ethics
10-05-2004, 10:40 AM
This article (http://redmondmag.com/features/article.asp?editorialsid=439) was written by a former MS developer. He speaks the truth on many of the aspects of the security holes, most of them were apparent by the members here. Still a good vindication of dropping an IE and using something like FireFox.
You know what's weird. I still have IE on my PC and still bring it up when I think FireFox can't handle something (which turns out to be false and the problem is usually with the server), but I get this weird feeling, not unlike if I am opening up my PC for script kiddies. Hmmmm, perhaps I am, just by merely using IE?
Now we're beset by increasingly common—and dangerous—security vulnerabilities. We knew IE was integrated with Windows, but we didn't have any idea how integrated it was. Even Microsoft doesn't seem to have a firm grasp on IE's internals, judging from the weeks it took to deliver an actual fix for the recent Download.Ject Trojan.
Not to say an integrated browser is all bad. To a developer, an integrated browser is cool because it gives you a built-in HTML rendering engine. You can then write apps that use HTML, knowing that the OS can render that HTML for you. IE can begin to take over the regular Windows Explorer shell and, in fact, has become so tightly integrated with Windows Explorer that it's a bit difficult to see where the shell ends and the browser begins.
The downside is a real downer. With a regular Web browser, a security vulnerability might let someone crash the browser. With an integrated Web browser they can crash the whole operating system. The tight ties to Windows means that the slightest IE security issue becomes an OS-wide panic. It's not just IE, either: Windows Media Player, Outlook Express, and even DirectX, are all, in my opinion, overly integrated and give hackers too much access to core PC functions.
But corporate users don't spend a lot of time playing with DirectX-based games, listening to Windows Media Player, or checking e-mail with Outlook Express. They do spend a lot of time in IE, and the more they surf the more they're vulnerable to its eccentricities. That's why more than a few corporations, not to mention individual users, are looking at alternatives—any alternative—to the built-in browser.
You know what's weird. I still have IE on my PC and still bring it up when I think FireFox can't handle something (which turns out to be false and the problem is usually with the server), but I get this weird feeling, not unlike if I am opening up my PC for script kiddies. Hmmmm, perhaps I am, just by merely using IE?
Now we're beset by increasingly common—and dangerous—security vulnerabilities. We knew IE was integrated with Windows, but we didn't have any idea how integrated it was. Even Microsoft doesn't seem to have a firm grasp on IE's internals, judging from the weeks it took to deliver an actual fix for the recent Download.Ject Trojan.
Not to say an integrated browser is all bad. To a developer, an integrated browser is cool because it gives you a built-in HTML rendering engine. You can then write apps that use HTML, knowing that the OS can render that HTML for you. IE can begin to take over the regular Windows Explorer shell and, in fact, has become so tightly integrated with Windows Explorer that it's a bit difficult to see where the shell ends and the browser begins.
The downside is a real downer. With a regular Web browser, a security vulnerability might let someone crash the browser. With an integrated Web browser they can crash the whole operating system. The tight ties to Windows means that the slightest IE security issue becomes an OS-wide panic. It's not just IE, either: Windows Media Player, Outlook Express, and even DirectX, are all, in my opinion, overly integrated and give hackers too much access to core PC functions.
But corporate users don't spend a lot of time playing with DirectX-based games, listening to Windows Media Player, or checking e-mail with Outlook Express. They do spend a lot of time in IE, and the more they surf the more they're vulnerable to its eccentricities. That's why more than a few corporations, not to mention individual users, are looking at alternatives—any alternative—to the built-in browser.