Slashdot Mirror
Microsoft's Emergency Internet Explorer Patch Renders Some Lenovo Laptops Unbootable (betanews.com)
Earlier this month, Microsoft issued an emergency patch for Internet Explorer to fix a zero-day vulnerability in the web browser. The problem affects versions of Internet Explorer from 9 to 11 across multiple versions of Windows, but it seems that the patch has been causing problems for many people. Specifically, people with some Lenovo laptop have found that after installing the KB4467691 patch they are unable to start Windows, reports BetaNews.
Stating a device is not bootable is far different than stating that an operating system is not bootable. The headline alone implies that a Windows update bricked laptops, which isn't true at all.
You'll have to disable secure boot...oh wait that's the fix for this whole thing. So just disable it and Windows boots again.
From what I understand, the issue is that some lenovo laptops were configured with 4GB of ram, and secure boot enabled. Unfortunately the IE fix triggered a bug in the secure boot code where it couldn't validate the entirety of the windows executables. It had really nothing to do with the IE fix other than it made the executable larger than before. Any change to any executable would have triggered the same effect.
But that is just what I've heard with very little actual technical information. For example the issue didn't affect lenovo laptops with 8GB of RAM or more, or had secure boot disabled. Likely there is a third piece missing that has some custom lenovo driver or BIOS issue that is also "buggy".
More than two decades after releasing IE they're still patching it and still not getting it right.
I know it's fun and exciting to blame a web browser hotfix for a booting problem..... especially when it's Internet Explorer, right? But..... ahhh, shit, hate to spoil the fun, but this is just another case of "journalists" not doing the bare minimum of reading before shitting out another article they'll get paid $10 for.
This booting problem with Lenovo laptops has existed for a month and a half -- it was introduced in the November 2018 cumulative security update. It even says so right there in the patch notes! But because these "journalists" don't know how to read anymore, we end up with Slashdot articles like this one that don't have the correct information in them.
All Windows patches are now cumulative, so sure, if you apply the IE hotfix to a machine that is three months behind in updates, then you can hit this problem. But it's not the IE part that's causing it.
Just before the release in Windows 95, something interesting happened.
Your timeline is skewed. Active Desktop took place in Windows 98 with IE4. Then you go with
So here's Microsoft with a billion dollars invested in a system for embedding pics in your documents and your desktop, suddenly not needed because HTML does documents with embedded pics and sounds so much simpler. What can Microsoft do to save their investment? They route they chose was to rename COM to "ActiveX" and pitch it as a web technology.
That isn't what ActiveX is at all. It was an extension of COM to allow scriptability to the system. IDispatch. COM objects could now be usable in a type indifferent scripting language. They shoehorned this into the web, but it was and is a very large part of the Windows Explorer Shell. A common platform. Something Linux still struggles with.
"When life gives you lemons, don't make lemonade. Make life take the lemons back!" -- Cave Johnson
Here's an article that Microsoft added to MSDN in 1995.
The second half of the article covers iDispatch, a style of COM interface.
https://web.archive.org/web/20...
Here's the 1996 Microsoft announcement officially announcing the ActiveX name and their strategy for presenting it as a web technology, in which they say "ActiveX controls (formerly COM components)". The Microsodt announcement says thousands of COM/ActiveX components were already available, but could now be used in the web browser (IE 3.0).
According to Microsoft's announcement, ActiveX controls" were formerly called "COM components". According to their announcement, many companies had already been making them, as "COM" for desktop software, prior to IE 3.0 supporting them and the change to the ActiveX branding.
One reason I remember this so clearly is that I was one of the people making COM components at the time it was rebranded ActiveX. I know I didn't have to change my software in order to make my existing COM components, including a styleable linear "slider" control I designed, into ActiveX components - the only change was the branding.
You are correct that Active Desktop was September 1997.
He left out the greater context in which this was happening. Netscape was the dominant browser from 1993-1998. You had to pay to buy Netscape during this time, just like buying Photoshop or Office. IE wasn't included as part of Win95, and as a standalone product it wasn't very successful.
Gates didn't believe in the Internet. Microsoft had bet on the CompuServe/GEnie/AOL model of global networking - where people paid to dialup to portals set up and controlled by one company. MSNBC was originally Microsoft's (and NBC's joint) foray into this model. That's right, you initially had to subscribe to MSNBC in order to view its content. As a result, Windows was late getting a TCP/IP stack (necessary for Internet) built in (it was included with Win95). Microsoft was very much a follower on everything happening on the Internet, like the web (which became big in 1994). Microsoft couldn't stomach the idea of someone else controlling the web, so they went for the jugular. They included IE for free with Win98, thus choking off Netscape's revenue stream. What Microsoft had done to Stacker was still fresh in everyone's minds. (Stac came up with the idea of disk compression. When Microsoft was unable to come to a licensing agreement with Stac, they built their own version and included it for free with MS-DOS, thus killing off the sale-ability of Stac's product.)
Bundling IE with Win98 for free would of course would raise the same legal issues the Stacker case raised - whether Microsoft should be allowed to use profits from DOS/Windows to subsidize development of products which competed with existing products which ran on DOS/Windows. There was a possibility a court would order Microsoft to unbundle IE and sell it separately in competition with Netscape. So to stave off that possibility, they did everything they could to tie IE as deeply as they could within Windows. That way they could honestly argue in court that it was impossible to unbundle IE from Windows.
And that deep embedding to prevent a court from thwarting their ploy to kill off Netscape is why an IE patch today can make Windows unbootable.
The COM and ActiveX stuff is relevant because Microsoft realized that if the world moved from DOS/Windows apps to generic web-based apps which could run on any OS as long as it had a compliant browser, nobody would pay for DOS/Windows anymore. So they set out to take control of web-based apps with ActiveX. (As it turned out, the performance hit for running a web-based app was big enough that it didn't really become competitive with native OSes until the mid-2000s, about the time Flash and Java came into their own.)