Welcome to MSDN Blogs Sign in | Join | Help

Dave Massy's Blog

Embedded Windows
More secure

UPDATE! 2/24/05 8:58AM PST

Some comments reflect the fact that my post below can be misunderstood. I'd like to clarify.
IE is an essential part of the Windows Operating system.

Nothing I say in my post below is meant to imply otherwise. In the sentence "The issue of not being part of the Operating System is an interesting one" I am referring to Mitchell Baker's comment. I go on to say "IE is part of the Windows Operating System so that parts of the OS and other applications can rely on the functionality and APIs being present."

Thanks
-Dave
End Update.

 

There's a story at http://news.zdnet.com/2100-9588_22-5630529.html where Mitchell Baker, president and chief lizard wrangler of the Mozilla Foundation is quoted as saying Mozilla is and always will be more secure than IE. That's an argument we can spend a great deal of time on and still not prove one way or the other. I also know from experience that the online press likes to play up stories about the browser so it's quite possible the statements in the article are taken out of context as such a claim invites something to happen to prove you wrong. It's a little like saying you've never had your car stolen only to leave work and find it is missing from the parking lot.

There was one part of the piece that I wanted to comment on though:

Part of Firefox's better security profile comes from how it is developed, compared with Internet Explorer, she said. "Not being in the operating system is a phenomenal advantage for us," Baker said.

Now I'm pretty confident that Mitchell doesn't actually know the details of how IE is developed so I don't fully understand the basis of the statement. As we develop IE we go through very thorough and stringent security reviews to ensure that every change is secure and does not expose the user to attack.
The issue of not being part of the Operating System is an interesting one though that is frequently the subject of misunderstanding. IE is part of the Windows Operating System so that parts of the OS and other applications can rely on the functionality and APIs being present. IE in turn relies on Operating System functionality to do it's job. To be clear there are no Operating System APIs that IE uses that are not documented on MSDN as part of the platform SDK and available to other browsers and any other software that runs on Windows. The security of any browser is irrelevant to if it is part of the operating system.
If we are to debate security of browsers then let's bring in relevant arguments and accurate details about different possible attacks rather than rely on the irrational fear that because IE is part of the operating system it must be exposing OS functionality to the web. This is not the case as any software has access to the same set of OS APIs and can therefore expose the same set of OS functionality as IE.

Update - Fixed the typo. Thanks for the feedback. I didn't have http://www.iespell.com installed on the machine I posted from.

Update - 4/4/05
In response to the feedback to this post DPA_LoadStream documentation has now been added .
http://msdn.microsoft.com/library/en-us/shellcc/platform/commctls/common/functions/dpa_loadstream.asp?frame=true
http://msdn.microsoft.com/library/en-us/shellcc/platform/commctls/common/functions/dpa_savestream.asp?frame=true
http://msdn.microsoft.com/library/en-us/shellcc/platform/commctls/common/functions/pfndpastream.asp?frame=true
http://msdn.microsoft.com/library/en-us/shellcc/platform/commctls/common/structures/dpastreaminfo.asp?frame=true
Thanks for all the feedback that helps us constantly improve our documentation.
-Dave

 

Published Tuesday, March 22, 2005 4:50 PM by DMassy

Filed under:

Comments

# re: More secure @ Tuesday, March 22, 2005 5:18 PM

I don't understand what people mean when they "IE is part of the OS". Isn't it just that the rendering part IE is an OLE component, which means things like Windows Explorer can embed an IE view in it's main window?

To me, "part of the OS" would mean it has bits running in kernel mode (so a driver would be "part of the OS" by that definition, but Microsoft Word would not be). Now, correct me if I'm wrong here, but I'd be very surprised if any of the code considered to be "Internet Explorer" ran in anything but user-land or even with privileges more elevated than the user running it.

Perhaps when they say "part of the OS" they mean "ships with the OS" but notepad.exe ships with the OS, so is Notepad "part of the OS" as well? And is notepad any less secure because it ships with the OS?

Dean Harding

# re: More secure @ Tuesday, March 22, 2005 5:28 PM

End result matters. Given that Microsoft is a professional organization
a) without any constraints whatsoever (funding, brillant software engineers, brilliant security experts etc.)
b) developing software for money (significant money)
c) having very thorough and stringent security reviews in your own words, we must not see any grave security bugs in Windows and IE at all. So why do we see so many of them?

I am not wanting to start a flamewar but I guess Microsoft should analyze and answer this question. Why so many repeated security related failures? Fix is fine but I can't imagine how things such as IE and IIS can have a security hole - before a fix someone might lose millions. You can't afford to fail when people are trusting million dollar businesses on your software and are paying for it dearly.

DoesntMatter

# re: More secure @ Tuesday, March 22, 2005 5:54 PM

DoesntMatter:

No one is ready to pay what really bug-free code would cost. We accept a few bugs. Please note that we even accept some airplane crashes (not to mention car accidents), but, naturally, different industries and software components pose different levels of "reasonable" bug count. A non-security bug resulting in a resource leak in IE would, in my mind, for example be more acceptable than an adverse remote-code-execution hole.

CN

# re: More secure @ Tuesday, March 22, 2005 6:06 PM

Be careful when you say "no one". Some folks with mission critical applications ARE willing to pay for that kind of reliability. Take for example:

- NASA
- The Big Three
- Medical applications: especially if the result of failure would be death.

That being said, your general point is true that most of us are willing to trade cost for reliability (look at the huge number of no name brand electronics as a example).

Eric W

# re: More secure @ Tuesday, March 22, 2005 6:33 PM

One thing that would be nice at some level would be to have an interface to which programmers could develop browser components. Then a user can use their chosen brower to display content for which a browser component is necessary.

This would do two things: it would remove part of the IE is part of the OS claims and it would encourage a more standardized markup to be sent to the browser component.

Part of this interface should have the application request certain technologies of the browsing component and Windows would pick the most preferred component matching those technologies.

That way, stuff that is using Microsoft-proprietary VML could be easily accomidated unless IE was somehow removed.

Brant Gurganus

# re: More secure @ Tuesday, March 22, 2005 11:17 PM

I've watched enough master thief romantic thrillers, where the 'hero' pulls of a 'heroic heist' to know this: man is a creative being and that's the only bug in the house.

If you really can't break into it, somehow, it's pure fíction, together with the timemachine and perpeetum mobile.

I think we underestimate the brilliance of the human mind if we truly belive that we'd ever create a completely secure software.
It's the enviroment that is the problem.

I live on the countryside, and even though it might sound like romantic drivel, we can actually leave the door open for days in a row, and return to a house where everything is still there.

The overall atmosphere and the IT-culture of today, is the real problem.

Of course, bugs needs to be fixed and holes need to be plugged, but simultainiously with that, politicians and the like need to help building an atmosphere where you dont always have to lock down the door.

This is a general problem today, and we need to adress it across the board, from personal safety to technical security.

Our best tool is the one it has always been, that man is also a morally aware being.

We need to make it very clear - that it's just plain wrong to break into systems - it's not romantic, not heroic, not cool - but just plain wrong.
It's no better than being a petty thief and it only contributes to an overall sense of insecurity that none of us really wants.



Mikael Bergkvist

# re: More secure @ Wednesday, March 23, 2005 5:45 AM

Trading cost for "reliability" might be fine not cost for "security" since then security will most certainly change the cost side of the equation. IE crash on one_obscure_site - OK. IE leaking user id and password on bank.com - NOT AT ALL OK.

And CN - Microsoft already charges hefty enough to be able to provide security hole free software. People develop free software with far better security reputation than Microsoft. It's just plain sloppyness which drives up the holes.

Mikael Bergkvist - I envy you that you are still able to dream for such a better place that I doubt world will ever be - It's deterioration everywhere.

DoesntMatter

# re: More secure @ Wednesday, March 23, 2005 9:39 AM

I would agree there are some loopholes on both sides of the arguement, but recent reports do show IE lagging further in their security over the past year than firefox did:
http://www.greatreporter.com/modules.php?name=News&file=article&sid=362

We all are aware of the weaknesses in IE, why are we even defending it other than PR purposes?

Brady J. Frey

# re: More secure @ Wednesday, March 23, 2005 10:41 PM

Brant: The problem with potentially allowing a third-party component to replace the various IE components is that Microsoft is ultimately responsible for supporting and maintaining the operating system. If something goes wrong--the browser (or parts of the OS or other 3rd party apps that use the browser) starts crashing, who will the end user blame? Microsoft. For example, just look at how people blame MS for blue screens of death when the vast majority of them are caused by 3rd party drivers.

Also, if Microsoft were to enable all these hooks for third parties to replace parts of the OS, that severely limits their ability to maintain the code. They can't make changes to the browser infrastructure without verifying that all of the third party components continue to work. Otherwise, people will blame MS. "I just downloaded a security patch and now I can't even open IE!" some users would say.

In addition, what's next after swapping in your own browser? Replacing the MSXML parser? Replacing the text box control? This would open pandora's box and result in a bigger mess than we have today.

That said, I do have to take issue with some of the stuff that Dave said in his post about APIs. I've been doing shell/IE related programming for many years, and have always been interested in the integration between the two. The documentation leaves a lot to be desired: there are many functions that are still undocumented, even after the huge number that were documented as part of the DOJ settlement. (see http://members.ozemail.com.au/~geoffch/samples/win32/shell/) And, most of these functions are documented in such a bare bones fashion that makes them virtually unusable. So, I would say that there's still work to be done there.

On a related note... the releasing of Avalon to Windows XP raises some questions. It would surely qualify as "middleware" under the settlement, and I hope that any additional APIs that it uses are documented as well. (That is, anyone today should be able to write their own equivalent of Avalon for XP using the existing documentation that is out there.)

Jonathan

# Let me explain, Dave @ Thursday, March 24, 2005 6:50 AM

"Now I'm pretty confident that Mitchell doesn't actually know the details of how IE is developed so I don't fully understand the basis of the statement."

The basis of the statement is:

(1) That Microsoft itself argued in a court of law that IE was embedded in the operating system.

(2) That many Windows apps, such as Explorer and the Help System, use the guts of IE to render content.

This is why people say IE is in the operating system. Because IT IS. No, not from a "I'm a kernel hacking geek" point of view, but from a practical one.

And why does this matter in terms of security? Because when IE gets hacked, it means all those programs that make up the OS environment are now vulnerable, and in many cases, now present new vectors for the attack, and more importantly, hacking IE can present a person with many channels into core OS programs.

This does not happen with Firefox. If you find an exploit in Firefox, you have exploited Firefox.

Thomas

# Pure PR bullshit. @ Thursday, March 24, 2005 6:56 AM

"As we develop IE we go through very thorough and stringent security reviews to ensure that every change is secure and does not expose the user to attack."

This is not meant to be read by geeks, it's for PHBs. Either that or I'll have some of what you're smoking.

Justin.

Justin

# Text Boxes @ Thursday, March 24, 2005 7:02 AM

Actually, replacing the text box is something I would KILL for. I use Emacs and have for 20ish years, and Windows-standard shortcuts simply never make any sense to my fingers.

When I worked on the Amiga OS, one of the things I did was design an interface to allow users to replace the command-line shell, and document it in AmigaMail to developers. (Partly because I wanted a more powerful unix-like one myself.) If (most) everything is a library/COM/OLE/whatever object WITH DOCUMENTED INTERFACES, then you can replace things without negative impacts. (Modulo bugs of course.)

Does this open up possible issues? Sure. Is this really the "here be dragons" evil mentioned above? No, not really.

Randell Jesup

# re: More secure @ Thursday, March 24, 2005 7:01 AM

> If we are to debate security of browsers then let's bring in relevant arguments and accurate details

Like the fact that Microsoft made the bad decision years ago to allow remote site operators to post ActiveX controls as part of their websites which would cause the browser to run unknown code?

chet

# re: More secure @ Thursday, March 24, 2005 7:02 AM

NASA is willing to pay for absolute zero bugs?

Funny, because when I think of 'people that write software that costs billions every time it crashes', NASA tops my list.

cosinezero

# re: More secure @ Thursday, March 24, 2005 7:08 AM

"This is not the case as any software has access to the same set of OS APIs and can therefore expose the same set of OS functionality as IE."

Let me get this straight, because other software can expose your system, it is OK for IE to do it?

lbm

# very thorough, stringent security reviews @ Thursday, March 24, 2005 7:03 AM

>>As we develop IE we go through very thorough and stringent security reviews to ensure that every change is secure and does not expose the user to attack.


And how do you think those are working out? Pretty well? Perhaps those reviews just started happening in 2005?

Rob Davis

# re: More secure @ Thursday, March 24, 2005 7:08 AM

Misspelled functionality "funcitonality" in your original post. Maybe it's time to bring Office spell checking "funcitonality" into IE...?

Da Man

# Operating System funcitonality @ Thursday, March 24, 2005 7:05 AM

You had me going for a bit.

xxx

# re: More secure @ Thursday, March 24, 2005 7:05 AM

So I guess we'll just have to take your word on it, since Microsoft won't release the source code. You COULD be lying about everything, we don't know. The Closed-Source model is what is hurting Microsoft.

CypherXero

# re: More secure @ Thursday, March 24, 2005 7:05 AM

Thomas: My thoughts exactly! Even if an alternative browser is compromised, because it is not bound to the OS (as microsoft freely admitted in a court of law, under penalty of perjury) you've only managed to exploit the browser.

Now the standard response from microsoft will be, but you can then execute arbitrary code and exploit the entire system. While that may be possible, the likelihood of a third party app, that doesn't rely on core OS functionality to render a web page, allowing the OS to be compromised is highly improbable.

Dave: If you have the time, and are in a position to speak further about this issue, I'd love to hear your thoughts on how IE does not create more problems than it solves by being so tightly integrated to the OS?

Eric W - 2

# you missed the point @ Thursday, March 24, 2005 7:07 AM

>The security of any browser is irrelevant to if it is part of the operating system.

With IE there are many more ways for me to take over the full machine because the browser is sprinkled throughout the OS. With Firefox, I get less of a payoff for the time I spend hacking.

Ben Archibald

# re: More secure @ Thursday, March 24, 2005 7:14 AM

You could convince me that IE is just an application if I could uninstall it like any application. BTW, I would love to be able to uninstall it like any application. Can I have this?

During the Netscape wars, you wanted every desktop to have a big blue 'E' on it so you embedded it in all kinds of loop ways (with painful results) and told the DoJ it was a core feature of the OS. What's with the short-term memory?

Jim Storch

# OSS vs closed product @ Thursday, March 24, 2005 7:09 AM

> Now I'm pretty confident that Mitchell doesn't actually know the details of how IE is developed so I don't fully understand the basis of the statement.

True... where's IE source code? Ah, Mozilla is OSS and you *can see* its code to verify his claims, but we cannot see IE source code to verify your words.

Do you believe? :(

Juanjo

# re: More secure @ Thursday, March 24, 2005 7:17 AM

I know you work for Microsoft, so it must be wilfull ignorance you are posting here. ActiveX, VBScript and so on, have proved over time to be security holes large enough to drive several trucks through. I wish Microsoft was more like Apple, that looks at their OS and says 'Hmm, better throw it all out, and start over.' - their new OSX is fabulous, ive been using windows since v3.11 till this winter where i got my first very own apple machine, they take all these great open components like KHTML, H.264, BSD and builds wonderful things with them, in a short amount of time.

But Microsoft seems to think "if it wasent made my microsoft, we dont know it exists" -- talk about reality distortion field? You could even take the Gecko engine and embed it into the next version of IE and have instantly the same features as Firefoxs rendering engine, free of charge! its tri-licensed, im sure one of the fits microsoft strategy.

But no, it would be better to just have IE crushing standards all over again? The web is alot bigger than Microsoft. Remember that.

Jamie

# re: More secure @ Thursday, March 24, 2005 7:18 AM

I'm impressed, this is the most W3C-compilant page that has anything to do with MS I have ever seen, only 18 errors in the HTML markup. As for the article, "the security of any browser is irrelevant to if it is part of the operating system." is obviously very little throught-through. Anything that is integrated into anything can obviously interact with that, something a stand-alone program obviously can not. See?

xiando

# re: More secure @ Thursday, March 24, 2005 7:19 AM

I'd be curious what you blame all of IE's security problems on then. IE's had some nasty vulnerabilites in the past which have resulted in quite a few problems for IE users.

Is the Security team testing releases just really untrained and lacking?

Are programmers just sloppy?

What is the major fault that resulted in the wealth of problems? Why would someone think that a technology such as ActiveX wouldn't result in abuse? Didn't that raise a flag right away (if not, I'd love to know why, and if so, I'd love to know why it remained).

Robert Accettura

# re: More secure @ Thursday, March 24, 2005 7:15 AM

Dave Massey said, "This is not the case as any software has access to the same set of OS APIs and can therefore expose the same set of OS functionality as IE."

Microsoft keeps most of these API's and protocols secure from other software devlopers so that MS software runs better on Windows than their competitors. This is one of the ways MS continues to maintain their monopoly and attempts to keep it "secure". When bugs are found for it then they are exploited with disasterous results. Since Dave works for MS, then yes, he has access to the API's and protocols, but not everyone else. Though his statement that any software has access to the same set of API's is true, if you dont work for M$, then good luck getting full access to them. Even with a governments court ordered mandate that the API's and protocols be opened up, MS still has yet to do it freely.

Jack Webb

# re: Please get your story straight @ Thursday, March 24, 2005 7:21 AM

During the Microsoft anti-trust trial, the court was told over and over again that IE was part of the operating system and couldn’t be removed. Now we have a MS employee stating that IE isn’t part of the operating system. Which is it?? I’m amazed that everyone at MS isn’t on the same page on this, or was it just another example of MS lying in court?

Todd

# re: More secure @ Thursday, March 24, 2005 7:21 AM

"As we develop IE we go through very thorough and stringent security reviews to ensure that every change is secure and does not expose the user to attack."

We? Who is we? A room full of monkeys? IE is NOT secure - the proof is in the attacks and exploits that are publically announced and that we all suffer.

Mozilla is also not secure but I trust it a hell of a lot more than IE.

IE is NOT in the operating system. It's a separate product that they turned into a "technology" so they could resume their browser monopoly. It's like saying that the Mozilla rendering engine is part of the OS because it's in a shared library which is available to all applications, and uses OS calls.

IE is a separate product - Microsoft even agree with me on that, as they let you download IE as a separate named download called "Internet Explorer".

Microsoft are just trying to pull the wool over peoples' eyes. Some fall for it, some don't.

I use Linux - Microsoft will never get another cent from me again.

Mike

# re: More secure @ Thursday, March 24, 2005 7:18 AM

So what's the difference? One word - ActiveX.

Scott

# re: More secure @ Thursday, March 24, 2005 7:19 AM

"As we develop IE we go through very thorough and stringent security reviews to ensure that every change is secure and does not expose the user to attack."

The word "not" needs to be three words earlier.

Anuda Man

# re: More secure @ Thursday, March 24, 2005 7:19 AM

No one is ready to pay what really bug-free code would cost

dont be so sure on that ms makes buggy code. i guess they allways have. pretty sad when a websight can highjack a browser or spyware can be installed or a vrii just by going to a web sight.i switched over to mac and on the wifes comp we are switching over to linux when i get a chance to download mandrake linux. i for one am not willing to put up with the buggy code ms puts out. seems funny that theres no viruses on linux but thounds on the win platform and i dont belive that its because theres more windows computers out there i belive that its because of the buggy code ms writes

unhappy with ms

# re: More secure @ Thursday, March 24, 2005 7:19 AM

Mozilla Firefox SO FAR is more secure from what i can tell. dont be dissin the Firefox OR te linux, both more secure and stable than their Microsoft counterparts.

Tucker

# re: More secure @ Thursday, March 24, 2005 7:20 AM

Yeah? It's not part of the operating system, ugh? Then tell me how to remove IE entirely from my system???

Joro

# re: More secure @ Thursday, March 24, 2005 7:20 AM

Given that the author is a representative of Microsoft, and that this is a public blog trying to extol the virtues of Microsoft's code review process I would have expected the author to spell check the text before publishing it.

"Oh we perform stringent checks of our code but I can't spell check or proof this document"

Doesn't read too well does it? If this is comparable to a short section of code then we can safely expect similar errors in the code base. Too lazy to check now too lazy to check at work.

Sloppy.

Soops

# re: More secure @ Thursday, March 24, 2005 7:21 AM

I just knew I'd been slashdotted when I received 10 comments in less than ten minutes :-)

I do encourage people to read what I wrote.
"I'd love to hear your thoughts on how IE does not create more problems than it solves by being so tightly integrated to the OS?"
I don't know what you mean by tightly integrated, it's not a term that I believe we've used. IE components ship as part of the Operating system so that other part of windows and other applciaitons can make use of that rich functionality. The benefits there are fairly clear, an application can incorporate rich HTML rendering as part of their user interface and benefit from any updates made available through Windows update.

Thanks
-Dave

Dave Massy

# re: More secure @ Thursday, March 24, 2005 7:21 AM

"As we develop IE we go through very thorough and stringent security reviews to ensure that every change is secure and does not expose the user to attack."

Pssst. Your process is broken. It doesn't work.

Tom

# re: More secure @ Thursday, March 24, 2005 7:26 AM

"we go through very thorough and stringent security reviews". Security reviews? Last time I checked IE has had the more problems with security compared to firefox. Long live firefox!

phil

# re: More secure @ Thursday, March 24, 2005 7:22 AM

You use some very nice word play. Doublespeak, I beleve it's called.

Of course IE uses standard Windows calls, but then again, Windows also makes calls to IE functions. Suppose I have Mozilla and IE on my computer, and I wanted to remove both of them from my computer, how long would it take? I would suspect that Mozilla's uninstall would take less than a minute. What about IE? Is it even possible? So you are still saying that it's not part of the operating system?

Also Firefox at least has a very nice safeguard against security flaws: $500 if you report a security issue. This means that, unlike with IE where google will turn up links to exploits for "IE Exploits", unless you keep your new found exploit secret, someone'll cash in on it and it'll get fixed.

Martin

# re: More secure @ Thursday, March 24, 2005 7:23 AM

Hmmm. So what part of the Windows Operating System is Internet Explorer for MacOS? This "bundling" arguement is as flaky as the "market share increases attacks." FUD.

You know what I want to see with IE 7.0? You freaking HTML rendering engine *not* running as Kernel service.

Acidus

# Architectural weakness @ Thursday, March 24, 2005 7:29 AM

>If something goes wrong--the browser (or parts
>of the OS or other 3rd party apps that use the
>browser) starts crashing, who will the end user
>blame? Microsoft. For example, just look at how
>people blame MS for blue screens of death when >the vast majority of them are caused by 3rd >party drivers.

MS architected their system in such a way that allows device drivers to take down the entire system. I also well remember the decision in NT4 to run video drivers in the kernel space to improve performance - and incidentally make the system much less stable.

So yes, given that PC architecture always comprises a set of diverse hardware compoments that *require* a diverse array of third party drivers to function at all, and MS Windows has always only worked on the PC architecture, I'd say it's quite reasonable to blame MS when their OS is not stable or secure due to fundamental architectural weaknesses.







Matt Palmer

# re: More secure @ Thursday, March 24, 2005 7:25 AM

"You know what I want to see with IE 7.0? You freaking HTML rendering engine *not* running as Kernel service."

I don't know who told you IE runs in the kernel. It doesn't and never has.
Thanks
-Dave

Dave Massy

# Spelling @ Thursday, March 24, 2005 7:30 AM

"Update - Fixed the typo. Thanks for the feedback. I didn't have http://www.iespell.com installed on teh machine I posted from."

Was the "teh" an intentional pun? :-)

Chris

# re: More secure @ Thursday, March 24, 2005 7:36 AM

unhappy with ms said:<BR><BR><I>pretty sad when a websight can highjack a browser or spyware can be installed or a vrii just by going to a web sight.i switched over to mac and on the wifes comp we are switching over to linux when i get a chance to download mandrake linux.</I><BR><BR>My university has become unhappy with MS too, critically. They've decided to move over to Linux. While talking with one if the enthusiastic techies, she reccomended me Mepis Linux, and hell, it's spread like wild-fire through the whole graphic design department. So check it out at <a href = http://mepis.com>Mepis Linux</a>, it's simply fantastic and has firefox onboard by deafult. It takes about 20mins to install and asks 10 basic questions. My 12year old sister installed it, all drivers detected and ready to go. It's a really good multi-media machine, video/flash/audio all working out of the box!

Susan.M

# re: More secure @ Thursday, March 24, 2005 7:37 AM

Is this a Microsoft employee stating that Microsoft puts its products through "very thorough and stringent security reviews to ensure that every change is secure and does not expose the user to attack" Can you please then tell me why you end up with this report (http://secunia.com/product/11/) from Secunia? The truth is that you are only focused on one area of Mitchell Baker’s argument. I have an idea, why don’t you explain to the people about those Active X controls that help hackers’ compromise their systems? But you won’t even go close to that subject because you just can’t defend it and you go and take the easy way out. Anther argument that Mitchell failed to delve upon is the fact that Firefox (as well as Safari, Opera and those others in Linux) are all W3C standards compliant browsers but for some reason Microsoft fails to be one. If Microsoft is to be this company that believes in cooperation, it should get on the bandwagon. Don’t waste you blog space babbling on your irrelevancies about how you have had the M$ brain wash and wax special without providing a real argument for continuing to actually use your browser.

Ivan,Firefox Forever

# re: More secure @ Thursday, March 24, 2005 7:33 AM

Why do people say it's part of the operating system? Try opening My Computer or some other folder and typing a URL in the address bar. Wow! Instantly morphed into Internet Explorer. Now uninstall internet explorer and do the same thing again...Wow! Morphed into IE! But, it's not part of the "OS", people confuse that with inextricable part of the software packages.

K.J.

# haaaa @ Thursday, March 24, 2005 7:39 AM

"I don't know what you mean by tightly integrated, it's not a term that I believe we've used. "

Right, the term you used in a court of law was "embedded." Sorry.

Thomas

# re: More secure @ Thursday, March 24, 2005 7:35 AM

If IE isn't part of the OS then try uninstalling IE sometime. Thought not.

Keith Harrelson

# slashdotted @ Thursday, March 24, 2005 7:41 AM

Well you are not slashdoted, I can see your page a write a comment. Slashdoted is used when the page becames unreachable.

Trukichu

# re: More secure @ Thursday, March 24, 2005 7:37 AM

The thing which I have noticed and concerns me is how, once you open a folder, you can go to the path of the folder, type in a URL, and it instantly opens IE and the webpage with absolutely zero lag. I admit I do not know all the details on how IE has been integrated with the OS, however I do gather a sense that IE is still tightly coupled and probably inseparable. With such a close tie in with the OS, I am not surprised that the simplest IE bug/hack can cause havoc on the machine.

By the way, there are several grammatical and spelling errors in the original posting at the top; just a fyi incase you werent thorough enough.

Anonymous Coward

# re: More secure @ Thursday, March 24, 2005 7:38 AM

I find this sort of comic. I seem to recall Bill Gates testifying that the browser *was* part of the OS and *couldn't* be removed. Now, when it turns out that that architecture renders it insecure (and Firefox is eating its lunch), we have the team claiming it's not part of the OS.

enodo

# re: More secure @ Thursday, March 24, 2005 7:39 AM

long live open source

William Gates III

# re: More secure @ Thursday, March 24, 2005 7:39 AM

ouch! no HTML. posted again for a better read ;)

unhappy with ms said:

pretty sad when a websight can highjack a browser or spyware can be installed or a vrii just by going to a web sight.i switched over to mac and on the wifes comp we are switching over to linux when i get a chance to download mandrake linux.

My university has become unhappy with MS too, in fact critically. Service Pack 2 broke about 200 machines and the spyware problem has become unmanageable. They moved to FireFox, or at least reccommended it wherever possible. That helped but then some botnet ended up slowing down the whole network. Anyway, they've decided to move over to Linux (Redhat Fedora actually). However, while talking with one of the enthusiastic techies, she reccomended me Mepis Linux, and hell, it's spread like wild-fire through the whole graphic design department (amongst the students). They can run whatever programs that normally run on Windows (photoshop, macromedia stuff etc).

So check it out at http://mepis.com. This Mepis Linux, it's simply EASY to use and has firefox onboard by default.

It takes about 20mins to install and asks 10 basic questions, all from a running CD - just put it in and reboot. My 12year old sister installed it BY HERSELF!! All drivers detected and ready to go. It's a really good multi-media machine, video/flash/audio all working out of the box!

Susan.M

# re: More secure @ Thursday, March 24, 2005 7:44 AM

First there was the story (the anti trust case) that Internet Explorer was part of the Operating System and couldn’t be separated. Then when the public asked for an updated version of Internet explorer there was a time that it wasn’t possible until the release of a new Windows (Longhorn). IE was too tied in with the OS and updating it would require changes at the OS itself.

Now it’s a 180degree turn. IE7 will be released for an older version of Windows XP and it seems that the claim today is that IE isn’t part of the operating system.

Somewhere you lost me!

silence

# re: More secure @ Thursday, March 24, 2005 7:45 AM

His spelling is almost as bad as IE

_

# re: More secure @ Thursday, March 24, 2005 7:46 AM

"I don't know who told you IE runs in the kernel. It doesn't and never has."

Herrr, IF it's not in KernelLand (don't run in kernel), so it's in Userland ?

But "That Microsoft itself argued in a court of law that IE was embedded in the operating system. ".

so we have an program which is embeded in the operating system and not in kernel ?


GeoVah

# re: More secure @ Thursday, March 24, 2005 7:43 AM

Kernel != GUI

You could seperate IE from windows if some other app was willing to be the windows GUI. But why?

IE is an app that other apps rely on for UI rendering.

You'd think linux & firefox fans had no concept of layered applications, with all these comments about how IE -IS- the OS.

cosinezero

# re: More secure @ Thursday, March 24, 2005 7:43 AM

Martin's comments are correct, and completely negate the point trying to be made in this blog...

Windows was LUCKY that firefox came around...or else to this day every windows PC would still be inundated with horrid virus/spyware issues.

Every computer I see running IE has nothing but problems...Any computer I see that is actively running FIREFOX...well I guess that it just shows a good measure of that user's intelligence. :)

Is it possible that an open source project is out-witting Microsoft's deep pockets?

My 2 Cents

Homan

Homan Towliat

# re: More secure @ Thursday, March 24, 2005 7:44 AM

The distinction between Windows and IE is blurry conceptually, if not technically, because you can just type an URL into the path bar of any open window and suddenly you have a browser in front of you. There is a conceptual illusion that IE is somehow inextricably tied into the operating system. This idea is compacted by the fact that there's no way to go into Add/Remove programs and remove IE. People consider it "part of the OS" and they will until Microsoft sees fit to give users more of a choice as to what components of the operating system they want on thier systems.

Tux

# re: More secure @ Thursday, March 24, 2005 7:49 AM

IE doesn't run in the kernel, but it still runs higher than most apps.

And you can remove IE, but even if you delete all of the files required, if you run the Windows Update EXE, it puts everything back.

Erase:
C:\Windows\System32\dllcache\iexplore.exe
C:\Windows\System32\IEXPLORE.EXE
C:\Program Files\Internet Explorer

And this only removes the IE shell. You can *STILL* use IE through explorer.exe, and there is absolutely no way around this unless you use another desktop shell.

In the OS? Yes. If the desktop shell depends on a web browser, it's in the OS. Sure, it's not a kernel service, a service, or anything of that sort, but the "core Windows functionality" (eg: a GUI) depends on it (Active Desktop, viewing C:\, browsing your music, some taskbar toolbars).

So, in IE, if something does break the sandbox (does IE have one? not sure..), they get the same set of APIs that Windows Explorer uses to view/erase/delete/move files. If you break Firefox's sandbox, you can run stuff as the local user, but typically it's only XUL/XUL apps. The APIs exposed to XUL apps/XPCOM/XUL/JavaScript is not a full set of system calls -- just enough to get the job done (yes, you can delete files, but no, you can't execute arbitrary kernel functions or edit the registry [XPCOM can, but the objects do that themselves; the APIs Mozilla/Firefox expose don't allow it]).

Ziggy

# re: More secure @ Thursday, March 24, 2005 7:51 AM

What, man is the problem. Oh I am sure that security risk POS activeX has nothing to do with it. In reality, IE would be a great browser if it wasn't for ActiveX. Since I have been working in this field professionally, (over 10 years), the biggest problem I continually run into is the pathetically weak security offered to a system from IE. From everything I can tell, this all stems back to that POS ActiveX. All the spyware/malware that exists in the world is all surviving on ActiveX and its completely fundementally flawed design/conception/implementation/existence. Maybe the developers would learn a lot if they took six months off from their job and actually went out into the wild and did support on their monstrosity of a creation. The lessons learned from this, I think would forever change the design team. If they had to sit through all the BS repair time I have dealt with brought on by the anemic security that IE wishes it had. When I moved all my clients off of IE and onto FireFox, I quit have to go and remove 300+ pieces of spyware off of machines once a month. When browsing the internet a few hours a day loads up a PC with so much malware that it becomes unusable, there is a MAJOR problem. But yet, these cheese head programmers that never have to deal with the results of their boss's POOR decisions, people like me are stuck cleaning up their mess daily, instead of being able to spend my time convincing my customers they need to buy new equipment, and new OS's.

bemenaker

# re: More secure @ Thursday, March 24, 2005 7:46 AM

I was wondering why there are so many simplistic and naive posts here. Now I know.

Thanks /.

Now how do I can browse at +5 for a while ;)

Go away /.

# re: More secure @ Thursday, March 24, 2005 7:54 AM

Eric: "the likelihood of a third party app, that doesn't rely on core OS functionality to render a web page, allowing the OS to be compromised is highly improbable"

I don't get it. Maybe I'm out of the loop but I would have sworn even FF requires an OS before it can run. Can you just install FireFox on a freshly formated drive (no OS no nothing) and it runs fine? I don't think so! Every application, including 3-rd party browsers (yes even FF) DO rely on core OS functionality.

Yes, IE is a component (siting on top of the OS) which other components use. But that doesn't make it any more part of the OS than my speakers are part of the OS because my MP3 player needs them to play the music.

I think part of the problem stems from "Windows" now often being used to refer to much more than just the OS. There is now basically Windows the OS, and Windows the OS bundle. As stated above things like NotePad, Calculater, Solitare, and IE are not part of the Windows OS, but are part of the Windows bundle which perhaps causes confusion. Would the strict Windows OS fail if IE was removed? Probably not, but Windows layers of components many other items in the Windows bundle probably would.

Should these things be more losely coupled? Strictly speaking, yes. From an architecture stand-point that might be nice. Pragmatically speaking is it possible to not have these dependcies and still give the users what they want (easy full functioning use)? I'm not so sure.

I think FF does some cool stuff and I enjoy it (aside from every "auto-update" being a new full install, and other stupid stuff it does), but mainly because it finally forced IE to reply shortly with features I've been waiting for.

I wish MS was more open and didn't need the FF threat to be forced into action, but I'm getting tired of the F/OSS community (of which I'm part of) tossing out claims without bothering to site references of studies to back them up. The more involved I get with F/OSS the more I see a lot of the "conventional wisedom" about what is better and more secure in fact has no real base in reality, it just that a bunch of zealots have repeated it enough that it must be true.

Goku

# re: More secure @ Thursday, March 24, 2005 7:50 AM


"His spelling is almost as bad as IE"

+1 Funny :P

Sindri

# re: More secure @ Thursday, March 24, 2005 7:51 AM

Dave, you are a stand-up guy for posting this and taking the feedback from both MS and *nix drones. It feels like the whole *nix vs MS is like Rep. vs Demo.

=)

Odium Devonix

# Part of the OS @ Thursday, March 24, 2005 7:52 AM

IE is part of the Windows OS because Bill says so. It can not be removed without breaking the OS and compatibility with other applications.

TeroV

# Microsoft Employee on IE Security @ Thursday, March 24, 2005 9:54 AM

This IE developer disputes claims by Firefox and Mozella about the way IE interacts with the operating system.

Firefox

# re: More secure @ Thursday, March 24, 2005 8:05 AM

Every operating system is vulnerable to malware. Windows just happens to have the largest community of malware authors who consider it a good target.

Why? Because Windows provides more accessible tools for the largely-unskilled developer to produce working applications quickly, and because people are constantly running around blaming Microsoft for everything. So a bunch of stupid people with little skill and less wisdom are saying "I'll show those Microsoft pigs!", and they whip out some basic trojan in five minutes that deletes a bunch of files. Then they send it out in a spam email, victimise a bunch of innocent morons who don't have anything to do with Microsoft, everyone starts whining and crying about security, and these jerks think they've struck a blow for the little guy.

The fix, of course, is for Microsoft to make Windows development more difficult and less accessible to the novie developer. This seems like a bad idea.

Caliban Darklock

# re: More secure @ Thursday, March 24, 2005 8:02 AM

<rant>Of course the committed OSS fans started the flame again (could you live without it?). Ok, why not, but have you checked the Firefox security bug vulnerability count recently? And the time it took to ship bugfixes for them? Nah? You should.</rant>

Now, forget about if IE is insecure or not for a moment (it is insecure, but Firefox doesn't do it better).

Internet Explorer is only a lightweight shell above the MSHTML engine. Nor MSHTML, neither iexplore.exe are part of the kernel. They do not operate more in kernel mode than Firefox, Mozilla or whatever user software does. That's a fact.

Ok, now move on. Both MSHTML and Internet Explorer are shipped with the operating system itself. That's a fact.

MSHTML is used by other operating system *applications*, such as the Add/Remove Programs applet, the HTML Help Viewer, the Explorer shell and a few other software (including IE). That's a fact.

Here we have three facts and now it's up to you to tell whether Internet Explorer is integrated with the OS.

Depending on what you mean under OS, you might be correct or wrong. Linux users often say that Linux is kernel only (especially when making security vulnerability count comparisons <g>). From this viewpoint, I think IE is not the part of the OS. If think about Linux as a distribution, which typically includes one of more browsers, I'd say IE is part of the OS.

pb

# re: More secure @ Thursday, March 24, 2005 8:03 AM

"As we develop IE we go through very thorough and stringent security reviews to ensure that every change is secure and does not expose the user to attack."

I am sure the security reviews are very thorough and stringent, however, the method in which your development model is based on is inheritently insecure. Open source software is more secure because MORE programmers can and do eye the code. The bigger team you have the more productive and more secure the product is. When will Microsoft start taking similar approaches with their products?

The track record shows us that Mozilla and even other browsers such as Opera (which isn't open source), release patches far faster than Microsoft. I know you have to test and test again before you release patches to make sure it doesn't hose any exisiting systems. IMHO, thats a design flaw. One reason why Mozilla, Opera, etc. can release patches much faster is because generally those patches won't mess up the product, nor mess up the OS. In otherwords it requires less regression testing than what is needed when there is a flaw in IE.

Secondly, Mozilla is standards compliant. Where is the full CSS2 standards compliance in IE? Will Microsoft stop sitting on their asses and start LISTENING to their customers about web standards and stop trying to reinvent the wheel? Atleast in theory, the more standards compliant you are will ultimatly lead to a more secure product, and happier customers. From my experience, Microsoft has alienated a lot of their customers because of this issue.

I suppose thats another difference between OSS and closed systems, the OSS programmers are more likely to listen to feature requests and implement them. We don't have to sit back and whine and cry about the implementation of web standards either. Bill, where is this interoperability you promised your customers a long time ago? I have yet to see it.


Thirdly, IE is more prone to spyware because its integrated into the OS. There are no containment procedures in place to prevent spyware. Now, really evil hackers are taking advantage of that flaw to steal financial information from unsuspecting IE users.


I am not anti-Microsoft, however being a developer from both sides of the fence I already see the better design approach to systems such as KDE as compared with Microsoft's design. I hope that Longhorn will prove me wrong, but IMHO, that will take a complete rewrite of the Windows operating system. For now, I will stick with the Dept of Homeland Security's recommendation not to use IE DUE to the current security flaws and current undiscovered security flaws in IE. You know you have a BIG problem when a government agency which purpose is to protect the citizens of the US recommends not to use IE.


Just my 2 cents worth

Thanks














Anonymous KDE Developer

# Fallacy of logic... @ Thursday, March 24, 2005 8:09 AM

The "Straw Man" attack, eh? I like how you completely dodge any real argument and instead focus on your blurred version of what he was talking about.

For those people unfamiliar with the fallacies of logic: the following excerpt is from here: http://www.nizkor.org/features/fallacies/straw-man.html

Description of Straw Man

The Straw Man fallacy is committed when a person simply ignores a person's actual position and substitutes a distorted, exaggerated or misrepresented version of that position. This sort of "reasoning" has the following pattern:

1. Person A has position X.
2. Person B presents position Y (which is a distorted version of X).
3. Person B attacks position Y.
4. Therefore X is false/incorrect/flawed.

This sort of "reasoning" is fallacious because attacking a distorted version of a position simply does not constitute an attack on the position itself. One might as well expect an attack on a poor drawing of a person to hurt the person.

Scooter

# re: More secure @ Thursday, March 24, 2005 8:05 AM

Dave,

I would be good if you could answer some of the tougher questions being presented here, not just the useless fanboy type flames.

For example, how do you reconcile your post with the fact that Microsoft swore under oath that Internet explorer is a tightly integrated component of Windows? Several people have asked this (not just here) and I have yet to see a serious reply.

Either you are lying, Microsoft lied at the trial or the situation is now completely different and IE is no longer tightly integrated. I would be curious to know what you think.

regards

adavidm

adavidm

# re: More secure @ Thursday, March 24, 2005 8:11 AM

You can remove IE. Using XPLite you can completely remove it and all its components (the dlls that actually render content inside of other windows tools like explorer and the help system.)

gregg

# re: More secure @ Thursday, March 24, 2005 8:11 AM

I think that it does not matter what anyone says because people who does not trust IE/MS will always take one or two of the statements from what they say and twist it to mean anything you want it to mean.

There are fundamental differences between how a corporation develops applications and how an OSS group does it, simply because the corporation have to weigh cost vs. effect.

If you think that means that a corporation will never be able to produce as secure an application as an OSS group, well, go right ahead and believe that, I don't.

One of the reasons, IMO, that IE has so "many" security holes is that everybody loves to poke holes in IE. Which means that not only is there a much larger group of people trying to create programs that take advantage of the holes, there's also a bigger group of people trying to expose the holes either so that MS can get them fixed or to just expose IE/MS as bad.

In time this will change if FireFox or other browsers steal enough market from IE.

And the reasoning that since you can look at the source code from OSS software and not at the MS code, that doesn't mean anything at all. The number of people qualified to both look at, understand, and find flaws with the source in so complex projects is a lot smaller than you think and the number of those again that would even bother to do so is even less.

Yes, you can, so there's a theoretical bonus. I don't think it's as big as people want it to be though.

As a final note, I still have a FireFox 1.0 installation running with the checkbox for a periodic check for updates checked, and it still hasn't asked me to upgrade, even though there's been two upgrades since 1.0. Must be a bug...

Lasse

# re: More secure @ Thursday, March 24, 2005 8:08 AM

Forget the security flaws in IE. We forgive you. But, at least, make the damn thing fully web standard compliant.

.

# re: More secure @ Thursday, March 24, 2005 8:13 AM

Sounds like a really bad design decision to me, why should the browser be integral to the OS? - and typical of the microsoft way of thinking: i.e. don't just design something to do one or two things: design it to do absolutely everything under the sun.

If microsft made toasters, they'd cost £200 and come with a CD-Rom, USB, IE 6 and bluetooth as standard - all unistallable 'because they're part of the OS'.

Mr Monkey

# re: More secure @ Thursday, March 24, 2005 8:19 AM

Well first of all I'd like to say this thread has about three types of posts thus far...

1) Firefox fanboys *stupidly* insulting IE/MS "MS suxxx, die gates die!!"
2) IE fanboys *stupidly* insulting Firefox and Mitch's article "IE isnt part of the OS. Nope nope nope. Its not running at the kernel level!"
3) People who actually know what theyre talking about...

Anyway.. With this era of "managed" software development, and API/COM+/.NET/whatever sharing across the board, something really doesnt have to be part of the kernel to be part of the OS. Windows ships with IE, and you cant remove it or the Windows OS basic functional is broken. Simple as that. Now maybe Dave's point is its not part of the "Windows OS" and he means the Windows Kernel. This is true.

At work we have many specially built (Dual Xeons, really tight machines) MRI consoles for various customers. Yep, we're a medical software and integration company. Back in "the day" the predacessors of these machines ran SunOS, since PC hardware/software just wasnt reliable enough when your worried about brain cancer :P However nowadays these machines are being built with Windows XP Embeded edition. In the configuration we have, IE is not imbeded into explorer/Windows UI at all. And let me tell you, it not only looks nicer, but they run like a dream... Although really a Dual Xeon is going to run like a dream anyway. So in this sense IE is not part of the "OS"

But in the version that Ships to end consumers IT CERTAINLY IS PART OF THE OS!

Now as per the articles claim, yes firefox IS more secure than IE. Whether its its because its not integrated into the OS or not, the fact remains true. Look at the track record over the last couple years. Microsoft has made some very poor decisions, aswell as released some very poor code. I know that testing is very difficult, and thankfully we do not have any products that are user-end or involve the internet(s) :P. We just have to worry about frying people with radiation, or other drug treatments in our dosimetry software. And yes, this is an industry that demands bug free code!

Oh and Dave, why do you only respond to the comments that are by Firefox fanboys and are easily debunked... There have been many credible questions that have gone unanswered.

Heh

# re: More secure @ Thursday, March 24, 2005 8:13 AM

Is it really possible to completely remove IE from Windows and still expect it to work flawlessly? (In fact is it possible to completely remove IE at all?) As far as I know - no (however, I'm no expert). As for notepad.exe - it makes no difference whatsoever.
I guess that's what is differen between beeing "a part of an OS" and beeing "shipped with an OS"...

arakell

# re: More secure @ Thursday, March 24, 2005 8:17 AM

You said:

If we are to debate security of browsers then let's bring in relevant arguments and accurate details about different possible attacks ...

I say:

IE - Active X
FF - no Active X

therefore IE is MUCH LESS secure than FF

Joe7pak

# re: More secure @ Thursday, March 24, 2005 8:22 AM

Face it, Microsoft is losing.

Mark

# re: More secure @ Thursday, March 24, 2005 8:23 AM

Has anyone noticed that Dave Massey only answers softball questions? I think there are some very valid points in this discussion, but he (or his lawyers) won't answer them. I can summarize for you Dave...

"As we develop IE we go through very thorough and stringent security reviews to ensure that every change is secure and does not expose the user to attack."

We? Who is we? A room full of monkeys? IE is NOT secure - the proof is in the attacks and exploits that are publically announced and that we all suffer.

Why so many repeated security related failures?

What is the major fault that resulted in the wealth of problems? Why would someone think that a technology such as ActiveX wouldn't result in abuse? Didn't that raise a flag right away (if not, I'd love to know why, and if so, I'd love to know why it remained).

Yeah? It's not part of the operating system, ugh? Then tell me how to remove IE entirely from my system???

Of course IE uses standard Windows calls, but then again, Windows also makes calls to IE functions. Suppose I have Mozilla and IE on my computer, and I wanted to remove both of them from my computer, how long would it take? I would suspect that Mozilla's uninstall would take less than a minute. What about IE? Is it even possible? So you are still saying that it's not part of the operating system?

During the Microsoft anti-trust trial, the court was told over and over again that IE was part of the operating system and couldn’t be removed. Now we have a MS employee stating that IE isn’t part of the operating system. Which is it?? I’m amazed that everyone at MS isn’t on the same page on this, or was it just another example of MS lying in court?

Go for it!

Me

# re: More secure @ Thursday, March 24, 2005 8:26 AM

Dave,

Thanks for your perspective and opening yourself up to abuse from the slashdot crowd. I personally use Firefox for browsing the web, but in my development job we use the IE rendering engine (mshtml.dll) for custom intranet based solutions. The ability to integrate our own custom written ActiveX controls into the HTML layout makes getting things done much easier.

Joseph Willcoxson

# you can uninstall IE with LitePC @ Thursday, March 24, 2005 8:34 AM

on my home computer with windows XP, I removed internet explorer with a program named LitePC at www.LitePC.com

in a nutshell, LitePC "fixes" windows so that it can be run without IE. What does that mean? well, a lot of programs installed on my home PC use IE for some function or another, and LitePC makes it so that they won't miss it. Why can't they program so that they don't have to use IE? wouldnt that be smarter? Is IE documented better than these APIs that are found in MSDN as referenced above? well, that is another argument.

so after I installed LitePC, and it uninstalled IE, it was great. I felt more secure immediately. Those nasty baddies wont get into my computer now... well sorta. They suffer from the same problem that mozilla has: They don't know exactly what IE does, they can just see results. so there is quirkiness with some programs, and others will just plain not run. however, since IE has been thought of as always being there *I don't know why anyone would think that* then software developers write code specifically for IE to run.

My question is.. if IE isn't part of the OS, but software developers can pretty much rely on it being there, isn't that then a defacto piece of the OS?

if it is *not* a defacto part of the OS, then that means you are telling a lot of developers that they are really stupid. That relegates IE to a mere *program* status. you would need to admonish these developers much like you would if they relied on notepad, or solitaire to be there.

Kevin Gabbert

# re: More secure @ Thursday, March 24, 2005 8:29 AM

OT maybe:

a reply on Dean Harding

>And is notepad any less secure because it ships >with the OS?

Yes, as is common knowledge one can acces streams on any NTFS volume through notepad. That is, store data not vissible to the user/sysop in it, and read it back.

EG run: notepad c:\temp\test.txt:test.txt

type something, store the file, take a look at the filesize and be amazed. where did the data go? into a named stream...

just search on: notepad and NTFS streams
in google and you'll find a bunch of sites related to this.

anyway i think this is insecurity...

TP

# re: More secure @ Thursday, March 24, 2005 8:35 AM

Do you understand billions of dollars lost for businesses, individuals because of viruses, trojans leave their computer pretty much useless? Do you really understand how companies and people use Microsoft product for mission critical applications and lose millions of dollars per day due to some bug in your products. It should be criminal to produce software like this. Shame on you to defend it!

Hem Ramachandran

Hem Ramachandran

# re: More secure @ Thursday, March 24, 2005 8:37 AM

Ok, on the "No one is willing to pay what it costs for bug free code" argument.

By that logic, Free as in beer code should have a lot more bugs than expensive MS code. So Firefox should crash every few minutes.

And why did MS say that IE was part of the OS in court. Maybe the AG should look into this.

stormesj

# re: More secure @ Thursday, March 24, 2005 8:37 AM

internet explorer may or may not be more secure than firefox. but because the API's that are tied to it are also tied to the OS so tightly that you cant remove IE, that makes the OS less secure, because if you exploit IE your accually exploiting Windows.

prove me wrong, i dare you.

accually i double dare you, and your whole department.

serialhex

# re: More secure @ Thursday, March 24, 2005 8:33 AM

The poster that stated people would pay large amounts of money that was bug free. I challenge you to show me an app of over 15,000 lines of code that is 100% bug free.

Brian

# re: More secure @ Thursday, March 24, 2005 8:33 AM


I dont understand how people can claim firefox is more secure than IE.

Things like http://www.securityfocus.com/archive/1/378632 indicate firefox QA isn't all that is cracked up to be, and possibly seemingly more secure as its only being used by a small minority.

Plus the fact there seems to be alot of "LOOK Microsoft stuffed up yet AGAIN!" from Firefox fanatics, when an exploit is found, but Mozilla/Firefox exploits dont seem to get the same negative attention.

Ren

# re: More secure @ Thursday, March 24, 2005 8:39 AM

I know that IE is supposed to be the browser equivalent of a door with no hinges but I'm not convinced. I run Firefox because of features, because of tabs, and css support, but prior to firefox 0.8 I ran nothing but IE when using Windows. I never once had my start page redirected, I never once go any virii that stemmed from my use of IE, I never once got any spyware except for the bundled kind that came with other software.

I can't claim to be representative as clearly other people have problems but how manny of the reported problems are theoretical security holes and how many actually cause real day-to-day problems?

A lot of them seem pretty unlikely to me.

That said, CSS support should not be an option that can be debated, it should just be, so flame on...

seriously though

# re: More secure @ Thursday, March 24, 2005 8:40 AM

About the "IE is part of the OS" statement...rather, so many things - even in the base Windows system - interface with IE that removing it would mean quite a few nasty things would happen.

niteice

# re: More secure @ Thursday, March 24, 2005 8:48 AM

I feel sorry for you. I must be somewhat depressing to read all these comments about your company. Some time ago it used to be great thing to say "I work at Microsoft". I don't think that's true any more. I guess people at Microsoft are more and more hiding the thing they are working there.

What comes to IE and it being part of the operating system I guess the view of you about the subject might be pretty interesting in some courts. In EU they'd like to get IE permanently removed from Windows to make it more secure. So far Microsoft has been telling it cannot be done (which I believe is true as it's clearly part of OS and running _inside_ the OS). However, if your point about IE being just a standalone application is correct then we have to start to push our EU MEPs more to get MS to release a version of Windows with IE removed.

Mike

# re: More secure @ Thursday, March 24, 2005 8:49 AM

This is a bit OT but will IE 7 finally display a PNG graphics file correctly?

tuco

# re: More secure @ Thursday, March 24, 2005 8:49 AM

I'll say this, speaking as someone who works with mozilla.org code:

Windows XP SP2 heralded a lot of great improvements on security, and several of those improvements impacted IE6 positively. I'm fairly confident that IE7 will be better in the security viewpoint.

Microsoft has been burned pretty badly over the whole security issue, and their response as I've seen it is all for the betterment of the users.

That said, I think people will be nodding their heads and saying, "Yeah, riiiiiight" until IE7 is actually released... after all, that's how a lot of people felt about Mozilla 1.0, having seen Netscape 6.0 (based on Mozilla 0.6)...

Alex Vincent

# re: More secure @ Thursday, March 24, 2005 8:51 AM

seriously though:
You clearly are a computer oriented user. For ANY non-techie IE is huge risk on their computers. I've seen very bad situations on some computers I constantly keep clearing from all bad things mostly coming from IE (and increasingly from the messenger) mostly on my relatives computers.

seriously indeed

# re: More secure @ Thursday, March 24, 2005 8:53 AM

DM-->"I don't know what you mean by tightly integrated"
Can you give us a link of a Microsoft KB on how to completely remove Internet Explorer from our systems and still to be able to use all the features we already use?

Anonymous Coward

# re: More secure @ Thursday, March 24, 2005 8:55 AM

If it isn't part of the OS, then why can't you uninstall it?

random troll

# HERE'S A SUGGESTION @ Thursday, March 24, 2005 8:59 AM

Hey I got a good idea. How about in the next release of M$ they include two DIFFERENT programs. ONE for that BS crap about how so parts of the OS "can rely on the functionality and APIs being present". And a completely other, separate, OPTIONAL program for BROWSING the internet (sounds like a simple concept), not something that "in turn relies on Operating System functionality to do it's job."
M$ SHOULD NOT HAVE EVER combined the two into one. This is what people mean when they say that "IE is part of the OS". Because IE has ties with OS and can be manipulated
"The security of any browser IS RELEVANT to if it is part of the operating system." IF only M$ would have taken this approach, instead of shoving IE down our throats and embedding it into the OS, spyware/malware wouldn't be in the dictionary.

And another thing:
"As we develop IE we go through very thorough and stringent security reviews to ensure that every change is secure and does not expose the user to attack"
-Yea I'm sure you pay your developers lots of money to do this... but what kind of environment do you provide them with? Probably fast running computers with nothing installed on it. Maybe this is why open-source software is always so much better then "cubicle-made" software... because a lot of the code gets developed on "real life" machines. And therefore it gets tested in real life scenarios, on actual setups that people are going to be browsing with.

And only the icons for IE can be erased. If IE were really able to be uninstalled the HELP system should never work after this occurs, along with many other things embedded into the OS, but the help system does work and I can go to "My Computer" and type in www.firefox.com and have the "uninstalled" IE open from thin air.

Apotropaic

# re: More secure @ Thursday, March 24, 2005 9:05 AM

The IE architecture is fundamentally flawed -- ActiveX. Microsoft was warned by security experts when they first got into the Internet game, but took the attitude of, "we've got really smart programmers, so don't worry we'll get it right." Well, Microsoft didn't get it right, the security experts were in fact correct. There's a huge difference between bugs in code and a fundamentally flawed design. Someone at Microsoft needs to call "do over."

Anonymous

# Trial Information @ Thursday, March 24, 2005 9:07 AM

This is from an section of this link...It appears MS can never make up it's mind...
http://www.theregister.co.uk/1999/01/21/schmalensee_trips_on_doj_banana/

Boies produced a Microsoft email from the Bristol versus Microsoft case (in which Schmalensee had testified): "We are now describing IE as part of the OS and putting it in the box. Conclusion: they already have rights to things like IE. It's a legal stretch, but I want to hear from our attorneys and you, Bob. But in any case, I'd rather use IE as a bargaining chip to clarify the extent of their rights; ie., treat IE as a separate deal and, thereby, set the precedent that apps in the box aren't really part of the OS." It now seemed that even Microsoft was willing to regard IE as something separate from Windows if it suited them. It was a very significant document. Urowsky was objecting furiously, but was overruled by Judge Jackson, who paraphrased Boies argument very well, thereby showing he was paying very close attention. The date of the email was 22 December 1995, just a couple of weeks after Microsoft's Internet strategy meeting in New York.

Just tell the TRUTH

# Is IE part of the OS? What is the official word? @ Thursday, March 24, 2005 9:18 AM

Ddue, your employer spent alot of time a few years back arguing that IE is integral to the OS, so I think it is pretty fair to recall that position.

mike

# re: More secure @ Thursday, March 24, 2005 9:13 AM

IE is so essential, in fact, that you can rip it out and not miss it.
http://nuhi.msfn.org/nlite.html
http://www.vorck.com/remove-ie.html

Fred Vorck

# Define "Part" of Windows @ Thursday, March 24, 2005 9:18 AM

I'd like for a M$ employee to define the term, "part of windows". How can you separate an application from and OS when it is "part" of the OS? If it is not integrated in a fashion that would allow it to be taken out of the OS and not cause a degrading of features of that OS, well that would conclude the OS depends on the features of the application and therefore is itself more than just an application.

"While scant on details for IE 7, Gates said the security enhancements will protect customers against phishing and other malware. The features will also be included in the version of IE for Longhorn. IE is part of Windows and is used by most Web users, but it has a bad security reputation."

DoubleSpeak

# re: More secure @ Thursday, March 24, 2005 9:19 AM

I think that there are two points of view about "IE is part of OS" On one hand we talk about OS as kernel (I/O, drivers, memory managment and so on) in that case - yes, IE is not part of OS and lays much higher (i suppose :)) Hence, base operations couldn't be affected by exploiting IE bugs. On the other user works with GUI wich, being higher level app is still part of OS (could you operate "windows" without windows in normal way anyway?).
Hence, using windows explorer, help system an other third part apps we still USE IE which is buggy :) we can't exclude IE presence from windows so, it doesn't matter what which API uses...

Swan

# re: More secure @ Thursday, March 24, 2005 9:26 AM

" I don't understand what people mean when they "IE is part of the OS". "

I thought this is what the mothership said in its multiple antitrust suits, no?

anymouse

# Spelling @ Thursday, March 24, 2005 9:26 AM

You should try Mac OS X - it has a Spelling checker built into the OS.

Oh... hang-on.. is that a good thing or a bad thing....

<brain explodes>

Diggory Laycock

# M$ behind the scenes @ Thursday, March 24, 2005 9:28 AM

Some decessions are particulary nasty. For example a couple of years ago, when the browser war was still running, Microsoft got sued for integrating Internet Explorer into Windows. The court ordered that Microsoft should also offer a version of Windows without IE. After some debate Microsoft decided to ship an additional version of Windows with every line of IE code removed. Because IE was part of the OS, and certain parts of the OS relied on IE components, this Windows version was broken. It just didn’t work. So people had the choice between an IE-less broken Windows version or a working one which did include IE. They followed the court’s order, but well, it didn’t work out how people hoped it would.

blah blah

# re: More secure @ Thursday, March 24, 2005 9:28 AM

ActiveX, ActiveX, ActiveX. Please get rid of it. Nope, I don't use IE, I use Opera or FF. But I spend a lot of time cleaning up the mess ActiveX allows mallicious users to make. It's been a problem for a long time. Even if nobody realise it was a mistake in the first place (why not?), it is a well documented problem now. Just remove it.

Oh yes, real CSS2 would be nice, if you've got some spare time.

another users

# Least Privilege @ Thursday, March 24, 2005 9:31 AM

Personally, I don't think it matters which browser is more secure. There will always be "one more bug". At the end of the day, virus writers, browser hijackers, etc (aka "the bad guys"), will aim for the biggest target they can find, and sometimes, they may aim more narrow, to try to go undetected.

Anyway, the point of this is that IE & Mozilla would both be much more secure if the user was not a Admin, super-user by default. I highly recommend using the technique's found at Aaron Margosis' blog --> http://blogs.msdn.com/aaron_margosis.

Change this to the default, and you improve security for everyone.

Jeff

# USE LINUX or MAC @ Thursday, March 24, 2005 9:33 AM

Linux and Mac make a user jump thru hoops to run as "admin"...if you do on these systems it's YOUR OWN FAULT...NOT THE OS

ADMIN_RIGHTS

# re: More secure @ Thursday, March 24, 2005 9:39 AM

" Linux and Mac make a user jump thru hoops to run as "admin"...if you do on these systems it's YOUR OWN FAULT...NOT THE OS"

What? Note there is no "admin" on *nix boxes. It is root and if you call su to root a hoop to jump through,you are lazy indeed.

Sergio Leone

# re: More secure