Slashdot Mirror
IE7 Bug Reports Flooding In
the JoshMeister writes "According to ZDNet, bug reports are already flooding in for Microsoft's new Internet Explorer 7 Beta 2 Preview. Specific issues include the possibility of arbitrary code execution as well as incompatibilities with McAfee Security Center, anti-spyware programs, and online banking sites." From the article: "... browser testers may already be at risk, according to security researcher Tom Ferris. Late Tuesday, Ferris released details of a potential security flaw in IE 7. An attacker could exploit the flaw by crafting a special Web page that could be used to crash the browser or gain complete control of a vulnerable system, Ferris said in an advisory on his Web site. Microsoft had no immediate comment on Ferris' alert."
Of course it's got bugs -- it's a beta!
A beta of a Microsoft product has bugs? Color me surprised!
It's beta software. Of course there will be bugs. The public B2 is much better than the leaked B2 which was still better than B1.
Taken with grain of salt... it's still beta.
sounds like a productive beta test. end users finding lots of bugs.
(anyone who would use it - or anything else beta - in a production environment is insane)
This just goes to prove that Microsoft's newfound 'dedication to security' and focus on writing code with less bugs in it is just a pure crock of doodie. Obviously, if they opened their source and let us all look at it, we'd be glad to help them find and iron out all the bugs by releasing several dozen exploits into the wild at the same time. My god, if the beta's this bad, how bad will the finished product be when they've finished adding features? ... um, my sarcasm tag is on, right?
Why is this front page, unless it's just the usual knee-jerk, let's-find-something-bad-to-say-about-Microsoft thing that makes Slashdot less than useful for info about anything about Microsoft.
Yeesh.
Calling Tom Ferris a "Security Researcher" is like calling Bill Gates a programmer... He is more a 'Robert Scoble' character. And his discovery of arbitrary code execution is incorrect as per the link: http://blogs.msdn.com/ie/archive/2006/02/01/522682 .aspx
The guy is not a professional anything, I mean he lists workarounds as 'Firefox'; which just shows how little he understands the security field which he claims to work in (A workaround should be a way to fix or bypass the bug, not a blind pointer at some random other product, even the Linux Security guys know that).
Look at the bright side, now we know what Ferris does on his days off.
He who knows best knows how little he knows. - Thomas Jefferson
...but I downloaded and installed and uninstalled this thing last night. Still seems there are loads of CSS problems in it (couldn't get a navigation menu to work but using :hover pseudo-class). It'll be interesting to see what MS comes up with on this one. It'll be nice to actually have a capable version of IE to test pages against.
I can't spell ripburger
How is this news? Betas are there for finding bugs. If you don't want to risk more than the usual, how about just not using it?
The past builds were also riddled with bugs, and the IE developers are very involved with testers to fix them. It's not like they're just sitting with their hands over their ears yelling "LA LA LA LA I can't hear you!"
..are the way it: a) Requires you to validate windows to install, b) Requires a reboot, and c) Actually attempts to pass off things like tabbed browsing and a search bar as innovative (really, take a look at the "demo" they bring you to when you first install it).
I'm not asking them to spend money advertising the fact that they're way behind the curve on browsers, just to stop lying to me.
people are claiming that a Preview Release ,not even a full beta yet, has bugs? Just wondering what these industry leading geniuses thought they were getting with a preview release? I have been using IE7 for a couple months now, my work provides me with a Technet Plus subscription, and I have had some issues. In most, if not all cases, I have been able to work around them and still rely heavily on Firefox. I will say that Microsoft has finally added some much needed functionality to their browser such as tabbed browsing and keyboard shortcuts which are exactly the same as Firefox's (coincidence, I think not). I guess my point is it's a preview release, it's not perfect and it has bugs, by using beta software you are agreeing to help solve some of the problems before final release, and there will be problems.
Just my two cents worth.
You must learn to be still in the midst of activity and to be vibrantly alive in repose. -Indira Gandhi
The problem for Microsoft is that many web applications use the following logic:
:-)
if (browser is Internet Explorer) then
emit HTML code that works around the numerous rendering bugs of IE
else (Mozilla, Netscape, Opera)
emit standards-compliant HTML code
With this kind of (flawed) logic, IE 7 will often be identified as IE, and hence be provided with IE 6-specific HTML code, whereas it should have been sent "correct" HTML code. The result may be, well, interesting
I really don't see what Microsoft can do against this. They can't expect millions of web sites to be updated overnight just to support IE 7.
OK, yeah, I got the point. It's a beta and betas will have bugs. But this isn't IE 1.0 Beta. This is freaking IE 7, and while it's a beta, you'd figure they'd have gotten at least some of these things straightened out in the past 6 versions. I'm not so much frustrated that a beta has bugs, but that even into version 7 they're still having huge problems and potential exploits.
I was about to post something about bugs being natrual in almost all beta software, then I read the article...
An attacker could exploit the flaw by crafting a special Web page that could be used to crash the browser or gain complete control of a vulnerable system
So, this is actually a relevant article, despite its initial appearance.
We've got some new additions and enhancements to IE, and here we have a flaw that can give an attacker complete control over the user's computer!
I guess this is a taste of things to come in Vista? Evidence that Microsoft's secure code development practices are mostly just verbal pacification?
Linux/Open Source/Anti Microsoft News
Microsoft had no immediate comment on Ferris' alert.
Not so - they tried to post a reply on his site but their browser kept crashing.
AT&ROFLMAO
Oh come on. Its Google. Don't expect it not to have bugs. All its products are BETA.
There you go, I corrected it for you. (no karma bonus checked for all those Gzealots)
Ubuntu is an African word meaning 'I can't configure Debian'
What kind of dumb-ass uses a beta browser for their banking anyway? It's not going to kill them to flick back to whatever their regular (non-beta) browser is.
I don't just mean IE either. Firefox in it's pre 1.0 days had a bug where tabs could read form data from other tabs. Like credit card numbers. All the way up to 1.0.
Why aren't beta's being released with some sort of self-setting desktop wallpaper that says "Look dipshit this is a beta product, and not like Google Beta TM, like buggy beta, so spare a seconds thought before you go doing your finances".
In next weeks news: some stupid fuck loses his identity and $20000 minutes after using IE7 Beta to pay his bills, therefore IE7 is bad.
Just looked at my logs for the last two days and MSIE 7 has already caused more requests than Opera/8, making it the #4 after MSIE 6, Mozilla and MSIE 5 (yes, grouping could be better for the Mozilla/Firefox family). It's a tech site, so the early adopters can be expected to show up here. Still, that was fast.
The famed acid2 test renders truly badly: http://www.webstandards.org/act/acid2/test.html#to p
I installed it the other day, and it was the safest browser I ever used, seriously. I couldn't get it to work with our proxy, so I could only browse the corp intranet. Amazingly, I didn't get infected by any malware.
Microsoft once again found itself playing catchup, this time in the browser market [again]. And with virtually all firms, that means a product often gets pushed out the door too quickly. That is clearly the case with I.E.7 (a.k.a. Deep-Six 7).
This release qualifies as no more than an alpha. Anyone who feels otherwise has either done little beta testing, or refuses to open their eyes. (And no, I am not a MS basher. In fact, I still use IE6.) Think about it. It's been over a year since Firefox began stealing market share. Microsoft saw (and clearly thought) it could wait no longer, even if the release was far from ready. They simply had to get "a new browser" on the market.
It may backfire, however. I tried Deep-Six 7, saw it was only an alpha, attempted to uninstall it, and then found it left my system in tatters! A beta should not do that; an alpha well may, however.
Microsoft sees its customers as guinea pigs, at least in this case. There is no way that junk should have been released on an unsuspecting public. Many here clearly forget that only 1% of computer users are geeks. The rest are "normal people." The latter will see a download available and simply get it, with no thought [knowledge?] of what they're actually doing. Microsoft should remember that itself.
I'm certain there were heated discussion about releasing it now (for marketing purposes) or holding off (for better quality before any public release). And now, the quality assurance folks are saying, "I told you so." This release has only further tarnished Microsoft's image as an innovative and quality-focused company. Instead, it now appear to be a behemoth that can barely move its own weight around, and certainly not nimbly keep up with its major competitors.
/.'s Psychic-in-Residence: Psychic to the Geeks
Finally, I'd like to reiterate the importance of the responsible disclosure of security issues. We firmly believe that privately disclosing security issues to software vendors is the best way to keep the users of the world secure.
I'm sorry, but I take issue with this, particularly with a product being beta-tested, but really, with any product. Users need to know what exploits are known. If there are serious, known, security flaws in IE, that may very well affect my decision of whether or not I want to install it on my system. THe idea of keeping it hush-hush doesn't really help anyone.
I know many people will just jump down Microsoft's throat for anything they do, they aren't my favourite company either. But I can't be sympathetic to people that complain about beta software.
1) NOBODY is forcing you to install a beta product. If you are curious or impulsive, and feel compelled to install beta software, your doing so at great risk to your security and data. Whether it's Microsoft beta's, Google beta's, or Linux Beta's, you are accepting that risk by the nature of installing beta software (its in the disclaimer)
2) THE REASON for beta software is to open it up to wider testing to CATCH AND FIX Bugs. This is a good thing, that bugs are flowing back to Microsoft. It will force them to fix the bugs and strengthen the product.
3) No, you CAN'T Sue, see 1)
4) Get a life. I mean, if IE 7 was in full release and these bugs were being reported, I would jump on the bandwagon myself and fire a few shots at MS, but this is still beta software, it isn't even a release candidate yet. Its intended for people with a brain to install it at their own risk and test the product, to REPORT bugs is the definition of what Beta software is. Obviously lots of stupid people are installing IE 7!
This is NOT NEWS, this is sad. To report and complain that Microsoft's beta software is full of bugs suggest a complete bias, prejudice, and ignorance towards them without merit or provocation. This is not microsoft screwing up, this is microsoft doing what countless other software companies do, release a beta in order to get feedback and bug reporting in order to fix and strengthen the product.
When FireFox 1.5 beta was released, it was full of bugs, but people praised Mozilla for their innovation and success. I can't stand double standards.
I haven't thought of anything clever to put here, but then again most of you haven't either.
Yes, specially since Firefox never had any bugs!
Right?
IE still lacks XHTML support of any kind - I don't want to seem picky here, but it has been 6 years. Sure, I can have applications I work on spit out XHTML that's mostly like HTML 4, and send the appropriate MIME type based on the Accept header, but I'd really quite like to see IE support vaguely recent standards, y'know...
blakespot
-- Heisenberg may have slept here.
iPod Hacks.com
I'm really serious about this... I'm not kidding...
The web community should start flooding the bug reporting for the IE beta with reports about CSS and XHTML/HTML standards non-compliance. Anything IE 7 does that isn't in line with web standards should be reported as a bug, by as many people as possible. And we should keep reporting these, daily, until the IE team wakes up to web standards and decides to support them.
Then, webmasters can make one version of the website that works in all modern browsers. Oh happy day. The IE team won't have to worry about supporting the weird IE quirks... people who haven't upgraded and are still using IE 6 will continue getting the same hacks that fix IE 6 and are ignored by Firefox et al, and IE 7 can ignore them just the same.
Seriously... it's best for everybody.
What's really going to piss me off is when they "fix" the hacks but not the non-compliance... AND on top of it they support some CSS 3 stuff in a non-standard way so we can go through this all over again when IE 8 comes out.