08:55 am, 21 Sep 06
ie vulnerabilities; switching back
I know this is all old news, but it sorta blows my mind how there are still new vulnerabilities in IE, like this report from yesterday of one in VML. Of all the pieces of software in the world you'd think they would've not only expended whichever resources are necessary to get the best static analyzers, but also simply hired security professionals to go over every line of code in this beast by now.
On the other hand. Back in college, my (then-acquaintance, now-roommate) friend Matt was running Linux on a PowerBook, and seeing his success got me into the whole Linux/PowerBook scene (which I loved, but eventually the laptop got too beat up and is now retired). Then he became a Mac zealot for a few years, even getting his friends to switch.
Recently, though, he switched back to Windows, primarily because Firefox on Linux is so agonizingly slow. (We have the same hardware, and you can honestly feel the difference between his Firefox/Windows and my Firefox/Linux.) He not only uses Outlook now (thankfully not for email), but I've even caught him using IE once.
There's a lot of pointing and laughing on my part, especially whenever it blue-screens or locks in other ways, but I know he's aware of his options and has apparently decided that buggy+crashy+fast is the balance appropriate for him. Needless to say, if we ever get a wired network I'll have to adjust my firewalling because I can't trust any network his computer is on...
On the other hand. Back in college, my (then-acquaintance, now-roommate) friend Matt was running Linux on a PowerBook, and seeing his success got me into the whole Linux/PowerBook scene (which I loved, but eventually the laptop got too beat up and is now retired). Then he became a Mac zealot for a few years, even getting his friends to switch.
Recently, though, he switched back to Windows, primarily because Firefox on Linux is so agonizingly slow. (We have the same hardware, and you can honestly feel the difference between his Firefox/Windows and my Firefox/Linux.) He not only uses Outlook now (thankfully not for email), but I've even caught him using IE once.
There's a lot of pointing and laughing on my part, especially whenever it blue-screens or locks in other ways, but I know he's aware of his options and has apparently decided that buggy+crashy+fast is the balance appropriate for him. Needless to say, if we ever get a wired network I'll have to adjust my firewalling because I can't trust any network his computer is on...
I think most of IE's problems aren't really problems in IE at all, but rather in dependent libraries. Off the top of my head I remember several image vulnerabilities which were actually bugs in GDI or GDI+, and there were a couple in the JScript engine (which may or may not be considered to be “part of IE” at Microsoft), and others in ActiveX controls that had been marked as “safe for scripting”. I would guess that this VML bug, given that VML is basically just Office graphics serialized to XML, was a bug in the Office graphics code which is no doubt the responsibility of the Office team rather than the IE team.
Microsoft's biggest problem is that it's just too big. Too many teams sharing each other's stuff and little communication (it seems) between them. Auditing IE really means auditing most of the Windows shell and all of the dependent libraries.
All of the pointing and laughing aside, my Windows box seems to do okay. The only times I can remember having critial (ie the whole system is unusable) problems is when running games that crash while using DirectX full-screen, because Windows seems to give them an undue amount of control over the hardware and if one locks up you've basically had it as far as the UI is concerned… and since the remote access options in Windows are laughable at best, if the UI's fucked then you're fucked most of the time.
For example, what's the ratio of Assertion errors in IE vs. hard-crashes? I'm guessing 0:1. The lack of willingness to spend a small percentage of the CPU cycles to verify correctness shows where they place their priorities.
An assertion error indicates that something your code thinks is true is not. If you put the assertion in there, it probably means that it was Really Important that it be true because your code is about to rely on it. In other words, an assertion usually indicates a truism that, if wrong, will result in a hard crash. Better to get the assertion error in the field with lines numbers and filenames than to get the same condition causing a hard crash at a less detectable time later.
It's no good just having assertions enabled for testers. Real users are numerically larger. And like the monkeys on the typewriters, they will find a new way to run the program and invoke new bugs. Exercising all the code paths through automated testing or whatever is insufficient since the data can vary in ways that can't be enumerated so easily.
I actually mix the two disciplines. I use an assertion macro which generates a log report, but does not halt the code. And then I always handle the error-which-wasn't-supposed-to-happen as best I can.
I use MSIE/Window every day at work, and Firefox/Linux at home. MSIE crashes substantially less frequently than Firefox on Ubuntu (although neither crashes often enough that I care much.) Windows has a more consistent UI, and better keyboard-only and mouse-only navigability than either Linux or MacOS X. The Windows APIs more internally consistent, and generally end up being more pleasant to work with than the mash of inconsistent design philosophies that is Linux.
There are a lot of reasons to prefer Linux or MacOS X anyway, of course. I still use Linux at home part of the time, when I don't have to use Windows for the voice recognition. But I would in general say that the idea that Windows and MSIE are somehow low quality is just not true anymore. They're relatively fast, stable, and all-around decent. In the past two years of using Windows XP every day all day at work, I have never once seen a blue screen of death.
(I think part of the reason vulnerabilities are found so often in MSIE is just that it's such an attractive target.)
Of course, only MS has the real numbers, so all we can trade are anecdotes. 2k was definitely less sucky than the 9x series anyway.