Internet Explorer: Difference between revisions

This article's factual accuracy is disputed. Relevant discussion may be found on the talk page. Please help to ensure that disputed statements are reliably sourced. (Learn how and when to remove this message)

Internet Explorer, abbreviated IE or MSIE, is a proprietary but free-of-charge web browser from Microsoft. It is available for most versions of Microsoft Windows, however Microsoft has now stopped releasing updated versions for any platform aside from Windows XP. For a time, Microsoft also produced a version for MacOS (based on a different rendering engine) and versions for use via the X Window System on Solaris and HP-UX, but these are no longer in active development.

Internet Explorer is by far the most widely-used web browser, making up approximately 93.7% of all browser usage according to the web analysis company WebSideStory. It has been shipped as the default browser in all versions of Microsoft Windows since Windows 95 OSR-2.

Microsoft's recent Windows XP Service Pack 2 adds several important security features to Internet Explorer, including an updated Windows firewall and popup-blocker. This addresses concerns with Spyware, which has heavily targeted the browser. Microsoft encourages users to update Microsoft Windows (through Windows Update) regularly.

Internet Explorer is derived from Spyglass, Inc.'s version of Mosaic. Microsoft licensed Spyglass's software in 1995, in an arrangement under which Spyglass would receive a quarterly fee plus a percentage of Microsoft's revenues for the software. Microsoft subsequently gave Internet Explorer away for free, and thus (making no direct revenues on IE) paid only the minimum quarterly fee. In 1997, Spyglass threatened Microsoft with a contractual audit, in response to which Microsoft settled for US $8 million. [1]

Later, IE was modified to integrate more closely with Microsoft Windows. Version 4.0 included an option to enable "Active Desktop" which displays Web content on the desktop itself and was updated automatically as the content changed. This could include an investment channel, weather map channel from the Windows Media Showcase or any other page.

In a legal case brought by competitor Netscape to the US Department of Justice, Internet Explorer was cited as an example of product bundling which in some cases is illegal under antitrust law. Netscape took issue with Microsoft's contract with OEM computer manufacturers that bound the manufacturers to include Internet Explorer with the copies of Microsoft Windows they installed on systems they shipped. Allegedly, it would not allow the manufacturer to put an icon for any other web browser on the default desktop in place of Internet Explorer. Microsoft maintained that integration of its web browser into its operating system was in the interests of consumers.

"Separate markets exist for shirts and buttons, cars and tires, cars and rustproofing, yet few people would object to these integrations." —Stephen Margolis, Professor of Economics at North Carolina State University, writing for the Independent Institute think tank [2]

Microsoft asserted in court that IE was integrated with Windows 98, and that Windows 98 could not be made to operate without it. Australian computer scientist, Shane Brooks, demonstrated that Windows 98 could in fact run with IE files removed. [3] Brooks went on to develop software designed to customize Windows by removing "undesired components". [4] Microsoft has claimed that the software did not remove all components of Internet Explorer.

The US Department of Justice overruled the charge in favour of Microsoft but agreed that Microsoft should make a settlement to open some APIs to the public domain.

"There is overwhelming economic evidence that Microsoft's actions have benefited and continue to benefit consumers. With no evidence of actual consumer harm, I do not believe that it is appropriate to second-guess, much less ascribe illicit motives to, business decisions that Microsoft and other companies made that have provided demonstrable consumer benefits.

"Charging low prices, expanding the markets, spreading the use of new technology, bringing consumers into the computer age, is providing benefits to consumers." The direct testimony of MIT Sloan School of Business Dean Dr. Richard Schmalensee.

Under heavy media scrutiny due in part its large user-base, exploitation of Internet Explorer's security "holes" earned IE the reputation as the least secure of the major browsers (which include Safari, Mozilla Firefox, Mozilla and Netscape, Opera, and Konqueror). Microsoft periodically issues security patches which can be automatically downloaded and installed to update the browser.

As of 13:50, 1 Dec 2004 (UTC), the security site Secunia.com counts 19 security flaws unpatched (not yet fixed) for Microsoft Internet Explorer, although some of these flaws may not affect Internet Explorer shipped with Windows XP Service Pack 2 (which may not be compatible with your other applications)
Vs. zero security flaw not yet fixed for the Mozilla Firefox browser.

Critics have claimed that security fixes take too long to be released after discovery of the problems, and that the problems are not always completely fixed. After Microsoft released patches to close 20 holes in their general operating system in February 2003, Marc Maifrett of eEye Digital Security stated that "If it really took them that long technically to make (and test) the fix, then they have other problems. That's not a way to run a software company." [5] Maifrett has previously released advisories on security flaws in various components of Internet Explorer such as its ActiveX component [6] and IE 5.01's PNG display component [7]. Microsoft attributes these delays to thorough testing to ensure that bug fixes do not lead to problems elsewhere.

Some security exploits associated with Internet Explorer are made possible through usage patterns of users of Microsoft Windows. For example, in Windows XP, it is the default system behavior to allow normal users to log into accounts with administrator privileges for everyday computer use. In this situation, an exploit which allows a cracker to run arbitrary code, effectively gives away control of the entire computer. This would be the case for any browser which ran with unrestricted privileges. Because the everyday use of root accounts for normal users is rare on other operating systems, attacks which rely upon inappropriately restricted browser processes are most often targeted at Windows-based browsers.

Much of the web was designed before the latest W3C recommendations existed. In addition, some web developers do not produce W3C compliant code. Due to wide fault-tolerance, Internet Explorer can render pages that were coded with or without W3C compliance in mind. Some rendering bugs exist that cause standard-compliant pages to be displayed incorrectly, particularly if the site uses CSS version 2.

On June 24, 2004, an attacker using compromised Microsoft IIS Web servers on major corporate sites used two previously-undiscovered security holes in IE to insert spam-sending software on an unknown number of end-user computers. [8] [9] [10] [11]

On July 6, 2004, CERT released an exploit report in which the last of six temporary workarounds (until a fix was released) was to use a different browser, especially when visiting untrusted sites. At least one news report erroneously described this as a recommendation not to use Internet Explorer at all.

Many security analysts attribute IE's ease of exploitation to its popularity, since its market dominance makes it the most obvious target.

The idea of removing Internet Explorer from a Windows system was first proposed during the Microsoft anti-trust case, as described above. Later, some security advocates took up the idea as a way to protect Windows systems from attack via IE vulnerabilities. Whether the net benefit of removing IE exceeds the cost, and indeed what it means to "remove IE", are disputed.

Simply installing and using another browser does not prevent third party programs and core operating system components from using IE libraries. Thus, a user who does not use IE to browse the Web can still be targeted by attacks against vulnerabilities in these libraries -- for instance, via Outlook Express or the Windows Help subsystem. However, removing the IE libraries will cause these programs, and other software which depends upon them, to cease functioning or even to crash the system.

As noted above, it is unclear what it means to "remove IE". Such a removal depends on being able to determine which files or functions on an installed Windows system are part of IE -- that is, to draw a line between IE and the rest of Windows. Microsoft has held that this is not meaningful; that "IE" is no longer (as it was prior to Windows 98) a separate piece of software, but simply a brand name for the Web-browsing and HTML-displaying capacities of the Windows operating system. In this view, the result of removing IE is simply a damaged Windows system; to have a working system without IE one must replace Windows entirely.

In contrast, some programmers and security writers have held that it is possible to have a useful and working Windows system with IE excised. Consultant Fred Vorck, who advocates that consumers should have the choice to remove "integrated" features of Microsoft Windows [12]; Dino Nuhagic, who is the creator of nLite — a product that allows users to remove Windows components like Internet Explorer and Windows Media Player, among other components [13]; and Shane Brooks, who created LitePC to remove and manage Windows components [14], have suggested removing Internet Explorer from computers in order to decrease exposure to security risks on the Internet [15].

It is possible to remove Internet Explorer from Windows 95, 98 and ME (see instructions on the Netscape website [16] and on Microsoft's website [17]), as well as from Windows 2000 and Windows XP at installation time. Microsoft claims that attempting to remove Internet Explorer from Windows may result in system instability.

As of 2004, the current version number of IE for Windows is 6.0.2900 (SP2).

The current version of IE 6, mainly focusing on improving security, was included as part of Windows XP Service Pack 2 in August 2004. This update also includes the much requested pop-up blocker.

In a May 7, 2003 Microsoft online chat, Brian Countryman, Internet Explorer Program Manager, declared that on Microsoft Windows, Internet Explorer will cease to be distributed separately from the operating system (IE 6 being the last standalone version); it will, however, be continued as a part of the evolution of the operating system, with IE updates coming bundled in OS upgrades. Thus, IE and Windows will be kept more in sync: it will be less likely that people will use a relatively old version of IE on a newer version of Windows, and newer versions of IE will not be usable without an OS upgrade. Reactions to this tethering are mixed; some see requiring users to upgrade the OS and browser simultaneously as a benefit for application developers and for the Internet at large, as it will help cut down on the number of outdated, exploitable operating systems and browsers in widespread use, while others see it as unnecessary and as a reflection of what they consider to be Microsoft's questionable business practices.

• Version 1.0 (Final) – August 1995
• Version 2.0 (Final) – November 1995
• Version 3.0 (Final) – August 1996
• Version 4.0 (Final) – October 1997
• Version 5.0 (Final) – March 1999
• Version 5.5 (Final) – July 2000
• Version 6.0 (Final) – October 2001

Freely downloadable copies of all versions of Internet Explorer, including Spyglass' original Internet Explorer browser, can be downloaded from browsers.evolt.org.

The rendering engine and other common user interface components for the Windows version of MSIE are used in alternative interfaces, including the following Internet Explorer "shell" applications:

• Avant Browser
• Crazy Browser
• iRider
• Maxthon (formerly MyIE2)
• NetCaptor
• NeoPlanet
• SlimBrowser

These applications supplement some of MSIE's usual user interface components for browsing, adding features such as popup blocking and tabbed browsing. Other applications, such as Intuit's Quicken and QuickBooks, AOL, Winamp, and RealPlayer, use the MSIE rendering engine to provide a limited-functionality "mini" browser within their own user interfaces.

On Windows, components of MSIE are also used in Explorer, the operating system component that provides the default filesystem browsing and desktop services.

IE components are also used to render HTML portions of email messages in Microsoft's popular Outlook and Outlook Express mail management software. This integration, while convenient, is one of the most often exploited "back doors", since the IE components make available more functionality to the HTML code than some feel should be permitted in the context of email messages, and Outlook and Outlook Express have, historically, not done enough to prevent malicious code from taking advantage of that functionality. The latest updates for Outlook Express, which require Windows XP and are distributed with Service Pack 2, are intended to improve this situation. Outlook 2003 already includes many of the updates.

While all of these programs can customize Internet Explorer's user interface and extend the feature set, they cannot modify Trident and are therefore subject to all of the benefits and all of the vulnerabilities of IE (including security holes and incorrect renders based on W3C standards).

While in many ways similar to competing browsers, Internet Explorer also has features which differentiate it.

These are features found in Internet Explorer alone, which are not found in other common browsers.

• Extensible using COM
• Search facility with step-by-step refinement and page preview (Search Companion), since version 6
• Remote administration across a corporate network
• Out-of-the-box support for Ruby characters, vertical text, element-level alpha and Photoshop-style image filters
• .NET integration - As part of the WebService behavior, makes integration of server and client side code easier, and enables applications to call functions on the server asynchronously
• Native Windows interface and controls
• Fault collection offers users the option to extract information about an Internet Explorer fault and upload the data to Microsoft for analysis
• Componentized implementation on Windows allows a high level of integration with other applications; allows integration with user interfaces in the operating system such as Explorer, which handles filesystem navigation and the desktop; and allows applications to build on IE by creating alternative browsing shells that supply popular features such as popup blocking, tabbed browsing and mouse gestures
• Fault-tolerant addon-manager
• Complex tailoring of security settings, but also a user-friendly choice of zones
• Content Advisor for screening out objectionable content by using industry-standard ratings

These are features found in Internet Explorer and some other browsers.

• Auto-update facility for addons
• Includes a wide array of popular plugins and features such as JavaScript, Shockwave and Flash
• Customisable pop-up blocker
• Range of options for accepting and restricting cookies
• All versions up to version 6 are free of charge (with a purchase of Windows)
• New set of events related to the use of the mouse wheel

These are features found in other common browsers, which Internet Explorer lacks.

• Incomplete support, as of version 6, of the W3C's CSS2 standard. (See, e.g., this page in IE and CSS2-compliant browsers.)
• Incomplete support for XHTML MIME types.
• Incomplete PNG support.
• No tab support, although freely-available IE addons provide this feature.

These are concerns and problems facing Internet Explorer users which do not, today, affect users of other browsers.

• Spyware and Adware generally targets Windows / Internet Explorer based systems, though the firewall and security controls in Service Pack 2 largely elimate this threat. Some, unpatched security vulnerabilities.
• Although specific security patches continue to be released for a range of platforms, most recent feature additions were released for Windows XP only.
• Last major version release was version 6 in August 2001, although two service packs have been released since then.

Note: While CSS and many other standards are handled differently than the W3C standard, because of its market share, IE creates de facto standards through its popularity and market dominance.

• History of the Internet
• List of web browsers
• Comparison of web browsers
• Browser wars
• Encarta

• Download Internet Explorer for Windows
• Changes in Internet Explorer for Windows Server 2003 - chat transcript with Brian Countryman (Internet Explorer Program Manager) and Rob Franco (Internet Explorer developer) for Microsoft TechNet
• How to Uninstall Internet Explorer 6 - Microsoft support article for pre-XP versions of Windows
• Chris Beach: "Why I Support Internet Explorer in the New Browser Wars" - opinion piece
• StopIE - opinion piece
• Browse Happy - 'Anti-IE' campaign by the Web Standards Project
• Better Browsing with Service Pack 2 - Benefits of SP2 with Internet Explorer