IE 8 To Include New Security Tools

Trailrunner7 writes "Internet Explorer has been a security punching bag for years, and rightfully so. IE 6 was arguably the least secure browser of all time. But Microsoft has been trying to get their act together on security, and the new beta of IE 8, due in August, will have a slew of new security features, including protection against Type-1 cross-site scripting attacks, a better phishing filter and better security for ActiveX controls."

Comments

Better security for ActiveX controls

[sakdoctor]

Or scrap ActiveX controls?

Re:Better security for ActiveX controls

[Tweenk]

ActiveX is a critical technology in (South) Korea - you can't do any online banking, online shopping, etc. without ActiveX support. MS can't drop ActiveX or it would lose the Korean market.

Re:Better security for ActiveX controls

[Anonymous Coward]

> MS can't drop ActiveX or it would lose the Korean market.

Lose it to whom? There aren't any other ActiveX providers, so if MS dropped ActiveX, South Korea would have no choice but to use whatever MS would provide as replacement.

Re:Better security for ActiveX controls

[owlnation]

Or scrap ActiveX controls?

If only... no one act would improve more the quality of everyone's browsing experience.

Re:Better security for ActiveX controls

[TheNetAvenger]

Or scrap ActiveX controls?

Too much legacy, best thing to do is continue to sandbox them as much as possible.

MS is shoving devlopers to either Silverlight or XBAP that have extensive sandboxing/security in comparison. MS has been in the process of killing ActiveX for several years now, next trick is to smack the developers around by making non-internal deployment really freaking hard.

Even Win32/64 has been being killed off slowly, but developers are slow moving creatures sometimes. (This is the biggest reason even people that hate Vista should be rooting for it to replace XP at the very least, as the non-Win32 APIs are its bread and butter, even working directly inside the vector composer of Vista, that XP can't do even if you try running .NET 3.x on it.)

Re:Better security for ActiveX controls

[Anonymous Coward]

If what you are saying is true, why hasn't MS stopped using ActiveX for WGA for most of their downloads?

Re:Better security for ActiveX controls

[AllIGotWasThisNick]

Lose it to whom?

You're far too serious sounding A. Coward to be sarcasm. My apologies if this was genuinely intended to be funny ;( In answer to your question: To (a) anyone that rushes in to provide ActiveX support in the void or (b) anyone that provides the replacement technology (if they still haven't learned -- seemingly the case), or (c) all browsers should they start using (eg) air/flash or regular ole' https+html instead of https/silverlight.

Re:Better security for ActiveX controls

[JebusIsLord]

ActiveX is the only thing keeping large businesses TIED to IE. The last thing MS would do is scrap them. And to be honest, within a corporate intranet (where users don't have the rights to install activex controls), ActiveX is a pretty solid technology.

Re:Better security for ActiveX controls

[Anonymous Coward]

Cause Korea doesn't have anti-trust laws? The problem is thus: There was a window between the Mosaic project winding down and closing up shop and the plethera of what became opensource browsers and standards. In that window, Microsoft was inventing the standards very quickly and with little consideration. Well in exactly the way the free-market had been doing a good job since Adam Smith's time. But the problem is that kind of thing isn't particularly helpful at a networking technology, be it roads/railroads/POTS/or lolcat infused intarwebz.

That has created a world of multiple standards which have unintended and undesirable consequences, but none-the-less have a tremendous amount of invested capital behind them. You might as well advocate the taking of an axe to any machine (or host of a virtualized machine) running legacy COBOL code. It's just not always convienent to rebuild the world from scratch, even if it's a GLOB of 1's and 0's.

The money isn't there to run two platforms sidebyside into the future, elegantly and mercifully letting the legacy cudgles fade away. The downtime for a do-over is so comically idiotic that standards zealots even speak to the idea at all is practically an indictment of their whole position. So we'll get to enjoy the interaction of a million (million-million?) poorly considered decisions for decades to come.

Re:Better security for ActiveX controls

[Telvin_3d]

Anyone rushing to provide ActiveX support? How exactly does someone rush to provide a fully compliant alternate version of a closed source system? If it was that easy to seamlessly duplicate ActiveX there would be ActiveX plugins for Firefox and Opera and this whole conversation would never have come about.

Re:Better security for ActiveX controls

[IntlHarvester]

Every Internet Explorer "plug-in" uses ActiveX. This includes Silverlight, Java, Flash and so on. AFAIK there's no plans for that to change, if you want to extend the browser, you need to use ActiveX.

What TheNetAvenger is saying is that Microsoft has been discouraging developers from writing custom controls. Part of this is making them more and more difficult to install. In most cases these controls were only used for custom UIs and things that did not require full unsandboxed system access. So they would be better off using AJAX/Silverlight/Flash/Java.

Re:Better security for ActiveX controls

[Z34107]

ActiveX controls sound a lot like Firefox Add-Ons. Except ActiveX controls are sandboxed, whereas Add-Ons run at browser privileges.

Am I wrong? Or should Firefox scrap Add-Ons before IE8 scraps ActiveX?

Re:Better security for ActiveX controls

[IntlHarvester]

Neither are sandboxed and both run with the same privs as the browser AFAIK.

The only real difference is that Firefox comes with a whitelist which prevents random sites from installing add-ons.

Re:Better security for ActiveX controls

[IntlHarvester]

There is an ActiveX plugin for Firefox: http://www.iol.ie/~locka/mozilla/plugin.htm

Either browser could easily support ActiveX on Windows if they wanted to. The main reason they don't is for marketing reasons (because it's perceived to be insecure).

Aside from that ActiveX is actually a documented Open Group standard, and there are (were) 3rd party implementations.

Re:Better security for ActiveX controls

[cheater512]

Err...Javascript is considered insecure by some.
How is running third party binary code secure?

Re:Better security for ActiveX controls

[IntlHarvester]

It isn't.

But yet every single modern browser has a way of running 3rd party binary 'plug-ins' or 'add-on' because its too damn useful. Therefore the only real distinction here between browsers that support ActiveX and browsers that don't is marketing.

Re:Better security for ActiveX controls

[Z34107]

Interesting - I was operating on bad information. (Shh!)

Internet Explorer's ActiveX controls (on non-Vista/IE7 machines, so most of them) with native privileges. Evidently they were designed to run fast-as-native-code and be "building blocks" other programs could hook into. For example, Internet Explorer exports a COM interface, which lets other apps load web pages or parse an HTML interface.

So, my Googling found that ActiveX relies on digital signatures and permissions explicitly given by a user.

Re:Better security for ActiveX controls

[cheater512]

Your ignoring the fact that ActiveX can be executed from any page with only a small security warning which everyone clicks yes on.

Re:Better security for ActiveX controls

[IntlHarvester]

Actually, I'm not. If you look at that Firefox plug-in I linked above, it uses a site whitelist which makes it considerably more secure than IE. Just because IE has/had poor ActiveX security doesn't mean another browser would have the same policies.

Look at the posts in this thread. Everyone's convinced that "ActiveX==BAD" while they probably have 50 Firefox add-ins and plug-ins installed. They're the basically the same damn thing, so I'll maintain this is almost entirely a perception issue (which exists for valid, but historical reasons).

Re:Better security for ActiveX controls

[IntlHarvester]

The digital signatures really only prevents one form of social engineering attack, it's not a sandbox/permission model like Java. And the big reason that ActiveX has such a terrible reputation is that the prompts could easily be bypassed in early versions (3/4).

Vista Protected mode does provide a sandbox, but I think you can break out of it with a UAC prompt. Which would be easy to social engineer around.

Re:Better security for ActiveX controls

[sqlrob]

ActiveX is documented, well enough for their to be clones.

Re:Better security for ActiveX controls

[eonlabs]

That's not how windows security works. If they doubled it, expect:

An activeX control has been detected on this site. Allow it to run (Yes/No)?
  (the close window button is missing, yes and no don't exist)

Are you sure you want to run it?
  (They may use both yes and no buttons instead of an OK button here)

Re:Better security for ActiveX controls

[sqlrob]

There's no "fast as native" code with ActiveX, it *IS* native code.

Re:Better security for ActiveX controls

[tokul]

ActiveX is the only thing keeping large businesses TIED to IE. The last thing MS would do is scrap them.

They can also push Silverlight. It is already listed in windows updates for Vista.

Re:Better security for ActiveX controls

[Daimaou]

Or maybe South Korea could pull their collective head out and stop supporting lock-in and using crap technologies.

Re:Better security for ActiveX controls

[IntlHarvester]

If you wanna to get conspiratorial, these changes aren't really about "security". They're designed to nudge companies with legacy VB6/VC controls into redeveloping with Silverlight.

Re:Better security for ActiveX controls

[man_of_mr_e]

Ahh yes, whitelisting. You know what would happen if Microsoft did the same thing, they'd be accused of monopolizing the ActiveX market and using their power to control who is allowed to install controls and who isn't.

There is no solution there.

Re:Better security for ActiveX controls

[spongman]

you know wrong. ActiveX on Vista runs in a sandbox with lower rights than the current user.

Re:Better security for ActiveX controls

[Anonymous Coward]

Firefox extensions are decidedly NOT the same.

Imagine that every single website you're doing business with - banks, online shops, ... - wanted you to install their own Firefox extension. If THAT was true, you'd have a case, since that's what it's like with ActiveX; but of course, it isn't like that, and I'm surprised you can't see the difference.

Re:Better security for ActiveX controls

[jonadab]

Actually, ActiveX controls that are installed at system deployment time by a network administrator are not really the problem. Microsoft could probably continue to allow those. The security problem was always the fact that ActiveX controls could be _installed_ as part of the normal browsing process. IE5 and 6 pretty much completely abdicated any pretense of security by doing this.

Re:Better security for ActiveX controls

[SEMW]

Neither are sandboxed and both run with the same privs as the browser AFAIK.

you know wrong. ActiveX on Vista runs in a sandbox with lower rights than the current user.

Actually, the GP isn't wrong. But you're not wrong either. The GP is right that ActiveX runs with the same privs as the browser, and you're right that ActiveX runs with lower privs than the current user (on Vista); because the browser *also* run with lower privs than the current user.

Re:Better security for ActiveX controls

[Anonymous Coward]

Well, half right. If you want Firefox to use a plugin, you install it in Firefox, not the OS. The *real* reason is that IE has full access to *Any* ActiveX contorl on your machine... realplayer, some demo software you installed 3 years ago, some UI enhancement tool, any and everything regardless if its a browser component or not.

It was another complete moron at m$ that never thought of or ignored this attack vector. Just look at this, encoded for a remote IE hack... Any ActiveX is accessible in IE, the biggest security fuck up of all time.

http://www.milw0rm.org/exploits/5793

muvee Technologies Text-Effect DXT Filter for autoProducer (TextOut.dll v6.0.18.1)
Fontsetting property remote buffer overflow exploit

Re:Better security for ActiveX controls

[WgT2]

Ooow. I thought 'Include New Security Tools' meant they would include Firefox... or something.

Re:Better security for ActiveX controls

[Anonymous Coward]

Which means, it runs with the privileges of the browser, which is, incidentally, what GP said.

Ans as it's running with the same privileges, it could mean taking over the browser, changing its prompts and asking your way out of the sandbox, but in a nice way. Oh well, nice idea, or so.

Re:Better security for ActiveX controls

[makomk]

I somehow doubt it - if they shipped it with an empty whitelist and let the end-user select what's allowed, there's no real way they could be accused of this. (Of course, they'd probably insist on whitelisting their own sites. In fact, I think this is roughly what IE7 and later do by default, though they don't have a clean way of adding sites to the whitelist without giving them all sorts of other abilities at the same time.)

Re:Better security for ActiveX controls

[makomk]

Yeah. The trouble with ActiveX is that:

- the companies issuing code signing certificates were more than willing to sell them to anyone who'd pay, including all sorts of shady adware and spyware vendors, though most of the time they did at least check the company name on the certificate was correct.
- a lot of people just automatically clicked "Yes" when asked if they wanted to install the software, and there were all sorts of social engineering attacks used to encourage them.

Re:Better security for ActiveX controls

[JebusIsLord]

Absolutely, that's what I meant. We package ActiveX controls for the business users, and then push them out through SMS. Frankly we haven't even upgraded to IE7 yet because of all the apps that would break.

Re:Better security for ActiveX controls

[Anonymous Coward]

Look at the posts in this thread. Everyone's convinced that "ActiveX==BAD" while they probably have 50 Firefox add-ins and plug-ins installed. They're the basically the same damn thing...

They are not the same thing. I have *never* encountered a site that would not function because I was missing a Firefox plugin.

Plugins are things that users seek out in order to
alter or augment their use of the web. Activex is forced on the user by (mostly) poorly-created web sites.

By your argument there is no difference between you using NoScript to browse Slashdot and me somehow forcing you to install a binary just so you can read my post.

Yes, firefox plugins and activex are both code that runs on one's computer with all the power of the controlling user (I believe this is true of firefox plugins, I don't know enough about them). But saying that they are the same is like saying that your beloved copy of InfraRecorder and the virus you downloaded last week are the same.

Re:Better security for ActiveX controls

[rbanffy]

If dropping ActiveX granted any real market advantage (people who know what is ActiveX are less than 2% of the overall computer-using population and people who know how bad ActiveX really is doesn't reach 1%), they would screw the South Koreans all over.

BTW, it seems they already screwed SK pretty bad.

Re:Better security for ActiveX controls

[IntlHarvester]

If you look at how Firefox has implemented whitelisting add-ons, its just another dialog box/infobar to click-through.

Unfortunately multiple confirm actions is what passes for "security" in modern browsers.

Re:Better security for ActiveX controls

[IntlHarvester]

You're right that Firefox's extension technologies have not been as widely adopted as ActiveX. But not because Firefox doesn't have the features.

In terms of the underlying mechanism and security risk, there's is almost no difference. Both are systems to e-z install native code into your browser process.

Re:Better security for ActiveX controls

[Anonymous Coward]

The difference lies in weather it is the user or the vendor that does the whitelisting.

Re:Better security for ActiveX controls

[man_of_mr_e]

Users have proven that they'll do whatever it takes to visit whatever porn site they want to. They'll whitelist anything. How is that any different from clicking through several levels of warnings?

Re:Better security for ActiveX controls

[Vexorian]

Countries must eventually pay for the bad decisions their IT elite made. I am sure (South) Korea is not an exception.

Re:Better security for ActiveX controls

[tehcyder]

Or maybe South Korea could pull their collective head out and stop supporting lock-in and using crap technologies.

It's almost as if the free market hasn't worked to optimum effect. Would you suggest that the government steps in to make Active X illegal?

Was I the only one to misread the title?

[The Standard Deviant]

Was I the only one to misread the title as: "IE 8 To Include New Security Holes" ?

Re:Was I the only one to misread the title?

[kjart]

Was I the only one to misread the title as: "IE 8 To Include New Security Holes" ?

That's true for almost everything new. As complexity rises, so does the chance of a problem, and browsers are surprisingly complex nowadays.

Re:Was I the only one to misread the title?

[Anonymous Coward]

Was I the only one to misread the title as:

"IE 8 To Include New Security Holes" ?

That's true for almost everything new. As complexity rises, so does the chance of a problem, and browsers are surprisingly complex nowadays.

What's IE?

Signed, a loyal Netscape, Mozilla, now Firefox user

Re:Was I the only one to misread the title?

[Jekler]

Although it's true that the potential for problems rises (perhaps exponentially) with the complexity, advancement does not have to mean an increase in complexity. Simplification is a much greater mark of advancement than complexity is.

Security, hah.

[Kingrames]

On hacker/cracker messageboards everywhere:

OOH! more security vulnerabilities to play with!

Re:Security, hah.

[Antique Geekmeister]

And more DRM to wade through. Much of Microsoft's current 'security' development is aimed squarely at DRM and protecting the control by businesses, not at protecting users.

Let me guess...

[GSPride]

An 'Install Firefox' button?

Re:Let me guess...

[snl2587]

Yes, congratulations is in order for Microsoft's IE team: they've finally reached nearly the same level as Firefox+NoScript. And they've only been in the game...how much longer? [/msFlame]

But seriously, maybe we should give Microsoft a little credit. As bad as they've been about IE security in the past, they're actually trying this time.

Re:Let me guess...

[lostmongoose]

As bad as they've been about IE security in the past, they're actually trying this time.

Because they say they are, right? They've said that it'll be more secure than before everytime they've done this and nothing really changes.

Re:Let me guess...

[snl2587]

Well, yes, but this time it's more of a "must do" situation. If they don't change something they're in for a bit of a rough ride. And for that, I give them the benefit of the doubt.

Re:Let me guess...

[lostmongoose]

They lost any benefit of the doubt after 6, imo. They could have done all this with 7 like they promised but they didn't. They've had years to correct the issues with security but would rather add useless superficial 'security' measures than any real fixes.

Re:Let me guess...

[GigaplexNZ]

Yes, congratulations is in order for Microsoft's IE team: they've finally reached nearly the same level as Firefox+NoScript.

Funnily enough, even Firefox without NoScript isn't at the same level. These comparisons should really only be done at default settings without 3rd party addons. It is fairly easy to lock down any of the browsers out there, but the majority of people don't do it.

Re:Let me guess...

[drinkypoo]

While IE7 is still a big pile of crap, it's not QUITE as bad as IE6. Maybe IE8 will be not QUITE as bad as IE7... It could be the beginning of an underwhelming trend!

Re:Let me guess...

[Anonymous Coward]

As long as it's not FireFox 3 (Keep scrolling down) https://bugzilla.mozilla.org/show_bug.cgi?id=423507

Good

[willyhill]

I think the IE7 solution to ActiveX sandboxing was well done. It's still a problem, but a lesser one I guess. I always thought that was the most serious issue with IE.

It just feels like it's taking forever to make IE a good browser. All those years in a stagnant pond where the order of the day was fighting little fires instead of improving the product beget Firefox, and now Microsoft is really feeling the heat. Competition is good, but Microsoft seems to still be moving at a glacial pace.

Re:Good

[MightyMartian]

I certainly hope they make IE8 faster. My (admittedly very anecdotal) experience is that IE7 is an absolute dog on startup and in browsing. There's a real lag there, that Firefox simply does not have.

Re:Good

[thetoadwarrior]

XP or Vista?

I'd say IE7 XP isn't that bad to start up but in Vista it takes forever.

Re:Good

[willyhill]

I honestly don't see the difference between IE7 and IE6 on either XP or Vista. And I think IE is a heck of a lot faster to load and initialize than Firefox. But Firefox seems to render pages slightly faster than IE7.

You might want to check the IE add-ins or whatever they're called. A girl at work started having problems with startup times and some pages that would get stuck when loading in IE7, until she figured out that the Skype ActiveX control was causing it. She disabled it and everything started working fine.

Re:Good

[Anonymous Coward]

Weird. Just the opposite here. Slowpoke on XP, pops right up on Vista.

Re:Good

[GigaplexNZ]

I honestly don't see the difference between IE7 and IE6 on either XP or Vista.

It is pretty easy to notice the difference between IE 6 and IE 7 on Vista. One runs, one does not. Also, how do you not notice the tab support in IE 7?

Re:Good

[onedotzero]

IE8 is pretty much instantaneous when starting up. Browsing/rendering pages is pretty good too.

There's always the option of increasing concurrent HTTP connections if you desire (this applies to IE7, too).

Re:Good

[stephanruby]

I certainly hope they make IE8 faster. My (admittedly very anecdotal) experience is that IE7 is an absolute dog on startup and in browsing. There's a real lag there, that Firefox simply does not have.

I'm not disputing your claim, but you may want to make sure both browsers are either fully prefetched or not prefetched at all before you run a comparison between the two. For me the opposite is happening, Firefox is the slower one, IE7 is in the middle, Opera is ahead, but then again I am used to having so many Firefox extensions running, and those Firefox extensions are precisely the reasons why I couldn't do without Firefox as my default browser -- so this isn't even a contest for me.

Re:Good

[willyhill]

It is pretty easy to notice the difference between IE 6 and IE 7 on Vista.

I know that. What I emant is that on the same hardware (pretty much), I can't see IE7 being much slower than IE6.

Also, how do you not notice the tab support in IE 7?

I don't understand that...? Of course I noticed it.

Nope, just the best one to date.

[DaedalusHKX]

"Uninstall Internet Explorer 8? Are you sure? Yes/Yes"

Perfect security tool, IMHO.

Re:Nope, just the best one to date.

[GigaplexNZ]

You paid $300 for use of software, I assume you got some use out of it, and later on after the shelf life of the product you want a refund not only for the full amount, but an amount higher than you initially paid for it? That's some serious optimism there. For the sake of argument, let's assume you are entitled to a refund. If you got any use out of the product at all, you are not entitled to a full refund, as you would be getting something for nothing. Even if you never were successfully able to activate (thus being entitled to a full refund), you made a conscious decision to buy the software at that price at that time, forgoing any interest you might have made on the money. If the software did work, you still wouldn't have got that interest.

Re:Nope, just the best one to date.

[DaedalusHKX]

Technically, if they break the use of the product it is THEM that broke it. For example, if you take a car to a dealership for an oil change, and they break your transmission, the auto company/dealership is NOT immune to a lawsuit because "hey, you got usage out of the transmission".

In fact, they will have to get you the FULL value of the transmission / replace it with a fully working one. See the whole issue is that a remedy to a broken contract is supposed to set you off AS WELL OR BETTER THAN BEFORE THE DAMAGE WAS INCURRED!

Pay attention to the caps... there's a reason for them. That was originally the whole point of contracts, fulfillments and remedies in case of broken contracts. Seems that companies that deal in software are permitted to break the product and the client is to blame. Strange that. Nowhere nearly as strange as the fact that you seem to think that such things are perfectly fine. Amazing. Nothing short thereof.

Not that I care. It was one more reason why I stopped using XP period. Guess what. Unless they give me a copy of Vista FREE, I don't plan to ever go back either. Hell, since I stopped gaming I've had more spare time than I've been able to waste with a conscious effort :)

Re:Nope, just the best one to date.

[GigaplexNZ]

Technically, if they break the use of the product it is THEM that broke it. For example, if you take a car to a dealership for an oil change, and they break your transmission, the auto company/dealership is NOT immune to a lawsuit because "hey, you got usage out of the transmission".

In fact, they will have to get you the FULL value of the transmission / replace it with a fully working one.

Note that the transmission is worth considerably less than the total value of the car. Also note that they actually broke your car, a better analogy would be if the gas station broke down and you weren't able to get petrol to fill the tank.

See the whole issue is that a remedy to a broken contract is supposed to set you off AS WELL OR BETTER THAN BEFORE THE DAMAGE WAS INCURRED!

What contract did you and Microsoft sign when you purchased the software? What contract did you and Microsoft sign when you instigated the use of the activation service? If you actually did sign such a contract, please post an excerpt from the contract where they agree to set you off as well as or better than before.

Seems that companies that deal in software are permitted to break the product and the client is to blame. Strange that. Nowhere nearly as strange as the fact that you seem to think that such things are perfectly fine. Amazing.

First of all, the product itself hasn't changed. It is the server side support that has ceased. Also, I never said that it was acceptable to cut off the support in a transparent fashion, just that you wouldn't be entitled to a refund of greater value than the purchase price. You may be entitled to an equal value refund depending on when it was purchased and when the activation problems surfaced.

Re:Nope, just the best one to date.

[DaedalusHKX]

Or I could be entitled to a "working" operating system? Nah, I don't need entitlement... I've already fixed the issue, but thanks for caring. (Not really.)

I agree, no written contract, indeed a problem. Secondly, since there is no written contract, it also means that I don't need to buy their next product again.

I love voting with my wallet. :) Best voting there is. Especially when an operating system sold "in good faith" (we presume it was) turns out to be a 30 day dud because the company crippled it on purpose and then stopped providing the missing component which they themselves removed from their otherwise workable product.

We used to call shit like that crippleware. Peculiar, but not impossible to sidestep. Frankly, I just pity the poor suckers stuck with it as their ONLY OS. Ye gods that must suck.

Re:Nope, just the best one to date.

[Anonymous Coward]

Hell, since I stopped gaming I've had more spare time than I've been able to waste with a conscious effort

No girlfiriend, huh?

Re:Nope, just the best one to date.

[javakcl]

Unfortunately, there are still no good JavaScript (or otherwise) programs that can replace a good ActiveX plugin for editing and printing Correspondence from say, a browser based medical application. Also, there are some companies that still only support M$ products and haven't taken the time to make a non-M$ compatible product.

Please say..

[wellingtonsteve]

..that they will be more usable than the current 'security tools' we get with IE7 which serve the purpose of securing IE by making it so annoying that no-one wants to use it..

I mean that security bar thing that appears below the address bar for example when you want to download something. "Are you sure you want to download this file? It may contain viruses, malware, zombies, ghosts, or even the mother-in-law amongst other Scary Things (tm)?" YES! Why no "Don't ask me again, I'm smart enough to know what I'm downloading thanks" option....

Ahem, rant over sorry.. But please MS, try harder this time..

Re:Please say..

[ConceptJunkie]

It would be nice if Microsoft's biggest security "feature" is asking the user to confirm any operation that could conceivably cause a problem. Oh, well, at least they can blame the user now... after all HE allowed it.

The one time I tried to use IE7 and MSN search (to look up TV remote control codes) MSN search returned a link that hijacked IE7 to a site trying to play porno movies and because of the constant message boxes claiming "Microsoft" found security problems and should I let it install a "fix" (probably Javascript trying to get me to install malware). The message boxes wouldn't go away and I couldn't even shut down the browser without killing the whole app from the task manager. (By the way, I checked the first several pages of Google's results to see if that fake link showed up, and it wasn't there. MSN is useless, too.)

I would have never in a million years thought that IE7 would be that horrible. It's like it's 1998 all over again. Microsoft does nothing but FAIL. I've been using Firefox (with NoScript, AdBlock+, etc) since it was Phoenix 0.4 or so and I had literally forgotten how horrible IE used to be... and still is. In all those years nothing like that has ever happened to me with Firefox.

I'm convinced Microsoft just needs to give up. They have become completely worthless and literally have nothing else to offer.

More details and ranting if you're interested: http://conceptjunkie.blogspot.com/2008/04/microsoft-needs-to-die.html

Re:Please say..

[IntlHarvester]

You could easily create a similar messagebox loop for Firefox, to try to encourage someone into installing a malware Add-On.

Unfortunately, no browser that I know of allows you to kill a javascript without taking out the whole browser.

Re:Please say..

[Rutulian]

Actually, you can't with Firefox 3. It will detect a looping script and give you the option of stopping it. If you use NoScript, you can block it entirely.

Re:Please say..

[ConceptJunkie]

Maybe you could, but it's never happened to me... even before NoScript came along.

That's the irony about the Web. It started out as a document display technology and eventually morphed into an application platform, taking about 15 years too long and going down too many dead ends on the way. I read somewhere that someone suggested the Web should have simply been X from the start. It surely would have saved them reinventing the wheel a dozen times in the last 20 years, that's for sure.

We've almost come full circle. The browser is _almost_ the OS which runs your applications. In fact, Microsoft's biggest problem was that they hooked the browser directly into the OS (in fact, their problem has always been that they hook everything directly into the OS). ActiveX was just a shortcut to run native code via the Web, and it suffered all the obvious problems from being so. "Hello, world,, run anything you want on my computer. I trust you." Java was better, but it's just too darn bureaucratic. I can't imagine having to actually develop in Java... from everything I've seen it's worse than dealing with the government and insurance companies combined.

So where will it all end up? Starting around 1991, we reverted back some 15 years in UI development and had to go through the 80's again, but in browsers. I figure in another couple years Web apps and native apps will essentially be indistinguishable, especially from the non-techie's point of view. That's not bad except all the good UI standards and conventions developed by Xerox, IBM, Microsoft, Apple backed with decades of research have been almost completely abandoned. I can't even imagine what the average computer experience will be like in 10 years, but if the past 20 is an example, some things will advance more than I could have ever guessed and others will barely change, and it will still take an expert to solve all but the most basic problems.

The term "bleeding edge" was a play on the term "leading edge" but at the rate things change, there is no more "leading edge" any more. With Vista and recent releases of OSX, the "bleeding edge" is the mainstream, and we've come to not only not be surprised that systems aren't even remotely complete when shipped, in fact, we expect a "dot oh" product to be essentially a late alpha. I don't recall what product it was, but it was a "release candidate" and at the same time the release notes said in effect, "but we haven't documented all the features yet because we don't have a firm list of what will be included". That's not a "release candidate" by any definition... not even Microsoft's. That's an alpha release, by the original definitions. But these days (and Google is a perfect example, even though many of their products are very good), most software never really gets out of "beta" any more. There are Google products that were literally labelled "beta" for years. It's always possible there was some legal reason for this, but the idea of a "test version" vs. a "release version" barely exists any more. Often the only distinction is the size of the group of users who have access to it. Microsoft does this, even though they still pretend to adhere to the gigantic monolithic release after years of development apparently because that's the only way they can justify charging people for the same old crap, but shinier and slower. I think the Ubuntu concept works well. They seem to have an attitude of "We'll take what we've got and make sure it installs and works together" every six months. Each release isn't always a huge change, that depends on the state of things like Gnome, KDE or the Linux kernel or who knows what, but this "evolutionary release cycle", where each subsequent upgrade is relatively small, seems to work a whole lot better than Microsoft's "revolutionary release cycle" where it's a major IT undertaking that is so massive most companies these days would rather not bother.

Hmmm... I seem that have digressed a bit.

Re:Please say..

[IntlHarvester]

Well, that's good to hear!

And FWIW, you could configure IE to whitelist javascripts on a site basis by using 'zones'.

Re:Please say..

[Anonymous Coward]

Firefox 2 does if it notices the script has taken up a huge amount of memory of processor time, so ti should be relatively simple for this to be activated manually as well. The difficulty is that JS alerts are implemented as blocking dialogue boxes, whereas ideally they would only block for the contents of their calling tab, but if you were to select another tab they would just disappear until you return to it.

I'll have to make that more coherent and submit it as a pair of feature requests.

Re:Please say..

[Mystra_x64]

Opera has "Stop executing scripts on this page" option in it's message box dialog.

Re:Please say..

[Tim C]

Firefox 2 would pop up a dialogue box after a while telling you that a script was taking a long time to run, and giving you the option of killing it. Or at least it did for me; I've no idea if that was stock behaviour or one of my extensions.

Re:Please say..

[Rutulian]

Well, like most of the security features Microsoft provides, IE zones are annoying and a pain to use properly. Firefox, by default, blocks most annoying Javascript behavior, but NoScript really takes it to the next level. If you ever find yourself on Firefox, you should try AdBlockPlus+NoScript. It's a pretty good combination and is very usable. See here and here for more information.

Re:Please say..

[Rutulian]

Yeah, it may have been in Firefox 2 as well...I don't remember exactly when they added that feature.

Re:Please say..

[rbanffy]

Why the hell were IE7 and MSN Search your first options to getting some information?!

Re:Please say..

[IntlHarvester]

Yeah, I'm aware of those extensions. NoScript in particular makes the web browser practically unusable for a normal person (as would managing IE zones), so I think it's a somewhat unfair standard to set. Only a few nerds are willing to break normal browsing behavior just to prevent getting rickrolled or dialog-spammed.

Re:Please say..

[atraintocry]

MSFT isn't dumb. My conspiracy theory is that they saw right away the potential for the web to be an application platform, and after initially just hoping it'd go away, they embraced & extended it with ActiveX, Active Desktop, Channels, and all of the other OS hooks IE still has. So, it wasn't a problem for them. Just like how J++ tanked, and that wasn't a problem. Just strategy.

ActiveX has no pretense of security because it was an effort to subvert the browser and keep ISVs developing for something that was Windows-only. And God bless 'em, it worked. I think that at least part of the reason it's taken this long for browsers to be this functional (besides the fact that it's not what they were designed for) was that Microsoft made it hard for advanced web standards to take hold. Not that Netscape was any better.

Also, I'd argue that, although you're right about the definition of things like beta & release candidate changing, people have always chosen cheaper software over better software. OS/2 had features we take for granted today, in the late 80s. And it ran DOS & Windows programs. We all know how that turned out. On the extreme end, the Amiga was more advanced than PCs that would show up a decade later, was pretty cheap, and was still relegated to life as a game console.

"Better" security for Activex?

[alexborges]

The only good activex is a DEAD activex. Kill it once and for all, for christ sakes.

Re:"Better" security for Activex?

[Tweenk]

As I commented under the first post it's not that easy. In Korea everything runs on ActiveX (online banking, e-commerce, etc.), it was the preferred way to provide rich client functionality for years. While ActiveX is deprecated, they can't drop it right now because of the giant backlog of legacy ActiveX applications in Korea. This is also one of their most loyal markets, so it would be a shot in the foot.

Re:"Better" security for Activex?

[alexborges]

Fuck Korea, Microsoft and the horse they rode on.

Activex should've died a simple rapid death a decade ago. Microsoft is willing to actually make their stuff standards compliant: that'll mess much more many people up than killing activex off.

In any case, I dont care at all: ive necer used activex and I never will. Hell, i dont even use IE and never will.

Re:"Better" security for Activex?

[smittyoneeach]

It's also at the heart of around a bazillion lines of VB applications and stuff.
While it would in theory be totally smarter to upgrade everything to .Net and use VSTO and the like, the installed base becomes the chief competition for MS.
Even if MS gave away all of the tools and converters to migrate away from all the VB, there would still be a crushing battle with bureaucratic inertia.

Re:"Better" security for Activex?

[doktorjayd]

so kill it,

and make the banks, etc reconsider in their next round of development. its actually pretty easy to adhere to standards that make apps cross-browser happy.

geez, if an online app gets 3 years of production life, its done pretty well, so planning for the next version _without_ activeX should be pretty straight forward.

just looking through my web server logs, theres still plenty of nufties running ie5/6, so killing activeX in ie8 wouldnt be the end of the world overnight - ppl would just have to have an older ie around for a bit longer ( or perhaps install it as an optional add-in to ie8...)

Re:"Better" security for Activex?

[LO0G]

What a great idea.

I do have one question...

If Microsoft kills it's plugin technology (ActiveX) how do you expect people to render video?

Every major browser out there (with the possible exception of Lynx) has a plugin technology that allows things like video rendering to be possible. As long as you allow plugins that have the ability to render arbitrary code, you have an environment that is the functional equivilent of ActiveX.

ActiveX has a bad reputation simply because it is the most popular plugin technology out there. There is absolutely nothing inherently less secure with ActiveX controls than there is in the extension mechanisms used by other browsers.

Does anyone remember the GreaseMonkey vulnerabilities? No ActiveX, but a buggy browser plugin.

Killing ActiveX won't make IE any more secure.

Re:"Better" security for Activex?

[Tubal-Cain]

If Microsoft kills it's plugin technology (ActiveX) how do you expect people to render video?

How about HTML 5's video tag?

And how does one get the angle brackets to not be parsed when posting? (is "parsed" even the right word?)

Re:"Better" security for Activex?

[MichaelTheDrummer]

Typing > will give you >
Typing &lt; will give you <

You have to escape the special html characters. Man I had to preview that 3 times to make sure I had the tags right!

Re:"Better" security for Activex?

[nabsltd]

And how does one get the angle brackets to not be parsed when posting? (is "parsed" even the right word?)

Either post as plain text, or use the HTML escapes: "&lt;" for left angle bracket (<) and "&gt;" for right angle bracket (>).

Also, to create the "source" in this post, I had to escape the ampersand that starts each sequence by using "&amp;".

I only have one comment.....

[zappepcs]

Since IE7 and Vista, I am no longer qualified to comment on the user experience of Windows products. These two products killed off *any* thoughts I might have of using MS products at my personal expense. Still on XP with FF/OOo et al at work. It might^H^H^H^H^H^H will take more to get me to try another MS product than it did to get me to try Ubunutu.

New security tools sounds like a good idea. Hope they do well with that. Everyone has to work to keep the bar high on secure computing development, but I won't be trying it. Yeah, don't bother telling me about how F/OSS has problems too... everything does. I just prefer my problems not be served to me without the lubricant.

I do hope they achieve something good, it will be good for the Internet as a whole.

Re:I only have one comment.....

[abshnasko]

I do hope they achieve something good, it will be good for the Internet as a whole.

And if they don't, that just means more people switching away from MS products and using free software. I can't decide which would be better.

ZZZ

[Anonymous Coward]

Its a boot time, heck there should have been a vastly better ver of IE with vista but of course they only care about makeing things pretty now rather then good code. The worst type of malware imbeds itself into IE and is like impossible to remove. For example zone alarms spy blocker bar/other scamware toolbars.

Blame Shifting Mechanism

[mpapet]

That's exactly what IE7 is. Why is this one going to be different?

Re:Blame Shifting Mechanism

[rob1980]

Because we really have it figured out this time! No, really! We're serious this time, guys.

Uhhh... guys?

Hello?

so.very.broken

[Anonymous Coward]

âoeIE8 prevents âoeupsniffâ of files served with image/* content types into HTML/Script. Even if a file contains script, if the server declares that it is an image, IE will not run the embedded script.â
âoeWe were able to make this change by default with minimal compatibility impact because servers rarely knowingly send HTML or script with an image/* content type.â

So much for them working towards natively supporting image/svg+xml which allows javascript in SVG files (does this also break Adobeâ(TM)s SVG viewer?)

IE 8?

[nx6310]

I still haven't installed IE 7 after the WGA scandal and all the PC's I had to de-WGA for months. IE8 is kind of like "that guy I hate"s kid bro.

But since Vista is WGA infested, I doubt it will ever be mainstream in Developing countries where FOSS strives to compete with Piracy.

Re:IE 8?

[Anonymous Coward]

actually you would be surprised how much easier it is to deal with WGA in Vista. Using the OEM BIOS crack I have never even seen a WGA notice, let alone been denied access by one. I had much more trouble with XP. Perhaps this was intended? That would help to explain why the "improved anti-piracy mechanisms" in Vista were so quickly and thoroughly broken even before the official release.

Re:IE 8?

[nabsltd]

I still haven't installed IE 7 after the WGA scandal and all the PC's I had to de-WGA for months. IE8 is kind of like "that guy I hate"s kid bro.

If you support enough machines, set up Windows Server Update Services on a machine that can be accessed via the Internet, and point all the machines you support to your WSUS for updates (use the "Local Computer Policy" MMC plugin). Then, you can completely control which updates get applied.

WGA isn't approved on the WSUS server I have, and none of my machines have had any problems with any updates (including test installs of IE7 to virtual machines). I'm sure there are some optional things you could download from Microsoft that require WGA, but you could always have one VM that has WGA installed and download using that. I don't know of anything that checks for WGA inside the install file itself, but I wouldn't be surprised if MS started doing that, too.

Sandbox javascript, flash etc ...

[BlueParrot]

There isn't any good reason why the javascript engine should run with the same privileges as the browser, and there certainly isn't any good reason why plugins like flash should have as many privileges as they do. Sandboxing those bits should help a lot.

Re:Sandbox javascript, flash etc ...

[Z34107]

In IE7 on Vista, those bits (and everything you do, actually) are sandboxed. It's called protected mode and like everything well-written and intelligible in life, there's a MSDN article. ~~

If you can get to a Vista machine, boot up Internet Explorer 7. In the bottom-right hand corner, you'll see a "Internet|Protected Mode: On." Internet Explorer, and everything launched in/from IE, run under a low "Integrity Level", which means they only have access to the "Temporary Internet Files\Low" folder and "HKEY_CURRENT_USER\Software\LowRegistry" key.

Any file access is transparently redirected from these points: An ActiveX control trying to create "virus.dll" in "c:\windows\system32" will have it actually created "Temporary Internet Files\Low\C\Windows\System32". (Nothing in this folder is executable.)

Open up task manager. (CTRL+SHIFT+ESC) You'll notice an "ieuser.exe" process - should something need more privileges, like you saving a file to your downloads directory, this process will grant that one action regular, non-admin user privileges. Anything system changing has to pass through an "IEinstal.exe" process, which will trigger a UAC prompt.

My understanding is limited to some Vista beta-era documentation and the MSDN article I linked, but they pretty much sandboxed the entire browser with sub-guest-account privileges. It's relies on some new parts of the Vista kernel (you won't see the same sandboxing on IE7 in XP) but it's still pretty nifty, I think.

Re:Sandbox javascript, flash etc ...

[Anonymous Coward]

Please ask firefox to do this as well - particularly with flash.

Re:Sandbox javascript, flash etc ...

[Anonymous Coward]

Since sandboxes are for cat shit, I think that says a lot about java(script) and flashplayer in general

As they say...

[LameAssTheMity]

Better late than never!

UAC

[asaivan]

You are about to visit a new web page, Allow or Cancel?

Wow! IE 8 to FINALLY include some security tools..

[KozmoKramer]

No wait...to include NEW tools....

When I think of TOOLS, I always think of Microsoft.

By Neruos

[Anonymous Coward]

I've used IE6.x for over 4 years with no ill issues. Though I know how to set security and options and I know when to scan and what websites are allowed to run things(cookies, activex, etc) and which shouldnt.

Not once has my computer been compromised due to IE.

Re:By Neruos

[Kangburra]

Your last statement implies that even though IE was not to blame your computer has still been compromised.

For many years I have been running Linux without any antivirus and my computer has never been compromised.

Re:By Neruos

[Anonymous Coward]

That is an assumition. My PC has never been compromised without my first knowing and willing to let it to happen.

Just make IE 6 obsolete

[Anonymous Coward]

It's a good idea of course, but if Microsoft would actually care(wishful thinking) they would make IE6 absolete already. Their users will be safer, the developers would be happier..

How about we get...

[Anonymous Coward]

support for the application/xhtml+xml mime type? It's been several years now, Microsoft. I'm sick of hearing people go on about how the new IE team *cares*, and yet I don't see all that much improvement.

I don't even care about whether IE actually parses xhtml as xhtml or as tag soup. Just accept the damn mime type and then internally parse it with your crappy engine.

So keep using internet exploder 7 'till then, k?

[lastomega7]

We promise you IE8 will be cool.
-MS lackey

PS- Despite what anyone tells you, don't get 'fire fox,' it's probably a virus.

Great! Now to re-design everything!

[digitalextremist]

This can only mean that when IE8 comes out there is going to be a massive hit to web designers out there. Gear up for the site re-design fest!

Re:Great! Now to re-design everything!

[v.dog]

Actually, MS are promising greater support for the W3C standards, so if your site works well in Firefox/Opera/Safari/other, it should work OK in IE8. The only people who should have problems are the developers that design sites to exclusively work in IE6/7, and rightly so.

Re:This is a simple job

[Anonymous Coward]

You know, statements like that don't just piss off Microsoft programmers, it pisses off Firefox coders, Safari coders, Opera coders, et al. It's *not* a simple job. It's an extremely fucking complicated job.

Security.. Thats all Microsoft knows how to update

[trr49378]

Not to diss Microsoft or anything... but seriously they need to get their act together with security updates. Every other day there seems to be a new security updates for MS XP why don't they stop messing with things then you don't need security updates. I'm a mac user and i would have to say mac's barely ever have updates for security, Is that cuz mac's are better?!?!?!?

The most welcome security feature...

[Bwana Geek]

Perhaps the most long-awaited security feature of all, the IE8 team promises that it will immediately uninstall itself if someone mistakenly puts it on their PC.

Re:The most welcome security feature...

[v.dog]

I'd settle for being able to uninstall it, period. If it was an application and not a Windows component, Windows would be more secure, and I'd be more likely to use IE as it would be there by choice.

Now, that sounds familiar!

[hdparm]

Will this turn out to be the same BS from Microsoft, as it was with all the previous IE releases? History tells us - yes. I mean, what real incentive do they have? All they care about is that IE integrates tightly with their other technologies, so already locked-in corporate users are happy.

The side-effect of less or no security introduced by having IE preinstalled on about all of the new consumer PC shipments is not their concern. Nobody pays for it, anyway.

"IE8 will be the most secure version of IE yet"

[QuietLagoon]

Of course, that's not saying much.....

Re:"IE8 will be the most secure version of IE yet"

[gmuslera]

Is saying a lot, in fact, with this is the 8th time that Microsoft about their current next version of web browser.

Ok, even more, they said that for middle versions like IE 5.5 too.

Screw security, give us standards!

[Yvan256]

I don't care what they do for security, I just want IE8 to support standard CSS stuff like border-radius, box-shadow and text-shadow. That's what people want to see when they sign up for contracts.

Same goes for Firefox (still no box-shadow) and Opera (neither box-shadow or border-radius).

Yada yada yada specs not finished, I don't care. Use the standardized prefixes for non-approved standards, they're here for that (ex: -moz-border-radius, -webkit-border-radius, etc).

Re:Screw security, give us standards!

[TheSeer2]

So they should implement a not-yet-standardised standard. Then, in the off chance they get scraped (or any other situation where it gets scrapped). Someone, probably the same people who wanted em' to implement it earlier will yell, oh noes, EEE! THEY' RE EXTENDING BLAH.

Re:Screw security, give us standards!

[Yvan256]

That's the way the W3C wants browser to implement things. They have standardized the names too (-browername prefix) so once the standard is approved you don't have incompatible parameters on the real names.

Also, if a browser doesn't know a CSS tag it's supposed to simply ignore it.

currently implemented in Firefox 3 and Safari 3, respectively:
-moz-border-radius: 6px;
-webkit-border-radius: 6px;

There is no shorthand way to specify different corners though (which is dumb IMHO, considering all the other styles such as border), so the standard might as well end up as:
border-radius: 6px 2px 4px 7px;

See? Different non-standard implementation names with different parameters that don't walk all over the final specs. That's how it's supposed to work.

Re:Security.. Thats all Microsoft knows how to upd

[metallic]

I'm a Mac user also and it seems like I install a security update about once a month. OS X is good but it's not that good. Hell, it's a few weeks after details of the huge gaping exploit in ARD was announced and there still isnt a security update. The best you can do is remove ARD.

oblig. Kingdom of Loathing quote...

[MRe_nl]

The smell of brimstone, the hulking body and dragging claws, the sound of "stfu d00d u r teh suk" -- yup, this must be a flaming troll.

impossible

[Haxx]

      "But Microsoft has been trying to get their act together on security"

SHHHH! QUIET! You will scare away all the open source people! Even a whisper of a positive spin on Microsoft could shut this site down. As an embedded programmer over here in the Northeast I refuse to accept this as the truth, even if it is true and I see it with my own eyes. No matter how true this might be it still must be false!

You can't fix ActiveX controls in IE.

[argent]

So long as IE is built around the idea that it's possible, even in theory, to create a sandbox that is both leaky and secure, the Microsoft HTML control will continue to be the biggest channel for malware in the world.

We (the security community) have been saying this for a decade, and Microsoft keeps saying "this time for sure".

Don't bet that this time is the last time they say it.

Re:Security.. Thats all Microsoft knows how to upd

[jfim]

No, that's because they batch them in some gigantic 100mb+ update, instead of doing small updates for several applications, which is what Microsoft does.

Seriously, there's no reason why a security update should take several dozens of megabytes. This only ensures that dial up users will not install them and that people are more likely to delay installing patches due to the download time.

Also, most patches on Windows are released every month, on what is called patch Tuesday, which is the second Tuesday of every month. I'm not sure I fully agree with the idea of a fixed patch schedule as it gives the malware authors a one-month window to exploit, although it does give corporate deployments a chance to test patches prior to deployment on a sane schedule.

Re:This is a simple job

[pdusen]

Actually, MS hires some of the best coders in the world. You're just an idiot.

'Fun' toolbars

[Anonymous Coward]

For love of God, please include a feature that is a one-stop shop to remove the various crippling toolbars.

Yes, there's the addon screen, but the number of evil toolbars that skip that are certainly the majority. They fall under the category of spyware/adware/trojans but just make it controllable. How hard can it possibly be?!

Every average users computer I've helped fix has always had one or more stubborn toolbars that a mixture of spybot, registry tweaks and detective work. Give the average user some way of managing the crap.

Simply inexcusable.

New interpretation of standards too

[Anonymous Coward]

They'll make sure content is rendered completely different from their previous browsers and those of their competitors.

Survey says...

[PNutts]

IE 6 was arguably the least secure browser of all time.

Well, IE6 was released in 2001, pre XP SP2 (over three years before FireFox), and is still in use seven years later. IE 6 has a total of 130 secunia advisories (highest unpatched is Moderately Critical). FF 1-3 have 71 advisories (highest unpatched Highly Critical) since release in 2005 and IE6 had 35 advisories in the same period.

Keeping in mind there are lies, damn lies, and statistics, I'm not going to argue either way and let the fanbois take their browsers into the shower with a ruler.

More than browser vulnerabilities I take issue with the verbiage of the OP. Superlatives are the worst things in the world.

Tools?

[Anonymous Coward]

Oh tools, I thought you said holes... or was it trolls...

Technically, IE7 is the most secure browser out...

[Toreo asesino]

it's the only one I know that runs with only the following privileges (Vista only)...

"RO to File System"
"RW to user IE temp dir (explicit DENY on execute)"

Everything other browser runs as logged in user I believe.

So even if IE7 gets hosed into the floor, nothing will happen.

That said, it still sucks compared to FireFox 3 in terms of useful functionality, but that's another story.

Re:This is a simple job

[Anonymous Coward]

You're absolutely right, it's the testers fault that these things happen so often.

Yes, they're old. But the best testers in the world would have noticed the mistakes (?) the best coders in the world made.

In more modern operating systems, it's become well known that MSFT hid the facts about how incredible their coders really are.

Re:This is a simple job

[Your.Master]

Right, because only nimrod programmers have bugs in their software.

I thought the same. Microsoft need to learn!

[QJimbo]

Annoying the user seems like a running pattern with anything Microsoft try and make secure.

Windows Live messenger: "This file was a security risk and has been removed", User: "BUT IT WAS AN MP3?!?!"

Windows Vista: *download program* IE7: "Are you sure you want to download?" *click yes... wait...* "File downloaded" *click Run* IE7: "Are you sure you want to run this file?" *click yes* Vista Access Control: "This file is a program and may cause bad things to happen! Are you sure?" User: "ARGH FOR THE THIRD TIME YES I'M SURE"

Re:This is a simple job

[Anonymous Coward]

A good analogy would be.. all the best lysol cans (coders) in the world can't make shit** (m$ products) turn into gold*. (gold being of course open source projects)

**m$ seems to be constipated, normally shit doesn't take 7 years to come out.

*you have to have time to find a lot of gold, but in the end, it's worth it.

IE8 already?

[Yvan256]

Just in time to break Apple's new MobileMe service...

Or do something so stop Spam

[Joce640k]

If they stop spam then how will people phish?

Microsoft is about the only company with the clout to change the email protocol. They should set a date (eg. Jan 1st 2008), openly publish the specs, push out an update to outlook, then make the switch.

So long as they don't try anything underhanded then most people will follow them. End of spam, end of phishing.

This would achieve far more security than any browser update.

whatever

[Anonymous Coward]

year after year after year after year after year after year after year......

all we ever hear is how MS is making their next OS/Browser/Apps more secure. Have they ever succeeded? Not once... all I have witnessed is bug patches and more complexity. Its very tiring to hear the same garbage over and over again.... ...and for any site that only runs activex - get with the rest of the world and learn something....

Re:whatever

[Anonymous Coward]

Interesting this was modded as insightful. Security is complexity and its a tough balance. No one cares they are prompted in OS X or chmod in linux all the time for escalation but since microsoft added it to vista WOW we have to pay attention in windows!!! Also security for active x has been out since windows 2000 and running in an enviroment that has not had an activex problem since windows 2000 I can say its pretty secure. One could make the argument that well the standard user needs this security to be easy then yes I would agree but if the /.ing nix zeolots cannot figure it out well then maybe you need to change your way of thinking and open your mind up a little more. Lastly I know alot of people that switch to firefox and have no idea how to update firefox. So FF is grabbing the mainstream but we will see problems arise as people never update and are bug ridden with old versions of FF everywhere becasue FF updates keep quiet. Plus I have already seen manyu home users I pushed to update to FF2 becasue they were sitting at FF 1.5 well because that was when they installed it.

BTW activex security exsisted in IE 6 and in IE 7 with vista they added the ability to whitelist activex install sites. mmm I think thats a good start with secruing activex plus adding security features and no buggy patch has been realsed to fix these currently working features.

Error in summary

[davidwr]

Internet Explorer has been a security punching bag for years

Internet Explorer has been a security bug for years

There, fixed that for you.

best security fix

[erica_ann]

Microsoft needs to announce the best security fix for their software: Opera or Firefox... until then, same ole same ole bloatware yet again with a new number

Wow

[techie24chick]

I have not deployed IE 7 to all of my computers, yet. I am interested in seeing how IE 8 will interact with our network applications. IE 7 had one problem but there was a quick fix that resolved the issue pretty quick. I am looking forward to seeing the differences between the to.

Re:This is a simple job

[Citizen of Earth]

Actually, MS hires some of the best coders in the world.

Then what the hell happens to them?

Re:This is a simple job

[Anonymous Coward]

MS hires some of the best coders in the world

Agreed, but they don't know what to do with us. I currently work as an on-site contractor for Microsoft in Redmond.

When left to my own devices, I'm several times as productive as the next best person I've ever met. If they'd let me, I would could our product's defect rate by an order of magnitude in a couple of weeks, but they're too damn afraid of change to let me do that. There's always a new release around the corner, and they're always in "OMG we can't change anything!!1" mode. The only changes they'll approve are cosmetic fixes for things reported by customers, despite the fact that you can't look at 100 lines of code without seeing an obvious bug. It's the least productive environment I've ever seen. I could literally replace 20-30 people in my department and nobody would notice a difference in output level.

p.s. Yes, I am looking for a new job outside Microsoft. I'm fed up with the BS.

0 (zero) plugins

[reiisi]

Well, here's one data point against your assertion.

I hate plugins.

Of course, I'm also the kind of guy who, if his wife would let him, take the family to the mountains to live off the land. You know, the kind of guy who, when the TV broke, just never bothered to fix or replace it.

To be sure... I would be perfectly happy with:

[DaedalusHKX]

If they wanted to regain me as a user (and perhaps buyer of future microsoft products, though I highly doubt it given their track record of shit customer support) I would suggest that since they've deliberately crippled XP and Vista, the next time they move on and discontinue support for an OS they SELL to people, they should, perhaps, like a GOOD producer, unlock the old product, perhaps a tweak, perhaps a program that disables the "disable" feature for the 30 day "activation wizard" counter.

Since their phone support and internet activation options will not activate a legit product, and its impossible to get one of those damn tech support monkeys to actually stay on the line instead of making excuses to put one on hold, I would wager that they won't pull an ID software thing and release the product, either fully, or just plain DE-cripple it... nope. Well that's fine and dandy... the few Windows games I wish to play can easily be played on 98 or 2000. Which basically means that once I'm done with those, I can even wipe the 2000 rig.

Not a bad deal. Especially given that the two games I'm looking forward to, Starcraft II and Diablo III, will both likely run natively in Linux (okay so one can hope) or, like Warcraft II, III, Starcraft, Diablo I, II, and WoW, will probably run flawlessly in WINE. Again, less and less reasons to ever stay on Windows as a primary OS, or even a secondary one at that.

Not that I mind. Their support was always crap, but now, in a downturned economy, crap support at a price is NOT enticing. To me at least. Your mileage may vary.

New security features

[DeltaQH]

I really hope that the new IE security experience is something like this.

Click... This web page can be dangerous for your computer. Do you want to proceed? (click yes)

Click(again)... This web page can be dangerous for your computer. Do you want to proceed? (click yes)

Click(again)... This web page can be dangerous for your computer. Do you want to proceed? (click yes)

Click(again)... This web page can be dangerous for your computer. Do you want to proceed? (click yes)

Click(again)... This web page can be dangerous for your computer. Do you want to proceed? (click yes)

Click(again)... This web page can be dangerous for your computer. Do you want to proceed? (click yes)

.....

Re:This is a simple job

[Anonymous Coward]

> Actually, MS hires some of the best coders in the world. You're just an idiot.

Parent may be wrong about Microsoft's coders, but it's the managers who are the problem. They put money ahead of making good code, as one might expect from people who make commodity software.

Re:Technically, IE7 is the most secure browser out

[cbhacking]

You *can* set up browsers under Linux to have the same types of permissions, using AppArmor or SELinux. It's not OOTB though, and not as easy to approve outside-the-sandbox actions (like saving a downloaded file to a non-temp folder).

It's also worth noting that this feature, called Protected Mode, is not available if UAC is disabled. If you honestly can't stand privilege escalation requests (for things that damn well should have them) then open the Local Security Policy management console (use the Start search, or look under Administrative Tools), find the UAC policy options, and set it enable automatic escalation for Administrators. You're still sort of protected, in that any app that was started as a non-admin will stay non-admin until it requests privilege escalation, but you won't be given a chance to deny that escalation.

Re:This is a simple job

[pdusen]

Read the AC's post below.

best security tool

[n3tcat]

It'll have the Firefox-tab extension.

Re:Technically, IE7 is the most secure browser out

[HyperQuantum]

IE7 might be the most secure browser on Vista.

But what does that matter if most IE users remain on WinXP? IE7 on XP does not have the sandbox feature. So if you look at things this way, it actually is a shame that Vista is so unpopular.

phail.

[uberoot]

"June 26, 2008 (Computerworld) Security researchers are warning users about an unpatched cross-site scripting bug in Internet Explorer 6 (IE6) that could be used by hackers to capture keystrokes and steal other information." from http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9103859 I guess that M$ prefer not to fix bugs and vuns in current releases but rather make a new IE version for hotter vulns... I guess by this time next year we'll have Internet Explorer v.932***...

What a load of fanboy baloney!

[LanceUppercut]

The IE6 was used as a "punching bag" only because during its time it was the only browser that could hold a punch. Everything else would fall apart and drop into crapper at the mere sound of the word "punch". Now, when the other browsers are finally starting to show promice of becoming usable in the foreseeable future, they still can't even remotely compete with IE7 on the security front. The original poster, of course, conveniently failed to mention IE7 in his post.

Re:This is a simple job

[Anonymous Coward]

and we should believe you why?

I believe the parent because of the horrible shit that M$ releases. If you want us to believe you, you're gonna have to come up with a better argument than "you're just an idiot", but perhaps you can't and that's the reason M$ cock-smokers like you have zero credibility here and in the real world.

Understatement of the Decade...

[Anonymous Coward]

Microsoft has been trying to get their act together on security...

I'm sorry, that one had me cracking up. Thou grandest of all understatements has arisen.

More effective security tool

[kmkznobeikoku]

Upon installing IE8: "Windows (version to be named) detected, Uninstall? Yes/ Heck Yes" "Are you SURE? Yes/ Oh Yeah, you betcha!" Either that, or nuke it from orbit...you know the rest.

Developer tools

[dark_panda]

Personally I'd be more interested in some decent developer tools. Specifically things like a JavaScript profiler and debugger. I know there are a few third party tools that kinda-sorta do this, but frankly they're all pretty horrible, at least compared to their Firefox equivalents. Give me Firebug and Venkman for IE and I'll be happy.