February 18th, 2009

Posted by Mary Jo Foley

Internet Explorer 8 [IE 8] is nearing the finish line, with a March release to manufacturing looking like a distinct possibility. But is IE 8 — or, more accurately — Web site developers and owners — really ready?

I have been testing IE 8 since the code became available publicly. And one thing that hasn’t changed much over the past several months is the fact that many Web sites still aren’t compatible with IE 8.

I’m not blaming the site owners here. Microsoft officials have known all along that even though the IE team is doing the “right” thing by finally making IE more standards-compliant, they are risking “breaking the Web” because the vast majority of Web sites still are written to work correctly with previous, non-standards-compliant versions of IE.

Microsoft has tried to mitigate the effects of moving to a default standards-based view in a few ways. IE 8 comes with a “Compatibility View” button that will non prescription cialis “fix” a seemingly broken site if a user knows to press it. Microsoft went a step beyond this with IE 8 Release Candidate 1, issued in January, by adding a downloadable list of sites that would automatically trigger IE 8 to move directly to compatibility mode, rather than standards mode.

(Here is the list of the 2,400 sites that are on Version 1.0 of Microsoft’s Compatibility View list.)

The Compatibility View list includes some major sites — Apple.com, CNN.com, eBay, Facebook, Google.com, NYTimes.com — even Microsoft.com (!) — and lots, lots more. Users also have the option of adding IE-8-incompatible sites they visit that didn’t make it onto the list that will be appended to the schema list they download.

The Compatibility List has made my IE 8 browsing a lot more stable. When I go to the NYTimes.com site now, it just works. The Compatibility View button (the icon for which looks like a broken Web page and is typically located directly to the right of the URL address bar) doesn’t appear at all (as is the case for all sites on the Compatibility List).

That said, there are a lot of sites I visit that aren’t on the list. And more often than not, they fail to render correctly with IE 8. Sometimes I remember that I should try hitting the Compatibility View button to see if there are boxes and buttons and text there that I can’t see because I am using IE 8. Other times, when I am visiting a site with which I’m unfamiliar, I don’t realize what I’m missing.

I’m at the point now — if a site looks weird, is slow or just doesn’t seem to be working right — I simply assume it is IE 8’s fault. Sometimes I’m right (as I discover when I open the same site in Firefox or Chrome and it looks and works fine). Other times, I’m not — a site just might be down or broken. The bottom line is I’ve come to expect a rocky browsing experience when using IE 8.

I doubt the compatibility experience is going to change much, if at all, between now and the time IE 8 is released. For months, Microsoft has been banging the drum for site owners to update their code — either by adding compatibility tags or redoing sites to take into account the changes in IE 8. Many site admins and developers have said they weren’t willing to take on that task until Microsoft delivered a near-final test release — at least a Release Candidate.

Some critics have said they think Microsoft is doing a disservice to developers by offering compatibility work-arounds. They say Microsoft created its own problems by delivering previous IE releases that flouted standards — which is true. And now Microsoft should bite the bullet and just go the 100-percent-standards route, they reason. That might be a better course in the long run for Web developers tired of having to do separate versions of sites and apps for standards-based browsers and for IE, but it punishes Web users in the interim.

What’s going to happen when IE 8 goes final and non-techie users have it pushed to them or get new PCs with IE 8 preloaded? I wouldn’t be surprised to see further losses in IE market share, as frustrated users find only some of their favorite Web sites displaying correctly but don’t really understand why. Perhaps Opera and its chums won’t need the antitrust courts to get a leg up on Microsoft, after all….

A security researcher has demonstrated a way to hijack Secure Sockets Layer (SSL) sessions to intercept login data.

Moxie Marlinspike, who spoke at the Black Hat security conference on Wednesday, explained how to subvert an SSL session by performing a man-in-the-middle attack. The anarchist researcher explained in a YouTube video that the attack uses a tool developed called SSLstrip, which exploits the interface between http and https sessions.

"SSLstrip man-in-the-middles all of the potential SSL connections on the network, specifically attacking the bridge between http and https," Marlinspike said in the video.

Secure Sockets Layer, and its successor Transport Layer Security, are cryptographic protocols used to encrypt communications over TCP/IP networks. SSL and TLS are often used by banks and other organizations to secure web transactions.

The attack relies on users not directly calling medicament cialis up an SSL session by typing a URL into a browser. Most users initiate sessions by clicking on a button. These buttons are located on unencrypted http pages, and clicking on them will take users to encrypted https pages to log in.

"That opens up all kinds of avenues for ways that you might intercept [details]," Marlinspike said. In his Black Hat presentation, he claimed to have gathered details on 117 email accounts, seven PayPal logins and 16 credit card numbers, within a 24 hour period.

SSLstrip works by watching http traffic, then by acting as a proxy when a user attempts to initiate an https session. While the user believes the secure session has been initiated, and SSLstrip has connected to the secure server via https, all traffic between the user and SSLstrip is http. This means "disastrous warnings" displayed by browsers are avoided, as to the browser the session appears normal. Login details can then be harvested.

Marlinspike said that an https padlock logo can be spoofed in the URL bar, to further lull the user into a false sense of security.

While SSL is generally accepted as being secure, security researchers have claimed SSL communications can be intercepted. In August last year, researcher Mike Perry said he had been in discussions with Google regarding an exploit he planned to release, which would allow a hacker to intercept a user's communications with supposedly secure websites over an unsecured Wi-Fi network.

Whether you want to speed access to the Web sites you regularly visit, keep better tabs on your tabs, or protect your system from potentially dangerous active content, there’s a Firefox extension ready to help you out. Jack Wallen shares his list of favorite time-saving, browser-enhancing add-ons.

One of the nicest aspects of Firefox is the ability to add extensions. And there are plenty to choose from. Some do little more than alter the aesthetics. But you’ll find others out there that you can’t browse without. No matter what your purpose in browsing, there is a killer-app extension just waiting for you. Let’s take a look at my top 10 extensions.

Note: This information is also available as a PDF download.

#1: Morning Coffee

This extension allows you to set a group of Web sites that will open (each in its own tab) with the click of a button. This will save you from having to roam through your bookmarks (while drinking that first cup of wake-me-up in the morning) to view your favorite sites. And you don’t have to limit yourself to personal browsing, either. I also use this extension to open up all the Web-based admin tools for sites I administer. You can even set sites up to open only on certain days (or every day). So news junkies or overworked administrators rejoice: This extension will make your browsing life a little easier.

#2: NoScript

This is one of the best tools for making sure your browsing experience is secure. With NoScript, you can disable active content from any site you don’t trust. Unless you configure it to allow JaveaScript, Java, and other executable scripting to run from a site, NoScript will completely block the script, keeping you browser safe from known and unknown exploits. And don’t think because you are using FireFox in Linux that you’re perfectly safe! Use this extension regardless of platform.

#3: ColorfulTabs

If you’re like me, you generally have a LOT of tabs open in Firefox. Sometimes this isn’t a problem. But there are times when the tabs can get a bit overwhelming and need a bit of organization. To help with this, ColorfulTabs gives each open tab a different color, making it easier to distinguish between them. With this simple extension, generic cialis forum you can color-code tabs either randomly or according to URL. You can also set tabs to fade. Another fun feature is that you can set a background image for tabs.

#4: BBCode

This helpful extension adds BBCode, HTML, and XHTML symbols and formatting to the context menu. BBCode also allows you to add up to 10 custom tags to your menu. This extension shows itself when you’re in a forum and you right-click a text area where you can select the tag you want to add from the menu. This extension will make your forum work quite a bit easier, as well as faster.

#5: Buggybar

This extension is invaluable to Bugzilla power users. With this extension, you will have a Bugzilla Chrome sidebar available which will readily show all bugs that relate to a bug list you have created. As of version 0.2, Buggybar works with all instances of Bugzilla.

#6: Clear Cache Button

I don’t know about you, but I always set up my browsers to clear their cache at exit. But what about those times you want to clear the cache but not exit the browser? Instead of navigating through the menu structure, you can add this simple extension. It provides a button that gives you complete cache clearing with a single click.

#7: TimeTracker

Okay, this is not really a tool that will aid or better your browsing experience. In fact, this little extension will remind you how much time you spend browsing. I have found this little gem useful in a number of circumstances. Whether you are in need of a quick five-minute break from number crunching or you just need to know how much time you spend on a specific Web site, TimeTracker will keep track of how long you browse. What is nice about this is that the tool times across sessions. So when you close the browser, the timer stops, and when you open the browser back up, the timer starts again. You can reset the timer by right-clicking the status bar timer and selecting Reset.

#8: iMacros

This extension automates pretty much anything you do in Firefox. From opening up sites to filling out forms and even administration work — you can automate it with iMacros. The iMacros extension has a sidebar that shows favorite macros. It also has a record feature that allows you to create macros by simply clicking Record, going through the motions of the macro to be created, and clicking Save. These macros can be as complex as you need them to be. When you want to run them, you simply navigate to the macro in the iMacros sidebar and click the Play button. The only downfall I have found with this tool is that you can’t assign key combinations to run macros. Other than that, this extension is a must-have for power browsers.

#9: Fasterfox

This extension does one thing: It makes Firefox load pages faster. Speed of page loading can be increased by allowing simultaneous connections and prefetching. This extension is currently in the experimental stage because of the release of Firefox 3. To install it, you have to log into a Firefox account to download. The extension is worth the hassle. The speed increase is noticeable.

#10: BlogRovR

We all read blogs. From my TechRepublic Linux and Open Source blog to the countless other blogs available, we all read them daily. And this takes time. Instead of wasting time going to the blogs, let this handy extension fetch them for you. You do have to sign up for an account using this extension (they promise they won’t spam you.) and you will be asked to install another sidebar (Stickies), which is not necessary. Once you have this installed, you just enter the blog URL, and BlogRovR will begin fetching the information for you. Warning: If you have NoScript installed, you have to allow the BlogRovR page to run scripts or it won’t be able to fetch pages for you.

February 18th, 2009

Posted by Mary Jo Foley

Internet Explorer 8 {IE 8} is nearing the finish line, with a March release to manufacturing looking like a distinct possibility. But is IE 8 — or, more accurately — Web site developers and owners — really ready?

I have been testing IE 8 since the code became available publicly. And one thing that hasn’t changed much over the past several months is the fact that many Web sites still aren’t compatible with IE 8.

I’m not blaming the site owners here. Microsoft officials have known all along that even though the IE team is doing the “right” thing by finally making IE more standards-compliant, they are risking “breaking the Web” because the vast majority of Web sites still are written to work correctly with previous, non-standards-compliant versions of IE.

Microsoft has tried to mitigate the effects of moving to a default standards-based view in a few ways. IE 8 comes with a “Compatibility View” button that will “fix” a seemingly broken site if a user knows to press it. Microsoft went a step beyond this with IE 8 Release Candidate 1, issued in January, by adding a downloadable list of sites that would automatically trigger IE 8 to move directly to compatibility mode, rather than standards mode.

(Here is the list of the 2,400 sites that are on Version 1.0 of Microsoft’s Compatibility View list.)

The Compatibility View list includes some major sites — Apple.com, CNN.com, eBay, Facebook, Google.com, NYTimes.com — even Microsoft.com (!) — and lots, lots more. Users also have the option of adding IE-8-incompatible sites they visit that didn’t make it onto the list that will be appended to the schema list they download.

The Compatibility List has made my IE 8 browsing a lot more stable. When I go to the NYTimes.com site now, it just works. The Compatibility View button (the icon for which looks like a broken Web page and is typically located directly to the right of the URL address bar) doesn’t appear at all (as is the case for all sites on the Compatibility List).

That said, there are a lot of sites I visit that aren’t on the list. And more often than not, they fail to render correctly with IE 8. Sometimes I remember that I should try hitting the Compatibility View button to see if there are boxes and buttons and text there that I can’t see because I am using IE 8. Other times, when I am visiting a site with which I’m unfamiliar, I don’t realize what I’m missing.

I’m at the point now — if a site looks weird, is slow or just doesn’t seem to be working right — I simply assume it is IE 8’s fault. Sometimes I’m right (as I discover when I open the same site in Firefox or Chrome and it looks and works fine). Other times, cialis professional vs cialis I’m not — a site just might be down or broken. The bottom line is I’ve come to expect a rocky browsing experience when using IE 8.

I doubt the compatibility experience is going to change much, if at all, between now and the time IE 8 is released. For months, Microsoft has been banging the drum for site owners to update their code — either by adding compatibility tags or redoing sites to take into account the changes in IE 8. Many site admins and developers have said they weren’t willing to take on that task until Microsoft delivered a near-final test release — at least a Release Candidate.

Some critics have said they think Microsoft is doing a disservice to developers by offering compatibility work-arounds. They say Microsoft created its own problems by delivering previous IE releases that flouted standards — which is true. And now Microsoft should bite the bullet and just go the 100-percent-standards route, they reason. That might be a better course in the long run for Web developers tired of having to do separate versions of sites and apps for standards-based browsers and for IE, but it punishes Web users in the interim.

What’s going to happen when IE 8 goes final and non-techie users have it pushed to them or get new PCs with IE 8 preloaded? I wouldn’t be surprised to see further losses in IE market share, as frustrated users find only some of their favorite Web sites displaying correctly but don’t really understand why. Perhaps Opera and its chums won’t need the antitrust courts to get a leg up on Microsoft, after all….

What’s your take? Is Microsoft taking the right course with Compatibility Mode in IE 8?