Simon Willison's Weblog: ie8

Quoting Alex Russell

2010-10-11T23:01:00+00:00

Why, for a decade of experience, can we not seem to see the IE 8 zombie coming? It’s not like it’s going to be some big surprise that unless we do something different, we’ll still be supporting it in 2015. That’s right: in 2015, you’ll still be thinking about a browser that doesn’t support canvas or video and doesn’t even have a JITing JS engine.

— Alex Russell

Tags: alex-russell, ie8, internet-explorer, recovered

Major IE8 flaw makes 'safe' sites unsafe

2009-11-22T15:34:23+00:00

Major IE8 flaw makes 'safe' sites unsafe

IE8 has an XSS protection feature which rewrites potentially harmful code in HTML pages—I think it looks for suspicious input in query strings which appears to have been output directly on the page. Unfortunately it turns out there’s a flaw in the feature that can allow attackers to rewrite safe pages to introduce XSS flaws. Google are serving all of their pages with the X-XSS-Protection: 0 header. Until the fix is released, that’s probably a good idea.

Tags: ie8, microsoft, security, vulnerability, xss, xssfilter

Pwn2Own trifecta: Hacker exploits IE8, Firefox, Safari

2009-03-19T15:30:36+00:00

Pwn2Own trifecta: Hacker exploits IE8, Firefox, Safari

You just can’t trust browser security: Current versions of Safari, IE8 and Firefox all fell to zero-day flaws at an exploit competition. None of the vulnerabilities have been disclosed yet.

Tags: browsers, firefox, ie8, internet-explorer, pwn2own, safari, security

Ehy IE8, I Can Has Some Clickjacking Protection?

2009-01-29T13:39:34+00:00

Ehy IE8, I Can Has Some Clickjacking Protection?

IE8 has built-in protection against clickjacking, but it’s opt-in (with a custom HTTP header) and IE only. It turns out the usual defence against clickjacking (using framebusting JavaScript) doesn’t work in IE as it can be worked around with a security=“restricted” attribute on an iframe.

Via ha.ckers.org

Tags: clickjacking, http, ie8, iframes, internet-explorer, javascript, security

IE8 Security Part IV: The XSS Filter

2008-07-03T09:37:39+00:00

IE8 Security Part IV: The XSS Filter

IE8 will include an XSS filter to identify and neutralise “reflected” XSS attacks (where malicious code in a query string is rendered to the page), turned on by default. Sounds like a good idea to me, and site authors can disable it using Yet Another Custom HTTP header (X-XSS-Protection: 0).

Via BlueHat

Tags: http, ie8, internet-explorer, microsoft, security, xss, xssfilter

Google's excanvas only works in quirks mode for IE8

2008-03-30T18:24:44+00:00

Google's excanvas only works in quirks mode for IE8

IE8 in act-as-IE8 mode disables VML but doesn’t implement canvas, so there’s currently no 2D drawing method for that browser. UPDATE: The problem is Google’s excanvas library, not IE8 disabling VML; see comments.

Tags: burningbird, canvas, excanvas, ie8

IE8 speeds things up

2008-03-11T05:42:32+00:00

IE8 speeds things up

Steve Souders notes that IE8 downloads script files in parallel before executing them sequentially, giving it a significant speed boost over other browsers that download sequentially.

Tags: browsers, ie8, performance, steve-souders

JavaScript in Internet Explorer 8

2008-03-06T23:59:11+00:00

JavaScript in Internet Explorer 8

John Resig’s analysis. News to me: IE 8 doesn’t support the W3C event model—I had assumed that would be a priority.

Tags: ie8, javascript, john-resig, standards

Internet Explorer 8 Readiness Toolkit

2008-03-05T18:28:20+00:00

Internet Explorer 8 Readiness Toolkit

The new built-in development tools look similar enough to Firebug to make me very happy. Also of interest: Selectors API (for fast getElementsBySelector), CSS 2.1 support, support for XHTML style namespaces in HTML, an interesting Web Slices feature based on the hAtom microformat and 6 connections per host (up from 2) which should make Comet easier.

Tags: comet, css, hatom, ie8, javascript, microformats, namespaces, selectors, standards

Table-Based Layout Is The Next Big Thing

2008-03-04T23:01:36+00:00

Table-Based Layout Is The Next Big Thing

Kevin Yank points out that the inclusion of display:table in IE 8 will finally open up a powerful tool for creating CSS layouts that has so far been mostly ignored.

Tags: css, displaytable, ie8, kevin-yank, tables

Principles and Legality

2008-03-04T19:45:55+00:00

Principles and Legality

Eric Meyer notes that language about legality in Microsoft’s recent IE announcement suggests that Opera’s much criticised EU threat may have helped positively influence the result.

Tags: eric-meyer, ie8, law, microsoft, opera, standards

Quoting IEBlog

2008-03-04T03:00:17+00:00

We've decided that IE8 will, by default, interpret web content in the most standards compliant way it can. This decision is a change from what we've posted previously.

— IEBlog

Tags: ie8, internet-explorer, web-standards

Sunsetting Quirks Mode

2008-01-23T14:56:44+00:00

Sunsetting Quirks Mode

Apparently proper standards support in IE (or at least the IE8 renderer) will be triggered by the HTML5 doctype, providing an alternative to those who don’t wish to pollute their markup with an IE-specific meta tag.

Tags: browsers, doctypes, html5, ie8, internet-explorer, sam-ruby, xuacompatible

Legacy.

2008-01-23T14:14:15+00:00

Legacy.

James Bennett has what I think is the most interesting analysis of the X-UA-Compatible header to date.

Tags: browsers, ie8, internet-explorer, james-bennett, web-standards, xuacompatible

Quoting Ian Hickson

2008-01-23T10:07:40+00:00

If Web authors actually use this feature, and if IE doesn't keep losing market share, then eventually this will cause serious problems for IE's competitors — instead of just having to contend with reverse-engineering IE's quirks mode and making the specs compatible with IE's standards mode, the other browser vendors are going to have to reverse engineer every major IE browser version, and end up implementing these same bug modes themselves.

— Ian Hickson

Tags: browsers, hixie, ian-hickson, ie8, internet-explorer, web-standards, xuacompatible

HTML 5 published as W3C First Public Working Draft!

2008-01-23T02:15:44+00:00

HTML 5 published as W3C First Public Working Draft!

A significant step, almost completely overlooked in the hubbub over IE8.

Tags: html5, ie8, web-standards, whatwg

Quoting Andy Budd

2008-01-22T21:00:50+00:00

No matter what great leaps forward the Internet Explorer team make from now on, the majority of developers won’t use them and the majority of users won’t see them. By doing this the Internet Explorer team may have created their own backwater, shot themselves in the foot and left themselves for dead.

— Andy Budd

Tags: andy-budd, ie8, internet-explorer, xuacompatible

2008-01-22T18:55:12+00:00

<META HTTP-EQUIV="X-BALL-CHAIN">

Mozilla hacker Robert O’Callahan discusses the technical implications of freezing copies of older rendering engines, including the increased footprint and the terrifying prospect of documents in different rendering modes communicating through iframes and the DOM.

Tags: browsers, dom, ie8, mozilla, roberto-callahan, xuacompatible

Broken

2008-01-22T18:42:37+00:00

Broken

Jeremy highlights the fly in the ointment: if you want IE 8 to behave like IE 8 (and not pretend to be IE 7), you HAVE to include the X-UA-Compatible header.

Tags: ie8, jeremy-keith, web-standards, xuacompatible

The versioning switch is not a browser detect

2008-01-22T16:34:08+00:00

The versioning switch is not a browser detect

PPK: “In other words, the versioning switch does not have any of the negative effects of a browser detect.”

Tags: browserdetect, browsers, doctypeswitching, ie8, internet-explorer, ppk, web-standards, xuacompatible

Quoting Eric Meyer

2008-01-22T14:24:06+00:00

Like DOCTYPE switching did in 2000, version targeting negates the vendor argument that existing behaviors can't be changed for fear of breaking web sites. If IE8 botches its implementation of some CSS property or DOM method, the mistake can be fixed in IE9 without breaking sites developed in the IE8 era. This actually makes browser vendors more susceptible to pressure to fix their bugs, and less fearful of doing so.

— Eric Meyer

Tags: browsers, doctypeswitching, eric-meyer, ie8, internet-explorer, web-standards, xuacompatible

Beyond DOCTYPE: Web Standards, Forward Compatibility, and IE8

2008-01-22T12:40:53+00:00

Beyond DOCTYPE: Web Standards, Forward Compatibility, and IE8

This has huge implications for client-side web developers: IE 8 will include the ability to mark a page as “tested and compatible with the IE7 rendering engine” using an X-UA-Compatible HTTP header or http-equiv meta element. It’s already attracting a heated debate in the attached discussion.

Tags: browsers, http, ie8, internet-explorer, web-standards, xuacompatible

IE7.js version 2.0 (beta)

2008-01-06T23:15:12+00:00

IE7.js version 2.0 (beta)

Dean Edwards has updated IE7, shifting enhancements that weren’t fixed by the real IE7 in to a new script called IE8. You can also now hotlink the library directly from Google’s servers, though I don’t know how intended Google Code’s subversion repository is for that purpose.

Tags: dean-edwards, goode, google-code, ie7, ie8, javascript

IE8 Passes Acid2 Test

2007-12-20T15:11:17+00:00

IE8 Passes Acid2 Test

This is huge. As Kevin Yank points out, this means IE8 includes proper support for the object tag, CSS table layout properties and generated content.

Tags: acid2, css, generatedcontent, ie8, kevin-yank, object, tablelayout, web-standards

Conversation with Bill Gates about IE8 and Microsoft Transparency

2007-12-06T11:47:17+00:00

Conversation with Bill Gates about IE8 and Microsoft Transparency

Molly asks the tough questions about IE8—it looks like there should be a lot of IE8 material at MIX08 next year.

Tags: bill-gates, ie8, internet-explorer, microsoft, mix, molly-holzschlag