Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft forced people to install their browser (2010)

toastytech.com

Post reply on HN
Print view View original

11–20 of 142 posts

Re: Microsoft forced people to install their browser (2010)

#11

Post by kibwen »

lmm wrote: post #8
Turing_Machine wrote: post #2

Besides the highly questionable business ethics discussed in this article, IE just plain sucked. On one medium-sized project I worked on back then, I calculated that around 30% of the code was there just to work around various IE bullshittery. I have to smile when I see young people complaining about Safari incompatibilities now. You have no idea , young padawans. :-)

IE had the right box model years ahead of everything else, a better way of doing embeds, an element transformation language that's still ahead of anything you can do with CSS, .... Sure it wasn't "standards compliant" but I don't remember Netscape/Mozilla/Firefox ever changing their behaviour to match a standard, they just got their behaviour declared as the standard and ignored the cases where they didn't.

> I don't remember Netscape/Mozilla/Firefox ever changing their behaviour to match a standard

Hm? Netscape/Mozilla/Firefox changed tons of behavior in order to match Internet Explorer specifically, which was the de facto standard at the time.

Re: Microsoft forced people to install their browser (2010)

#13

Post by darkwater »

Old greybeard moment: I remember all of this and how people on newsgroups (Usenet) defended Microsoft, said that the IE integration in the OS was a technical requirement and not an MS tactic. It clearly was a deliberated tactic to retain power, just like Chrome is today (even if they look less evil)

Re: Microsoft forced people to install their browser (2010)

#15

Post by JimDabell »

lmm wrote: post #8
Turing_Machine wrote: post #2

Besides the highly questionable business ethics discussed in this article, IE just plain sucked. On one medium-sized project I worked on back then, I calculated that around 30% of the code was there just to work around various IE bullshittery. I have to smile when I see young people complaining about Safari incompatibilities now. You have no idea , young padawans. :-)

IE had the right box model years ahead of everything else, a better way of doing embeds, an element transformation language that's still ahead of anything you can do with CSS, .... Sure it wasn't "standards compliant" but I don't remember Netscape/Mozilla/Firefox ever changing their behaviour to match a standard, they just got their behaviour declared as the standard and ignored the cases where they didn't.

> I don't remember Netscape/Mozilla/Firefox ever changing their behaviour to match a standard, they just got their behaviour declared as the standard and ignored the cases where they didn't.

This is not even remotely true. There’s thousands upon thousands of bugs publicly available in Bugzilla showing fixes to standards conformance, not to mention the Acid Test and things like that.

As far as “got their behaviour declared as the standard”, in several important cases the opposite is true. The reason why Netscape 4 was so terrible with CSS is because there were two competing approaches for styling – CSS, which Microsoft had already started implementing; and JSSS which Netscape had already started implementing. The W3C picked CSS, and Netscape scrambled to catch up by transcoding CSS into JSSS as a stopgap measure. Which is also why Netscape 4 lost CSS support when JavaScript was disabled.

Re: Microsoft forced people to install their browser (2010)

#16

Post by steve1977 »

Turing_Machine wrote: post #2

Besides the highly questionable business ethics discussed in this article, IE just plain sucked. On one medium-sized project I worked on back then, I calculated that around 30% of the code was there just to work around various IE bullshittery. I have to smile when I see young people complaining about Safari incompatibilities now. You have no idea , young padawans. :-)

Is Safari incompatible with the standards or with Chrome?

Re: Microsoft forced people to install their browser (2010)

#17

Post by cm2187 »

All of these practices feel fairly benign compared to what microsoft is doing now.

At the time they merely shipped the browser with the OS. I don't think this would even raise an eyebrow now. They were also accused of adding new features only in IE which forced websites to deal with incompatible browsers. /s of course this is a problem developers do not need to deal with anymore!

The Microsoft we are dealing with now gives you warnings if you are trying to install another browser and makes it difficult to change your default browser. And in that space Apple has done way worse: breaking internet standards by deprecating flash (and other unsupported features), banning 3rd party browsers on iOS completely. And using their dominant position to force the deprecation of internet standards is another thing google is not shy about either.

Re: Microsoft forced people to install their browser (2010)

#18

Post by JimDabell »

kevindamm wrote: post #10
danybittel wrote: post #9

Earlier quoted context omitted.

Not only that, but IE4 was the first browser you could do, what we would now call "web apps". It had a stable javascript implementation and css, which let you create and edit elements dynamically. It really paved the way of how we do things today.

and IE5 introduced dynamic web requests (originally ActiveXObject, then as the familiar XHR) which was way better than holding open a long page response

There was also a way of doing it with the DOM that Mozilla implemented. I don’t recall the specifics, it was something like you would instantiate a new Document object and then call open() on it with a URL. It ended up being abandoned when XMLHttpRequest was made the standard by WHATWG I think.

Re: Microsoft forced people to install their browser (2010)

#20

Post by creatonez »

> Outlook 98 used IE 4 to compose and render HTML e-mail messages (rather than just translating to RTF) as well as a summary page of messages, tasks, and calendar events called "Outlook Today". Everybody was perfectly happy to ignore the fact that this opened up Outlook to all of the bugs and exploits present in IE 4.

This one is funny in retrospect, because nowadays we would probably say that replacing a custom parser with a standard out-of-the-box runtime is a better tradeoff for security, as long as it is a full replacement suited for the task, and you are not greatly extending the functionality/looseness of the spec[^1]. Outlook 95's RTF format was likely afflicted by all sorts of vulnerabilities that are still undiscovered today, simply because it was less audited than modern Chromium and Firefox versions that get near-weekly security updates.

These days we have several interesting solutions that support this idea:

- The deprecation of Flash and replacement with HTML5 ports and Flash emulation via WASM - This has probably done a huge blow to the number of RCE exploits on the web.

- Firefox uses PDF.js to display PDF files inside of the web sandbox. We have wasted a ton of CPU time doing this, especially when compared to Okular - a particularly energy-efficient PDF reader, but Firefox having a builtin web-sandboxed PDF reader has likely has saved many users from the numerous RCE exploits in outdated version of other reader software.

- The proliferation of Electron and CEF. This has been troubled in terms of security due to lack of consistent updates for many applications, and because it's more privileged than web browsers it opens up a new attack surface for applications that could have just been true web apps -- however, when done correctly, using a standard known runtime allows important bugfixes to be centralized. But this is another one that has wasted a ton of CPU time for what is usually a more complex solution.

- The switch from C to memory-safe interpreted and bytecode languages, and the later un-proliferation of these as folks mostly switched to Java, C#, Python, Ruby, Lua, and Javascript

So, some great solutions, along with some technical debt we're not satisfied with. The core problem with all these solutions is that they risk putting too much weight on one failure point.

---

^1: The fact that they shipped IE4 in Outlook 98 with known exploits is very bad on this front

Post reply on HN