Slashdot Mirror
Bring Down Internet Explorer In Six Words
Marcion writes "Some handy Japanese guy called Hamachiya discovered a bug in Internet Explorer. Under certain conditions, an asterisk when used as a wildcard can crash IE as soon as the user attempts to go to another page." The article claims the "five HTML tags and a CSS declaration" crash IE7 as well as IE6, but I couldn't get IE7 to fail. This page says that as of June, IE6 was at about 37% market share and IE7 under 20%.
I didn't think I'll see the day when browser crashing on something would be a newsworthy item. We - the industry - have made improvements in the last years I guess.
...then here's a word perfect translation of that article (courtesy of Babelfish).
Erm... then again, maybe not.
(If you liked that translation, you might enjoy Babelfish's attempt at Slashdot.jp.)
"Slashdot - News and Chat Sites Deviant". (Click "homepage" link above for details).
It indeed crashes IE here... Windows 2K3, IE7
Post
A
Crappy
Article
On
Slashdot
And we bring down a site from a link in the OP.
It takes a few seconds to crash after the new tab is opened; that's enough time to type in an auto-completed URL and have it start loading. Strange thing about this is that even though Windows shows the standard "crashed" dialog box for IE, beneath that I can still see (e.g.) Slashdot continue to load in the background until I dismiss the dialog.
"Slashdot - News and Chat Sites Deviant". (Click "homepage" link above for details).
I is AC. I install MS VISta. It got IE. It good for look at porn. Problem PORN got Not god virus On it and IE not work. Jhow can you help me? I here this thing called linox solve? How virus not get hit? HATIGN@! computer STD. Me loves MSN +.
> as of June, IE6 was at about 37% market share
:(){ :|:& };:
Anyone feels like explaining what characters this is all about? Page in article is, liek, down.
You can crash IE? Really? With a webpage? Who would have thought?
Seriously, here's a phone. Call someone who cares. Or at least isn't surprised. Or at least thinks it's newsworthy.
I don't care if I have to wave karma goodbye now, but sensibly, is there an event running today that tries to see how many really uninteresting, uninspired and utterly pointless "news" can make it to the front page on a single day? Yes, it's possible to crash IE. Hey, breaking news, you can even crash it in a way that allows you to execute arbitrary code. Wow. Teh horrorz.
This ain't news. It may be a new hole detected, but could we at least get less lurid subject lines that sound like it's the end of the world? How about "new bug in IE detected"? It would have been at least as accurate and more objective. You might get the same "duh, no kidding" replies, but at least people wouldn't make fun of you for making something trivial as an IE bug sound like it's the end of the internet.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
* {position:relative}
</style><table><input></table>
When your shit has more than 200HP then it's probably useful to know the temperature
which is totally what she said
Dr.Who: I can bring down your administration in one word. Prime Minister: One word. Even you aren't capable of that. Dr.Who: Okay, six words. Dr.Who (wispers to aid): Don't you think she looks tired?
DAMN YOU SLASHDOT!
Genesis 1:32 And God typed
Alt-F4 gets rid of it much more quickly, and doesn't rely on a Japanese website not having been /.ed.
The shock of this story has left me nearly speechless. A bug that causes a browser to crash? A story so lame this early in the morning? How can these things be?
Error:
MSFT should try to fix the bug that is crashing IE, because crashes in IE have a tendency to become a remote execution bug later. But still, no point in bashing MSFT on this issue. Browsers crashing on malformed input is well known. Firefox, my fav and only browser, too crashes often on malformed input. There is this thing called fuzzing, sending deliberately malformed input to the browser and see what happens. Firefox used to crash more often than IE under fuzzing. Now they provide fuzzing tools for their testers to strengthen mozilla products.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Independence Day
TFA's servers aren't responding at the moment, so this might be included, but has anyone tried this with non-IE programs which use the Trident layout engine?
If it's Trident that's bringing down IE, then you're looking at HTML code that could also bring down Windows Media Player, several versions of Outlook and Outlook Express, MSN Messenger, Steam (from Valve), and other applications which use it to render web pages. I think at least some versions of Winamp used trident as well, but I'm not sure about that.
200 HP? Is your shit a 20th level Barbarian or something?
http://marketshare.hitslink.com/default.aspx
I won't speculate on the accuracy of these sites but it's interesting to compare the w3 statistics with the hitslink.com statistics. Linux for example gets twice the share on the w3 counter as on the hitslink.com site. Vista gets fewer hits on the w3 counter than on the hitslink.com site, it's currently standing at 5,4%, I thought it would be in more widespread use by now. The older Macs are completely missing from the w3 counter although I know for a fact that loads of people are still using them.
Only to idiots, are orders laws.
-- Henning von Tresckow
Yeah, but don't you think w3schools would be a bit biased? W3schools is a site full of tutorials and information for developers. Developers tend to prefer FireFox due to its robust plugin system and some of the excellent plugins for that system (Firebug, Web Tools, etc.) so I'm not surprised that FireFox has a higher rate of use on such a site. In fact, I am surprised that it's not higher!
One hack to rule them all...
However, it's misleading to call these "Engrish", as that normally refers to the use of bad English (or even pseudo-English) by the Japanese.
By contrast, this is a quaint auto-translation of correctly-written Japanese. Okay, so the "cute" tone is probably down to the differences between Japanese language and culture as well... but it's still not Engrish per se.
"Slashdot - News and Chat Sites Deviant". (Click "homepage" link above for details).
To be perfectly fair, Safari also crashes from time to time, but I do not know the specific causes as with this error... The thing that annoys me the most about Safari, though, is that is drinks memory like a sailor drinks beer...
:-)
The difference is, though, that you can take my MacBook Pro away from me when you pry it from my dead cold fingers... Expensive or not.. Other than some minor quirks, I am so much more efficient during the day on my MacBook Pro than I ever way on Windows...
Six words? Please.
As any pimply-faced 14 year old surfing the web alone in his bedroom could've told you, all it takes is your Mom unexpectedly calling your name from right outside your door to cause IE to be shut down immediately.
...one hack to find them, one hack to show them all, and in the code lines fry them?
Every time I start to have faith in humanity, I ruin it by driving to work between 7 and 8 am.
"I tend to use http://www.w3counter.com/globalstats.php more than the w3schools stats, they're usually more accurate since w3schools has a very specific audience."
;)
It may be more accurate, but still not very, considering that it says that Latvia makes up 4% of web usage.
-- "I never gave these stories much credence." - HAL 9000
If the point of this item is to point out bugs in IE it isn't alone. I crashed a large Epiphany session with a segmentation violation a couple of days ago and its relatively easy to crash Firefox if you limit the amount of memory available using ulimit (Firefox doesn't catch "early" C++ memory allocation failures and handle them gracefully). Firefox also has the infamous "window unexpectedly destroyed" bug (#263160) for ~3 years (which will crash the browser if you attempt to close the untitled window).
I suspect all of the Mozilla based browsers will effectively die if one throws enough "heavyweight" pages at them (i.e. those which are activity heavy [because there isn't a Javascript/Active HTML/Animated GIF scheduler]) or run out of swap space (again because memory allocation failures are not handled gracefully).
IMO, developers place too much emphasis on feature enhancements rather than making the existing browsers run reliably (bugs shouldn't linger for 3 years), with a minimal machine footprint (Netscape 4.7x required significantly less memory than Firefox) and effective priority scheduling of the "top" window (user responsiveness).
Six words to bring down IE: Use FireFox to browse the web
A badly formed INPUT tag has been known to take down IE since at least 2003.
Bigger news is why is it still there?
If you include it in the body of an HTML mail message.
Big deal. I can crash Safari 2.0.4 in two clicks. Enable Slashdot's new discussion system and click on a 'Reply to This' link. Press the Back button. Crash.
Or we could militarize it, and only show the words to our national enemies!
Wait... where have I heard of that idea before...?
The Fight for Student Power on Campus: www.forstudentpower.org.
Yup, doesn't crash IE 5.2.3 for Mac OS X.
-- Boycott Shell
Here I was all excited because I thought it was a writing contest to insult IE in 6 words. My mind was all ramped up for creativity. Now I have the mental equivalent of blue balls ...
On Ubuntu, with ies4linux, it crashes ie6 but not ie7.
http://24.29.222.112/ Why? Has something bad happened to my 'puter as a result?
"There is no more pr0n here."
Gentoo Linux - another day, another USE flag.
Oh, we have one holdout in our office. Everyone else is switched over to IE7, and I use Firefox, but this guy is unbelievably stubborn and refuses to allow me to upgrade it for him despite all explanations of why it's a good idea.
He's one of the company owners, and gets all pissy if I even install a security update on his machine. But if he wants to risk losing his QuickBooks when his computer eventually gets 0wned through IE6, well, that's his problem then.
Does it make you happy you're so strange?
Last I checked, a single Javascript command was enough to crash IE, and I think it works in IE7 as well as IE6:
for (x in document.write) { document.write(x);}
Was a great prank (ie, a sig link saying "IE USERS DON'T CLICK HERE"). Heh.
it's not necessary. I've already got a fix up.
hee hee hee
+5, Truth
If I have nothing to hide, you have no reason to search me
It's easier than introspection, huh? Dipshits.
1. *
2. {
3. position
4. :
5. relative
6. }
Patents Drive Free Software as Hurricanes Drive Construction Industry
1. <style> />
2. *{position:relative}
3. </style>
4. <table>
5. <input
6. </table>
Patents Drive Free Software as Hurricanes Drive Construction Industry
"Doesn't it look tired these days?"
For those of you researching bug #263160, click on the link provided.
~ In Trust, We Trust ~
That asterisk is trouble for everyone now.
Coooool, it worked. Now, just post this on every website with a note that says "This website is best viewed with Firefox" and tah dah, the fall of IE! :P
Funny, I read it as "Horsepower".
This is what happens when you implement stuff by adding hack on top of a hack (CSS on top of "magic" HTML elements) instead of refactoring old crap and using proper approach (all display handled by CSS only).
The six words are, "don't you think she looks tired?"
If it's not one thing it's your mother.
The Power of Christ Compels You?
Sometimes at night I imagine the darkness is filled with horrible things with too many teeth, like Julia Roberts.
Just curious, are there any figures which compare security issues for KHTML, Webkit, Gecko, Opera, etc.? I am guessing that bug trackers alone would be incredibly skewed towards the most-used engines, and statistical methods tend to own me.
Well, security holes and crashes are somewhat orthogonal to each other. In systems where instruction space is separate from and protected from data space and the kernel space is separate from the user space it isn't clear how bad security can get in practice. Browsers I suspect are more vulnerable if one has plugins that can gain access to the user data space (form entry strings, user files, etc.). Installation of any binary packages is problematic (the greatest risk in an open source world would be compromised mirrors IMO).
/. readers.
There is a lot of attention on (and tracking of) potential security holes (buffer overflows, etc.) and differences between such holes in IE vs. Firefox, rates of security patches in various closed source systems vs. open source systems (and then distribution through open source distributors) -- but from someone on the outside, such as myself, there seems to be a lot of handwaving and very little detail on how real problems are put into web sites or emails and infect "real" protected user systems (which Unix/Linux/BSD systems have always tended to be) and which Windows (e.g. Vista) is slowly becoming. I suspect the real security experts know how one might make such attempts (root kits, etc.) but no "real world" "real risk" statistics seem to be available even for people who are regular
He's a heavy tipper.
Just using adblock software like Admuncher(http://www.admuncher.com/) IE7Pro(http://www.ie7pro.com)
and add this rule:
<style>* {position:relative} </style><table><input></table>
then it must be ok
Which is as it was intended (obviously)
which is totally what she said
It should be noted, that the page lists both IE7 and IE6 percentages. IE's total market with a combined IE6/7 is 57%.
it's been a while since anyone mentioned the malformed tag as a problem3 -04-20/2003-04-26/0
;)
http://www.securityfocus.com/archive/1/319360/200
Would all the anti IE folks please put this on their site immediately so I don't have to spend time on them
Many crashes are due to misbehaving plugins. Due to Mozilla plugin architecture, there's nothing we can do about this. (However, an experimental WebKit back-end was recently added to Epiphany.)
I don't remember. It may have filed it and I may have received a note that it didn't contain enough information. Bug reports without full symbol traceback information are pretty useless most of the time. I'm in the process of rebuilding all of the latest libraries with debugging but thats always a multi-day process unfortunately (and not one that I would guess the average user would undertake). If one gets a SEGV after running the browser a couple of days in the middle of a complex session its probably a memory corruption problem -- and likely only able to be debugged by a few core developers who understand everything thats in the heap. I don't use a lot of Epiphany plugins and generally ditched most of my Firefox plugins because they contributed to heap fragmentation/memory loss (even the Flash player from Adobe since that tended to fault). I'll be leaning towards the first browser that gets a robust bookmark system as neither Epiphany nor Firefox (2.0 *or* 3.0a7pre) are anything I'd consider to be worthy of the label "production".
Out of curiosity, what would it take for you to consider a bookmark system "robust"?