft Windows". It's "part of the OS" in terms of customer expectations, developer expectations, and the business defintion of what Microsoft defines as an OS. Actually, nowadays it's finally recognized as absolutely ridiculous to ship an OS without a browser.
It is _not_ a part of the OS proper in a CS/technical definition. It is not required for functionality of the kernel or core OS services.
"IE is part of the Windows Operating System so that parts of the OS and other applications can rely on the functionality and APIs being present."
So why not just have an html rendering library and make IE an optional add-on? Plenty of other OS's seem to get by with this approach; I guess that none of them are so hellbent on pushing out a particular product...
"Quoting famous computer scientists out of context is the root of all evil (or at least most of it) in programming." - K
Thats the point though the IE gives websites access to the APIs of other programs like WMP without asking the user.
IE is part of the Windows Operating System so that parts of the OS and other applications can rely on the functionality and APIs being present.
Guys, uh guys, that's The Problem.
http://www.eweek.com/article2/0,1759,1776387,00. asp
To sum my thoughts in that story up, you have a gateway, IE, to the Internet that has deep, Inadequately Protected, connections to the core operating system.
IE, in specific, and Windows, in general, cannot be secured.
Microsoft's one seamless whole is really one giant security hole.
Steven
It is part of the OS. That's the part of the post he made.
IE is part of the OS primarily because it is an API that is relied on by other parts of the OS, and other 3rd party apps.
It is rightly described as "middle-ware". Clearly, it's not a driver, or the kernel, or whatnot.
But also clearly, it is not a single executable strapped on top.
It's integrated, but using only methods that and API that are available to anyone to use.
As part of the testing phase when I design a new web site I have to point out that the majority of my time is spent "tweaking" the site to display correctly in IE. While on the other hand I can take the same site and test it in Mozilla, Firefox, Konqueror, Safari, Netscape, etc. on various platforms (Linux, Mac, and Windows). I don't see why all browser developers can not or will not just design browsers to be equally compliant. With all the market share MS already has in my opinion they should, as atleast an act of good faith, build IE to conform with standards. I can not see any reason not to, I mean come on how difficult is it.
Open Source, Open Formats, Open Doors, Open Your Mind "Break On Through to the Other Side" The Doors
An article from 2003:
Microsoft allegedly opened up Windows APIs last year... Now, Devos claims that Microsoft's disclosures remain sufficiently inaccurate and incomplete for developers to continue using his own documentation.
Devos claims that Whirling Dervishes has discovered hidden Windows interfaces that are crucial for the development of such applications, but whose existence is denied by Microsoft. Not much change there then, post-lawsuit. These and other interfaces which Devos says should have been part of the API disclosures are used in NSELib, and he proposes to make public full documentation on how to use them.
Developers: We can use your help.
The employees at Microsoft are pure geniuses. I mean, look how long they have been able to pull off shit like this and still profit. Either that or the general public is stupid, which makes Microsoft look intelligent.
XeRo
To be clear there are no Operating System APIs that IE uses that are not documented on MSDN as part of the platform SDK and available to other browsers and any other software that runs on Windows.
This is always the standard Microsoft defense. Our products are written with the same API's as are available to everyone else. Everything's fair.
Except that Microsoft developers get access to the people who wrote the specifications. They can influence the specifications to change. In fact, according to a friend of mine who works at Microsoft, they have a tool which highly optimizes their code after compilation, by, among other things, moving the infrequently used code like error handling routines to the back of their DLL's, etc.
The fact that this tool hasn't been released to other developers is proof that they unfairly compete.
"As we develop IE we go through very thorough and stringent security reviews to ensure that every change is secure and does not expose the user to attack."
I would have loved to be at the party they must have had when ActiveX went through it's security reviews.
Seriously though, that post was a load of bollocks. But hey, I pity the guy.. in a way. He can't turn around and admit the architecture's a piece of shit.
What he means is parts of the Windows desktop environment rely on the HTML engine which is also part of IE.
It's like saying KDE can't work without Konqueror and KHTML. Of course it can, you use Gecko.
Also they obviously mean IE is part of the Windows distribution package. Are they going to say MSN/Windows Messenger is part of the OS next?
Honestly, it is this kind of technical retardedness that stops me using Windows.
Yes but that is just explorer. explorer is an app in windows just like anything else. You don't need explorer to run windows, in fact you can replace it. So no IE isn't REALLY part of the OS but it is reused heavily in primary apps on the windows desktop.
The reason IE is part of the Windows operating system is because of mshtml32.dll, shdocvw.dll, etc. - System DLL's that explorer.exe uses. Really, all IE does is to wrap the browser control and provide bookmarks, etc.
In all seriousness, this is not a bad thing - it promotes code re-use in the Windows code base and prevents Windows developers from having to continually re-invent the wheel (or browser). The problem is that IE (ahem, the Internet Explorer_Server Window Class) is a complete piece of vulnerable, buggy, garbage.
It's really easy to use though - Anyone can write a simple MFC based browser - just use CHTMLView for your view class, add an address bar, implement navigation buttons, and hook it up to either the correct CHTMLView member function or the correct COM call if you're doing it that way, and you're done. Should take 2 hours tops.
Granted his machine is a bloody mess, riddled with SpyWare but, prior to the uninstall, at least he could connect to a network - which would make my thankless task of resurrecting this poor abused box much easier.
Lesson: Sure, IE isn't part of the operating system, provided you don't count a working TCP/IP stack as a necessary part of the OS.
I was speaking recently to a developer working on Longhorn and he gave me the following information: IE cannot legally, since the court battles, use any undocumented system API calls. Therefore all of the calls that IE used have been made public on MSDN. They may have strange names and actually do other things than the documentation strictly says, but Microsoft has been forced to announce what "they do" to the public at large.
(Actually, this might not work on IE 6.0+. Can you believe they actually fixed the problem.)
Still not fixed, at least its not fixed as of IE version 6.0.2800.1106
"To be clear there are no Operating System APIs that IE uses that are not documented on MSDN as part of the platform SDK and available to other browsers and any other software that runs on Windows..."
Several points to this:
One, the MDSN documentation is horrific. There are few examples and fewer cross references. So you get into a game of "find the API" call you want.
Second, many of the API's are horribly quirky and have known bugs. The bugs tend to stay because programs become dependant upon them. But the MSDN documentation NEVER DOCUMENTS these "quirks". I'm sure IE has plenty of workarounds for these... but still use the "documented API's"
Thirdly, Microsoft will change the OS calls to suit their whim. Then bury it in the documentation with maybe a one-line blurb buried with about a dozen under changes in the latest MSDN release. (EG The new list control grouping features for XP or when they implemented "coolbars" for IE) And then there were few examples of usage. So general acceptance doesn't occur until some kind soul has trudged through the pixel mines and figured out how the new control API's work.
Lastly, IE functionality may only use ONE OS API call (CreateWindow) and have all custom code written for the rest of the app...er..kernel module...
I see you're trying to counter the open source movement... Let's get started! Would you like to:
-Spell check
-Grammar check
-Print this document
-Connect to Microsoft Office Online
[/CLIPPY]
"If you think you have things under control, you're not going fast enough." --Mario Andretti
What, Mozilla does security through lack of features?
If the "features" are insecure, would you want them?
Mod me down with all of your hatred and your journey towards the dark side will be complete!
You might want to check your spelling when you're making a very public argument about how your software is not more prone to vulnerabilities than another.
Who proofreads blog entries? That's like clicking the Preview button on Slashdot.
kind of offtopic, i know but anyway. i was bored in college once, so i wrote a VB app in about30 seconds with a textbox, a go button and an IE OCX. the code was this (might not be perfect, ive not done any VB for a long time now):
sub command1_click()
iecontrol.navigate2 text1
end sub
And it was suprising how the security of IE is tied to the address bar and the rendering portion of the browser allowed me into c:, which i wasn't allowed to do in windows explorer. i cant remember if i was able to add/edit/delete files or not though.
To be clear there are no Operating System APIs that IE uses that are not documented on MSDN as part of the platform SDK and available to other browsers and any other software that runs on Windows.. How do we know ? You did not show us the code ;)
'IE is part of the Windows Operating System so that parts of the OS and other applications can rely on the functionality and APIs being present. To be clear there are no Operating System APIs that IE uses that are not documented on MSDN as part of the platform SDK and available to other browsers and any other software that runs on Windows..'
But was this case 7 years ago when Win98 came out with the integrated browser? NO. Only now that they've faced anticompetitive presures have they been willing to document certain "secret" api's.
Most of the best software available between 98 and 2002 (when they started releasing api's to the public) was designed by former microsoft alumni or other big companies working in close collaboration with MS. What little information that was available was only available in the "Microsoft Press" books.
This is just another case of Microsoft newspeak, ie: Documentation for most of our API's is available for free, (implying) Documentation for most of our API's has ALWAYS been available for free.
Cool! Amazing Toys.
I'm the guy who posted the story to Slashdot. One thing I noticed and which got edited out was that - nowhere in the post, does Dave Massy criticize Firefox itself. Though it is his own personal blog (it is not the IE team blog), he never mentions anything about Firefox. On the other hand, we have various people associated with Firefox badmouthing IE every chance they get.
I'm sure Dave could have pointed out with glee Firefox recent security problems (IDN, GIF handling ) or update-rollout problems. Can you imagine a Firefox dev not jumping on similar problems with IE and making fun of them?
I worked with a guy last year who came from the IE6 team at MS. He wasn't a programmer, but he agreed that it was common knowledge on the team that IE used secret APIs for better performance/quality, which competitors like Mozilla couldn't. He also said that this was also true about MS SQLServer, though he didn't have direct knowledge. And that these secrett APIs weren't controversial, or just gossip - they were assumed by everyone talking about development strategies for those products.
This MS developer is lying. I used to talk with people programming VB6, when I was project lead for a big NYC insurance project that MS was hot to get started in the industry through. They would routinely lie to me about internal code paths that were triggering bugs, especially in printing. When I would analyze them into a deductive corner, they would tell me a little truth. Their big mistake was their managers' greed to get into the industry, which put me in direct, unmediated contact with the programmers, combined with their technical inadeqacy to keep up with the discussions enough to mediate them.
I suspect that the MS claims of "national security" interest in keeping their code secret is based partly on the political havoc that would ensue (pun intended) if we could see just how much MS code is written to protect their anticompetitive abuses. The Department of Justice would have a lot to answer for, and it certainly wouldn't stop there. Especially if the ripples could prove how many Congressmembers were bribed to keep their monopoly "remedy" decisions untouched by human hands.
--
make install -not war
But you *can't* fix them! Those bits use proprietry MS code. What MS is saying is that anyone _could_ hook into their code, and therefore, arguments that IE is tightly integrated with the OS are rubish.
But the counter argument being made here is that, yes, Mozilla (for example) could integrate with these MS "features", but doing so would result in an insecure browser.... so probably not a good idea.
I'd venture that MS can't _un-integrate_ them from IE because and bunch of other code (from MS office to Encarta) depends on this functionality.
And I'd further venture that the "..get them fixed.." idea has occured to MS but that this isn't easy to do due to poor design.
And hasn't that been the argument all along?!
Especially considering that it's not VBScript's fault, is the WMP ActiveX control. That particular piece of code can be translated into JScript rather trivially and work just as well.
It will not work without Windows media player.
It does not involve any privlege escalation either - it was designed to do that (even if rather stupid).
Kinda wish the modded-Informative post-bashing would at least get their facts right... Yeah, I know, never going to happen.
User: I want to be able to log in without a user name or a password! Remotely!
Tech: That's horribly insecure
User: I don't care! Its easier that way!
Tech: * finds rusty knife and commits seppuku *
And that, boys and girls, is one of the reasons why Microsoft is the 800 lb gorilla. It understands that users are more than willing to sacrifice security on the altar of 'its easier that way'.
Hello? Wasn't this an issue of the monopoly law suit? That it CAN'T be removed from the operating system?
I must be wrong, so somebody please clear this up for me. Can somebody explain this to me in lamen's terms?
Also, he says that the IE development process prevents them from introducing bugs into the software? Then how does stuff like viewing .jpgs become a security flaw? Is it that there development process is just not up to snuff? Or is it the APIs that the use from the operating system that are flawed? So it's not the browser, that's flawed, it's the operating system? That makes me feel better. Also regarding a user experience the difference between the operating system is null?
I confused.
Treat me like a marketing stat, and I'll treat your movie like a series of ones and zeros
the blog was obviously microsoft-centric, considering it was written by an employee. however, the comments were pretty interesting and thought-provoking until you got to the ones posted today after this was posted to slashdot. why must all the people on slashdot be out to get microsoft? as a company they are not evil. a lot of the comments to the blog just make open source advocates out to be a bunch of complete idiots. one comment in particular... "move away from closed source, that's always been microsoft's downfall". microsoft doesn't seem to be collapsing or losing money to me... apparently closed source works for them. come on now people, get real...
please me, have no regrets.
I would, if only MS didn't claim EMBED tags are their OS.
Really Dave? Great, so i can use Firefox for Windows updates?
SEO Firefox Extension
The specificness here is that the ActiveX control that comes with windows media isnt smart enough about handling running in an untrusted container.
there are win32 api calls that manage this (you have to implement some other interface in your COM object to get told about security zones), but nobody ever does.
ActiveX is the underlying problem here. They took something that worked in a constrained role -OCX controls for adding functionality to VB apps, and made them -as you note- scriptable by web pages.
the worst part: they dont give up. Even IE6SP2 leaves activeX at "prompted" in the internet zone. Since windows update sites are in that zone, you cannot run windows update without saying yes to prompted downloads. If you disable AX in the internet zone, bye-bye security patches. I despair.
Or perhaps your scenario indicates the failing of the technology industry to find a solution that does not place undue burden on the user?
It's nearly two years ago that Whirling Dervishes said they'd found these secret functions and promised to release documentation on them. But I can't find any documentation or specific info on their web site.
I'm not sure what to blame, but I just compared IE and FireFox side by side on a PC isolated to my local network. FireFox loaded many pages many times faster. Then I uninstalled all the virus protection (Norton) software on this newly aquired PC (as it will always be isolated to my local network for in-house testing) and IE performance improved dramatically.
He says, "To be clear there are no Operating System APIs that IE uses that are not documented on MSDN", because he knows we cant go and check the source to ensure he isnt lying, BUT HE IS LYING.
. html
http://www.desktoplinux.com/articles/AT7614463206
Jeremy White (CEO of CodeWeavers) who actually got IE to work under wine says so:
Lehrbaum: Did the issues that needed to be addressed relate to undocumented Windows functions used by the app, or non-API functions and/or environmental considerations expected by the app?
White: In the case of Quicken and QuickBooks, no. For Visio, you can see that the programmers at Visio had used some rather interesting pieces of the Windows API. These required new implementations or new understandings of the Windows API, and a reworking of Wine. For the undocumented API calls, the king is Internet Explorer!
Everyone keeps whining about not being able to remove IE from Windows. But did you ever stop to think about just how many applications actually use IE's API, and integrate html and web pages into their programs? So even if it were possible to rip IE out of Windows, which so many people seem inclined to do for whatever reasons, those programs just wouldn't work anymore.
And you know why? Because nobody else has developed such an API for Windows. It's not impossible for one to replace IE's API if they really tried. I know that many of the open source software developers are a clever breed, and can work around any obstacle presented to them. It's just that nobody's done it, or even tried to do it that I know of.
So don't whine about not being able to remove IE if you don't have an adequate replacement to prevent many other pieces of software from breaking. It would become a tech nightmare if IE WAS removable, because then every dummy would be trying to uninstall it to hate on Microsoft like all the "cool" people, then be crying for someone to come fix their machine when all their instant messengers stopped working.
I mean seriously, if you hate IE that much, why are you even still using Windows?
Consider OpenSSL. OpenSSL is a Linux operating system; however it is a fairly independent library implemented using only public APIs. Many parts of "the operating system" depend on OpenSSL and would break upon its removal.
Ditto MSIE.
IE uses public APIs from the OS. Other parts of the OS use public APIs of IE. Thus IE cannot be removed from the OS without removing or altering the components that depent on it - such as, AFAIK, Windows Explorer (the file manager).
We can question the decision to make other parts o f the OS depend so deeply on IE, and we can question the decision to make that dependency on IE rather than an abstract "web browser API" that could be implemented by other tools. That doesn't change the fact that it's still a part of the OS.
Eh no, this is an issue will allowing scripts run with unfettered access to the system. Made IE great for intranet applications but a security disaster on the web.
Oh, I'd say less of a security disaster and more of a security mushroom cloud. It is pretty much the source for most security problems on the internet.
-----
Check out the Uncyclopedia.org , the only wiki source for not-semi-kinda-untruth about things like Kitten Huffing and Pong! the Movie!
Please allow me to hate the creator of the 120-character limit: *HATES*. Thank you.
Or, in the case of automatially installing malware, any burden on the user!
If corporations are people, aren't stockholders guilty of slavery?
Someone please mod this post up. It's the only one that addresses the real issue. When people talk about IE's integration with the OS they are referring almost entirely to ActiveX and Browser helper objects. These are the real root of IE's security and malware holes.
They bought Macs and are too busy actually getting things done to post here about the latest response from an IE developer.
The fact is, there are more uninformed people out there than there are informed people (just read the crap in the original article).
Another fact is that there are more Microsoft fans than there are Open Source fans (right now).
So, the intersection of those two groups means that there are more uninformed Microsofties than there are informed Open Source fans.
And those Microsofties, for whatever reason, have decided to hang out on
Get used to it. That's the same way it will be throughout most of your life, unless you restrict yourself to very exclusive groups with very high entrance requirements (/. is not one of them).You can't argue them down. They don't know enough of the material to know how ignorant they are.
I've argued here with people who swore that SMTP did NOT have authentication. Even after I posted links to the RFC's.
Yep, once the megalith recognizes the upstart then the upstart has succeeded. That is how we can surmise FF and Linux are ending M$FT's strangle-hold on technology advancement. Viva la software developer, maybe a time of advancement awaits!
Expect Freedom.
Hold on hold on, let me get this straight. You originally said that IE is allowing secret hidden APIs (at least that is what is interpreted from your quote) because there was a security hole that allowed VBscript to load arbitrary ActiveX controls. Yet you failed to give any example of how Microsoft has kept developers from integrating VBscript into their own applications (for sake of argument, we will say Mozilla). Then you went to change your argument to how MS is so bad because they allowed such a glaring security hole. Do you see the topic jump there? We've gone away from talking about these secret hidden APIs that supposedly exist to bashing MS because of an old security hole.
3 years ago your post would have been -1 troll or flamebait and no one would have cared to argue with you. Times have changed and moderators are not moderating properly and have given you +5 interesting for a comment that is IRRELEVANT to the article. I am a windows supporter in the fact that I use it on a daily basis. I am also an OSS zealot in the fact that I use and contribute to many OSS projects.
I have yet to see a valid comment about how Microsoft his hiding secret apis from developers. Instead I see this post-apocolyptic wasteland created from your comments and the moderators that are falsely promoting your FUD.
-dk
I'm not your typical Slashdot-fanatic, M$-hating, L1nux d00d. I love most of the latest MS products and think they're solid (as long as you're clued).
However, I literally laughed out loud when I read the following comment by the blogger:
As we develop IE we go through very thorough and stringent security reviews to ensure that every change is secure and does not expose the user to attack.
Which version of IE is this?! Nearly every released version of IE has had laughable (keep in mind, I'm not a Linux bigot) security flaws. I'm sorry, but you can't feed the sheep their own shit. They know, they KNOW.
He goes on to say:
The security of any browser is irrelevant to if it is part of the operating system.
That seems to be Microsoft's mantra. However, any security engineer or person with common sense would disagree.
If we are to debate security of browsers then let's bring in relevant arguments and accurate details about different possible attacks rather than rely on the irrational fear that because IE is part of the operating system it must be exposing OS functionality to the web.
Are you fucking joking? There is documented exploit after exploit demonstrating this. People aren't pulling it out of their asses. It's backed by fact, something you appear to be ignoring.
I'm a somewhat-loyal MS customer, but I've got to say I don't like reading tripe like this. What I do like reading is "we're going to fix IE's security model and this is how we're going to do it, what does the community think?".
Perhaps the IE team needs to review their security procedures, because they fuckin' suck hard.
I could tell that Slashdotters were posting half way down the page when the comments turned into "OMGF OSS" and "But in the anti-trust case..." bullshit repeated over and over again.
Frankly, I could give a rat's ass if IE uses super-secret API calls. Other browsers seem to do just fine without them.
To me, the larger problem is the level at which other applications leverage IE's COM interfaces (IWebBrowser, etc.). These interfaces are published in the Platform SDK as part of the Windows development environment, without much mention of IE (that I could find). But using them requires IE to be on the system, since Microsoft makes it difficult (imposible?) for other browser applications to expose these interfaces and to be used instead of IE. Quickbooks is a great example, it uses these COM interfaces to include web pages in its application, requiring keeping IE on the computer in organizations that would like to purge IE. Sloppyness on Intuit's part? Perhaps. But is it really in their best interest to wedge support in for say, Gecko, when IE is pretty much guaranteed to be on the computer?
While it might be a misnomer to say "IE is part of the Operating System", it might as well be since developers are guided with a club toward it.
Features are not insecure, users are insecure.
There is an old saying: UNIX doesn't stop you from doing stupid things, because that would stop you from doing clever things.
We used to complain that you couldn't do clever things on Windows. Now we're complaining that you can do stupid things on Windows.
Meanwhile, Linux continues happily letting people do even stupider things, and whenever these people complain -- we respond that it's their own stupid fault for not being smarter.
So why is it always the user's fault on Linux, but always Microsoft's fault on Windows? It seems to me that all the recent email worms need some dumbass to actually RUN THE PROGRAM. On Linux, we would say this user was stupid. But on Windows, this user was victimised by Microsoft's insecure operating system? I don't think so.
Security is the reciprocal of convenience, and the developer is simply unqualified to determine what security I need and what convenience I don't.
Microsoft cheerleader, blue flag waving, you got a problem with that?
I use FF now, but I have a preminition:
IE will get fixed, people will accept it and the world will move on. FireFox will go down as a footnote in history as the browser that fixed IE.
Its interesting to see the the insance amount of MS bashing that goes on her everytime a MS related article is posted.
Just to clear the air b4 someone calls me a MS agent, I'm a HW/SW developer that works for a bioTech comany and I do all my development work on *nix.
And no I'm not trolling, I'm just trying to state some facts.
I hear a lot of crying about IE being sucky etc etc. Fine, there are a lot of holes in it that are discovered routinely. But have you guys stopped to think that most of these holes are discovered because the browser is very popular. FireFox is becoming popular and it is starting to get attacked too (I've started to get pop ups in FireFox). But this concept applies to anything, if you live in a house facing a busy street, i.e. main road, your house will be more susceptible to crime, but when you move the same house to a quiet street, the house becomes less susceptible to crime.
About the whining that it comes packaged with windows, I say why not, when you buy a car, wouldn't you like it to come with free goodies instead of you having to pay extra for everything from floor mats to a CD player?
MS Windows also comes packaged with MS Media player, but why are there still so many users of WinAmp? I've been using Winamp for the past 7 yrs. The same thing applies to other pieces of software that come prePackaged with windows and yet has ppl using other solutions. The fact of the matter is if someone doesn't like a product and finds a better one they will go and get it. This even applies to cars, if ppl don't like what they have they buy stuff like CD decks, speakers etc.. The same applies to IE.
I have yet to see a valid comment about how Microsoft his hiding secret apis from developers. Instead I see this post-apocolyptic wasteland created from your comments and the moderators that are falsely promoting your FUD.
Youre confusing me. You keep going on about the hidden APIs issue and I dont think that was what was being implied... Im assuming you mean this quote
IE is part of the Windows Operating System so that parts of the OS and other applications can rely on the functionality and APIs being present. To be clear there are no Operating System APIs that IE uses that are not documented on MSDN as part of the platform SDK and available to other browsers and any other software that runs on Windows..
You also start the parent post with
Hold on hold on, let me get this straight. You originally said that IE is allowing secret hidden APIs (at least that is what is interpreted from your quote) because there was a security hole that allowed VBscript to load arbitrary ActiveX controls. Yet you failed to give any example of how Microsoft has kept developers from integrating VBscript into their own applications (for sake of argument, we will say Mozilla).
I didnt interpret his post this way and I dont think others did either(I could be wrong of course). I thought that the grand daddy post was making the point was that it was actually a good thing that Firefox et al dont have access to these APIs or else the browser can start accessing things it has no right to access.
Sorry if Im wrong... but I dont think its a issue of hidden APIs that Mozilla cant implmement is the issue. The issue is these APIs are documented fine, but we shouldnt implement them.
As to how this relates directly to the article being discusssed... specifically the original quote. He is arguing(I think) that the idea of intergrating something as netward facing as a HTTP client with core functionality is "stupid".
Actually I blame that on the browser; it shouldn't allow access to objects just because a web developer says they want to.
But as I stated before, MS seems to have 'fixed' this, as I get a permissions denied error in IE when i open the link.
Getting firefox WILL make you more secure, because one of the larger avenue of attacks is simply gone. You can't create ActiveX controls using script in FF. True there may be other exploits, but one of the larger ones is not there be design.
Given that they purposefully left out ActiveX scripting tells me they are at least learning from MS' mistakes, which creates some trust for them in me.
Security is, by its very nature, nothing more than making certain things a pain in the ass in order to prevent them from being done. This applies to computers, to the physical world, everywhere. The stronger the security, the less the convenience, and vice versa.
Granted, the degree of inconvenience and thus security is (intentionally) disproportional from authorized users to authorized users - those who have/know the key are less inconvenienced and thus less restricted than those who don't - but there is still the inconvenience of having to keep or remember the key, and to unlock the system when you want to use it. If you use a multiple-key solution, the security gets even better but it's even more inconvenient. That's the nature of the beast.
The only perfect security is to "completely inconvenience" everyone - just kill 'em all, or destroy whatever they're trying to access. The only perfect convenience is to completely unsecure the system. These are obviously unwanted polar extremes, and the solution lies somewhere in between them - where depends entirely on context. You'd just got to find some system which makes certain things inconvenient enough that most security breaches won't be likely.
This could be a combination of physical and digital systems, even - say local login requires no authentiation but remote login is restricted, that way you've got to break the physical security in the building or the digital security over the net, but either way there is some security keeping unauthorized users out.
But if you've got the GP's hypothetical "I want to be able to log in from anywhere and do whatever I want without authentication!" user, then *anything* that will grant their wish will allow *anyone* to log in from anywhere and do whatever they want. There is no solution which could give them what they want and keep any semblance of security. The technology hasn't failed: the specs being demanded are flawed and impossible to match.
It's like designing a house without any locks because those damn keys are just so inconvenient - fine, but don't expect the doors to magically keep people out of the house while you're away. There is no lock that could possibly be created that will keep something secure without inconveniencing the user to provide some sort of key.
-Forrest Cameranesi, Geek of all Trades
"I am Sam. Sam I am. I do not like trolls, flames, or spam."
Is The Browser Part of the Operating System?
An exercise in misdirection
I don't know how accurate your source is, but my friend at Microsoft is quite adament that people working on different products at Microsoft are hardly even allowed to talk to each other. After all the court action in the past, Microsoft's set an in-house policy that basically says that each product team is only allowed to access other teams' specifications that have also been released in public.
Having said that, it wouldn't surprise me the slightest bit if executives make decisions from time to time that completely ignore this policy, if they think they can get away with it. But in the general case, programmers at Microsoft aren't allowed to talk to each other about the internal workings of independent projects except to distribute already published material. I suspect that this would be enforced quite a lot between the Windows/IE barrier, given all the accusations in the past.
Personally I think the bigger problem is getting Windows to stop bundling, loading and using IE at every opportunity if and when it's not wanted. I haven't used Windows seriously for several years, but it can't be that easy to change the assumption that many Microsoft and Third Part applications seem to have, that IE will always be available on a Windows system.
My understanding was that this was the whole issue. If IE were to be removed, many applications would simply break. Windows would also break, since it uses IE's API (which, by the way, is published for any operating system to use) to do so many things.
Is this still a problem? I haven't used Windows seriously for several years now, although to me XP appeared that Windows Explorer and Internet Explorer were still based on the same engine, even when I'd changed my default browser.
Undocumented APIs are APIs that are not documented. Their use by other apps is "cheating". How do you know that MS apps don't call those APIs? BTW, making methods public that aren't to have external linkage is known as "really bad programming", or "unstable hack".
--
make install -not war
Depending on which components you consider as part of "IE", there ARE undocumented APIs used by those components.
Some of them have since been documented by microsoft as part of the DOJ decree.
But not all of them.
I wish I could say that about *any* stack.
All the kernel mode stuff is downright maddening. Maybe I'm just stupid, the whole notion of an IRP just seems like a pain in the ass. Ok so it's asynchronous. The the code to deal with it is huge and if things don't work, it's damn near impossible to figure out *why*.
And, as a USB developer, it boggles my mind that the XP DDK comes with a "simple" USB BULK transfer driver example: it's 8492 lines of code in 6 C files and 7 headers. 2751 of those lines are for Windows PnP support. 1686 are for power management (USB only supports three states! Connected, suspended, disconnected!)
And it does damn near the same thing as the 349 line usb-skeleton.c in Linux (essentially allows simple read()/write() access to a bulk endpoint pair).
Well-designed my ass. We're talking a factor of 24x more code to do the same thing.