Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×
Internet Explorer Mozilla The Internet

IE Developer Responds to Mozilla Accusations 782

Posted by Zonk from the other-side-of-the-coin dept.
sriram_2001 writes "Dave Massy, a Microsoft employee who works on the Internet Explorer team has a response to the Mozilla Foundation's Mitchell Baker's comments. Specifically, he responds to the claim that IE is a part of the operating system. 'IE is part of the Windows Operating System so that parts of the OS and other applications can rely on the functionality and APIs being present. To be clear there are no Operating System APIs that IE uses that are not documented on MSDN as part of the platform SDK and available to other browsers and any other software that runs on Windows..'
This discussion has been archived. No new comments can be posted.

IE Developer Responds to Mozilla Accusations More

IE Developer Responds to Mozilla Accusations

Comments Filter:

  • MS needs to change windows fundamentally (Score:5, Insightful)

    by filmmaker ( 850359 ) * on Thursday March 24, 2005 @10:53AM (#12035294) Homepage
    No one is ready to pay what really bug-free code would cost. We accept a few bugs. Please note that we even accept some airplane crashes (not to mention car accidents), but, naturally, different industries and software components pose different levels of "reasonable" bug count.

    And therein lies the heart of the MS development philosophy. Strictly speaking, that's true, but take something like Windows XP. It's is the ultimate case of the kid who cleans his room, ostensibly, but when his mother checks the closet, an avalanche of dirty clothes and assorted toys and things exlpodes from the doorway. I think MS could learn a lot from Apple, as they always have, and should look into utilizing something like BSD to start over. Obviously, they can't come out and say "our products suck; it takes half a gig of ram just to appease the system tray icons in Windows XP...sorry about that." But some way, some time they will have to move away from Windows as it is today.

    • Re:MS needs to change windows fundamentally (Score:5, Insightful)

      by Dr. Evil ( 3501 ) on Thursday March 24, 2005 @11:01AM (#12035389)

      How much RAM does it take to get a system tray icon to appear in Gnome or KDE?

      Linux on the Desktop can nearly match Windows feature for feature now, but it can no longer claim low resource requirements while doing so.

      IMHO, Mozilla or even firefox is a heavier app than IE. Once running, they're faster (to a trained eye) but sometimes, when pulling out of swap, they will still slug along.

      No, the reason to go with Mozilla or Firefox is not performance. It, for me, is everything from reasonable error messages, to being able to control the junk which finds its way on to my machine, to standards compliance.

      • Linux on the Desktop can nearly match Windows feature for feature now, but it can no longer claim low resource requirements while doing so.
        Yes, but unlike windows, linux is still modular.

        I refuse to switch to KDE or GNOME because it's easy to use. Hell I still use FVWM without any fluff and my computer kicks ass.

        You can take away the fluff of linux. You CAN'T take away the fluff of windows XP.
      • With price of RAM these days, it dose not take that much to run 1 gig or more, I have less than $100 in RAM and currently run 1 gig.

        I like to see windows pull this trick.

        I have / (root of the drive) mounted in RAM! All my apps pop up instantly, (including firefox) Here is how to do it.

        http://forums.gentoo.org/viewtopic-t-296892.html

    • Re:MS needs to change windows fundamentally (Score:5, Insightful)

      by 21chrisp ( 757902 ) on Thursday March 24, 2005 @11:02AM (#12035400)
      OSX takse up it's fair share of RAM. More than XP or any other OS by my experience.

    • Re:MS needs to change windows fundamentally (Score:5, Informative)

      by dknj ( 441802 ) on Thursday March 24, 2005 @11:03AM (#12035406) Journal
      Not to negate your post, but have you used any modern window manager that was big on eye candy? They use just as much ram as windows xp does. Mac OS X with less than 512mb of ram is a joke (heck,even with 512mb of ram it slows down when I fire up more than one resource intensive app) and KDE is just as bad. If you go back to Windows 95 or NT 4 before all these themed desktops came into light you wouldn't need half a gig of ram to show systray icons..

      -dk

      • Re:MS needs to change windows fundamentally (Score:5, Informative)

        by zoney_ie ( 740061 ) on Thursday March 24, 2005 @11:46AM (#12035877)
        Simple answer. Turn off the eye-candy. It's pointless. I use WinXP with classic theme (and theme service turned off), and along with turning off other unneeded services, WinXP runs with a memory profile of about 70MB when idle with no apps loaded.

        Now as you do want to run multiple apps, even 128MB isn't enough leeway - but I do get by fine with 256MB.

      • Mac OS X with less than 512mb of ram is a joke

        Well, 512 millibits would indeed be a joke, but if you meant 'MB' for megabytes, then your definition of 'joke' must be different from mine...

        I used to run it in half that, and it worked just fine thanks. When I added a load more, it got a lot faster for editing huge audio files or having lots of heavy apps open, but for general use there wasn't that much difference. I wouldn't recommend using less than 256MB, but it's perfectly comfortable with that amo

    • I don't think we accept airplane crashes. We don't even accept space shuttle crashes. We want 0 crashes, it's not like "it's ok to have a crash each x number of flights"
      • I don't think we accept airplane crashes. We don't even accept space shuttle crashes. We want 0 crashes, it's not like "it's ok to have a crash each x number of flights"

        "Want" and "Tolerate" are quite different things. We "Want" no crashes, but what is "Tolerated" is quite another thing. The space shuttle program has been grounded for 2 years now. Tolerance there, clearly zero. What would happen if that tolerance was applied to air travel?

        I expect much of that is influenced by the media. The space shutt

      • Of course we accept airplane crashes. When an airplane crashes, air travel is not affected by any measurable amount - people still travel. The only event in memory that noticeably affected air travel was when a bunch of troglodytes hijacked 4 airplanes in one day and used them in spectacularly heinous attacks.

        The only reason we want zero space shuttle crashes is because there are only three shuttles. United Airlines, American Airlines, Continental Airlines, Delta Airlines, and Southwest Airlines have ab

  • Not tied? (Score:4, Interesting)

    by ShepyNCL ( 740977 ) on Thursday March 24, 2005 @10:54AM (#12035317) Homepage
    IF there are no operating system API's used by the browser, then why did MSFT fight so hard not ot have to remove it from the browser. IT might not use the OS API's, but im fairly sure it works the other way round. Has he ever tried to remove IE cleanly from a windows install?

    • Re:Not tied? (Score:5, Insightful)

      by Arathrael ( 742381 ) on Thursday March 24, 2005 @11:05AM (#12035420)
      They are operating system APIs used by IE, he says so - just none that are 'not documented on MSDN as part of the platform SDK and available to other browsers and any other software that runs on Windows', i.e. no secret undocumented APIs. So you can rest easy in the knowledge that if someone finds a bug letting them use a malformed website and IE to read files off your local hard drive, IE is only using a documented API to do it.

      And he also says that IE is indeed part of the operating system 'so that parts of the OS and other applications can rely on the functionality and APIs being present'. Which presumably would mean a bug in IE could affect those parts of the OS and other applications. Which seems to be to go right along with what I thought the Mozilla guy was saying.

      As responses go, it's not the best is it? :-)

    • Re:Not tied? (Score:5, Insightful)

      by TheRaven64 ( 641858 ) on Thursday March 24, 2005 @11:25AM (#12035632) Journal
      The term operating system is not a clear one. In academia, the terms operating system and kernel are used more or less interchangeably, the operating system (OS) is the part that has more privilege than user programs - either a monolithic kernel and device drivers, or a microkernel and privileged servers. In Microsoft's world, an OS is `a kernel, and all of the stuff we pile on top of it and call an OS' (note that this is similar to RMS's definition of an OS, e.g. Linux + GNU tools + X11 + desktop environment). The second is more accurately known as an operating environment (OE) - a kernel and a set of basic libraries and applications that developers can rely on being present. OS is typically used in place of OE, because an OS on its own is not really much use to anyone, and so they are rarely available separately.

      Internet Explorer is not part of the Windows OS (kernel). It does not have a privileged status, and makes use of no extra functionality that is not available to other applications. Internet Explorer is part of the Windows OE. Other applications depend on the libraries provided by it (most commonly the HTML layout engine). The most obvious example of this is the Windows help program, which most applications use. As such, it is not possible to remove Internet Explorer without replacing it with something functionally equivalent (i.e. exposing the same API), unless you expect things to break.

      Being part of the Windows OE does not inherently make Internet Explorer insecure, this is just FUD spread by idiots. It does, however, mean that flaws in Internet Explorer are more likely to be important (it is tied into other applications, providing multiple attack vectors for an exploit). Internet Explorer has a large number of flaws (a fair number in design, as well as implementation), and I would not wish to be in the position of having to defend it, but claiming that `it is tied to the OS and therefore bad' is just stupid and undermines any rational arguments that may be proposed at the same time.

  • Hmmm (Score:5, Insightful)

    by That's Unpossible! ( 722232 ) * on Thursday March 24, 2005 @10:56AM (#12035332)
    I can't figure it out. Is Dave playing dumb, or is he really dumb?

    The guy works for Microsoft, so maybe it is willful ignorance. How else can you explain someone that works on IE from trying to claim it is not part of the OS? Oh, we're going to get down to nit picking. Yes, yes, yes IE is not part of the kernel.

    However, Microsoft wasn't too interested in this argument when it was fighting for its life in court, arguing that IE was embedded and could not be removed from the OS.

    And now we see, they were right. IE may not be part of the kernel, but due to its use (and trust) by many core applications in Windows, it presents many more security challenges when compared to a standalone app like Firefox.

    • Re:Hmmm (Score:4, Insightful)

      by gowen ( 141411 ) <gwowen@gmail.com> on Thursday March 24, 2005 @11:09AM (#12035474) Homepage Journal
      IE may not be part of the kernel, but due to its use (and trust) by many core applications in Windows, it presents many more security challenges when compared to a standalone app like Firefox.
      But the same is true of a core Unix library, like libc. It's exposed to data from wild sources, like DNS records in gethostbyname(), and yet it doesn't seem to have the same history. Similarly, the KDE GUI libs and libkhtml (for example -- or the equivalent Gnome ones) perform the many of same functions as IE's DLLs, without anything like as many security holes.

      Fact is, IE is a security disaster because it's badly written, not because exposing common rendering components to HTML code in the wild is necessarily a bad idea.

      • Re:Hmmm (Score:5, Insightful)

        by That's Unpossible! ( 722232 ) * on Thursday March 24, 2005 @11:11AM (#12035501)
        But the same is true of a core Unix library, like libc. It's exposed to data from wild sources, like DNS records in gethostbyname(), and yet it doesn't seem to have the same history.

        Uhh ok, well I wasn't defending IE, but anyway I will on this count. Are you honestly trying to compare a full-featured web browser to libc?

        Fact is, IE is a security disaster because it's badly written, not because exposing common rendering components to HTML code in the wild is necessarily a bad idea.

        My point was if you have many OS components that rely on this poorly written software and interact with it in a trusted way, you are going to have many more severe security issues than with something like Firefox.

      • Re:Hmmm (Score:3, Informative)

        by drinkypoo ( 153816 )
        There have been many holes in assorted portable C libraries. You don't hear about it like you do about IE problems because IE is used by thousands and thousands of people every day and it is on the front lines, where the rubber meets the road as it were. C library problems can be found when a hole manifests itself in any program using it (which is any C program) and when it is fixed for any of them it is fixed for all of them. IE is used by a lot of programs, but not as many as the C library.

    • Re:Hmmm (Score:5, Insightful)

      by MightyMartian ( 840721 ) on Thursday March 24, 2005 @11:13AM (#12035528) Journal
      Microsoft simply changes the story to fit the audience. To a more technical audience, it denies that IE is part of the OS. To a court that could make its life miserable, it claims deep embedding. If this fellow doesn't like the accusation then perhaps he should go to his betters in Redmond and ask them what they mean by IE being part of the OS. I mean, we're only repeating what MS told a court, and MS wouldn't lie to a judge, would they?

      • Newspeak (Score:3, Interesting)

        by inKubus ( 199753 )
        'IE is part of the Windows Operating System so that parts of the OS and other applications can rely on the functionality and APIs being present. To be clear there are no Operating System APIs that IE uses that are not documented on MSDN as part of the platform SDK and available to other browsers and any other software that runs on Windows..'

        But was this case 7 years ago when Win98 came out with the integrated browser? NO. Only now that they've faced anticompetitive presures have they been willing to docu

        • Re:Newspeak (Score:3, Informative)

          by man_of_mr_e ( 217855 )
          Uhh.. No. The MSDN program started in 1993. In particular, the IE API's have been available on MSDN since IE3, which was before MS had "integrated" it in the OS.

  • what i want from Firefox... (Score:3, Interesting)

    by H8X55 ( 650339 ) <jason...r...thomas@@@gmail...com> on Thursday March 24, 2005 @10:57AM (#12035348) Homepage Journal
    I would never use I.E. again if Firefox could do one thing (more), to be able to navigate to other (windows) boxes using my browser (like i can in I.E.)

    by typing \\servername or \\ip address

    my understanding was that this functionality was part of the API that is not available? this is the only thing keeping I.E. on my windows desktop.

  • Pure PR crap, anyway. (Score:5, Funny)

    by aug24 ( 38229 ) on Thursday March 24, 2005 @10:57AM (#12035349) Homepage
    As we develop IE we go through very thorough and stringent security reviews to ensure that every change is secure and does not expose the user to attack.

    This is not meant to be read by geeks, it's for PHBs. Either that or I'll have some of what he's smoking.

    Justin.

  • i am reminded of the opening of the hhgg (Score:5, Funny)

    by silid ( 733394 ) on Thursday March 24, 2005 @10:58AM (#12035357)
    "But Mr Dent, the plans have been available in the local planning office for the
    last nine month."

    "Oh yes, well as soon as I heard I went straight round to see them,
    yesterday afternoon. You hadn't exactly gone out of your way to call attention
    to them had you? I mean like actually telling anybody or anything."

    "But the plans were on display ..."

    "On display? I eventually had to go down to the cellar to find them."

    "That's the display department."

    "With a torch."

    "Ah, well the lights had probably gone."

    "So had the stairs."

    "But look, you found the notice didn't you?"

    "Yes," said Arthur, "yes I did. It was on display in the bottom of a locked
    filing cabinet stuck in a disused lavatory with a sign on the door saying
    Beware of the Leopard."

  • Stop. What's that sound? (Score:5, Funny)

    by Anonymous Coward on Thursday March 24, 2005 @10:58AM (#12035360)
    IIIIIIIIIIEEEEEEEEEEE!!

    That's the sound lusers make as they get their so-called browsers hijacked and spywared to death.

  • Dr Seuss explains IE (Score:5, Funny)

    by TommyBear ( 317561 ) <tommybear2@gmail.com> on Thursday March 24, 2005 @11:03AM (#12035404) Homepage
    If a packet hits a pocket on a socket on a port,
    And IE is interrupted as a very last resort,
    And the address of the memory makes your FireFox abort,
    Then the socket packet pocket has an error to report.

    If your cursor finds a IE link followed by a dash,
    And the VBScript code puts your windows in the trash,
    And your data is corrupted because IE and Firefox clash,
    Then your situation's hopeless and your system's gonna crash!

  • I'm Confused. (Score:4, Insightful)

    by itsNothing ( 761293 ) on Thursday March 24, 2005 @11:03AM (#12035407)
    I mean if
    ... there are no Operating System APIs that IE uses that are not documented on MSDN as part of the platform SDK and available to other browsers and any other software that runs on Windows..
    Then how is it that ...
    IE is part of the Windows Operating System so that parts of the OS and other applications can rely on the functionality and APIs being present.
    These two statements seem to contradict each other. Either:
    It's part of the OS and uses "internal" or protected calls that provide it a significant advantage OR
    It uses the exact same interface as any other program in which case it can be pulled out and replaced without affecting anything else in the OS.

    • Re:I'm Confused. (Score:5, Informative)

      by Richard_at_work ( 517087 ) on Thursday March 24, 2005 @11:45AM (#12035862)
      They dont contradict each other. What it is saying is that IE is implemented using publically available OS API calls only, not secret ones as people have surmised, and that it is PART of the OS in order to provide some DIFFERENT API calls to third party applications.

      The two statements bear no relation to each other, other than that they both relate to IE and APIs.

  • erm... (Score:4, Insightful)

    by carpe_noctem ( 457178 ) on Thursday March 24, 2005 @11:04AM (#12035413) Homepage Journal
    "IE is part of the Windows Operating System so that parts of the OS and other applications can rely on the functionality and APIs being present."

    So why not just have an html rendering library and make IE an optional add-on? Plenty of other OS's seem to get by with this approach; I guess that none of them are so hellbent on pushing out a particular product...

    • Re:erm... (Score:3, Interesting)

      by INeededALogin ( 771371 )
      Exactly... this is most likely why Microsoft was found a monopoly... the .exe is not providing the OS API for 3rd party and other windows components, it is the html rendering library.

      OS X has its WebCore and Safari is built on top of that. Anyone in the world could use the WebCore libs and make their own browser out of it.

      Same for FireFox... Why do you think Netscape is so easily able to use the Mozilla renderer... because it is a library.

      Microsoft's argument for not detaching IE is retarded as the e

  • IE's Win Connections arethe Problem (Score:5, Informative)

    by sjvn ( 11568 ) <sjvn AT vna1 DOT com> on Thursday March 24, 2005 @11:05AM (#12035424) Homepage

    IE is part of the Windows Operating System so that parts of the OS and other applications can rely on the functionality and APIs being present.

    Guys, uh guys, that's The Problem.

    http://www.eweek.com/article2/0,1759,1776387,00. asp

    To sum my thoughts in that story up, you have a gateway, IE, to the Internet that has deep, Inadequately Protected, connections to the core operating system.

    IE, in specific, and Windows, in general, cannot be secured.

    Microsoft's one seamless whole is really one giant security hole.

    Steven

    • That's a common misconception by the uninformed.

      When we say it's "integrated into the OS", we mean to say that the html rendering engine (mshtml.dll & SHDocVw.dll), along with the simple GUI app that uses these interfaces (IE) are installed with the OS. They don't have "deep ties" or "connections to the core OS"; the Windows kernel has zero knowledge of IE. By installing the html rendering APIs and making them public, 3rd party applications are free to use the rendering engine for their own purposes.

  • From a web developers eyes. (Score:4, Insightful)

    by dacoto ( 770892 ) on Thursday March 24, 2005 @11:08AM (#12035473)
    As part of the testing phase when I design a new web site I have to point out that the majority of my time is spent "tweaking" the site to display correctly in IE. While on the other hand I can take the same site and test it in Mozilla, Firefox, Konqueror, Safari, Netscape, etc. on various platforms (Linux, Mac, and Windows). I don't see why all browser developers can not or will not just design browsers to be equally compliant. With all the market share MS already has in my opinion they should, as atleast an act of good faith, build IE to conform with standards. I can not see any reason not to, I mean come on how difficult is it.
    • I agree with the above poster, that's the main problem right there: non compliance with standards.

      Security is also an issue, certainly. It's less of an issue if you aren't a complete bonehead.

    • Re:From a web developers eyes. (Score:4, Insightful)

      by MemoryDragon ( 544441 ) on Thursday March 24, 2005 @12:07PM (#12036076)
      You dont know Microsoft my friend. That has been their tactics since the mid eighties. They call that embrace and extend a standard. Which is the standard way for them to take over existing standards.

      First they follow the standards, then they start to extend them with Microsoft only stuff, then they add bugs to their implementations which they never fix, and in the end you have to do twice the work, once for Microsoft which by then usually has the significant market share and once for the rest of the world which still follows the standards. If you just follow the standards then you get the heavy beating of the users. Most people simply due to cost reasons then do Microsoft only versions and basically cement the monopoly of Microsoft. This is not done due to lazyness but often due to cost reasons.

      The last step of this approach is to take over entirely, close the standard, break it in every possible way and put NDAs patents etc.. on it so that nobody outside of the Windows world really can use it.

      This tactic has worked with SMB so far, Corba was another thing, OpenGL as well which basically was the base for the first really usable Direct3d version. With HTML Microsoft already has started to do it by not implementing a properly working CSS1 and totally ignoring CSS2 and 3.

      They already work on a closed replacement called Xaml which should by pushed by not doing anything they speced themselves in the W3C. They already broke SVG with an incompatible implementation which they called differently and plasted with patents although only a few commands are broken, and the next step on this road probably will be the breaking of the newly specified open document format.

      Kerberos was such an issue as well, they added a few bytes to the standard implementation and put everything under an NDA.

      So what does this say to you. Dont expect anything from Microsoft, and the last you can expect is some decency and goodwill regarding the usage of standards, they only follow standards as long as they have less than 30% market share.

      Also dont expect anything from your users, the average user is not aware of this whole mess caused by them, they just want things to work, the problem is they most of the times want to work with half working soft which has nice UIs and the tag of microsoft on top of it.

      Which basically means you run constantly into problems and cannot move towards working alternatives.

      If I count all the time together in the last 10 years, I probably have spent around 30% of my working time to navigate around problems Microsoft deliberately has caused and never fixed. The percentage probably would have been much higer if I had not used java and other cross platform stuff in the last few years, which normally just works.

      And I am probably not the exception, count towards all developers in the world which have to deal with Microsoft platforms and the problems caused by them and you probably end up with the sum Microsoft has in the bank calculated from the loss of worktime over their deliberate breaking of standards.

      So in the end my conclusion is that lots of the earnings by Microsoft are basically indirectly drained from the worktime of others to bypass their monopoly game on the technical side to make things work again. This is not a false conclusion since their non standard conformity tactis have been used by them since the mid eighties on a regular base.

  • They lied about it last time (Score:5, Informative)

    by truthsearch ( 249536 ) on Thursday March 24, 2005 @11:09AM (#12035478) Homepage Journal
    An article from 2003 [theregister.co.uk]:

    Microsoft allegedly opened up Windows APIs last year... Now, Devos claims that Microsoft's disclosures remain sufficiently inaccurate and incomplete for developers to continue using his own documentation.

    Devos claims that Whirling Dervishes has discovered hidden Windows interfaces that are crucial for the development of such applications, but whose existence is denied by Microsoft. Not much change there then, post-lawsuit. These and other interfaces which Devos says should have been part of the API disclosures are used in NSELib, and he proposes to make public full documentation on how to use them.

    • What are these APIs they found? (Score:4, Informative)

      by Len ( 89493 ) on Thursday March 24, 2005 @12:16PM (#12036154)
      It's nearly two years ago that Whirling Dervishes said they'd found these secret functions and promised to release documentation on them. But I can't find any documentation or specific info on their web site.

    • Given that the shell namespace interfaces (which appear to have been what Devos meant, although he never really said) ARE documented, which is how come people write SOFTWARE with them, and that Devos never actually came up with a single instance of an undocumented API or interface, and that the area is really pretty well explored and understood, and that Devos' products just happened to include Windows API documentation and utility libraries... which he had to persuade people to buy somehow, even with the r

  • Microsoft Unfairly Competes (Score:4, Interesting)

    by MojoRilla ( 591502 ) on Thursday March 24, 2005 @11:10AM (#12035489)
    To be clear there are no Operating System APIs that IE uses that are not documented on MSDN as part of the platform SDK and available to other browsers and any other software that runs on Windows.

    This is always the standard Microsoft defense. Our products are written with the same API's as are available to everyone else. Everything's fair.

    Except that Microsoft developers get access to the people who wrote the specifications. They can influence the specifications to change. In fact, according to a friend of mine who works at Microsoft, they have a tool which highly optimizes their code after compilation, by, among other things, moving the infrequently used code like error handling routines to the back of their DLL's, etc.

    The fact that this tool hasn't been released to other developers is proof that they unfairly compete.

    • Re:Microsoft Unfairly Competes (Score:5, Insightful)

      by bpbond ( 246836 ) on Thursday March 24, 2005 @11:27AM (#12035652) Homepage
      The fact that this tool hasn't been released to other developers is proof that they unfairly compete.

      What? How is that unfair? They must document and release all APIs, sure, but all their in-house development tools too? That's quite a standard, and I bet not one you'd put on any other company in any other industry. Assuming those tools use some clever coding and those same public APIs, what's to stop anyone else from making their own super-DLL-optimizer?

      I agree with the basic subject of this post ("Microsoft Unfairly Competes"), but this seems ridiculous.

  • From the blog.. (Score:5, Insightful)

    by tmasky ( 862064 ) on Thursday March 24, 2005 @11:10AM (#12035490)
    "As we develop IE we go through very thorough and stringent security reviews to ensure that every change is secure and does not expose the user to attack."

    I would have loved to be at the party they must have had when ActiveX went through it's security reviews.

    Seriously though, that post was a load of bollocks. But hey, I pity the guy.. in a way. He can't turn around and admit the architecture's a piece of shit.

  • Complete nonense (Score:3, Insightful)

    by gilesjuk ( 604902 ) <<giles.jones> <at> <zen.co.uk>> on Thursday March 24, 2005 @11:10AM (#12035493)
    What he means is parts of the Windows desktop environment rely on the HTML engine which is also part of IE.

    It's like saying KDE can't work without Konqueror and KHTML. Of course it can, you use Gecko.

    Also they obviously mean IE is part of the Windows distribution package. Are they going to say MSN/Windows Messenger is part of the OS next?

    Honestly, it is this kind of technical retardedness that stops me using Windows.

  • Hee Hee (Score:3, Informative)

    by mattyrobinson69 ( 751521 ) on Thursday March 24, 2005 @11:27AM (#12035655)
    kind of offtopic, i know but anyway. i was bored in college once, so i wrote a VB app in about30 seconds with a textbox, a go button and an IE OCX. the code was this (might not be perfect, ive not done any VB for a long time now):

    sub command1_click()
    iecontrol.navigate2 text1
    end sub

    And it was suprising how the security of IE is tied to the address bar and the rendering portion of the browser allowed me into c:, which i wasn't allowed to do in windows explorer. i cant remember if i was able to add/edit/delete files or not though.

  • Humility (Score:3, Interesting)

    by sriram_2001 ( 670877 ) on Thursday March 24, 2005 @11:35AM (#12035746)
    I'm the guy who posted the story to Slashdot. One thing I noticed and which got edited out was that - nowhere in the post, does Dave Massy criticize Firefox itself. Though it is his own personal blog (it is not the IE team blog), he never mentions anything about Firefox. On the other hand, we have various people associated with Firefox badmouthing IE every chance they get.

    I'm sure Dave could have pointed out with glee Firefox recent security problems (IDN, GIF handling ) or update-rollout problems. Can you imagine a Firefox dev not jumping on similar problems with IE and making fun of them?

    • Re:Humility (Score:4, Interesting)

      by bluGill ( 862 ) on Thursday March 24, 2005 @11:54AM (#12035956)

      They are tying like everything to ignore FireFox, while responding to the threat. They will be forced into the next step, but not until we get firefox a lot more popular.

      I'm not helping though. I like Konqueror much more than firefox.

  • Antisocial Engineering (Score:5, Insightful)

    by Doc Ruby ( 173196 ) on Thursday March 24, 2005 @11:39AM (#12035788) Homepage Journal
    I worked with a guy last year who came from the IE6 team at MS. He wasn't a programmer, but he agreed that it was common knowledge on the team that IE used secret APIs for better performance/quality, which competitors like Mozilla couldn't. He also said that this was also true about MS SQLServer, though he didn't have direct knowledge. And that these secrett APIs weren't controversial, or just gossip - they were assumed by everyone talking about development strategies for those products.

    This MS developer is lying. I used to talk with people programming VB6, when I was project lead for a big NYC insurance project that MS was hot to get started in the industry through. They would routinely lie to me about internal code paths that were triggering bugs, especially in printing. When I would analyze them into a deductive corner, they would tell me a little truth. Their big mistake was their managers' greed to get into the industry, which put me in direct, unmediated contact with the programmers, combined with their technical inadeqacy to keep up with the discussions enough to mediate them.

    I suspect that the MS claims of "national security" interest in keeping their code secret is based partly on the political havoc that would ensue (pun intended) if we could see just how much MS code is written to protect their anticompetitive abuses. The Department of Justice would have a lot to answer for, and it certainly wouldn't stop there. Especially if the ripples could prove how many Congressmembers were bribed to keep their monopoly "remedy" decisions untouched by human hands.

    • Re:Antisocial Engineering (Score:5, Insightful)

      by the eric conspiracy ( 20178 ) on Thursday March 24, 2005 @12:20PM (#12036194)
      This MS developer is lying. I used to talk with people programming VB6, when I was project lead for a big NYC insurance project that MS was hot to get started in the industry through.

      Given the history of Microsoft on this issue I cannot imagine that anyone would take ANY pronouncements of this sort at face value until you can go into Add/Remove and uninstall IE and seemlessly replace it with another browser. If IE is only providing services to other applications in the manner they describe, MS should publish the API so alternatives can seamlessly replace IE.

      If somebody from Microsoft is making pronouncements of this sort without first getting them approved by MS and their legal team there are either nuts or looking to be fired/sued. This developer should be viewed as the Mouth of Sauron until proven otherwise.

    • Re:Antisocial Engineering (Score:5, Informative)

      by IamTheRealMike ( 537420 ) on Thursday March 24, 2005 @12:55PM (#12036539)
      Yeah, I mean seriously. IE only uses documented APIs? What's this [ozemail.com.au] then?

      Can somebody - Dave? - point me to the API that let IE4 add a "Favourites" item to the start menu in Windows 95? I don't mean something that was documented last year, I mean something that was documented ... in 1995. I don't think there is such an API. I don't think there ever was.

      Can somebody - Dave? - tell me why the IE installer calls the undocumented Extract cabinet.dll function?

      As far as I'm concerned this is all very simple. Could Netscape have done to Windows 95 what Microsoft did with IE4? Obviously the answer is no: IE did things that weren't just *adding* APIs, they were replacing core parts of the OS like Explorer in order to add the Favourites menu, Active Desktop etc etc. Dave is full of shit and the sad thing is, he probably believes his own story.

    • It's not magic [msdn.com], Raymond Chen debunks some of those assumptions in his article. He specifically notes many people view this as undocumented APIs.

  • I confused (Score:4, Insightful)

    by asoap ( 740625 ) on Thursday March 24, 2005 @11:58AM (#12035996)
    I'm not all that technical, so I might have gotten this wrong. But did this person just admit that IE is not apart of the operating system, but it just relies on APIs built into the opeating sytem? Therefore it can be removed from the opeating system?

    Hello? Wasn't this an issue of the monopoly law suit? That it CAN'T be removed from the operating system?

    I must be wrong, so somebody please clear this up for me. Can somebody explain this to me in lamen's terms?

    Also, he says that the IE development process prevents them from introducing bugs into the software? Then how does stuff like viewing .jpgs become a security flaw? Is it that there development process is just not up to snuff? Or is it the APIs that the use from the operating system that are flawed? So it's not the browser, that's flawed, it's the operating system? That makes me feel better. Also regarding a user experience the difference between the operating system is null?

    I confused.

    • It's not that confusing really (Score:4, Informative)

      by Craig Ringer ( 302899 ) on Thursday March 24, 2005 @12:24PM (#12036244) Homepage Journal
      Consider OpenSSL. OpenSSL is a Linux operating system; however it is a fairly independent library implemented using only public APIs. Many parts of "the operating system" depend on OpenSSL and would break upon its removal.

      Ditto MSIE.

      IE uses public APIs from the OS. Other parts of the OS use public APIs of IE. Thus IE cannot be removed from the OS without removing or altering the components that depent on it - such as, AFAIK, Windows Explorer (the file manager).

      We can question the decision to make other parts o f the OS depend so deeply on IE, and we can question the decision to make that dependency on IE rather than an abstract "web browser API" that could be implemented by other tools. That doesn't change the fact that it's still a part of the OS.

  • interesting comments (Score:5, Insightful)

    by rizzo420 ( 136707 ) on Thursday March 24, 2005 @11:59AM (#12036010) Journal
    the blog was obviously microsoft-centric, considering it was written by an employee. however, the comments were pretty interesting and thought-provoking until you got to the ones posted today after this was posted to slashdot. why must all the people on slashdot be out to get microsoft? as a company they are not evil. a lot of the comments to the blog just make open source advocates out to be a bunch of complete idiots. one comment in particular... "move away from closed source, that's always been microsoft's downfall". microsoft doesn't seem to be collapsing or losing money to me... apparently closed source works for them. come on now people, get real...

  • Windows Updates (Score:5, Insightful)

    by flood6 ( 852877 ) on Thursday March 24, 2005 @12:05PM (#12036064) Homepage Journal
    Dave Massey: "IE in turn relies on Operating System functionality to do it's job. To be clear there are no Operating System APIs that IE uses that are not documented on MSDN as part of the platform SDK and available to other browsers and any other software that runs on Windows."

    Really Dave? Great, so i can use Firefox for Windows updates?

    • Re:Windows Updates (Score:3, Informative)

      by man_of_mr_e ( 217855 )
      The only thing preventing Firefox from being used for Windows Update is the Mozilla foundations refusal to support ActiveX, which is patently stupid because Mozilla extensions are exactly the same thing.

      Microsoft could, if they wanted to, write a Firefox/Mozilla extension for Windows Update, but there's nothing compelling them to do so right now.

  • Patches on Security Patches? (Score:3, Interesting)

    by nacredata ( 761540 ) on Thursday March 24, 2005 @12:16PM (#12036157)
    I'm not sure what to blame, but I just compared IE and FireFox side by side on a PC isolated to my local network. FireFox loaded many pages many times faster. Then I uninstalled all the virus protection (Norton) software on this newly aquired PC (as it will always be isolated to my local network for in-house testing) and IE performance improved dramatically.

  • Come on now (Score:3, Insightful)

    by FyberOptic ( 813904 ) on Thursday March 24, 2005 @12:24PM (#12036243)
    Everyone keeps whining about not being able to remove IE from Windows. But did you ever stop to think about just how many applications actually use IE's API, and integrate html and web pages into their programs? So even if it were possible to rip IE out of Windows, which so many people seem inclined to do for whatever reasons, those programs just wouldn't work anymore.

    And you know why? Because nobody else has developed such an API for Windows. It's not impossible for one to replace IE's API if they really tried. I know that many of the open source software developers are a clever breed, and can work around any obstacle presented to them. It's just that nobody's done it, or even tried to do it that I know of.

    So don't whine about not being able to remove IE if you don't have an adequate replacement to prevent many other pieces of software from breaking. It would become a tech nightmare if IE WAS removable, because then every dummy would be trying to uninstall it to hate on Microsoft like all the "cool" people, then be crying for someone to come fix their machine when all their instant messengers stopped working.

    I mean seriously, if you hate IE that much, why are you even still using Windows?

  • I'm a happy user of MS products, but... (Score:5, Interesting)

    by hkb ( 777908 ) on Thursday March 24, 2005 @01:28PM (#12036858)
    I'm not your typical Slashdot-fanatic, M$-hating, L1nux d00d. I love most of the latest MS products and think they're solid (as long as you're clued).

    However, I literally laughed out loud when I read the following comment by the blogger:

    As we develop IE we go through very thorough and stringent security reviews to ensure that every change is secure and does not expose the user to attack.

    Which version of IE is this?! Nearly every released version of IE has had laughable (keep in mind, I'm not a Linux bigot) security flaws. I'm sorry, but you can't feed the sheep their own shit. They know, they KNOW.

    He goes on to say:

    The security of any browser is irrelevant to if it is part of the operating system.

    That seems to be Microsoft's mantra. However, any security engineer or person with common sense would disagree.

    If we are to debate security of browsers then let's bring in relevant arguments and accurate details about different possible attacks rather than rely on the irrational fear that because IE is part of the operating system it must be exposing OS functionality to the web.

    Are you fucking joking? There is documented exploit after exploit demonstrating this. People aren't pulling it out of their asses. It's backed by fact, something you appear to be ignoring.

    I'm a somewhat-loyal MS customer, but I've got to say I don't like reading tripe like this. What I do like reading is "we're going to fix IE's security model and this is how we're going to do it, what does the community think?".

    Perhaps the IE team needs to review their security procedures, because they fuckin' suck hard.

  • Way to go Slashdot. (Score:3, Insightful)

    by KarmaMB84 ( 743001 ) on Thursday March 24, 2005 @01:45PM (#12037045)
    I could tell that Slashdotters were posting half way down the page when the comments turned into "OMGF OSS" and "But in the anti-trust case..." bullshit repeated over and over again.

  • Great comment: (Score:5, Informative)

    by Steve Cowan ( 525271 ) on Thursday March 24, 2005 @02:13PM (#12037338) Journal
    The linked article is Dave Massy's blog entry with comments at the bottom. Dave attacks the Firefox site's assertion that it is more secure because it is not "rolled into the OS" like IE is. In the comments at the bottom, this one [msdn.com] by Dave Thomas puts it up so well...
    "Now I'm pretty confident that Mitchell doesn't actually know the details of how IE is developed so I don't fully understand the basis of the statement."

    The basis of the statement is:

    (1) That Microsoft itself argued in a court of law that IE was embedded in the operating system.

    (2) That many Windows apps, such as Explorer and the Help System, use the guts of IE to render content.

    This is why people say IE is in the operating system. Because IT IS. No, not from a "I'm a kernel hacking geek" point of view, but from a practical one.

    And why does this matter in terms of security? Because when IE gets hacked, it means all those programs that make up the OS environment are now vulnerable, and in many cases, now present new vectors for the attack, and more importantly, hacking IE can present a person with many channels into core OS programs.

    This does not happen with Firefox. If you find an exploit in Firefox, you have exploited Firefox.


  • Is The Browser Part of the Operating System? (Score:4, Interesting)

    by swm ( 171547 ) <swmcd@world.std.com> on Thursday March 24, 2005 @04:02PM (#12038696) Homepage
    Is The Browser Part of the Operating System? [std.com]

    An exercise in misdirection

Slashdot Top Deals

I have hardly ever known a mathematician who was capable of reasoning. -- Plato

Close