Archive for: February, 2008

IE8 Will Set Back The Internet by Years

Feb 11 2008 Published by under Bugs/Issues, Internet, Microsoft

There is a great deal of debate going on about the upcoming version of the Internet Explorer – IE8. It looks like Microsoft is going to screw up this time too.

From the A List Apart article Beyond DOCTYPE: Web Standards, Forward Compatibility, and IE8:

All of these factors leave us, the website developers, in a bit of a pickle when it comes to making websites. How do we ensure that browsers continue to render what we want them to?

We could specify the version of the languages we use, such as CSS 2.1 or JavaScript 1.5. Unfortunately, browser vendors often implement only part of a spec and the interpretation of a specification often differs from browser to browser, so any two contemporary browsers may offer completely different renderings of the same CSS or may trigger completely different events from the same form control.

With this spanner in the works, we’re really only left with one option for guaranteeing a site we build today will look as good and work as well in five years as it does today: define a list of browser versions that the site was built and tested on, and then require that browser makers implement a way to use legacy rendering and scripting engines to display the site as it was intended—well into the future.

This is exactly what our group decided to recommend for IE8, and we hope to see it implemented in other browsers as well.

Basically what they say is that every developer should add a meta tag specifying the version of the browser the page was tested on, to every web page he creates. This must be done for every browser – Microsoft recommends.

IE8_yahoo

What kind of a solution is this? Certainly not scalable.

What are the implications of this foolishness? Every browser will have to carry the previous browser editions too. This is to ensure that a web pages are rendered exactly as the developer intended it to. For example, a page designed for IE5 should be rendered exactly as it was rendered in IE5. This means that IE8 will include rendering engines of all the previous editions of IE.

Here is what Ann Evan Kesteren of Opera thinks:

You’re shipping a lot more code, and it grows a lot with each release. If the user browses a mix of pages, you’ll actually execute a lot more code too. Good luck competing in the mobile space when you ship half a dozen engines and your competitors only need one.

Pathetic solution I would say. It is sure that this solution will not go beyond IE8. I predict that by IE9, Microsoft will be looking for another solution to break up the web.

Kesteren continues:

Solutions? We can ignore this all together. We can get popular Web server software to set IE=edge. We can convince the world to use a browser that does not have the ability to lock pages into a specific rendering mode. Bah.

And Robert O’Callahan from Firefox says:

It seems clear that for now we have no market need for drastic multi-engine compatibility, and therefore there’s no need to even consider the pain it would cause. One could argue that by slaving themselves to the needs of the corporate intranet, IE is actually being hobbled for the mass market.

I wonder why we took all the pain of developing our websites to the standards if Microsoft had this brilliant idea of breaking up the web.

3 responses so far

TypeKey stores your passwords in plaintext

Feb 07 2008 Published by under Bugs/Issues, Security

TypeKey is a free, open system providing users a central identity for posting comments on weblogs and logging into other websites. It is run by Six Apart, the providers of TypePad and MovableType. It is a service used by thousands of users worldwide.

TypeKey_SixApart

And guess what? They store your passwords in plaintext.

I forgot my password for TypeKey and clicked on the ‘forgot password’ link and provided my email ID. They sent me my username and password.

Typekey_password

Great usability; poor security.

Alarming to see that even big names get security wrong.

13 responses so far

Security Talk

Feb 06 2008 Published by under Security

Just in case you forgot, security is only as strong as the weakest link.

Security is not about how strong your systems are. It is all about how weak they are. Security is not about the 99.99% uptime your firewalls boast of. It is all about the 0.01% time when your systems are open to attacks. In fact security is not about systems. It is about processes and people. That is why we hear about all the successful social engineering attacks even on the most secure systems in the world.

Security: Lock and Key

I would argue that we have excellent cryptographic algorithms and protocols that can remain secure for many years to come. For instance, when we double the key length of AES from 128 bits to 256 bits, the security is not just doubled; It is increased 2^128 times. That is a huge difference. This means that most of our security failures are not the case of some expert cracker breaking our algorithms or protocols. Instead, all of the attacks target our implementation flaws.

Read more if you are interested:

One response so far

« Newer posts