Internet Explorer: Difference between revisions

Content deleted Content added

Inline

Revision as of 17:14, 13 December 2004

Internet Explorer 6 for Windows

Internet Explorer, abbreviated IE or MSIE, is a proprietary but free-of-charge web browser from Microsoft. It is available for most versions of Microsoft Windows, however Microsoft has now stopped releasing updated versions for any platform aside from Windows XP. For a time, Microsoft also produced Internet Explorer for Mac (based on a different rendering engine, Tasman; while Trident is used in the Windows version) and versions for use via the X Window System on Solaris and HP-UX, but these are no longer in active development.

Internet Explorer is by far the most widely-used web browser, making up approximately 93.7% of all browser usage according to the web analysis company WebSideStory. It has been shipped as the default browser in all versions of Microsoft Windows since Windows 95 OSR-2.

Microsoft's recent Windows XP Service Pack 2 adds several important security features to Internet Explorer, including an updated Windows firewall and popup-blocker. This addresses concerns with Spyware, which has heavily targeted the browser. Microsoft encourages users to update Microsoft Windows (through Windows Update) regularly.

History

Origin

File:Megara 008.jpg

Internet Explorer 1.5

Internet Explorer is derived from Spyglass, Inc.'s version of Mosaic. Microsoft licensed Spyglass's software in 1995, in an arrangement under which Spyglass would receive a quarterly fee plus a percentage of Microsoft's revenues for the software. Microsoft subsequently gave Internet Explorer away for free, and thus (making no direct revenues on IE) paid only the minimum quarterly fee. In 1997, Spyglass threatened Microsoft with a contractual audit, in response to which Microsoft settled for US $8 million. [1]

Later, IE was modified to integrate more closely with Microsoft Windows. Version 4.0 included an option to enable "Active Desktop" which displays Web content on the desktop itself and was updated automatically as the content changed. This could include an investment channel, weather map channel from the Windows Media Showcase or any other page.

Anti-trust

In a legal case brought by the US Department of Justice and twenty U.S. states, Microsoft was accused of breaking an earlier consent decree, by bundling Internet Explorer with their operating system software. The department took issue with Microsoft's contract with OEM computer manufacturers that bound the manufacturers to include Internet Explorer with the copies of Microsoft Windows they installed on systems they shipped. Allegedly, it would not allow the manufacturer to put an icon for any other web browser on the default desktop in place of Internet Explorer. Microsoft maintained that integration of its web browser into its operating system was in the interests of consumers.

Microsoft asserted in court that IE was integrated with Windows 98, and that Windows 98 could not be made to operate without it. Australian computer scientist, Shane Brooks, demonstrated that Windows 98 could in fact run with IE files removed. [2] Brooks went on to develop software designed to customize Windows by removing "undesired components". [3] Microsoft has claimed that the software did not remove all components of Internet Explorer.

On April 3 2000, Judge Jackson issued his findings of fact that Microsoft had abused its monopoly position by attempting to "dissuade Netscape from developing Navigator as a platform", that it "withheld crucial technical information", and attempted to reduce Navigator's usage share by "giving Internet Explorer away and rewarding firms that helped build its usage share" and "excluding Navigator from important distribution channels". [4]

Jackson also released a remedy that suggested Microsoft should be broken up into two companies, however the remedy was overturned on appeal. Seven months later, the DOJ agreed on a settlement agreement with Microsoft. However as of 2004, although nineteen states have agreed to the settlement, Massachusetts is still holding out.

Security

Under heavy media scrutiny due in part its large user-base, exploitation of Internet Explorer's security "holes" earned IE the reputation as the least secure of the major browsers (which include Safari, Mozilla Firefox, Mozilla and Netscape, Opera, and Konqueror). Microsoft periodically issues security patches which can be automatically or manually downloaded and installed to update the browser.

As of 13:34, 10 Dec 2004 (UTC), the security site Secunia.com counts 19 security flaws unpatched (not yet fixed) for Internet Explorer 6 (however some of these flaws only affect Internet Explorer when running on certain versions of Windows or when running in conjunction with certain other applications). In comparison, Secunia reports three security flaws unpatched in the current Mozilla Firefox browser. See the article Computer security for more details about the importance of unpatched known flaws.

Critics have claimed that security fixes take too long to be released after discovery of the problems, and that the problems are not always completely fixed. After Microsoft released patches to close 20 holes in their general operating system in February 2003, Marc Maifrett, Chief Hacking Officer of eEye Digital Security stated that "If it really took them that long technically to make (and test) the fix, then they have other problems. That's not a way to run a software company." [5] Microsoft attribute the perceived delays to rigorous testing. The testing matrix for Internet Explorer demonstrates the complexity and thoroughness of corporate testing procedures. The browser is released in 26 different languages on many different Windows platforms. Therefore, each patch is tested on at least 237 installations.

Some security exploits associated with Internet Explorer are made possible through usage patterns of users of Microsoft Windows. For example, in Windows XP, it is the default system behavior to allow normal users to log into accounts with administrator privileges for everyday computer use. In this situation, an exploit which allows a cracker to run arbitrary code, effectively gives away control of the entire computer. This would be the case for any browser which ran with unrestricted privileges. Because the everyday use of root accounts for normal users is rare on other operating systems, attacks which rely upon inappropriately restricted browser processes are most often targeted at Windows-based browsers.

On June 24, 2004, an attacker using compromised Microsoft IIS Web servers on major corporate sites used two previously-undiscovered security holes in IE to insert spam-sending software on an unknown number of end-user computers. [6] [7] [8] [9]

On July 6, 2004, CERT released an exploit report in which the last of six temporary workarounds (until a fix was released) was to use a different browser, especially when visiting untrusted sites. At least one news report erroneously described this as a recommendation not to use Internet Explorer at all.

Many security analysts attribute IE's ease of exploitation to its popularity, since its market dominance makes it the most obvious target.

Removing Internet Explorer

The idea of removing Internet Explorer from a Windows system was first proposed during the Microsoft anti-trust case. Later, some security advocates took up the idea as a way to protect Windows systems from attack via IE vulnerabilities. Whether the net benefit of removing IE exceeds the cost, and indeed what it means to "remove IE", are disputed.

Simply installing and using another browser does not prevent third party programs and core operating system components from using IE libraries. Thus, a user who does not use IE to browse the Web can still be targeted by attacks against vulnerabilities in these libraries -- for instance, via Outlook Express or the Windows Help subsystem. However, removing the IE libraries will cause these programs, and other software which depends upon them, to cease functioning or even to crash the system.

It is unclear what it means to "remove IE" because such a removal depends on being able to determine which files or functions on an installed Windows system are part of IE — that is, to draw a line between IE and the rest of Windows. Microsoft has held that this is not meaningful; that "IE" is no longer (as it was prior to Windows 98) a separate piece of software, but simply a brand name for the Web-browsing and HTML-displaying capacities of the Windows operating system. In this view, the result of removing IE is simply a damaged Windows system; to have a working system without IE one must replace Windows entirely.

In contrast, some programmers and security writers have held that it is possible to have a useful and working Windows system with IE excised. Consultant Fred Vorck, who advocates that consumers should have the choice to remove "integrated" features of Microsoft Windows [10]; Dino Nuhagic, who is the creator of nLite — a product that allows users to remove Windows components like Internet Explorer and Windows Media Player, among other components [11]; and Shane Brooks, who created LitePC to remove and manage Windows components [12], have suggested removing Internet Explorer from computers in order to decrease exposure to security risks on the Internet [13].

It is possible to remove Internet Explorer from Windows 95, 98 and ME (see instructions on the Netscape website [14] and on Microsoft's website [15]), as well as from Windows 2000 and Windows XP at installation time. Microsoft claims that attempting to remove Internet Explorer from Windows may result in system instability.

Web standard support

Internet Explorer's rendering engine fails to completely implement the web standards as defined by the World Wide Web Consortium (W3C). Although with each version Microsoft have improved standards support, including the introduction of a "standards-compliant mode" in version 6, the core standards that are used to build web pages (HTML and CSS) are still implemented in an incomplete fashion. For example, there is a complete lack of support for <abbr> which is part of the HTML 4.01 standard, and there are bugs in the implementation of float-margins for the CSS1 standard.

Pages that are designed to be compliant with W3C standards may not render correctly in Internet Explorer. However Internet Explorer's dominance of the web-browser market for the last 5 years has lead many web developers to treat it as a de facto standard and design their websites for IE's characteristic rendering, rather than coding them to conform to the W3C standards. This leads to problems for users who use other web browsers.

Conversely, many other web designers build websites compliant to W3C standards, and then implement workarounds or hacks to account for Internet Explorer's rendering inadequacies, or to hide advanced website features from IE.

In order to render as many web pages as possible, Microsoft have designed Internet Explorer's rendering engine with strong fault-tolerance in mind. It will compensate for errors made by web designers while building web pages, by filling in missing HTML tags or ignoring structural problems.

Version information

Current versions

File:XPSP2 popup.png

The pop-up blocker included with 6.0 SP2

As of 2004, the current version number of IE for Windows is 6.0.2900 (SP2).

The current version of IE 6, mainly focusing on improving security, was included as part of Windows XP Service Pack 2 in August 2004. This update also includes the much requested pop-up blocker.

Future versions

In a May 7, 2003 Microsoft online chat, Brian Countryman, Internet Explorer Program Manager, declared that on Microsoft Windows, Internet Explorer will cease to be distributed separately from the operating system (IE 6 being the last standalone version); it will, however, be continued as a part of the evolution of the operating system, with IE updates coming bundled in OS upgrades. Thus, IE and Windows will be kept more in sync: it will be less likely that people will use a relatively old version of IE on a newer version of Windows, and newer versions of IE will not be usable without an OS upgrade.

Release History

Version 1.0 (Final) – August 1995
Version 2.0 (Final) – November 1995
Version 3.0 (Final) – August 1996
Version 4.0 (Final) – October 1997
Version 5.0 (Final) – March 1999
Version 5.5 (Final) – July 2000
Version 6.0 (Final) – October 2001

Freely downloadable copies of all versions of Internet Explorer, including Spyglass' original Internet Explorer browser, can be downloaded from browsers.evolt.org.

IE-based programs

The rendering engine and other common user interface components for the Windows version of MSIE are used in alternative interfaces, including the following Internet Explorer "shell" applications:

These applications supplement some of MSIE's usual user interface components for browsing, adding features such as popup blocking and tabbed browsing. Other applications, such as Intuit's Quicken and QuickBooks, AOL, Winamp, and RealPlayer, use the MSIE rendering engine to provide a limited-functionality "mini" browser within their own user interfaces.

On Windows, components of MSIE are also used in Explorer, the operating system component that provides the default filesystem browsing and desktop services.

IE components are also used to render HTML portions of email messages in Microsoft's popular Outlook and Outlook Express mail management software. This integration, while convenient, is one of the most often exploited "back doors", since the IE components make available more functionality to the HTML code than some feel should be permitted in the context of email messages, and Outlook and Outlook Express have, historically, not done enough to prevent malicious code from taking advantage of that functionality. The latest updates for Outlook Express, which require Windows XP and are distributed with Service Pack 2, are intended to improve this situation. Outlook 2003 already includes many of the updates.

While all of these programs can customize Internet Explorer's user interface and extend the feature set, they cannot modify Trident and are therefore subject to all of the benefits and all of the vulnerabilities of IE (including security holes and incorrect renders based on W3C standards).

Features

While in many ways similar to competing browsers, Internet Explorer also has features which differentiate it.

Distinguishing features

These are features found in Internet Explorer alone, which are not found in other common browsers.

Extensible using COM
Search facility with step-by-step refinement and page preview (Search Companion), since version 6
Remote administration across a corporate network
Out-of-the-box support for Ruby characters, vertical text, element-level alpha and Photoshop-style image filters
.NET integration - As part of the WebService behavior, makes integration of server and client side code easier, and enables applications to call functions on the server asynchronously
Native Windows interface and controls
Componentized implementation on Windows allows a high level of integration with other applications; allows integration with user interfaces in the operating system such as Explorer, which handles filesystem navigation and the desktop; and allows applications to build on IE by creating alternative browsing shells that supply popular features such as popup blocking, tabbed browsing and mouse gestures
Fault-tolerant addon-manager
Complex tailoring of security settings, but also a user-friendly choice of zones
Content Advisor for screening out objectionable content by using industry-standard ratings

Common features

These are features found in Internet Explorer and some other browsers.

Auto-update facility for addons
Includes a wide array of popular plugins and features such as JavaScript, Shockwave and Flash
Customisable pop-up blocker
Range of options for accepting and restricting cookies
All versions up to version 6 are free of charge (with a purchase of Windows)
New set of events related to the use of the mouse wheel
Fault collection offers users the option to extract information about an Internet Explorer fault and upload the data to Microsoft for analysis

Missing features

These are features found in other common browsers, which Internet Explorer lacks.

Full support for the W3C's CSS2 standard. (See, e.g., this page in IE and CSS2-compliant browsers.)
Full support for XHTML MIME types.
Full support for PNG images. IE renders PNG images without alpha transparency.
Tabbed browsing support, although freely-available IE addons provide this feature.

Concerns and problems

These are concerns and problems facing Internet Explorer users which do not, today, affect users of other browsers.

Spyware and Adware generally targets Windows / Internet Explorer based systems. Older spyware attacks have largely been mitigated in Windows XP SP2, but Microsoft has advised against installing SP2 on a system that already has spyware. [16]
Some unpatched security vulnerabilities.
Although security patches continue to be released for a range of platforms, most recent feature additions and security improvements were released for Windows XP only.
Last major version release was version 6 in August 2001, although two service packs have been released since then.

External links

Download Internet Explorer for Windows
Changes in Internet Explorer for Windows Server 2003 - chat transcript with Brian Countryman (Internet Explorer Program Manager) and Rob Franco (Internet Explorer Program Manager) for Microsoft TechNet
How to Uninstall Internet Explorer 6 - Microsoft support article for pre-XP versions of Windows
Chris Beach: "Why I Support Internet Explorer in the New Browser Wars" - opinion piece
StopIE - opinion piece
Browse Happy - 'Anti-IE' campaign by the Web Standards Project
Better Browsing with Service Pack 2 - Benefits of SP2 with Internet Explorer
IE Team Blog - The IE Team Blog
IE Community - The offical Microsoft Internet Explorer Community

@@ Line 36: / Line 36: @@
 Critics have claimed that security fixes take too long to be released after discovery of the problems, and that the problems are not always completely fixed. After Microsoft released patches to close 20 holes in their general operating system in February 2003, [[Marc Maifrett]], Chief Hacking Officer of [[eEye Digital Security]] stated that "If it really took them that long technically to make (and test) the fix, then they have other problems. That's not a way to run a software company." [http://news.com.com/2102-1002_3-5158625.html] Microsoft attribute the perceived delays to rigorous testing. The [http://blogs.msdn.com/ie/archive/2004/08/17/216080.aspx testing matrix] for Internet Explorer demonstrates the complexity and thoroughness of corporate testing procedures. The browser is released in 26 different languages on many different Windows platforms. Therefore, each patch is tested on at least 237 installations.
-Some security exploits associated with Internet Explorer are made possible through usage patterns of users of Microsoft Windows. For example, in Windows XP, it is the default system behavior to allow normal users to log into accounts with administrator privileges for everyday computer use. In this situation, an exploit which allows a cracker to run arbitrary code, effectively gives away control of the entire computer. This would be the case for any browser which ran with unrestricted privileges. Because the everyday use of [[root]] accounts for normal users is rare on other operating systems, attacks which rely upon inappropriately restricted browser processes are most often targeted at Windows-based browsers.
+Some security exploits associated with Internet Explorer are made possible through usage patterns of users of Microsoft Windows. For example, in Windows XP, it is the default system behavior to allow normal users to log into accounts with administrator privileges for everyday computer use. In this situation, an exploit which allows a cracker to run arbitrary code, effectively gives away control of the entire computer. This would be the case for any browser which ran with unrestricted privileges. Because the everyday use of [[root (computing)|root]] accounts for normal users is rare on other operating systems, attacks which rely upon inappropriately restricted browser processes are most often targeted at Windows-based browsers.
 On [[June 24]], [[2004]], an attacker using compromised [[Internet Information Services|Microsoft IIS]] Web servers on major corporate sites used two previously-undiscovered security holes in IE to insert [[e-mail spam|spam]]-sending software on an unknown number of end-user computers. [http://zdnet.com.com/2100-1105_2-5247187.html] [http://www.cnn.com/2004/TECH/internet/06/24/internet.attack.ap/index.html] [http://isc.incidents.org/diary.php?isc=79fcd38fcac%20d616798ba716ac6e99ca1] [http://62.131.86.111/analysis.htm]