Internet Explorer 7 Officially Released, Opinions......Big Bug Bets? Options

[Final_Cut_Guru]

I thought it was time that I make my return to techsans. As to who I am, I will reveal that in time but my name should be a good hint.

So Microsoft released IE 7 officially today. And out of the gate it ain't all it is cracked up to be. Hey it ain't my opinion, read for yourself: Greg's Head IE 7 Review

Here are some interesting excepts:

IE 7 includes a number of new features however I believe this release will do more to send people over to FireFox then it will to bring people from Firefox back to IE.

RSS Features

IE 7 adds a number of RSS features that may be of interest to users who have never used RSS. The features are very basic and provide little advantage over traditional favorites.
The RSS icon on the mini-toolbar lights up when an RSS feed is available.
Clicking on the RSS icon allows you to view the feed within the browser.
The browser/reader view allows basic searching and filtering functions. These functions are often less then what many web-logs already have built in.
IE can then track the RSS feed telling you when new content is available.
OK, it doesn’t actually tell you. You have to open the secret unlabeled star drop-down, navigate to the Feeds section and then realize that bolded items are new content.
One nice thing about these RSS feeds is that they can be read offline. So if you’re traveling with a laptop it does make it easier to bring some reading material along for the ride. It’s also possible to download enclosure documents such as podcasts, although doing so is not an obvious setting.
Overall I’m not impressed. Although it’s good that IE is adding support for RSS this reader lacks many features that would make it a viable newsreader. As a comparison the Outlook-express newsreader that was built in ‘98 and pretty much abandoned since has many more features for reading and aggregating news feeds. An update version of the news-reader with RSS support would have leveraged existing technologies and provided a lot more features. The RSS support in IE7 is much less then what is provided on RSS websites like bloglines, yahoo, google newsreader and others.

Under the hood

The new version of IE has added a number of features that are under the hood helping the browsing experience. These include improved rendering of CSS, clear type, RSS infrastructure, security filters, international support and more. These improvements are unlikely to be seen or understood by the average user of IE 7.

Cleartype support will make online text look better.
The phishing security filter is a good thing although it’s currently hard-wired to Microsoft server to determine the trust and quality of a site. It would have been good to leave this open so Symantec, Norton, CyberNanny and others could add value in this space. The response time of the filter is pretty slow and it seems to be done after the page has loaded. This may pose a security risk as the potentially bad site has a window of opportunity.
Improved CSS support, PNG support and other standards are a good thing. It’s likely that every round of browser updates will introduce a new set of issues and workarounds but the hope is that these workaround continue to get smaller and smaller. Initial testing shows that most sites work without a problem although more complex sites that rely on HTML editing such as blogger.com do have problems with the new browser.
Overall: 3 out of 5

Interface 3/5 – I think overall it’s not as good or as flexible as IE 6 or Firefox 1.5. I think the menus and toolbar interactions are odd and the smaller buttons will make the core browser a little awkward to use and to get used to. The added support for tabbing is nice but falls short of innovative or spectacular.
CSS Support – 3/5 – A lot better then it was and definitely on it’s way. The acid test2 is still pretty far from where it’s supposed to be. This test is becoming the yard stick for how browser CSS is judged and IE has already stated that they don't expect that they will pass the test.
RSS Reader – 2/5 – IE has a base level of what you could do for RSS. Anyone familiar with RSS will likely continue using their current reader. This may engage some new users but the design doesn’t have much advantage over favorites. To be fair Firefox is also equally lacking in the RSS reader department.
Printing – 4/5 – Much improved and offering all the base features that users will look for.
Security – 3/5 – The new security filter is a good thing but the information bar introduced in XP SP2 will still confuse and get in peoples way as they try to download legitimate files. It's not clear to me that browsing with IE is more or less secure then with any other browser.

I swear I tried to find one + about it and there wasn't. As for magazine revues I don't trust them. I prefer word of mouth.

Oh, I guess 4 to 6 months before it is crippled by the first major bug or security hole.

[pebkac]

Hi ben.

[Final_Cut_Guru]

Hi ben.

who is that?
JK

Yeah I did make it a bit obvious, but kudos to ya for yanking me out of the box early.

[Spectatrix]

Pshaw, don't try to hide your identity once it's been revealed -- that's just silly.

[Jim]

Pshaw, don't try to hide your identity once it's been revealed -- that's just silly.

You're a towel.

[Spectatrix]

You're a towel.

NO U

[Jim]

NO U

No, I'm a human. You're a towel.

[pebkac]

Can I be a towel?

[Spectatrix]

Can I be a towel?

NO U

I mean, yes.

I mean, no, but you can be a towel head instead.

This post has been edited by Spectatrix: Oct 18 2006, 09:28 PM

[Hartmann]

I'm not sure how many bugs will be found... I hope they make more of a fuss about the key shortcuts which are pretty sweet.

[impala454]

I'm been using the x64 version in the Vista RC1 x64 and haven't had any probs as of yet. I'm pretty simplistic when it comes to browsers though so even when there's new features I tend to just turn em off. I'm not a big fan of tabbed browsing or reading RSS feeds from a newsreader. IE7 does seem pretty fast and the text definitely seems clearer to me. I can't think of any ground breaking new features to describe, but as with any new software version I'm sure the code came out a lot cleaner than the previous version.

The article the OP posted... the guy obviously isn't fond of the thing, but I don't really see how a new IE version would make people switch over to Firefox.

[Hartmann]

I'm been using the x64 version in the Vista RC1 x64 and haven't had any probs as of yet. I'm pretty simplistic when it comes to browsers though so even when there's new features I tend to just turn em off. I'm not a big fan of tabbed browsing or reading RSS feeds from a newsreader. IE7 does seem pretty fast and the text definitely seems clearer to me. I can't think of any ground breaking new features to describe, but as with any new software version I'm sure the code came out a lot cleaner than the previous version.

The article the OP posted... the guy obviously isn't fond of the thing, but I don't really see how a new IE version would make people switch over to Firefox.

Do you use the shortcut keys? That's one of the best improvements I've seen yet.

[impala454]

naw what are they?

[Hartmann]

naw what are they?

http://blogs.msdn.com/ie/attachment/715071.ashx

[woody]

http://secunia.com/Internet_Explorer_Arbit...erability_Test/

IE7 Vulnerability

[impala454]

I see what the guy is saying, but that's not how most websites work. Sure, I go to www.bankofamerica.com, but once I log in I end up at like https://servername123.bankofamerica.com/bin...f9a0j3409f/blah. Now unless there's a way to get the address bar for another open window, this exploit wont really ever get any information I care about. It would work for less secure sites like facebook, but it's not like people keep their bank account info on there. You could also bypass this by telling IE to run windows in a separate process (which is good anyhow bc it isolates each browsing session).

[zetec]

It would work for less secure sites like facebook, but it's not like people keep their bank account info on there. You could also bypass this by telling IE to run windows in a separate process (which is good anyhow bc it isolates each browsing session).

You'd be surprised at the information people keep on their facebook. Besides, all you need is their facebook email and password, and at least half the time that gives you access to whatever else. I speak from experience here. People get bank shit emailed to them all the time, then say they use the same password there, etc etc, identity theft ahoy. Sounds like a leap, but considering i've had the resources (and accounts) to do it, with nothing but my conscience keeping me back (i still nosed around though, I got into her photobucket O:P), i assure you, it's extremely feasable.

[impala454]

but you couldn't extract a password using this technique.

[zetec]

have to admit, i didn't fully read it.


still, the idea of a new browser is to plug security holes.

[impala454]

yeah, here's a quick summary of how it works:

1. you navigate to malicious site
2. malicious web site attempts to open a web page using simple javascript (all programmatically, it's basically getting the stream of html, the user wouldn't see this)
3. if you happened to be currently logged into a website, they can open and see the same site, provided they guess correctly what site to try.

so, for this thing to work, you have to be at a common website and logged in (say www.facebook.com), and then browse to the malicious site. then, the malicious site would have to have www.facebook.com in its list of sites to check. the malicious site could then "open" www.facebook.com in the context of your browser, which in this case would show them your facebook "home" page. now since facebook doesn't have ID's in the links to edit your profile (ie the link is something like this http://ttu.facebook.com/editprofile.php), they could potentially get whatever info you have in there, and possibly change it.

the impracticality here is that any site with useful information (like banks) are not going to save your password, and even if they did, they take you to some URL with a long ass ID attached. so once I log into bankofamerica.com, i really end up at bankofamerca.com/blah/blah/asdf?23ti2otj2o3ijt2093tj2039jt023jt, which the malicious site would have no way to guess or get to. even if for some crazy reason they could guess that long url, bank sites (at least mine) don't ever list full account numbers or pins/passwords. so in a best case scenario they could see my balance. also the malicious site would have to have an extremely large number of websites to check for it to even have a chance of finding one it could use. it would also have to "navigate" to all of these sites, which would at the very least bog the user's connection.

so yeah i agree this is pretty shitty that it can happen and think it should be fixed, but i'm not all that worried about it stealing important information.

[pebkac]

yeah, here's a quick summary of how it works:

1. you navigate to malicious site
2. malicious web site attempts to open a web page using simple javascript (all programmatically, it's basically getting the stream of html, the user wouldn't see this)
3. if you happened to be currently logged into a website, they can open and see the same site, provided they guess correctly what site to try.

so, for this thing to work, you have to be at a common website and logged in (say www.facebook.com), and then browse to the malicious site. then, the malicious site would have to have www.facebook.com in its list of sites to check. the malicious site could then "open" www.facebook.com in the context of your browser, which in this case would show them your facebook "home" page. now since facebook doesn't have ID's in the links to edit your profile (ie the link is something like this http://ttu.facebook.com/editprofile.php), they could potentially get whatever info you have in there, and possibly change it.

the impracticality here is that any site with useful information (like banks) are not going to save your password, and even if they did, they take you to some URL with a long ass ID attached. so once I log into bankofamerica.com, i really end up at bankofamerca.com/blah/blah/asdf?23ti2otj2o3ijt2093tj2039jt023jt, which the malicious site would have no way to guess or get to. even if for some crazy reason they could guess that long url, bank sites (at least mine) don't ever list full account numbers or pins/passwords. so in a best case scenario they could see my balance. also the malicious site would have to have an extremely large number of websites to check for it to even have a chance of finding one it could use. it would also have to "navigate" to all of these sites, which would at the very least bog the user's connection.

so yeah i agree this is pretty shitty that it can happen and think it should be fixed, but i'm not all that worried about it stealing important information.

Your bank have bill pay? That's another way that they can get to your money. Also, at least at Wells Fargo, they can get at your account number if they look on your statement online. It's there a lot of times, it's just a bit harder to find.

[impala454]

Your bank have bill pay? That's another way that they can get to your money. Also, at least at Wells Fargo, they can get at your account number if they look on your statement online. It's there a lot of times, it's just a bit harder to find.

well not using this method. although i don't use wells fargo, i'm going to guess they at least have the same system of, browse to www.wellsfargo.com, log in, now you're redirected to blah1.wellsfargo.com/asdf/blah/bs.blah?jf03jf0293jf09j32flsioj923ur902u3r09. in these cases this particular technique of hacking would be useless.

but yeah man that is pretty unsecure if your full bank account number is displayed on the screen when you're logged in. bank of america will just show the last few digits of each account.

[pebkac]

Does anyone know of any place where you can get new themes for IE 7? The default is ugly as hell.

[impala454]

yeah it was pretty much designed for vista so it does look kinda weird without the aero interface

[Hartmann]

yeah it was pretty much designed for vista so it does look kinda weird without the aero interface

I thought IE7+ was specifically for Vista with IE7(-) being for everything else??