Windows Users: Do Not Press Just Any Key!

Apparently, there is a strange security bug in Windows XP whereby some web sites will ask you to press the F1 Key, and if you do, you are screwed.

"The vulnerability exists in the way that VBScript interacts with Windows Help files when using Internet Explorer," read the advisory. "If a malicious Web site displayed a specially crafted dialog box and a user pressed the F1 key, arbitrary code could be executed in the security context of the currently logged-on user."

details

More like this

Internet Explorer - that browser still exists?

By NewEnglandBob (not verified) on 04 Mar 2010 #permalink

Believe it or not, a SAP-based tool used by my employerfor employees to do HR stuff doesn't just require IE (or IIIIIEEEEEEEEEEEEEEEEEEEE! as I prefer to call it), it requires IE6!

My keyboard doesn't have an 'Any' key! Sorry, couldn't resist.

IE? Isn't that the program I used to download Chrome when I first got my computer?

By Unikraken (not verified) on 04 Mar 2010 #permalink

Brian @3, I know you're joking, but I have heard (possibly apocryphal) reports that the message Greg's title refers to was changed to "Press a key to continue." Supposedly multiple customers aborted an installation because they could not find the "any" key.

By Eric Lund (not verified) on 04 Mar 2010 #permalink

Theo @2,

I call it Internet Exploder. Like Unikraken, I only use it to download better browsers.

@2
IE 6 is still very common in corporate settings. My users are required to use it as it's the only browser compatible with my intranet software. Then I have another internal\external site used for sales materials (that I built), that is completely incompatible with IE6. So many of my users here are forced top have different browser for different sites.

It's a pain in the ass, and IE is one of the worst things about MS. They refuse to follow international standards for web browsers, making web design a pain in the ass.

http://gizmodo.com/5483186/inside-the-excruciatingly-slow-death-of-inte… (via POPsci)

@Unikraken: shame, shame - the proper way is to:

1. use ftp to download wget
2. use wget to download Chrome

@Theo Bromine: Yeah, I'm always amazed by teh st00pid. Locking software into a specific version of other software is a maintenance nightmare. On systems I've developed it's usually a case of "use version X or later of software Y" except in the extremely rare cases when software Y's next version is not compatible - in which case if you use free software it's a mere nuisance and not a nightmare as it *always* is with proprietary software. ~20 to 10 years ago most of my computer work involved supporting or reverse engineering and getting away from proprietary software and hardware which was no longer supported for any number of reasons (company does not exist, company no longer supports the product, company has changed its business...)

By MadScientist (not verified) on 04 Mar 2010 #permalink

I think even Microsoft wishes that IE6 would go away. But you can't force people to upgrade (actually I'm pretty sure they could, but marketing would have a fit).

I think even Microsoft wishes that IE6 would go away

They very much do wish it would go away. The problem is that it shipped with XP and MS has stated that they will continue to support XP until April of 2014. From the MSDN blog

"Dropping support for IE6 is not an option because we committed to supporting the IE included with Windows for the lifespan of the product. We keep our commitments. Many people expect what they originally got with their operating system to keep working whatever release cadence particular subsystems have."

and

For its own part, Microsoft would be happy to see you stop using IE6, too. In another blog post, the company says, "Think about what technology and the Internet were like in the year 2000 â and consider how they've evolved since then. In 2000, âphishing' was something that happened at the lake, not online. There was no social networking, no RSS feeds, and no real blogs. It was a different time â and people's browsing needs were different."

@Mad

Locking software into a specific version of other software is a maintenance nightmare

This is one thing that angers me. We have an intranet that interfaces directly with our ERP software. Granted it's just SQL tables, but the company that made the ERP made the intranet software and they are picky about giving us the proper definitions of tables. They won't upgrade the intranet software so that it can run on newer systems. It runs on old Active X controllers, among other things (I hate active X!) and IE7 and 8 won't work, nor will Firefox or any webkit browser.

When I work from home, everything I need to do I can do on my Mac, except for a couple of company websites that I occasionally have to visit. Then I have to fire up the Windoze laptop they gave me so I can run IE. After I am done, I go back to working on my Mac.

Check this out, particularly the Web Technology Support, Image Format Support, and Vulnerabillities sections.
http://en.wikipedia.org/wiki/Comparison_of_web_browsers

And this. The Usage share of IE has been steadily decreasing and hopefully in another 5 years, if the trend continues, will only be used by those too stupid to install a different browser.

http://en.wikipedia.org/wiki/Usage_share_of_web_browsers

By The Wander (not verified) on 04 Mar 2010 #permalink

IE 6 is still very common in corporate settings.

Indeed - it's the bane of my fucking life at the minute. It's really not easy to build a web application that works properly in both IE6 and decent browsers.

i don't need no browser for my commodore 64. a 300 baud modem and 32k of program space is plenty good for the computing needs of the average user.

@rob #13, at least you are far less likely to have any computer security issues. Good for you!

By Shawn Smith (not verified) on 05 Mar 2010 #permalink

It's really not easy to build a web application that works properly in both IE6 and decent browsers

I'd say that's an understatement. Been causing me hell for quite sometime

@The Wanderer

. Then I have to fire up the Windoze laptop they gave me so I can run IE

Shit, if your companies big enough you should look into Citrix app server. My Mac and Home users just launch a quick script file to connect them to my Windows server, which brings up a seamless IE window right in OS X (I use it for my Linux laptop when at home/road). It's a real IE6 instance, only it's ran on a session on the server in the office, but shows on your desktop (remote session). Also makes for easy home access to the corporate network, including Outlook (exchange), MRP software and Crystal Reports. I have it setup for wither single apps or you can get an entire windows desktop, kind of like a virtual machine, only it doesn't hit your local resources, as everything ran server side. Terminal Services FTW

The idea of using a browser as the interface to so many things is quite sensible, I think. But it's standards that make it sensible: so a developer can sort out the server end and leave the client up to the user. Designing software that requires a particular browser, or a browser that doesn't follow the standards completely ruins this.

As for websites, any site that doesn't work properly with my chosen browser - whatever that may be - is unlikely to get a return visit. I don't want other people telling me what software I can and cannot use.

An absurd proportion of sites in Korea only work under IE. Places like top tier universities included!

Developing web apps almost always results in rough hacks which work (more or less) in the browsers the developers use. Standards are getting better, and developing using the Mozilla engine means that most browsers will probably work ok. However, this was far from the case just a few years back.

Making matters worse, Micro$oft was busy trying to take over the web by introducing their own non-standard ways of doing things. Mozilla and others had their own extensions, but those were intended to be incorporated into future standards... Micro$oft made crap like ActiveX and hosts of smaller extensions which were intended to exclude competing browsers.

Finally, javascript sucks rocks. It is a horrible language that pretty much ensures crappy code. I'm amazed how much work folks have done making the frameworks and such which make it actually useful. Still, I'm for burning it down to the ground and starting over from a more sound foundation.

Developing web apps almost always results in rough hacks which work (more or less) in the browsers the developers use. Standards are getting better, and developing using the Mozilla engine means that most browsers will probably work ok. However, this was far from the case just a few years back.