Slashdot Mirror


IE7 to be Pushed to Users Via Windows Update

dfrick writes "CNET is reporting that IE7 will be pushed to users via Windows Update. This has serious implications for e-commerce websites whose functionality might be affected by any bugs in the software. Also to have end users suddenly using a new browser right before the holiday shopping season could magnify the cost any bugs that might create a bad user experience on sites."

28 of 608 comments (clear)

  1. Another Get Firefox day coming soon... by WinEveryGame · · Score: 5, Insightful

    Well we just celebrated the Get Firefox day. Perhaps the day IE7 gets pushed via Windows update would be yet another Get Firefox day.

    1. Re:Another Get Firefox day coming soon... by voice_of_all_reason · · Score: 5, Insightful

      Whoa, let's not get crazy here. Now, I like firefox as much as the next reasonably intelligent computer user. But it's got a memory footprint like the goddamned Galactus. It is literally the beast that cannot be fed. Firefox operates like a beowulf cluster dividing by zero simultaneously.

      //has seen it easily use u[ 1.5gb+ of ram before.

    2. Re:Another Get Firefox day coming soon... by ZakuSage · · Score: 5, Informative

      about:config
      browser.sessionhistory.max_total_viewers set to 0

      Problem solved.

    3. Re:Another Get Firefox day coming soon... by giorgiofr · · Score: 5, Insightful

      ActiveX controls. Some people might, you know, want to use them.

      --
      Global warming is a cube.
    4. Re:Another Get Firefox day coming soon... by giorgiofr · · Score: 5, Insightful

      Frankly, I've never understood the demonizing of ActiveX technology. Actually, I've never even understood why people seem to concentrate only on the embedded controls in MSIE when ActiveX is about COM integration on the whole Win32 platform... Anyway, assuming we only care about browsers: the reason why you might want ActiveX is the same why you might want plugins or extension: to make the browser do something MORE than render (D)HTML. Unless you also hate Java applets, plugins, FF extensions and Opera widgets, how can you hate ActiveX? Its only problem is that people blindly click on "Yes please install this dialer". How is that a tech problem? I call PEBKAC! Besides, when a java applet pops up and asks for permission to elevate its privileges, how come that's good and holy, yet when an ActiveX control does the same that's so disgusting?
      All this coming from someone who DOES dislike the my-broswer-makes-coffee-too mentality so common today. But really, why do you single ActiveX out?

      --
      Global warming is a cube.
    5. Re:Another Get Firefox day coming soon... by Simon80 · · Score: 5, Informative

      Simply because it's permanently browser dependent and proprietary, and thus has no place on any website whose purpose isn't related to pushing updates into windows installations.

    6. Re:Another Get Firefox day coming soon... by cheater512 · · Score: 5, Funny

      ActiveX is the bug which Microsoft hasnt fixed since IE 3.
      I believe they are calling it a 'feature'. ;)

    7. Re:Another Get Firefox day coming soon... by Opportunist · · Score: 5, Informative

      The reason is simply that AX is the only technology where a webpage can directly affect your system. Yes, that is convenient and the opportunities are incredible. But so is the danger.

      The internet is, by its very nature, to be considered an insecure and hostile network. Pages you surf to are by definition to be seen as hostile until proven benign. And even then, it's happened more than once that a page considered safe was hacked and turned into a malicious site.

      AX is a "direct link" between net applications and your system. Which is incredibly convenient, but also incredibly dangerous considering the described problems with the internet. If the internet was a trusted medium, this would be THE technology. Since it is not, it is THE threat.

      Yes, PEBKAC is part of this danger. But then, think again how many of the "killer viruses" that spread within the last few years relied ONLY on the stupidity of people and how successful they were. ILoveYou, Kournicova (or however she's spelled) and their variants required user interaction to become active. Without a stupid user, these programs would have had zero chance of spreading.

      A web application or technology has no business with my machine's system. It may run in a sandbox, which is great, it may read/write in certain, predetermined places (which are secured against the rest of the system), that's it. Giving an application from an insecure, potentially malicious, source the ability to run at system level is simply and plainly stupid. It's like playing russian roulette with 5 chambers loaded and, after hearing the 'click' once, thinking that nothing can happen and it's safe.

      --
      We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
    8. Re:Another Get Firefox day coming soon... by steve_l · · Score: 5, Insightful

      1. I dont let java code escalate its privileges. Its got a sandbox, stay in it. Actually, I dont even enable java in the browser.

      2. I actually discovered one of the first activeX security holes, way back in 1999.

      The problem with AX is that it is really Ole Controls, OCX, upgraded for the internet era. OCX was nice, a version of Visual Basic (VBX) controls that was language neutral. Their goal was to make it easy for anyone to embed their controls inside their apps, and so have fancy apps with less coding. Classic Java Beans were sun's ill-fated attempt to copy this. VBX and OCX were probably the enablers of the best market in re-usable client-side components. Want fancy reports in your app? Crystal Reports OCX. Want good database access? Use the db access controls that ship from MS. OCX was a really nice design.

      The trouble with ActiveX was that they turned the web browser into a container, with the ability to download and run any activeX control. By default, all OCXs that are installed on a PC are enabled for use in IE, even though they were never written for the assumption that their caller was trusted. There's nothing wrong with an OCX to be embedded inside a C++ app letting you open files in the local filesystem. delete files there, overwrite things. But have some random javascript do that and your box is owned. Most emergency patches by MS and PC manufacturers is for built in controls. to mark them as unsafe for scripting, or to mark them as revoked.

      Failing one: ActiveX is only secure if the controls are designed to be called by untrusted people. Even if the controls arent scripted, they can still take params which can be malicious and read/write illegitimate files. Example: windows media control lets you pass in a path in the local filesystem. Script doesnt have access to the contents, but you can work out if the file is present or not. It is leaking information.

      Auto control download is the other problem. AX controls are pulled down, their signature verified. There is no sandbox, so the system is built entirely on the model that the people who write the controls are well meaning. The spyware industry showed the lie for that.

      Failing two: there is no sandbox for control.

      Now, for a few hundred dollars verisign will sell a cerificate in the name "Microsoft requires you to install this component.ltd" and that is what appears on the click-here-to-be-0wned dialog.

      Failing three: the vendors of certificates are more interested in certificate sales fees than the safety of the box. If verisign took some financial hit for every bit of spyware they signed off, things would be different.

      AX controls are usually written in C++, which is one of the C/C++ family of 'buffer overflow enabled' languages. I know I always get marked down for flame baiting when I say that, but the truth is while compentent people can write really secure code in C/C++ (eg. Apache HTTPD, openSSH), too many developers are in a hurry that ship something that just about works on the deadline required. Because AX controls are not in a sandbox, every single attribute and method has to be treated as something that a malicious piece of javascript can call.

      Failing four: the lack of a sandbox forces AX developers to write secure code, and they don't appear up to the job.

      If you find a security hole in an active x control, it can be rereleased, a new .cab file produced and the web pages marked so that IE will update to a later version. Sound good? No. You can push out any old version of an activeX control up by serving it out and using a version marker of -1,-1,-1,-1, meaning "always update". This makes it impossible for anyone to ever reliably stop an insecure AX control from being served up. The only way to do this is by adding the control to the "do not run" list in the registry, a registry that is fault of myself and richard smith.

      failing 5: its nearly impossible to stop malicious sites pushing out buggy versions of other people's AX controls.

    9. Re:Another Get Firefox day coming soon... by poulbailey · · Score: 5, Interesting

      Why on earth should they switch it off as a default? The ability to go back and forth in your history without rerendering the entire page again is a great feature.

      I've never understood why people with 1-2GB of RAM freak out when applications actually use some of that available memory. What good is a ton of memory if it's not being used? Firefox is a memory pig, yes, but it's giving it back to Windows should other programs actually need it.

      The same can be said about the aggresive memory trimming. Why are people willing to put up with a frozen UI whenever Firefox trims its memory is beyond me.

      I have plenty of free memory and don't really care either way, so I value usability higher than low memory use. People should probably get their learn on about Windows memory usage before posting any more wrong statements about Firefox.

      That's not to say that Firefox (and some of the more well-known) extensions don't leak memory like a proverbial sieve. I'm just saying that the above instances aren't memory leaks and anyone claiming that they are should be modded down.

    10. Re:Another Get Firefox day coming soon... by tehcyder · · Score: 5, Funny
      I love anecdotal evidence
      Right...I'm sitting here at my ofice gig running Firefox with 473,298 open tabs, it has consumed not only all the available memory in the company, but also approximately 17TB of swap space on our servers' RAID storage array. So far, it's coping, but tab 421,823 (a CCTV feed from the, ahem, bathrooms) is a bit jumpy at present, and the IT guys are trying to bash my office door in wih a fire extinguisher.
      --
      To have a right to do a thing is not at all the same as to be right in doing it
  2. Force-Feeding by (1+-sqrt(5))*(2**-1) · · Score: 5, Informative
    From TFA:
    Automatic Updates will first notify people when IE 7 is ready to install and then show a welcome screen that presents key features and the choices to install, not install or postpone installation.
    It appears, therefore, that they haven't yet resorted to force-feeding; and until security chief Stephen Toulouse eats his dogfood, moreover, force-feeding would be unconscionable.
  3. My favourite quote: by tomhudson · · Score: 5, Informative

    My favorite quote FTA: "It will be available from Microsoft's Download Center Web site, Schare said. "We're really trying to get the world ready for a major new browser release."

    Sorry, I already got my "major new browser release" about the time Microsoft were claiming "nobody needs tabbed browsing." IE7 is too little, too late, even for the poor unfortunates I know who are still stuck running Windows.

  4. Halo 2 by aersixb9 · · Score: 5, Funny

    Could they push a copy of Halo 2 and Crimson skies via Windows Update while they're at it?

  5. Bugs? by The+MAZZTer · · Score: 5, Informative

    I've fiddled around with beta 3 for a bit, it's just as stable as IE6 is (even moreso, if you can believe that). I think this summary was written by someone scared of "beta" software.

    As for breaking webpages, big deal. IE6 has been breaking webpages for years. Now at least the web designers who built pages for the IE6 "standard" instead of the STANDARD standards will taste a bit of our pain.

    Only IE7 bug I noticed is that IE7 REFUSES to remove borders on iframes (or maybe it's the body tag inside the iframe). Using CSS or deprecated HTML attributes have no effect. IE6 does not have this problem.

  6. Really a problem? by DuranDuran · · Score: 5, Funny

    This would be a problem if users could not select which updates to install and which to ignore. DuranDuran, for instance, has been without the Microsoft Malicious Software tool since it was first released.

    He has also been referring to himself in the third person since earlier this morning.

    --
    "You can justify anything by putting it in quotes, adding a famous name and making it a sig" - Albert Einstein
  7. Good... by Anonymous Coward · · Score: 5, Insightful

    "Also to have end users suddenly using a new browser right before the holiday shopping season could magnify the cost any bugs that might create a bad user experience on sites"

    I for one welcome this. IE6 sucks. Badly.

    IE7 has a few problems, but the faster IE6 dies, the better.

    This and as a web developer, I hope the bugs associated with pushing this app out will create a bad user experience and force developers that rely on hacks and nonstandard practices to get screwed over. I've had several sites I use not work with IE7 and the simplest has been because their simple javascript that detects IE versions tells me I need to use IE5.5 or greater. I've had others not work with the activeX controls because of new security models (or so I imagine).

    The sooner developers move towards standards the better. IE7 is a good push towards this goal, and having it pushed out buggy and forcing developers to address the idiotic IE Only Features is just another milestone on this route.

  8. Do it the simple way by Will2k_is_here · · Score: 5, Funny

    Get your quick 'n easy version of IE7 straight from the main website: www.ie7.com

  9. What's the problem? by jaronc · · Score: 5, Insightful

    Maybe I'm missing something, but I'm not sure I understand the doom and gloom of the post? It is an update afterall. And a lot of what I've read online has been positive towards 7 over 6. On top of that, the article pushes that you don't have to install it if you don't want to.

    As for the ecommerce sites being broken, it's not like they haven't had time to check to make sure their sites work in the new version. When the first beta came out, even I checked to see if there were any problems with my sites. I didn't fix them straight away, but I made sure to note down where the issues were for later repair.

  10. How Ironic by ben+there... · · Score: 5, Informative
    Firefox has just completed downloading an important update and must be restarted so that the update can be installed. Update: Firefox 1.5.0.5

    Ironic that I received that message as I was reading this story, and about to post that automatic update will only download IE7, but will give the users a choice of whether or not to install it. Kind of like the message I just received for Firefox.

    Bandwidth is really the only issue with this release method, but not so much for a single user. Businesses who would be affected by the download can install the IE7 Update Blocker Toolkit to prevent even the download.

    This really isn't that big of a deal.
  11. Re:Developers by ozmanjusri · · Score: 5, Insightful

    Oh dear, somebody who doesn't understand how the internets work. Here, this is a good start. http://www.w3.org/

    --
    "I've got more toys than Teruhisa Kitahara."
  12. instructions by RickBauls · · Score: 5, Funny

    to get the new update, simply remove this:
    msi http://microsoft.com/xp ie6 main

    and replace it with this:
    msi http://microsoft.com/xp ie7 main

    in your c:/etc/apt/sources.list file. then do:
    apt-get update
    apt-get upgrade

  13. Re:Developers by PintoPiman · · Score: 5, Insightful

    More like someone who is realistic and knows that all browsers have their quirks I would say personally. Not all quirks are created equal. IE is so far behind the modern browsers in implementing standards like CSS that they're no longer even in the ballpark. With the newer browsers rev'ing so much faster than IE, I don't think they'll even be in the same league for long.

    The argument here isn't idealistic or puritanical or religious - it's practical. CSS allows web developers to effectively separate content and presentation, which in turn allows for more efficient development. It's not about laziness either. We web developers have finite time. We either spend that time working on new features/content/layouts/whatever, or chasing down 4 year old bugs in IE.

    Take as an example a group of mechanical engineers plotting designs for a car. Group A favors one brand of mechanical pencils. Group B favors another. An astute engineer might attempt to settle the matter as you do: "all mechanical pencils have their quirks." Unfortunately, group C is using crayons that are worn nearly to the nub. IE is a crayon that is worn quite to the nub.

    To write off the pitiful state of IE's HTML, CSS and javascript support as "quirks" is to let MS off the hook. They leveraged their monopoly and "won" the browser wars. Having done so, it appears that they intend to use their dominant browser in order to defend their Big Two products by retarding the progress of web technologies indefinitely.

    As a side note, why does "realist" now refer to people who give up on ethics (and other such long term concerns) for short-run gains?

  14. wtf? by botik32 · · Score: 5, Informative

    Windows could have 'another' application that could call the IE DLLs, sure, but they are NO MORE PRELOADED than FIREFOX. As they would BE IN A DIFFERENT process that IE DOES NOT HAVE ACCESS TO.

    IE has to re-load all of its DLL even if another application has already loaded the Windows HTML rendering engine. So the memory reported in TaskMgr for IE is WHAT IE IS USING. Get it?


    Um... what did the above just mean? If I remember my CS courses correctly, the reason DLL's exist is to REUSE the CODE by putting it ONCE in MEMORY and then allowing ACCESS from (gasp) DIFFERENT applications. Perhaps you are talking about DATA. There, you will have separate pages copied. That does no mean that CODE does not take space. If I am correct in assuming the HTML rendering engine code IS provided as a DLL, and the IE is just a wrapper around it, the rendering CODE could easily take 5-10MB of RAM, because rendering engines ARE COMPLEX.

    Moreover, in Windows, fonts are bundled into the DLLs, making them shared as well. This means that IE can re-use fonts loaded into the HTML rendering engine, while Firefox probably cannot (It would make no point to write a browser that depends on another rendering engine, IMHO).

    That's what I think the parent meant.

    If you need substantiation for these claims, here you go (wikipedia):


    The shared library term is slightly ambiguous, because it covers at least two different concepts. First, it is the sharing of code located on disk by unrelated programs. The second concept is the sharing of code in memory, when programs execute the same physical page of RAM, mapped into different address spaces. It would seem that the latter would be preferable, and indeed it has a number of advantages. For instance on the OpenStep system, applications were often only a few hundred kilobytes in size and loaded almost instantly; the vast majority of their code was located in libraries that had already been loaded for other purposes by the operating system.

    In Windows, the concept was taken one step further, with even system resources such as fonts being bundled in the DLL file format. The same is true under OpenStep, where the universal "bundle" format is used for almost all system resources.

    And, BTW, you're wrong about denied access. There is a function in the Windows API that allows any process run a thread in another process. Yep, any app can do that. From the Phrack magazine, issue 62:


        The CreateRemoteThread function creates a thread that
        runs in the address space of another process.

        HANDLE CreateRemoteThread(
            HANDLE hProcess,
            LPSECURITY_ATTRIBUTES lpThreadAttributes,
            DWORD dwStackSize,
            LPTHREAD_START_ROUTINE lpStartAddress,
            LPVOID lpParameter,
            DWORD dwCreationFlags,
            LPDWORD lpThreadId
        );

    Two more functions:

        VirtualAllocEx()
        WriteProcessMemory()

      give us the power to inject our own arbitrary code to the
      address space of another process - and once it is there, we can
      create a thread remotely to execute it.
    .. but that's a whole different can of worms.

  15. Most CSS bugs are fixed in IE7 by vdboor · · Score: 5, Informative

    Well the good news is, they fixed most CSS2.1 bugs in IE7. They killed almost every bug mentioned at positioniseverything.net. They also added support for CSS2 selectors.

    The bad news is they didn't add ":after" support..
    If you used this to clear floats without structural markup, you need to find another way.

    And worth mentioning:

    • the new bugfixes are not applied in quirks-mode. Shouldn't be a problem, quirks mode is ment for backwards compatibility anyways.
    • most of my pages rendered exactly like Firefox and Safari already did. In fact, if I left a "bug" there because it was only visible in Safari, it will likely be visible in IE7 too due their better support for standards.
    • If you coded your pages for standards, and only used "* html" for IE5/6, most pages still look fine in IE7
    • they removed the "* html" bug because it broke web sites since they also support of the child-selector (html>body) in IE7.
      Note that pages render fine now without this hack!
    • they appear to have left a new hack, *>html, but they recommend conditional-comments instead
    --
    The best way to accelerate a windows server is by 9.81 m/s2 ;-)
  16. Why single out ActiveX? by Savage-Rabbit · · Score: 5, Informative
    But really, why do you single ActiveX out?

    You must be new here. Here are a few reasons, some of them obvious:
    1. A lot of people dislike it simply because it is made by Microsoft. Not very rational but a fact none the less.
    2. I haven't kept up to date on MSIE security issues but ActiveX used to be a source of security risks. That may have been fixed but even if it has, the stigma has stuck.
    3. ActiveX is only available with MSIE which only runs on Windows so it is widely seen as an attempt to achieve vendor lock. MSIE can be made to run on Linux and soon on OS.X via WINE but that happens without Microsofts blessing and I am not at all sure how well ActiveX works with a WINE'd MSIE install on Linux.
    4. Because of the Windows only nature of ActiveX any website that is based on it but offers content that has appeal to more people than just Windows users ActiveX kind of sucks since they can't use those websites. Where I used to work half the development department used Linux laptops for work related resons and they had to jump through flaming hoops to access the corporate web app used to track trouble reports etc. which was based on ActiveX and certified for MSIE only. Many companies tend to prefer Java based webapps or Microsoft solutions to keep their options open on switching to browsers other than MSIE or even OS'es other than Windows.
    --
    Only to idiots, are orders laws.
    -- Henning von Tresckow
  17. Re:Windows...still... booting... by Criffer · · Score: 5, Informative

    You know, this is the best troll I've heard in a while. And it's scored "+5 informative". Wow.

    1) DLLs are shared across processes. If one process loads a DLL, it resides in physical memory, at a specific virtual address. If another process loads the same DLL, it reuses the same copy in physical memory, but in a different virtual address space. It may even be loaded at a different virtual address in the second process. The pages are read-only so any attempt by either process to modify them will result in an access violation.

    2) Windows explorer is a process which exists as an application called explorer.exe. It is started when you log on to Windows, and explorer.exe links to mshtml.dll and shdocvw.dll. These are the IE core DLLs (the Microsoft HTML parser and the Shell Document View, respectively). It also happens to link to gdiplus.dll, gdi.dll, user.exe, ntdll.dll and a bunch of others.

    3) Internet explorer is a very small application (a few hundred KB compiled) which links into shdocvw.dll and mshtml.dll. It also happens to link to a bunch of other DLLs like ntdll.dll.

    4) Firefox is another application. It links to such Windows DLLs as ntdll.dll and user.exe. It also happens to link to gecko.dll, which no other Windows application will load. Therefore when Firefox starts up, it is going to be the first to load gecko.dll.

    5) Going back to point 1; every time any application loads a specific DLL, the loader will check to see if it is already present in physical memory, and will create a new virtual mapping for it. The physical memory used is shared across each process. When Windows starts, it loads the IE core DLLs. Most of IE is in memory by the time you can view the desktop. Firefox however, has a much smaller percentage of the application in memory before you click on it.

    Hence: Most of IE is loaded before you click on the IE icon. Most of Firefox is not loaded until you click on the IE icon.

  18. Re:We can call it good and we can call it bad... by Bogtha · · Score: 5, Informative

    You are very misinformed.

    'Pretend XHTML'? You are kidding right? MS is one of the companies that wrote XHTML and sure IE6 support sucked, but IE7? Um.... I don't think so.

    I quote from the Internet Explorer developers' weblog:

    if we tried to support real XHTML in IE 7 we would have ended up using our existing HTML parser (which is focused on compatibility) and hacking in XML constructs. It is highly unlikely we could support XHTML well in this way; in particular, we would certainly not detect a few error cases here or there, and we would silently support invalid cases.

    I would much rather take the time to implement XHTML properly after IE 7, and have it be truly interoperable - but I did want to unblock deployment of XHTML as best we could, which is why we made sure to address the XML prolog/DOCTYPE issue.

    No version of Internet Explorer supports XHTML. If you label XHTML as text/html, Internet Explorer will render it because it thinks it's HTML. There's a problem that XML prologs cause because of this, so they implemented a special-case workaround.

    All of this is very well known to web developers, I suggest you actually ask your developers about this if you don't believe me.

    Watch the Video on Expression Web Designer. It is the new FrontPage so to speak, and is designed to work with IE7 in the long run, and it pushes VERY HARD - XHTML and CSS standards, to the point it will break IE6 if you tell it to comply 100% with standards. They also wouldn't be making such a 'standards' based site development tool if it was going to break IE7.

    XHTML is being treated as a buzzword these days. The document included in that video included a <meta> element that claimed the media type was text/html. This is not XHTML being parsed as XHTML. It's XHTML pretending to be HTML and being parsed as HTML - which is the only way in which any version of Internet Explorer can understand XHTML as it doesn't support XHTML.

    In every way in which XHTML differs from HTML, Internet Explorer follows the HTML rules. If you disagree, please give examples. If you don't disagree, please explain how that means that Internet Explorer supports XHTML rather than "pretend XHTML".

    Are you seriously making assumptions about what Internet Explorer supports by trying to spot implications from marketing material for a tangentially related product by the same company?

    That isn't why it won't pass the Acid2 test. It won't pass the Acid2 test because that is far too much work for a single major revision. It would require implementing a lot of the CSS that is currently unsupported

    This has 'little' to do with WHAT CSS is implemented, but more over what 'foreign and non-standard' CSS and IE specific goofs are allowed. IE7 does a good job of support CSS features, the DRAWBACK is that is STILL supports NON-STANDARD CSS and MS IE standards that when put to the ACID2 test fail.

    I'm sorry, but this simply isn't the case. Have you looked at the Acid2 test at all? The problems Internet Explorer has with it are either parsing problems or outright lack of support for various features of CSS and HTML. Internet Explorer's support for non-standard CSS extensions are not a factor.

    WindowsXP is 5 years old, it is about time people moved to it.

    You can argue that people should upgrade all you like, it makes no difference as to whether they actually do it or not. I'm saying that lots of people don't upgrade for years. Telling me that they should is completely irrelevant. It's not up to me whether they upgrade.

    So YES we can start moving to real XHTML and CSS based sit

    --
    Bogtha Bogtha Bogtha