Does IE8 Really Pass Acid2? [Updated] 174
thevirtualcat found some inconsistencies in IE8's Acid2 results that made him wonder what's going on. Can anyone replicate these results or, better yet, explain them?
Update: 03/22 23:54 GMT by KD : Several readers pointed out this has to do with cross-site scripting prevention, as described here.
Update: 03/22 23:54 GMT by KD : Several readers pointed out this has to do with cross-site scripting prevention, as described here.
The answer... (Score:5, Informative)
As TFA mentions (at the very end!) this is explained here [msdn.com].
Summary: cross-site security means that if you move the test off the original domain, the test changes. In fact IE8 does the wrong (nonstandard) thing in these cases, but according to them it's more secure (it fails earlier). They're considering making it more standards compliant once they're convinced it's secure enough.
Re:The answer... (Score:5, Interesting)
To a point, they are right, but they did this to show they are better and only seem insecure because if they don't do such things as they have done the Internet will not work. Oh yes, btw, those other browsers are not secure either... see how their stuff still works?
Re:The answer... (Score:5, Informative)
Actually, Microsoft is not correct. The browser is supposed to be unable to load the object that is tripping IE's cross-domain security features. Regardless of whether the object fails to load because of security policies or because the resource flat out doesn't exist, the test is constructed so that the browser will display the fallback content for the object, which IE does not do.
Re:The answer... (Score:5, Insightful)
and
Re:The answer... (Score:5, Interesting)
Re: (Score:3, Informative)
The spec says you must try to render the fallback if an object is not processed because the browser is configured not to render it. I quoted the relevant section in my last post.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
How about: The contract you're working under specifies that your product will meet the standard.
Re: (Score:2)
I think general situations are more interesting than specific ones.
Re: (Score:2)
Re: (Score:2)
I'd much rather Microsoft, or any browser maker, put in actual features rather than spending all their time testing obscure error conditions that'll never come up in practice.
Re: (Score:2)
http://slashdot.org/comments.pl?sid=476844&cid=22660062 [slashdot.org]
The ACID Test is a measure of HOW WELL A BROWSER DOES ON THE ACID TEST, not how standards compliant it is, and not a measure of it's worth.
Wish we'd get over the acid test already.
Re: (Score:2)
Re: (Score:2)
Well, yes and no. The acid test, where actual web standards are well established and universally agreed upon, does test these. But the problem with the acid test is that in all actuality, it tests a series of obscure, next-generation "standards", some of which haven't been hammered out in their entirety. Which means, in this case, that the Acid 3 test, and the Acid 2 test before it, at
Re: (Score:2)
And nobody thought to update the standard?
Re:The answer... (Score:5, Informative)
No, that is not the case. IE8 is trying to prevent exploitation of their own, proprietary ActiveX API, and simply needs to make some minor corrections to make sure that they do it in such a way that does not violate the standards. The standards don't need to be revised since nobody else implements the swiss cheese that is ActiveX.
Re:The answer... (Score:5, Informative)
However they then ignore the fall back content hence the problem.
The standard says that if there is a problem with the object tag then the html inside the html tag should be shown.
IE8 has a problem with the object tag and then ignores the fallback completely.
Why does it work on the official site?
Because its not cross scripting anymore, instead it fetches the page and gets a 404.
It then uses the fallback content.
In summary: Microsoft is making their own standard as per usual.
Re: (Score:2)
Why don't you save the huffiness for when it's actually released?
They'll probably fix this issue for the RTM.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Dear MS:
A fallback, be definition, means that if you can't render the original, fall back to this content. This is exactly what the web author would have wanted. Thank you.
Re: (Score:2)
Brett
Re: (Score:2)
The test in question should get a 404 then display the fallback content.
Move it to a different domain and it fails the security checks but doesnt show the fallback content.
A clear violation of the standard and IE 8 gets the FAIL rubber stamp.
Re: (Score:2)
The cost of moving to a browser that doesn't support ActiveX (read: rewriting all ActiveX-dependent applications) has got to be higher than the cost of running IE7.
Re: (Score:2)
Re:The answer... (Score:5, Insightful)
In a word, no.
Next anti-Microsoft flame, please?
Re: (Score:2, Interesting)
Reverse yellow boxes.... (Score:2, Informative)
I do not see any "'t's in reversed yellow boxes" in the reference document, so I am going to go out on a limb and suggest your browser does not pass the ACID3 test.
Re: (Score:2)
IE8's behavior is definitely wrong (and has nothing to do with XSS), but Microsoft claims the original test didn't test that particular behavior, so failing on that doesn't mean they fail the original test.
It's not that big of a deal since this will most likely be resolved before the next rel
Re:Yes, that's true. (Score:5, Funny)
Re: (Score:3, Informative)
Not like it matters. By the time anyone trys something that is in the ACID3 test there will be an ACID4 that nobody can get to 100 with
Re: (Score:2)
Acid3 was recently released so that people have new standards to meet. Nobody is 100% Acid3 compliant as of yet, and not everyone is Acid 2 compliant. This has been discussed to death in a million threads.
Firefox is and will likely continually be one of the more compliant browsers, as opposed to IE, which will continually be one of the less compliant browsers. That's just how it is. Not "the best" or "the worst".
Re:Yes, that's true. (Score:5, Insightful)
Acid3 isn't a standard, it's a set of tests for specifications that have already existed for years. Acid3 didn't make Firefox less compliant, it merely pointed out ways in which Firefox was already non-compliant.
Re:Yes, that's true. (Score:5, Informative)
Let's do exactly what you suggest, and "RTFM". From the Acid3 page at webstandards.org [webstandards.org], with links to the specifications and dates added by me:
As you can see, the majority of the Acid3 test is comprised of behaviour described in specifications published years ago, with a substantial portion of them over five years old and some over a decade old.
Actually, CSS 3 is not a single specification, but a group of
Re: (Score:2)
I'm sorry, that's not true either. I count eleven Recommendations, one ECMA standard, five Candidate Recommendations and two RFCs.
Candidate Recommendation is the stage when browsers are supposed to implement them. They don't reach final Recommendation status ("Web Standard") until after there are two interoperable implementations.
So of the nineteen specifications listed, over half have final Rec
Re:Yes, that's true. (Score:4, Interesting)
Beside this list is all the major browsers and how they implement each feature (fully, partially, broken, not implemented, etc...).
Voila! Partial compliance.
Answer (Score:2, Redundant)
I heard the exact details about this over at MIX but I don't remember them now.
Re: (Score:2)
Known Cross-domain security issue (Score:5, Interesting)
Here's the explanation:
http://blogs.msdn.com/ie/archive/2008/03/05/why-isn-t-ie8-passing-acid2.aspx [msdn.com]
Google is your friend next time...
Re: (Score:2, Informative)
Incorrectly set up website fails to render (Score:3, Funny)
I smell bullshit at the IE blog (Score:3, Interesting)
The Acid tests are test cases used to assess a browser's web standards support.
Yet, in the explanation of the incorrect rendering at the IE blog, AciveX is invoked, with some excuse about cross-domain security.
ActiveX has absolutely nothing to do with Web Standards.
This leads me to believe that MS plans to keep playing the Internet game by their rules for a while yet.
Re:I smell bullshit at the IE blog (Score:5, Informative)
Re: (Score:2, Insightful)
Also, it was not an excuse, it is a reasonable security measure. Frankly, most web developers are far too reckless about security. Rule #1 of secure programming: be as paranoid as you can, and then be more paranoid. If you don't think that every user is out to get you, then you're not being paranoid enough.
You obviously didn't comprehend what you read.
Cross-domain == cross-site (Score:5, Interesting)
Re: (Score:2, Insightful)
Please... don't use an expression that you don't understand.
Re: (Score:2)
Indeed; the correct phrases to use here would be, 'as-is,' 'unmodified,' 'in toto' or perhaps even 'all willy-nilly.'
Re: (Score:2)
Making it a relative URL means they can't guarantee that the <object> element fails to render. They needed it to be an absolute URL so that they could be certain it returned a 404.
This is not a security problem, per se. (Score:4, Insightful)
The fact that the blog writer mentions security is a red herring. While it is true that this does have something to do with security code, the real problem is that the fallback behavior is poor.
Re: (Score:2, Informative)
The portion of the acid2 test that is at issue with IE8 here works like this:
1. The test has markup that points to an object at http://www.webstandards.org/404/ [webstandards.org]; basically, the object's not there, on purpose.
2. The test has subsequent markup that contains a data: URI with embedded replacement/fallback content.
What should happen?
Two claims:
1. MS IE team: Because the lark documen
No, it does not. Security problem is their problem (Score:5, Interesting)
No, it does not pass.
There is no cross-domain insecurity in <object> as defined by the HTML specification. There is a problem in IE8's broken implementation.
If object can't be displayed, browser should ignore it. Ignored <object> isn't any more dangerous than <div>. In such case there's only one document, with one DOM, all within same domain.
But apparently IE8 can't ignore undisplayable <object> properly, so they've hacked around the problem by spawning new IE8 instance that pretends to be a plug-in that handles the invalid <object> (an <iframe> effectively). And when you do stupid things like that, of course you've got a security problem!
No Acid2-passing browser has any problems with displaying same-origin fallback to cross-domain object.
Re:No, it does not. Security problem is their prob (Score:2)
No, that's exactly wrong. If an <object> element can't be rendered, its content should be rendered instead.
Re: (Score:2)
Microsoft Has Lost The Race (Score:3, Insightful)
Internet Explorer is losing ground to Firefox, so they come out with a new version and claim that it meets standards and works better. Nope, it's just more of their marketing spin.
The real problem is that Microsoft has lost sight of the goal. They're supposed to be producing software that meets the needs and desires of their customers, but they're busily producing software that's only intended to further their goal of "world domination". Their marketing department is busy trying to make that pig look like a swan, but it's not working.
Too bad that Linux distributions aren't quite "there" yet - close, but not yet. This is a golden opportunity for a real competitor...
Re: (Score:3, Interesting)
It is still impossible to have 100% (not 99%) perfect web experience for end user if he/she is not using Windows XP/Vista
It's a massive improvement... (Score:5, Interesting)
All of this can only mean web developers sleep more soundly at night, and more real work gets done. The IE developers can give themselves a big pat on the back for achieving something useful that will make everyone's lives better, like they used to do with IE3 and 4 and initial CSS1 support. Shame the management decided to slack off on IE development so long. Microsoft: intelligent geeks, ruined by management.
Now, on to Acid 3. IE8 is still clearly trailing everyone else by some distance and is probably going to play catchup for a while yet until they implement native SVG (think about the possibilities for Explorer and Office, that Apple, KDE and friends are just beginning to explore).
As an aside, think how good MS Office might be if they had this level of competition due to having to implement a proper Open Document standard not specified by them. Everyone would get more work done, would be fitter, happier, healthier and better, and Microsoft would probably still have the lion's share of the market. OOXML needs to die now, for everyone's sake, including Microsoft's.
Re: (Score:3, Informative)
The Webkit nightly is up to 95/100 on Acid 3. Anyone run Gecko nightly lately?
Re: (Score:2, Insightful)
What the fuck? Yeah, I know I'd gain at least 3 hours per week in productivity if Office used a standard XML format than its current implementation.
Re: (Score:2)
Re: (Score:2)
Re:It's a massive improvement... (Score:4, Insightful)
I'm an IT manager by trade. I don't care who provides my company with software or what platform it runs on, as long as the business I provide IT for benefits from it and it is cost-effective, ideally giving me an advantage over my company's own competitors. The changes in UI between MS Office XP (which they're mostly using now), 2003 and especially 2007 are big enough that I have to retrain my users to use them, and frankly the cost of training my users to use 2007 is enough that I've been seriously considering moving them to OpenOffice.org.
However, the lack of a properly standardized file format prevents me from doing that. I have experimented with OOo with some of my users, and the biggest complaint (once I have trained them up a bit in OOo) I have is that
I know from experience with KOffice that I get better import - pretty much spot-on for the fairly complex documents my users create - from that into OO.org as ODF than I do Word documents into OO.org, so there must be something good about having a properly standardized file format. My conclusion therefore is that if MS Office had to support ODF, then MS would be forced to fix the bugs in Word and Excel rather than rely on their proprietary file format to keep competitors out and ignore the problems.
This is a similar situation with IE8 finally fixing long-standing bugs in order to pass the Acid 2 test, which is only possible by HTML and CSS being properly standardized.
Re: (Score:2)
OOXML will probably hav
Re: (Score:2)
I'm calling bunk on that for two reasons:
1) Office 2003 was virtually identical to Office 2000. Cost of retraining: $0.
2) Office 2007's UI is a better interface among every single Office user I've talked to. And that's in a
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
After Opera ASA from Norway, that little company has taken them to court to SUPPORT WEB STANDARDS. That happened while everyone joking with them. I am sure they are still being joked at.
http://yro.slashdot.org/article.pl?sid=07/12/13/1524233 [slashdot.org]
Hard to prove? Of course, it is closed source, nobody knows what IE8.zip source code contains. I just say you can't simply code w3c standard compliant code from a non standards supporting/ conspiring code over 3-4
Re: (Score:2)
Oh come on. It's just a test. It does note indicate overall standards compliance. Gecko is quite good at that. For instance, it's still the only web browser to implement the CSS2 :last-child pseudo-selector.
The reason. (Score:5, Funny)
To maintain compatibility and be secure by default we didn't want to invoke fallback either, as original web authors might not have intended this behavior.
"What does 'It's not a bug, it's a feature' mean, daddy?"
"I'll tell you when you're older."
Other object types (Score:4, Interesting)
Safari 3.1 fails Acid2 (Score:2)
Re: (Score:2)
(the Bug is http://bugs.webkit.org/show_bug.cgi?id=4911 [webkit.org] )
Re: (Score:2)
Re:On another note... Acid3 (Score:4, Insightful)
Re: (Score:2)
Re: (Score:2)
>if that were to happen, Firefox and Opera would do everything possible to catch up immediately.
But firefox doesn't pass acid2 either. I must have missed your point (or you're wrong)
You must have. His statement is as follows:
if( IEPasses(ACID2) && IEPasses(ACID3) ) {
FirefoxWorkHarder(StandardsCompliance);
OperaWorkHarder(Standardcompliance);
} else {
continue(PresentSituation);
}
We're stuck in the else case since, you know, IE doesn't pass both tests yet...
Re: (Score:2)
while (1) {
while (!IEPasses(ACID2) || !IEPasses(ACID3)) continue(PresentSituation,60*60*24*365);
FirefoxWorkHarder(StandardsCompliance);
OperaWorkHarder(StandardsCompliance);
}
Assuming, that is, that this is an ongoing cycle for the rest of eternity. This could probably be a little more elegant, too.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Firefox 3 beta allegedly gets 63 (haven't tested that yet, just downloading it. btw. didn't realize the mozilla downloads were hosted on facebook before..)
Re: (Score:2)
Safari 3.1 is at 75, and looks pretty close to the correct image.
I'd add the Webkit nightly (Plus Safari) is up to 95, as of yesterday night.
Firefox 3 beta allegedly gets 63
The Firefox 3 beta For OS X and Linux scores a 67, or at least it did the day after the Acid 3 was finalized. The Firefox 3 beta for Windows scored a 59. There may be a newer beta by now.
Note: all these numbers were from my own testing on the same machine, not claims from others.
Re:On another note... Acid3 (Score:4, Interesting)
Putting all that aside, it would still hardly constitute some unfair conspiracy. For one thing every other renderer in released browsers fails quite miserably at it too. Secondly, it's not some arbitrary test, Acid3 measures accuracy of conformance to DOM and ECMAscript standards. Acid3 didn't just make up the standards on the spot, they have existed for years and IE could have (and should have) been attempting to conform the whole time (as should every other renderer).
In other words: No, I don't find it intriguing. It's a mild coincidence, nothing more.
Re:On another note... Acid3 (Score:5, Funny)
Re: (Score:2)
I read on various web sites that IE8 passes Acid2... a day or two later I read that Acid3 has just come out, and IE8 fails. Can you correct the inaccuracies please? I'm sincerely curious of the truth.
Re:On another note... Acid3 (Score:5, Informative)
Re: (Score:2)
Ah well, I guess I'll put my tin foil hat back on.
The IE team announced their internal IE8 build passed Acid2 in mid-December. Acid3 was released March 3. IE8's first public beta went out on March 5.
Re: (Score:2)
Acid3 has been in the works since before IE8 passed Acid2, and is still not finalized.
Really? Looking at http://www.webstandards.org/press/releases/20080303/ [webstandards.org] I see "The Web Standards Project (WaSP) today announced the release of Acid3, the latest in a line of tests designed to expose flaws in the implementation of mature Web standards in Web browsers." That implies to me that it is intended to be final. Hixie will surely fix any test in Acid3 that turns out to be broken, assuming of course any of the tests are broken. Otherwise, the test will probably not be changing from this point forward
Re: (Score:2, Informative)
Re:Simple stuff like CSS (Score:5, Informative)
Auto margins failing to centre block elements is a hallmark of quirks mode, which means that you aren't using a doctype, which means that you are writing invalid code, which means that you aren't in any position to criticise others for not following the specifications.
Re:Simple stuff like CSS (Score:4, Interesting)
Validity is a property of documents; a doctype declaration alone cannot be valid or invalid. But that code is incorrect, you've forgotten the public identifier. That code also puts other browsers into quirks mode [dbaron.org].
There's more than one ISO HTML 2000 doctype declaration available. As for correctness, that depends on whether or not you screw the syntax up. But next to nobody uses that doctype anyway. Can you name a single HTML tutorial that mentions it? The OP wondered if he was reading the wrong tutorials, in my experience, it's common for tutorials to miss out doctypes altogether and unheard of for them to mention ISO-HTML at all. So we can reasonably eliminate that from consideration as well.
It is not invalid, but you shouldn't do so when serving it as text/html as it goes against the compatibility guidelines in the XHTML 1.0 specification, which RFC 2854 requires you to follow. Further, Internet Explorer hasn't chosen quirks mode for documents with XML prologues since version 6, so that's not the issue here either.
There's nothing wrong with that, although again, it's not something tutorials teach. You can divide HTML tutorials into two different groups: one doesn't mention doctypes and the other says that the doctype must come first (or straight after the XML prologue).
But "some IE versions" isn't relevant here, we are talking about version 8 in particular. Are you actually looking for an explanation for the problem, or are you just trying to find a way of blaming Microsoft? Doctype switching has been around for many years, all major browsers do it, and it's silly to blame Microsoft for auto margin centring not working when Internet Explorer has supported it for seven years.
Re: (Score:2)
"The HTML5 standard"? No such thing. Not yet at least. So far only drafts exist.
Yes, which is not what tepples posted. The doctype tepples posted included PUBLIC, indicating that a public identifier was coming up, and then failed to include it.
And in the context of the discussion at hand, the HTML 5 doctype makes Internet Explorer 8 use its newest rendering engine, no
Re: (Score:2, Informative)
Re: (Score:2)
Re: (Score:2)
*it's an implementation detail*
It should also be noted that the security problem doesn't go away if activex is taken out of the picture. Whatever is implemented in it's place still has to be security checked. The difference being that it might be possible to sandbox the object renderer.
The question that I want to know the answer to is "does the part of the standard this feature is attempting to test describe what the security implications should be?"
If the answer is "N
Re: (Score:2, Funny)
Re: (Score:2)
Opera has the same issue despite passing acis2.. Some sites that render just fine in IE and Firefox without modification break in Opera because it fails to implement some parts of CSS correctly that the others do right - and acid2 was no help in finding this issue (my wife showed me one ages ago, where she had a CSS laid out page, written 100% to standards and validated correctly, and it looked like crap on Opera because the CSS she was using wasn't
Re: (Score:2, Interesting)
It renders fast and has a lot of fun features to play with. I'm already addicted to the mouse gestures up to the point the normal clicking i do with windows feels boring. I wonder if there is any OS that offers mouse gestures??