A Mozilla Plugin to Help Overcome IE Rendering Flaw 270
least_weasel writes "An article on Ars Technica reveals Mozilla's intention to create and release a plugin for Internet Explorer that would allow the often-criticized IE to utilize some of the cooler rendering code developed for Firefox. The current WIP focuses on rendering using HTML5 standards, but the plans seem to be more ambitious than just fixing this one small piece of IE. The article covers some of the plans, hurdles, and potential benefits. It also spills the beans on the code name for the project: Screaming Monkey."
Interesting, but difficult (Score:5, Interesting)
FYI, Screaming Monkey was already discussed in an earlier story [slashdot.org].
The only problem is getting people to install the plugin. My own solution was to use the market penetration of Java Applets to develop a shunt [dnsalias.com] that would render Canvas using Java APIs. (Note that the events system has not been completed in that demo. Make sure you click outside the block falling area so that the browser receives the keyboard commands.)
The same sort of shunt could be done with Flash 9 or Silverlight. Which would do a nice end-run around the problem of getting plugins installed.
Re:Sad or happy day in Redmond? (Score:5, Interesting)
The new plan for Mozilla:
What could possibly go wrong?
Re:HTML5 is a standard now? (Score:5, Interesting)
HTML 5: have DOM storage (session and local) and database storage. These should all be SameOrigin. Meant to block userâ(TM)s deleting of tracking cookies. Use of database storage, there can be SQL injection against the local database. Some browsers support GlobalStorage that donâ(TM)t have SameOrigin control. Lots of new attack surface in FF3. Websites can be protocol handlers (support spyware!!). Installation of protocol handler is one click. WebKit is a big supporter of HTML5 and supports these issues.
HTML5 has limited storage (~ 15 Mbytes total) allowing easy exhaustion attacks and there is no UI to manage this. DOS is easy. Can easily plant arbitrary evidence on a system. HTML 5: Security âoeneed to write this sectionâ.
We now have web developers making desktop apps without any security or privacy expertise. The Web is becoming more heterogeneous and far far more dangerous.
Look to the beam in your own eye (Score:5, Interesting)
Hey, that's great. Do they also have plans to fix the flaws in Firefox?
Off the top of my head, could we finally have support for SVG as a native image format? Or even just SVG rendering that isn't slower than a stone cow?
Don't want to sound like the grumpy old man, I just want most of my web shit to work in *one* browser before I worry about how it works in every browser.
Re:I'm a bit skeptical (Score:3, Interesting)
I assume you can have the browser display a "download plugin" button for those people, just like it does it you're missing flash or shockwave.
Re:Er... (Score:5, Interesting)
I think that people who don't have permission to install the plugins just won't be able to do so, but they wouldn't be able to install FF anyway.
Re:Er... (Score:5, Interesting)
Re:HTML5 is a standard now? (Score:5, Interesting)
We now have web developers making desktop apps without any security or privacy expertise. The Web is becoming more heterogeneous and far far more dangerous.
What bothers me is how security is somehow pushed to the forefront as the most important issue, even more important than functionality.
The most secure system is one that is turned off. This new stuff they're adding increases the attack surface, sure, but it's also necessary to build stuff that actually works (like a web app that doesn't die when your wifi does).
But even aside from the issue of functionality vs. security, there's the issue of security somehow being way more important in the browser, which I think is nonsense. Client-server apps have always had lousy security, and were easily hijacked. Just because they now run in a browser, the threat level hasn't changed. A hacker that is determined can break in sure, but they've always been able to break in. Nothing has truly changed, except for the perception of the threat level.
All in all I think the web stack is pretty secure by default, when comparing it to the alternatives.
Why does the title sound like a low-blow? (Score:2, Interesting)
Should it not read: A Mozilla Plugin to add Enhanced IE Rendering?
Come on. This old fight between browsers is becoming stale. IE included many things now in the HTML specs that were not available in any other browser, such as CSS Style for shadow effects, etc. Why is it that when something new comes out for IE that it is automatically described as a "bug" fix or a workaround to a "flaw"?
Please people, I like FF and IE for different reasons. At least write unbiased stories and stop bashing each other's code efforts.
Exactly backwards (Score:5, Interesting)
random idea for IEs final destruction... (Score:3, Interesting)
Have Mozilla send come checks to all major software companies (Adobe wink wink) - perhaps Google can through in a few $100 million in the pot too to distribute. Goal: install Firefox (if not installed yet) and make Firefox the default browser. A little taste of Microsoft's own medicine.
*nawcom sips from his glass of kool-aid*
Re:I'm a bit skeptical (Score:3, Interesting)
Re:HTML5 is a standard now? (Score:3, Interesting)
Developers as a whole have been programming without security and privacy expertise, web developers just happen to have a program that's exposed to (at best) everyone in a particular company, or often everyone in the world. With that kind of exposure, what percentage of non-web-based programs would survive without getting exploited?
Sorry, rant over. Security is a big concern, and for things which need to be very secure these features shouldn't be allowed. However, that shouldn't keep the browsers from increasing functionality and usability. Hopefully developers are learning their lessons and becoming more security conscious.
Re:HTML5 is a standard now? (Score:3, Interesting)
All in all I think the web stack is pretty secure by default, when comparing it to the alternatives.
Really? My opinion is that the "web stack" (not sure which stack you mean here; MSIE-Windows, FF-Windows, Safari-MacOSX, Konq-Linux, etc) has by far the worst record so far. MSIE-Windows has to be the #1 vector for infection now, and has been for at least the last 6-7 years. Which alternative are you thinking of? Because the "web stack" is, in my opinion, the premier virus runtime environment.
My opinion is that web designers made a HUGE mistake in not treating network input cautiously. The emphasis has been on "rich APIs", "data structure passing", extensibility, desktop integration, and so on. These are undoubtably good things in the absence of malicious input, but the fact is, there is a lot of malicious input out there. Web browsers would benefit greatly from some simple privilege separation; the Mozilla camp could do this with some effort, but MSIE is pretty much dead in the water here due to the level of integration with the base system. I understand the HTML5 camp's worry that Flash/Flex will become a de facto standard, but in my opinion, web security has not been taken seriously enough. These kinds of vulnerabilities have become a major source of income for organized crime in the East, and still people like you are saying that security is not the most important issue? Gimme a break.
Re:Er... (Score:5, Interesting)
I'd also like to believe Microsoft will get a bit arsey about it and be all "wut, we don't need ur bloody plugins, we'll make these features available ourselves!" and thus push them towards implementing more standards rather than just fixing the broken ones they have now.
Note: Not trying to troll on Microsoft here, just trying to point out that it would be helpful to everyone if IE supported more features that other browsers have.
Re:Er... (Score:5, Interesting)
Sigh, if life were fair this would be true. The jocks become corporate sales guys and upper management types. While I honed my programming skills they developed "leadership" skills on a football scholarship at State U. Now they drive nice cars, play golf on office time, and their cheerleader girlfriends have become hot moms.
I think I'm going to put Revenge of the Nerds on to feel better.
Re:Er... (Score:3, Interesting)
I can't speak for him, but I do, and I'll endorse that statement.
Develop to standards first. Target Firefox first, Safari second, then worry about IE. Put IE-specific hacks in separate stylesheets, and don't even let non-IE browsers see them.
And throw "GetFirefox" links around where you're allowed to.
Re:Er... (Score:2, Interesting)
I think his analogy was perfect... He points out quite right that in both cases people don't care. And while you point out that the jocks and cheerleaders are shooting themselves in the foot you can't correctly claim this as evidence that the analogy is flawed or inapplicable... as people who use IE are shooting themselves in the foot as well.
The analogy is quite sound.
oh and you are completely wrong about the results of this plugin. It will bring about no measurable change in and of itself. As was said in the post before you the people who care are unlikely to install this plug-in as they likely don't use Ie or when they do they do so simply to see if IE is garbling their page. The people who actually need it don't even know what "an IE" is much less understand the need for this plug-in much less have any intention of getting it.
There are extremely few exceptions to this. Most of the exceptions are limited to the stubborn people who actually like IE and the way IE works enough to not care about whether pages are standards compliant. In fact the majority of the "what's an IE" crowd *would* feel the same way if they were to find out the details. They are comfort blanket type people. They would rather stick with something "good enough" than leave their comfort zone to learn something new especially when it is as trivial as "computer stuff." C'est la Vie. This is Life.
As a result the vast majority of users (those who don't know what "an IE" is) will not get this plugin and web developers will still have to jump through the same hoops they have to now. Yes they *could* make their page standards compliant... but they can do that now. If they do they will have the same problem with people adopting the plugin that they have now with people adopting gecko based browsers. Same shit different day.
The only way this could *lead* to what you describe is if it spurred MS to fix their own crap and include it in an update or the next version of IE (which, if history is any indication, is 10 years down the road) thus disseminating a standards compliant browser to the populace at large.