61–70 of 94 posts
Is this a big deal? It's amusing that it is such a simple chunk of HTML, but I was under the impression that it's not terribly difficult to DoS the average browser. I accidentally discovered some very simple HTML that reliably crashes Outlook whenever you try to view or preview the message a while back. I reported it and I think they eventually fixed it.
How do you DoS chrome?
I'm the author that discovered this bug - and went way out of my way to tell the Internet Explorer team about it. I uncovered the error while working on a client's SharePoint site and figuring out why a certain page always caused their computer to freeze up. The most amazing part of this exercise has been analyzing the traffic trends. This page gets a crazy amount of traffic in Japan and China - I still can't figure…
Yesterday I ran into errors "String is undefined" when trying to augment String.prototype. Testing for undefined got me "undefined is undefined". Turns out it was a variation of a known issue they deem so unlikely that they won't even bother to fix it. (The issue is this one: http://msdn.microsoft.com/en-us/library/gg622929%28v=VS.85%2... ) If anyone wants to know the fix: you have to set the innerHTML of the parent element of the iframe to '' before detaching that element from the DOM. That actually stops code inside the iframe from running.
What I also love is the arrogance with which they suggest solutions, like on the page I linked: "If your application uses a programming pattern that is affected by this issue, you may wish to consider not removing the iFrames from the page."
Does not crash IE10 on Release Preview 64-bit. Neither desktop or Metro version.
I think the most shocking thing is when you follow it through to the MSDN bug discussion—and you find people blaming the author for writing invalid HTML. Apparently IE doesn’t need to follow the robustness principle. http://en.wikipedia.org/wiki/Robustness_principle
This isn't a case of "Robustness principle". Not crashing on invalid input is just plain old decent programming, not to mention secure programming. Programs should not crash on invalid inputs, period. "Robustness" as in the robustness principle refers to trying to actually process invalid data and go make a guess at what the functionality should be. In fact, you can make quite a case that "robustness" as defined that…
Fun times.
Earlier quoted context omitted.
If it only crashes IE, and you want to punish IE users, why bother wrapping it?
So that you can embed it in all of your pages secretly and get users to switch from IE to pretty much any other browser that actually follows web standards for implementation.
Earlier quoted context omitted.
I agree, it's unbelievable. End users don't care about incorrect markup, they care about their browser hanging.
Obviously this is a bug in IE that needs to be fixed and it's Microsoft's responsibility to ensure that their browser doesn't crash in invalid input, but end users don't actually care about the browser either (they don't even know what a browser is), they care about your site crashing.
Earlier quoted context omitted.
That's incorrect. If your TV crashed would you blame the TV program you were watching at the time? People know the difference between software and content. Content should never be able to crash software.
I agree with you in that content should never be able to crash software. I disagree with you TV example, however. If the same TV show repeatedly crashed one of the most popular TV models, consumers would blame the show.
Earlier quoted context omitted.
Where is the bug report? I'd be curious to read the response from Microsoft. (The link on the page is just to a Google Group discussion, which doesn't appear to have participation from Microsoft.)
https://connect.microsoft.com/IE/feedback/details/554467/loa...
Wow. I guess Microsoft is still the pinata. I write web-based software. Every day. I have made every browser crash and become completely non-responsive, many times over. Chrome. Firefox. Opera. All of them. Now, this is mostly through JavaScript, when I do something stupid by manipulating the DOM the wrong way or some other funny thing. I fix it and keep going. Because breaking the browser is bad. Want to report it t…
If you are crashing them as often as you claim, you should be filing security bug reports - every other browser team will respond quickly to non-Flash crashes.
>This page crashes Internet Explorer, even version 9 and 10. That headline sounds disingenuous and somewhat flamebaity given that 10 is still in development and the latest public version available on Windows 8 does not crash.