IE8 Released As Critical Update For XP

Binestar was one of several readers writing in to note that Microsoft is listing IE8 as a critical update to Windows XP. CNet reported a couple of weeks back that Microsoft would be rolling our IE8 to users in a gradual fashion, and requiring an opt-in before installing it. Opinion has been split as to whether IE8 is worth installing or not. Binestar notes delicately, "For those not interested in upgrading to IE8 at this time, the MSDN released information back in January on how to keep IE8 off your machine."

Comments

So what

[rossdee]

I use Firefox as my default browser. Should I care what version of IE is on my (XP) system?

Good for web developers?

[Verdagon]

So this means that more of the browser market will be standards compliant?

standards compliance is not about exception markup

[Onymous Coward]

Does anyone know if this is still in effect?

1. When a user has a problem with a website in IE8, they can click the "Compatibility View" button to revert to IE7 rendering.
2. The URL is sent to Microsoft who compile a list of IE8-incompatible websites.
3. This list is sent to IE8 users so the site can automatically switch to IE7-mode for everyone.
4. If your website is fixed or is accidentally added to the list, you can add a meta tag to disable compatibility mode!

http://www.sitepoint.com/blogs/2009/02/19/ie8-standards-mode-opt-in/
http://blogs.msdn.com/ie/archive/2008/12/03/compatibility-view-improvements-to-come-in-ie8.aspx

Does this seem like a way for Microsoft to require people to mark their pages as "standards compliant" in a Microsoft-specified syntax?

It seems like IE8 users would click the compatibility mode button not because they think the site should render better in IE7, but because it doesn't look right. Won't this populate Microsoft's "render as IE7" list with sites that are just poorly rendered in IE8? Surely this can't be what's going on. It'd be a train wreck in progress. Any good, standards-compliant pages IE8 can't render very well get rendered even more poorly unless you put MS markup in them?

Can't be.

My guess is that MS are engaged in some kind of gambit to pollute the existing DOCTYPE standard somehow, by requiring browser-specifying markup, but it's not clear to me exactly how. Well, IE8 is here. We'll see what happens.

Re:what's so critical about a web browser?

[benjymouse]

You haven't been paying attention to the way Microsoft works, have you? This has been typical for .... ummm .... as far as I can remember. Ship first, patch later and frequently.

Erm. Then you haven't been paying attention to the way Microsoft have worked for the past 5-6 years, have you? They have seriously pulled themselves together since the code red, nimda and initial IE6 days. I know that it's a popular myth that Microsoft software is swiss cheese, but security analysts are starting to point at Microsoft SDL (Secure Development Lifecycle) as an example on how to do it. Independent analysts, i.e. IBM, researching vulnerability reports, have for the past 3 years pointed out how Windows XP and Windows Vista are actually the operating systems hit with the fewest vulnerabilities (but still most exploits).

Looking at vulnerability stats at secunia shows that Microsoft QC have improved drastically across their entire product portfolio:

• IE7 was released at roughly the same time as FF2. IE7 has had half (77) of the vulnerabilities of FF2 (154). And those vulnerabilities stopped counting last year when FF2 was EOLed. And FF3 is already at 68 - about to overtake the 3 year old IE7. Of course there are still browsers out there with much fewer vulns than all of these.
• The .NET Framework 2.0 is roughly as old as JRE 1.5, and although the former also has "enterprise" stacks such as ASP.NET etc, the .NET Framework 2.x has been hit by 10 vulns whereas JRE 1.5 has had 111 vulns in the same period.
• IIS6 was released with Windows Server 2003. Since then it has had 4 (four) vulnerabilities. IIS7 was released with Vista/Server 2008. It has experienced 1 (one!) less critical vulnerability. In comparison Apache 2.x has experienced 23 vulnerabilities. Considering what they had to work with, I'd say that's pretty impressive.
• Silverlight 1 and 2 both have clean sheets. Zero vulnerabilities so far. Compared to Flash Player 9&10 with 37 and 5 vulnerabilities respectively , Microsoft is certainly doing allright there as well. Especially considering that some of those Flash vulns were high-profile potent vulns which were featured in pwn2own.
• On the database front, SQL Server 2005 has registered 10 vulnerabilities. Oracle Database 10.x comes in with a staggering 828 vulnerabilities.

On the whole Microsoft seems to do pretty well and considerably better than their competitors in all of the above areas. And no, Microsoft does not hide vulnerabilities. They may delay publication in a responsible disclosure, but any MS admin will tell you that they are very specific about each vuln in their patch bulletins. Microsoft cannot slip a "fix" through, as they have to provide enough information for admins to take a decision whether to block or allow a given patch based on security against stability (like in fewer changes). And Microsoft does not patch "frequently". They patch 12 times a year + emergency patches. This schedule has in general been well received by admins and several other vendors are now following the same schedule.

Re:what's so critical about a web browser?

[thsths]

>Looking at vulnerability stats at secunia shows that Microsoft QC have improved drastically across their entire product portfolio:

You have to read these with caution, though. Microsoft has been trying to get the vulnerability count down, and one way of doing this is merging several vulnerabilities into one. It looks good on paper, but it does not make the product any more secure.

That being said, the recent product certainly show improvements. They absolutely beat Java and Acrobat, when it comes to security. I think the comparison with Firefox may be uneven, though, because the Firefox guys class just about anything as a potential security issue, just to be on the safe side.