1.3 Security

Under heavy media scrutiny due in part its large user-base, exploitation of Internet Explorer's security "holes" earned IE the reputation as the least secure of the major browsers (which include Safari, Mozilla Firefox, Mozilla and Netscape, Opera, and Konqueror). Microsoft periodically issues security patches which can be automatically downloaded and installed to update the browser.

Critics have claimed that security fixes take too long to be released after discovery of the problems, and that the problems are not always completely fixed. After Microsoft released patches to close 20 holes in their general operating system in February 2003, Marc Maifrett of eEye Digital Security stated that "If it really took them that long technically to make (and test) the fix, then they have other problems. That's not a way to run a software company." [4] Maifrett has previously released advisories on security flaws in various components of Internet Explorer such as its ActiveX component [5] and IE 5.01's PNG display component [6]. Microsoft attributes these delays to thorough testing to ensure that bug fixes do not lead to problems elsewhere.

Some security exploits associated with Internet Explorer are made possible through usage patterns of users of Microsoft Windows. For example, in Windows XP, it is the default system behavior to allow normal users to log into accounts with administrator privileges for everyday computer use. In this situation, an exploit which allows a cracker to run arbitrary code, effectively gives away control of the entire computer. This would be the case for any browser which ran with unrestricted privileges. Because the everyday use of root accounts for normal users is rare on other operating systems, attacks which rely upon inappropriately restricted browser processes are most often targeted at Windows-based browsers.

Much of the web was designed before the latest W3C recommendations existed. In addition, some web developers do not produce W3C compliant code. Due to wide fault-tolerance, Internet Explorer can render pages that were coded with or without W3C compliance in mind. Some rendering bugs exist that cause standard-compliant pages to be displayed incorrectly, particularly if the site uses CSS version 2.

On June 24, 2004, an attacker using compromised Microsoft IIS Web servers on major corporate sites used two previously-undiscovered security holes in IE to insert spam-sending software on an unknown number of end-user computers. [7] [8] [9] [10]

On July 6, 2004, CERT released an exploit report in which the last of six temporary workarounds (until a fix was released) was to use a different browser, especially when visiting untrusted sites. At least one news report erroneously described this as a recommendation not to use Internet Explorer at all.

Many security analysts attribute IE's ease of exploitation to its popularity, since its market dominance makes it the most obvious target.

1.3.1 Removing Internet Explorer

Some Internet users, amongst them Fred Vorck, who advocates that consumers should have the choice to remove "integrated" features of Microsoft Windows [11]; Dino Nuhagic, who is the creator of nLite — a product that allows users to remove Windows components like Internet Explorer and Windows Media Player, among other components [12]; and Shane Brooks, who created LitePC to remove and manage Windows components [13], have suggested removing Internet Explorer from computers in order to decrease exposure to security risks on the Internet [14].

Simply installing and using another browser does not prevent third party programs and core operating system components from using IE, however removing Internet Explorer libraries that Microsoft has closely integrated into their operating system may result in unpredictable results.

It is possible to remove Internet Explorer from Windows 95, 98 and ME (see instructions on the Netscape website [15] and on Microsoft's website [16]), as well as from Windows 2000 and Windows XP at installation time. Microsoft claim that attempting to remove Internet Explorer from Windows may result in system instability.

2 Version information

2.1 Current versions

As of 2004, the current version number of IE for Windows is 6.0.2900 (SP2).

The current version of IE 6, mainly focusing on improving security, was included as part of Windows XP Service Pack 2 in August 2004. This update also includes the much requested pop-up blocker.

2.2 Future versions

In a May 7, 2003 Microsoft online chat, Brian Countryman, Internet Explorer Program Manager, declared that on Microsoft Windows, Internet Explorer will cease to be distributed separately from the operating system (IE 6 being the last standalone version); it will, however, be continued as a part of the evolution of the operating system, with IE updates coming bundled in OS upgrades. Thus, IE and Windows will be kept more in sync: it will be less likely that people will use a relatively old version of IE on a newer version of Windows, and newer versions of IE will not be usable without an OS upgrade. Reactions to this tethering are mixed; some see requiring users to upgrade the OS and browser simultaneously as a benefit for application developers and for the Internet at large, as it will help cut down on the number of outdated, exploitable operating systems and browsers in widespread use, while others see it as unnecessary and as a reflection of what they consider to be Microsoft's questionable business practices.

2.3 Release History

• Version 1.0 (Final) – August 1995
• Version 2.0 (Final) – November 1995
• Version 3.0 (Final) – August 1996
• Version 4.0 (Final) – October 1997
• Version 5.0 (Final) – March 1999
• Version 5.5 (Final) – July 2000
• Version 6.0 (Final) – October 2001

Freely downloadable copies of all versions of Internet Explorer, including Spyglass' original Internet Explorer browser, can be downloaded from browsers.evolt.org.

3 IE-based programs

The rendering engine and other common user interface components for the Windows version of MSIE are used in alternative interfaces, including the following Internet Explorer "shell" applications:

• Avant Browser
• Crazy Browser
• iRider
• Maxthon (formerly MyIE2)
• NetCaptor
• NeoPlanet
• SlimBrowser

These applications supplement some of MSIE's usual user interface components for browsing, adding features such as popup blocking and tabbed browsing. Other applications, such as Winamp and RealPlayer, use the MSIE rendering engine to provide a limited-functionality "mini" browser within their own user interfaces.

On Windows, components of MSIE are also used in Explorer, the operating system component that provides the default filesystem browsing and desktop services.

IE components are also used to render HTML portions of email messages in Microsoft's popular Outlook and Outlook Express mail management software. This integration, while convenient, is one of the most often exploited "back doors", since the IE components make available more functionality to the HTML code than some feel should be permitted in the context of email messages, and Outlook and Outlook Express have, historically, not done enough to prevent malicious code from taking advantage of that functionality. The latest updates for Outlook Express, which require Windows XP and are distributed with Service Pack 2, are intended to improve this situation. Outlook 2003 already included many of the updates.

4 Features

4.1 Positive

• Native Windows interface and controls
• Addon-manager with fault tolerance and auto-update facility
• Includes a wide array of popular plugins and features such as JavaScript, Shockwave and Flash
• Extensible using COM
• Search facility with step-by-step refinement and page preview (Search Companion), since version 6
• Customisable pop-up blocker
• Security Zones allowing complex tailoring of security settings
• Remote administration across a corporate network
• Content Advisor for screening out objectionable content by using industry-standard ratings
• Fault collection offers users the option to extract information about an Internet Explorer fault and upload the data to Microsoft for analysis
• Range of options for accepting and restricting cookies
• Componentized implementation on Windows allows a high level of integration with other applications; allows integration with user interfaces in the operating system such as Explorer, which handles filesystem navigation and the desktop; and allows applications to build on IE by creating alternative browsing shells that supply popular features such as popup blocking, tabbed browsing and mouse gestures
• All versions up to version 6 are free of charge (with a purchase of Windows)
• New set of events related to the use of the mouse wheel
• Out-of-the-box support for Ruby characters, vertical text, element-level alpha and Photoshop-style image filters
• .NET integration - As part of the WebService behavior, makes integration of server and client side code easier, and enables applications to call functions on the server asynchronously

4.2 Negative

• Spyware and Adware generally targets Windows / Internet Explorer based systems. Some, unpatched security vulnerabilities.
• Incomplete support, as of version 6, of the W3C's CSS2 standard. (See, e.g., this page in IE and CSS2-compliant browsers.)
• Incomplete support for XHTML MIME types.
• Incomplete PNG support.
• No tab support, although freely-available IE addons provide this feature.
• Although specific security patches continue to be released for a range of platforms, most recent feature additions were released for Windows XP only.
• Last major version release was version 6 in August 2001, although two service packs have been released since then.

Note: While CSS and many other standards are handled differently than the W3C standard, because of its market share, IE creates de facto standards through its popularity and market dominance.

5 See also

• History of the Internet
• List of web browsers
• Comparison of web browsers
• Browser wars
• Encarta

6 External links

• Download Internet Explorer for Windows
• Changes in Internet Explorer for Windows Server 2003 - chat transcript with Brian Countryman (Internet Explorer Program Manager) and Rob Franco (Internet Explorer developer) for Microsoft TechNet
• How to Uninstall Internet Explorer 6 - Microsoft support article for pre-XP versions of Windows
• Chris Beach: "Why I Support Internet Explorer in the New Browser Wars" - opinion piece
• Page Icon (Favicon) Resources - list of resources about feature of web browsers
• StopIE - opinion piece
• Browse Happy - 'Anti-IE' campaign by the Web Standards Project

Microsoft software Web browsers Windows software

zh-cn:Internet Explorer

<Hide>