Author Topic: Microsoft's Turn-off mode in IE8 not enough, says Opera. (Read 25892 times)

Josh · « **on:** March 10, 2009, 04:03 PM »

Over the weekend, Microsoft revealed that in its latest private beta build of Windows 7, it will allow users to uninstall the Internet Explorer 8 Web browser front end -- a choice it has never offered to consumers since version 3.0. The fact that since 1996, the presence of IE in Windows was elevated to such an extent that users could not completely uninstall it, nor could they ever entirely avoid it, has been credited by many as the real reason for Microsoft being perceived as having won the browser war against Netscape.

While Microsoft credits "user feedback" as having driven the need for this feature -- or actually, something like this feature but maybe more up-front -- the truth is, users have been supplying that feedback now for more than a decade. Most likely, it was the European Commission's latest objection which finally drove Microsoft to institute what some are seeing as the first crack in the dam. But is it enough to let any light break through for the other browser manufacturers desperate to gain more than a toehold on the Windows desktop?

More at Source

Am I the only one who is growing tired of opera's whining? Opera is a fantastic piece of software, but come on.

Ehtyar · « **Reply #1 on:** March 10, 2009, 04:57 PM »

I'm far more tired of IE itself than of anything Opera has ever done. I don't really care how it's accomplished, getting IE off the Windows platform is a win for everyone IMO.

Ehtyar.

Deozaan · « **Reply #2 on:** March 10, 2009, 05:06 PM »

Am I the only one who is growing tired of opera's whining? Opera is a fantastic piece of software, but come on.
-Josh (March 10, 2009, 04:03 PM)

I agree. Stop whining and improve your product. It's been working pretty good for Firefox.

Josh · « **Reply #3 on:** March 10, 2009, 05:18 PM »

Ray, what is getting IE off going to do? Do you know how many people that would confuse and annoy than it would help anything? Sure us techies would be good to go, but then the average consumer would be raped by companies like best buy and other services which would then charge users for a service call when they cannot "open the internet". Microsoft should be free to include IE in IT's product. They made it a part of the OS and it has proven that a good majority actually enjoy the functionality that this allows.

And as for deo, yes, I agree. Firefox isn't worried about making public statements and showing how superior their products are, rather improving the core and letting it go from there. Firefox had one massive publicity push while opera has tried numerous stunts like the infamous "I will swim the channel if we get so many downloads" stunt.

Ehtyar · « **Reply #4 on:** March 10, 2009, 05:26 PM »

Ray, what is getting IE off going to do? Do you know how many people that would confuse and annoy than it would help anything? Sure us techies would be good to go, but then the average consumer would be raped by companies like best buy and other services which would then charge users for a service call when they cannot "open the internet". Microsoft should be free to include IE in IT's product. They made it a part of the OS and it has proven that a good majority actually enjoy the functionality that this allows.
-Josh (March 10, 2009, 05:18 PM)

That would be why Windows still comes with IE Joshua. Though I certainly wouldn't go so far as to say the majority enjoys IE, perhaps a more accurate description would be they find IE adequate for their needs (in many cases simply because it's what they're familiar with or because they're unaware of an alternative). Until of course you end up with malware on your machine thanks to it. There is a reason Firefox's market share is increasing at the rate it is.

Ehtyar.

Josh · « **Reply #5 on:** March 10, 2009, 05:29 PM »

I haven't had a single malware issue that wasn't due to a user just clicking "install". That is not IE's fault. IE provides a mechanism which provides great functionality. What we really need, rather than removing IE from Windows, is to educate the userbase so they know better. That is what I do and 9 times out of 10, I never have the same user back for the same problem.

Ehtyar · « **Reply #6 on:** March 10, 2009, 05:42 PM »

I haven't had a single malware issue that wasn't due to a user just clicking "install". That is not IE's fault. IE provides a mechanism which provides great functionality. What we really need, rather than removing IE from Windows, is to educate the userbase so they know better. That is what I do and 9 times out of 10, I never have the same user back for the same problem.
-Josh (March 10, 2009, 05:29 PM)

What we really need, is a browser that properly informs users when they're about to install potentially harmful software (AcitveX - should never have been available in the first place), and a provider that's willing to take responsibility for their software (Mozilla anyone?).

Ehtyar.

f0dder · « **Reply #7 on:** March 10, 2009, 05:56 PM »

Josh: there have been numerous drive-by exploits targetting IE, though... it's not the best piece of code in the world. Ontop of that, since IE7 the browser now loads as slow as FF, and even IE8 is waaaaay behind standards-wise. I wish MS would do something serious about the product.

On the other hand, IE7 introduced the "protected mode" (ie, dropping privileges) which is a very good thing - but of course morons turning off UAC lose that feature. FireFox ought to adopt privilege-dropping as well.

It isn't possible to remove much more than the iexplore.exe frontend from the system, though. A large part of IE is the common controls, which just about every non-tiny windows application now uses. Another part is ISAPI, which handles HTTP and FTP connections - drop that, and applications like µtorrent stop working. Even the HTML rendering component is used by a lot of 3rd-party software, and often for stuff that doesn't even touch the web.

Josh · « **Reply #8 on:** March 10, 2009, 06:17 PM »

f0dder: I agree, there are a large number of exploits targetting IE, as you point out due to market share as said in another post. The problem is, a lot of these are played out to be far more serious. Yes, they should be marked as serious, but from my experiences, very few people are actually affected by the exploits that sites like secunia or securityadvisor claim as "critical". The last time I was hit by a windows exploit was the blaster worm, and that was patched in 2 minutes time.

And then the standards question, if we are talking actual STANDARDS then yes I agree. If we are talking passing the ACID# test, then I disagree. The acid test, while good in a test environment, is not valid for every day in the wild browsing.

And yes, I fully agree that all browsers should have a "dropped privilege" mode.

f0dder · « **Reply #9 on:** March 10, 2009, 06:28 PM »

Well, I'm not sure I always agree with the level the security advisories are given. Sure thing, XSS flaws can be pretty dangerous and can lead to all sorts of misery, but as I understand it the attacks have to be at least slightly targetted. The really nasty bugs are those that can lead to remote code execution, and especially those that are fully drive-by automated without the need for a stupid user to click "yeah, install this supermagic codec to watch brittany spwears nækkid". From my memory of security bulletins (and this is off top of head, I can't be bothered to dig back and check!) IE has had far more of this kind of exploit than FF has.

IMHO the ACID test is important, since if all (or, well, at least FF and IE) passed it, web developers could spend less time on doing ugly hacks. Sure, ACID isn't that important wrt. rendering todays sites, but it would be nice if people thought a bit about the future... and Microsoft has a lot of blame to take for stagnating with IE6 for all that darn time, not improving much with IE7, and not improving that much with IE8 either. I hate it when they do that.

Of course it would also help if we had never had HTML and had designed XHTML directly, and if the W3C actually had a correctly working reference renderer that people could check their browsers against - and a strict DOM definition. But those are of course impossible dreams now

Josh · « **Reply #10 on:** March 10, 2009, 06:47 PM »

Agreed. The ACID test would be a great tool and yes the reason it isn't important for MODERN sites is due to MS. I just don't think you can use a single test as a way to say "I am compliant". Why not just use the validator provided by the w3c? It can check your code and make sure it is up to par.

Another issue arises with third party scripting languages like JS, PHP and the like. some of those can be tricked into passing wrong data to the server thus returning exploitable web addresses or code to the user.

Josh · « **Reply #11 on:** March 11, 2009, 12:07 PM »

In its first statement in response to Microsoft's decision announced over the weekend to enable Windows 7 users to deactivate and/or uninstall Internet Explorer 8 after the operating system's setup installs it, a spokesperson for Google, which makes the Chrome browser, told Betanews overnight that not only should Windows users be given the option to choose their browsers during setup, but to do so every time they turn their machines on.

"We have not yet been able to see the planned new features of Internet Explorer but are looking forward to examining them when they are released. The Internet was founded on choice and openness and this requires a level playing field with multiple options for accessing it. From the moment a computer is turned on, people should be able to access a range of browsers easily and quickly," the spokesperson stated.

More at Source

Quite frankly, If I have to choose each and every time I boot my PC what browser I want to use, as google suggests, then I clearly think google needs to re-evaluate the software market and look at just how a computer operating system works. This is getting ludicrous. It's like the others are whining because they don't have an OS to include their own browser in by default. Microsoft makes Windows, Microsoft makes IE, they should be able to bundle both together as they deem fit.

app103 · « **Reply #12 on:** March 11, 2009, 01:16 PM »

You know, for years people have complained about Microsoft including IE with Windows, wanting them to stop.

But they fail to consider this:

If Microsoft didn't include a browser with their OS, then what would you use to visit a site and download your browser of choice?

How do you visit a site and download Chrome, Firefox, K-Meleon, Opera, Safari, or any other browser if you don't have a browser to begin with?

I do agree that IE shouldn't be so deeply integrated into the OS, and it should be completely removable, but the idea of requiring Microsoft to get rid of it entirely is just crazy and not well thought out.

What would be the alternative to Microsoft including IE? Would it be better to include a bundle of every browser in creation for the user to choose from? How would this be any different than a bloated OEM crapware bundle? And you just know if they did that, that some browser developer somewhere would cry foul because his wasn't included in the bundle. Before you know it, you'll need an extra 8G of space just for the browser bundle or Microsoft will have to toss in another 2 DVD disks with the setup files for all of them.

And why target Microsoft and nobody else? Does Apple's OSX come with a browser? Who made that browser? How is it really any different? Why doesn't anyone cry about Apple doing it, like they cry about Microsoft?

I haven't had a single malware issue that wasn't due to a user just clicking "install". That is not IE's fault. IE provides a mechanism which provides great functionality. What we really need, rather than removing IE from Windows, is to educate the userbase so they know better. That is what I do and 9 times out of 10, I never have the same user back for the same problem.
-Josh (March 10, 2009, 05:29 PM)

Since the release of IE6 SP2, I have not seen a single issue with drive-by malware installs that was the fault of IE. Just like you, the issues I have seen were the results of the user clicking install.

In the case of the drive-by installs I have seen, they were the fault of another company's software, mostly Flash and Java, which are not exclusive to IE, nor are they Microsoft's products.

Or they were IE based browsers like AOL, or the one that was once included with Ares Galaxy, or an IE based RSS reader, none of which included the extra safeguards built into the Microsoft supplied IE user interface. Again, not the fault of Microsoft if another developer gets lazy and skimps or takes shortcuts on their own product.

One of the nastiest pieces of malware I have had to remove was Winfixer/Virtumundo, which gets on a system by exploiting a vulnerability in an older version of Sun's JRE. The problem is that Sun doesn't uninstall the old vulnerable versions when you upgrade your JRE. They leave them on your system to be exploited. So just because you have everything up to date, you can still be a sitting duck to the drive-by malware attacks that the older stuff is vulnerable to.

And most people don't know this and don't know they have to remove the older JRE versions. I sure didn't before I got hit with the first attack (for the record, the browser used was Firefox). I thought the newer versions of JRE that I was installing required the older ones to stay on my machine. I thought they were installed as patches on top of the older version, like some other software I have does. I thought the extra entries in add/remove programs was so I could roll back if I had any problems with the newer version. I never for one moment thought that Sun was doing something so stupid as leaving multiple exploitable individual versions on my machine.

And I am sure most users are as oblivious to that issue as I was. And you don't have to be a stupid newbie to think that. I know plenty of experienced knowledgeable power users that don't know.

And this is not the fault of Microsoft, and not related to IE.

f0dder · « **Reply #13 on:** March 11, 2009, 06:56 PM »

How do you visit a site and download Chrome, Firefox, K-Meleon, Opera, Safari, or any other browser if you don't have a browser to begin with?

A stub that only allows you to download browsers, perhaps?

(or, the way it'd be done in order to show how f'ing ludicruous this idea is: you'd have to find your browser from some distribution media. That'd piss non-*u*x people off). Alternately, a decent package manager for Windows...

I do agree that IE shouldn't be so deeply integrated into the OS, and it should be completely removable, but the idea of requiring Microsoft to get rid of it entirely is just crazy and not well thought out.

Considering what "IE" is, uprooting it is a bad idea. The libraries it offers are useful. Apart from that, I don't find IE (the browser part) to be very tightly integrated in the operating system, except for Windows Update. Sure, there's a few apps that launch IE instead of your primary browser, but that's not IE's fault. There's also apps that launch explorer.exe instead of the shell handler for Folder/Directory - FireFox, for instance.

And why target Microsoft and nobody else? Does Apple's OSX come with a browser? Who made that browser? How is it really any different? Why doesn't anyone cry about Apple doing it, like they cry about Microsoft?

Because Apple is an underdog, and it's users are zealots. Their gurus can't be wrong. EU and the like obviously only target the reeeeeally big companies.

The problem is that Sun doesn't uninstall the old vulnerable versions when you upgrade your JRE. They leave them on your system to be exploited. So just because you have everything up to date, you can still be a sitting duck to the drive-by malware attacks that the older stuff is vulnerable to.

Yeah, this is bad - shame on you, Sun! And because Java applets are executed through an alternate process (flash isn't btw), IE7+'s Protected Mode (on Vista w/UAC) probably doesn't help much. (I should read up on the PM though - it could be that java.exe is being started by iexplore.exe so it also runs with reduced rights).

And this is not the fault of Microsoft, and not related to IE.

Try explaining *u*x morons that flash and java based exploits isn't IE's fault

fenixproductions · « **Reply #14 on:** March 11, 2009, 08:00 PM »

The libraries it offers are useful.
-f0dder

What makes whole case sound even more as "whims of the loosers" is fact that none of them offer replacement for it.

Sometimes I really wonder what could they do if MS said "Enough! No more Win for Europe"

app103 · « **Reply #15 on:** March 11, 2009, 08:32 PM »

I do agree that IE shouldn't be so deeply integrated into the OS, and it should be completely removable, but the idea of requiring Microsoft to get rid of it entirely is just crazy and not well thought out.
Considering what "IE" is, uprooting it is a bad idea. The libraries it offers are useful. Apart from that, I don't find IE (the browser part) to be very tightly integrated in the operating system, except for Windows Update. Sure, there's a few apps that launch IE instead of your primary browser, but that's not IE's fault. There's also apps that launch explorer.exe instead of the shell handler for Folder/Directory - FireFox, for instance.
-f0dder (March 11, 2009, 06:56 PM)

Here are some signs that point to the fact that it is:

Explorer:

Microsoft's Turn-off mode in IE8 not enough, says Opera.
And you can even load web pages in it, unless you have set some non-IE based browser as your default.

IE:

Microsoft's Turn-off mode in IE8 not enough, says Opera.

Then there is the nice IE integration with the desktop, too....complete with capabilities supplied by Adobe's flash plugin for IE.

Microsoft's Turn-off mode in IE8 not enough, says Opera.

Have you ever seen an IE javascript error message on your desktop after an Explorer crash, when clicking that button that is supposed to restore your desktop? I have, on many occasions.

Have you ever seen an alert from a firewall that the Windows Recycle Bin wants to connect to the internet, when trying to empty it, because of some rogue IE BHO "search helper" on the system? I have.

To me, these are all signs that IE is a bit too deeply rooted in the OS.

J-Mac · « **Reply #16 on:** March 12, 2009, 01:52 AM »

And then the standards question, if we are talking actual STANDARDS then yes I agree. If we are talking passing the ACID# test, then I disagree. The acid test, while good in a test environment, is not valid for every day in the wild browsing.
-Josh (March 10, 2009, 06:17 PM)

IE8 was actually TOO standards compliant in its early beta versions, believe it or not. See this article by Joel Spolsky. (I know some here don't like Joel but this article is a classic!).

But they fail to consider this:

If Microsoft didn't include a browser with their OS, then what would you use to visit a site and download your browser of choice?

I dunno... But I do know that I had no problem getting my hands on Netscape Navigator back before IE was there.

(I probably used my Apple II!! Or maybe my Mosaic or Lynx browser. Or maybe I just used one of the 346,000,000 "Free Disks" I received from just about everywhere!)

I haven't read enough about Microsoft's decision to determine if this actually removes all the interface between Windows and IE or if it just removes the ability of IE to open as a browser. Completely removing all of IE's ties to the OS would be a massive undertaking, "new" OS version or not. Be interesting to see just what they actually did.

Jim

nosh · « **Reply #17 on:** March 12, 2009, 03:01 AM »

What about Opera Mini forcing Yahoo as the default/only search engine until recently? Almost everything Apple comes out with is locked in/tied down - their latest Shuffle confines you to using their own headphones. Sure, you don't have to buy it but doesn't the same thing apply to Windows? Opera's attitude stinks of desperation and double standards.

fenixproductions · « **Reply #18 on:** March 12, 2009, 04:22 AM »

2nosh

What about Opera Mini forcing Yahoo as the default/only search engine until recently? Almost everything Apple comes out with is locked in/tied down - their latest Shuffle confines you to using their own headphones. Sure, you don't have to buy it but doesn't the same thing apply to Windows? Opera's attitude stinks of desperation and double standards.
-nosh (March 12, 2009, 03:01 AM)

You can read an interview with one of Opera's guys and get answer here:
http://www.betanews....ot-enough/1236630337

Spoiler

Short: if you're small you can do whatever you want to, if you're big... no ('cause you can shake the market)...

zridling · « **Reply #19 on:** March 15, 2009, 02:06 AM »

You know, for years people have complained about Microsoft including IE with Windows, wanting them to stop.

But they fail to consider this:
If Microsoft didn't include a browser with their OS, then what would you use to visit a site and download your browser of choice? ... How do you visit a site and download Chrome, Firefox, K-Meleon, Opera, Safari, or any other browser if you don't have a browser to begin with?
-app103 (March 11, 2009, 01:16 PM)

FTP?

Imagine the heartache and trouble Microsoft could have saved itself if it had decoupled IE from Windows back in the 90s? When you click on something that requires a browser, Microsoft could simply offer a one-time choice to download it for you, let you install and go. Heck, they could even script it so that it runs the .exe itself just in case grandma doesn't know what to do next. But this "problem" isn't showing any signs of going away.

Ehtyar · « **Reply #20 on:** March 15, 2009, 02:32 AM »

I really don't see how many could possibly argue against Microsoft including a run-once utility with Windows that lets you choose a browser to download, install and use. And just to dispense with this crap about common controls, wininet, mshtml etc being a part of IE...why are those components a part of IE when they could exist just as well (many may argue better) without it? Not to mention, the whole Windows Update infrastructure could operate entirely independent of IE if Microsoft simply let you run the automatic update applet manually (this is only an issue in XP of course).

The simple, unfortunate fact is, none of these possibilities will ever come to pass.

Ehtyar.

app103 · « **Reply #21 on:** March 15, 2009, 03:28 AM »

Relevant to this discussion:

http://weblog.infowo...is_version_8_th.html

Brings up some important points...

But regardless of which direction Microsoft takes -- WebKit or Gazelle -- it will still have to navigate the treacherous waters of legacy ActiveX support. And as someone who has spent some not-so-quality time developing ActiveX controls in the past, the need to maintain some sort of compatibility layer within any proposed IE replacement is a critical consideration.

For most casual users (i.e., grandma in her den surfing eBay), ActiveX was and is just another annoying RIA (rich Internet application) mechanism, one that has increasingly been supplanted by Adobe Flash or various AJAX-based mechanisms. However, for enterprise IT shops with a heavy Microsoft investment, ActiveX has long been an integral part of many in-house applications.

If Microsoft intends to pull the plug on IE after version 8, it will need to articulate a clear legacy migration strategy that allows these shops to preserve their investments in ActiveX controls and resources.

And something I had wondered about, since some of the applications I have written depend on this, as well as many that I personally use on a daily basis:

Finally, there's the matter of third-party developers using IE's rendering engine with their own applications. A good example would be a program that includes a help file in HTML format and then uses a custom form to display an embedded Web browser object to host the file. This embedded object is invariably an ActiveX container for the IE engine that's installed with Windows, so any attempt to remove IE from the OS -- or to radically change its core underpinnings -- will need to account for applications that rely on the existence of an accessible, programmable IE object model.

nosh · « **Reply #22 on:** March 15, 2009, 03:36 AM »

Decoupling IE completely from Windows, I'm all for.
Giving Mr."Less than 1% market share" a free piggyback ride with Windows? Naah!

Josh · « **Reply #23 on:** March 15, 2009, 07:35 AM »

That is my biggest objection. I could care less if IE is coupled with windows. Hell, it makes my job that much easier on a reinstall so that I do not have to download a browser. People whine and whine about IE being included, but in the end, it is the easiest to use and most compatible browser out there. There is a reason the gov't uses it as it's primary platform for web applications. Hell, citrix metaframe still does not interact nicely with opera (but then again, what third party code does) and firefox is only just recently getting it to work.

But yes, as I said above, I am in full agreement with nosh. Why should Microsoft cater to Opera and give them free advertising? Opera should be forced to pay them for a spot in the, if it ever comes to be, browser selection screen.

I almost hope this movement fails because it will open up a pandoras box. What's to say that media player giants don't demand the same? Or calculator developers, or file browsers/shell replacements? Microsoft created IE as well as Windows, I see no reason they should NOT be allowed to incorporate one product into another. The end goal is ease of use for the end user, and as such, including IE makes it easier for the user to "just work". The average user does not want 200 choices when they start their machine or, god forbid, have to reinstall. Why do you think Microsoft slipstreamed the install process?

Steven Avery · « **Reply #24 on:** March 15, 2009, 09:38 AM »

Hi Folks,

The concept of "bundling" as an anti-trust scheme has a long and dishonorable history in realms such as trying to prevent the usage of non-OEM automotive replacement parts by the car manufacturers. The pressures take various forms, such as pressuring the dealers or manufacturers, warranty stuff, this and that. Microsoft has been an expert in such abuse.

Now probably a 100% libertarian does not think the government should be involved in anti-trust. While I respect that view, to me it does seem to be one legitimate government function.

The simple fact is that the USA fell down on the job of preventing abusive bundling by Microsoft while Europe did a good job (some may say too aggressively).

Opera is simply using the proper forums, with bite, for trying to bring real change. I will not fault them for using the only forum that really can change the situation. (Even if governments and courts tend to come up with mediocre solutions.) As for their competition with Firefox and others, that is a problem for them either way, Firefox happens to be surprisingly successful with their open architecture (plug-ins and extensions) which will likely keep them way ahead of Opera. Much like the general PC environment is way ahead of Apple, while Apple is nonetheless quite successful. However all that is neither here nor there in the bundling equation. (My usage is Firefox #1 and Opera #2, Chrome and IE behind.) Similarly I will not fault Chrome for chiming in .. clearly they learned a bunch about Microsoft machinations.

The really best change would be full browser and op-sys independence, where the IE browser is simply calling op-sys functions that other programs can call (or not) through the API. An example is Eudora, which has the choice of their own viewer or the IE-viewer. However that "viewer" should be a Windows op-sys function, called by IE or Firefox or Eudora, not an IE function.

(Eudora is an example of an excellent software product (from Qualcomm) that basically closed up development because of the bundling of the mediocre Outlook Express.)

Shalom,
Steven Avery
Queens, NY