After Microsoft confirmed that a hole in its Internet Explorer browser was used in the December cyber attacks on Google and at least 33 other outfits, a trio of security-conscious nations - Germany, France, and Australia - went so far as to warn their citizens against the use of IE. And that led to a very good week for the likes …

COMMENTS

House rules Send corrections

This topic is closed for new posts.

Page:

1. Thursday 21st January 2010 01:04 GMT Steve Roper
  
  That might be useful
  
  if you're debugging a website, but as a means of selectively blocking content I can tell you now it would suck. Most websites, even if the front page looks fairly simple, often assemble the graphical layout from dozens of tiny image files arranged in divs or tables (ugh!), and often use component files for common parts of the site; e.g. the header, navigation bar, sidebar, footer, promo boxout, and main content sections are fetched separately as component HTML files.
  
  For example, our company website, on its home page alone, fetches 78 images (most of which are only a few hundred bytes here and there), 8 CSS files, 14 Javascripts and 6 HTML component files on page load. Were you to visit our home page using the system you describe, you'd be looking at 106 yes/no/block clicks before you were done. And that's just the home page. And our site is conservative compared to some of the sites I've seen!
  
  So, nice idea, but would be incredibly annoying to use in practice.
  
  0 0
  1. Thursday 21st January 2010 09:47 GMT vincent himpe
    
    of course
    
    You could toggle tracing and and off. The traces should have the possibilty for block and filter lists. like :
    
    You would only turn on tracing if you suspect something going on. if the html being parsed all of a sudden grasps files that come from a totally different domain -warning-
    
    At least it would make life a lot easier thatn having to read the code ( by then it's too late )
    
    i see this as a right click menu item. instead of clicking on a link you right click the link you don't trust and select 'trace' or 'trace with blocklist'.
    
    Of course the tracer popup menus could be made a bit smart. if it wants to download a jpeg file you can click yes, no, yes to all jpg for this site, yes to all for this and linked sites.
    
    JPEg files are relaitvely safe. So are PNG files. If i see that thing all of a sudden grab a java file from a totally different domain , that would be a red flag.
    
    The filter should NOT look at extensions but analyse what is going on. also when it hits embedded snippets of javascript in html it should pop a warning with an option to execute, block instance , block always for this site.
    
    Anything you click during a trace session is logged to the block-list. blocklists are saved.
    
    whenever you open a webaddress, and a blocklist for that address exists in your blocklist folder : pick up the blocklist. anything new that comes up and is not handled by the blocklist : popup.
    
    That would be one hell of a tool to find out what websites are really throwing at you when you open them. add the capabaility to share blocklists from a pool ( for example blocklists handed out by antivirus companies for known web nasties. ) there could be a blocklist 'for-any'. that is in effect if you have no specific blocklist.
    
    And it is very easy to implement. All you have to do is modify the html parser so that it triggers this popup menu ( when tracing is enabled) whenever it goes off and grabs something from the site. In essence if the html instructs to grab other documents while still parsing : trigger. it would be a simple if then else clause (if tracing=enabled then if msgbox "site will access" & object" from "&domain &""allow yes ,no"=yes then ...procees. else next.) popup in the handler to retrieve a file from a web address.
    
    And it would be a very welcome tool to debug websites too. You could snare any cross site scripting crap with this thing too.
    
    0 0
2. Thursday 21st January 2010 10:04 GMT Wibble
  
  Activity monitor
  
  Safari's activity window shows all the files which are being downloaded. Quite interesting to see the activity of sites like foxbusiness.com. Then add these domains to adblock to see them gone forever. Then sit back and enjoy your dramatically improved browsing experience.
  
  0 0
  1. Thursday 21st January 2010 14:26 GMT I'm Brian and so's my wife
    
    @Activity monitor
    
    Of course, you could avoid anything by Fox & dramatically improve your browsing experience...
    
    0 0
Wednesday 20th January 2010 22:31 GMT jon 77

@Neil 7..

why are you looking at *ancient* opera versions???? V1010 working fine here....

maybe you should READ those reports!!! quote" solution: Upgrade to Opera version 10.10" ..

0 0
Thursday 21st January 2010 01:01 GMT Neil Greatorex

@ Lord Lien

"Does anyone know if beer is effected"

Yes, beer is effectively affected.

1 0
Thursday 21st January 2010 01:04 GMT Anonymous Coward

@Neil 7

I have to say that all of your links about bugs in Opera are obsolete, and only two of them affected Opera 10.0. The current version is 10.1, which isn't affected by any of those bugs.

It's a bit like pointing people to bugs in Firefox 1.5 or 3.0 in order to bash 3.5.

Your icon's rumours of El Reg's demise are greatly exaggerated.

0 0
Thursday 21st January 2010 01:04 GMT Neil 7

@jon 77

The point is Opera is just like every other browser - it isn't perfect. Your comments seem to imply that Opera IS perfect and has never needed patches for security issues yet a 5 second search confirms that, shock horror, most versions of Opera have been blighted by some form of exploitable bug so it really is just like every other browser - it is no better and no worse.

I'm sure if I tried searching for a few seconds longer I could find evidence of current exploits in the latest version of Opera, but then the imaginary world you seem to inhabit would start to come apart at the seams... :)

0 0
Thursday 21st January 2010 05:25 GMT Winkypop

A day at the Opera

Bah, give me back my Firefox any day.

0 0
1. Thursday 21st January 2010 10:14 GMT Anonymous Coward
  
  Why?
  
  Want to tell us exactly? Opera is far more memory efficient than Firefox, it's faster too, has all the useful features that Firefox needs extensions to do, built right it (althogh perhaps not so easy to find).
  
  Certainly a day is far from enough time to evaluate something as comprehensive as Opera.
  
  Did you use OperaLink?
  
  Did you try Unite?
  
  Did you use the Mail/News/RSS/Chat stuff included?
  
  This page highlights some of the stuff:
  
  http://www.opera.com/browser/
  
  2 1
  1. Thursday 21st January 2010 11:24 GMT James Hughes 1
    
    Memory...in the corners of my mind
    
    Got to agree about FF memory issues - had to kill FF (v3.0.5 on Windoze) yesterday that was using 750MB according to task manager. When it restarted using same tabs it was about 100MB I think. Maybe a newer version will be better - not sure IT will let us upgrade.
    
    Although on my Linux box at home I have Opera, FF and Chrome, and now use Chrome almost all the time. It starts much faster than FF, the Flash works (which is flakey in Opera - never investigated why though), and does all that I want.
    
    0 1
Thursday 21st January 2010 10:07 GMT Wibble

A good news story

This story is nothing but good news. The fewer people using that festering IE browser, the better it is for the Internet. We need a heterogeneous Internet browsing experience based upon standards and consensus, not monkey-boy's flawed vision for total domination.

The only good thing about any version of IE is that web developers get paid good money to create sites that work on all the common browsers. IE 6 and 7 being the worst offenders by far.

Security on IE will always be inferior all the time it includes OLE^H^H^H AxtiveX and comes as part of the core "OS". I'm sure it would be more secure if MS had to release *nix and Mac versions.

It's not as if this is new news. Microsoft have never listened. Reap what ye sow.

1 0
Thursday 21st January 2010 10:08 GMT Anonymous Coward

Microsoft announcements

I know that they're continually accused of talking a load of pish but this took the cake:

"We take the decision to go out-of-band very seriously given the impact to customers, but we believe releasing an update out-of-band update is the right decision at this time."

Duplication, lack of clairity, no mention of product. Surely "We'll be releasing a patch for the IE vulnerabilities asap, even though it's not patch day". It's shorter too.

Looks like it's not just their code that's bloated and wonky...

1 0
Thursday 21st January 2010 11:26 GMT Robert Carnegie

This Opera user can restrict

...Javascript only when I want to allow a web site to use Javascript, on a permanent per-site basis. By default it is switched off for my browsing, by my choice. Likewise other content on web sites, even images: I control what the website is allowed to send to me. Moderate technical understanding is needed to configure this feature.

So if there's a security bug in Opera's Javascript then I'll install the next download - although the concept of "out of band" doesn't apply as far as I know, because they don't seem to have enough security issues for a regular recurring release date, or enough business users - but in the meantime I won't be using Javascript anyway except on a few sites where I decided it was useful. (Yes, I have heard of "cross site scripting". I think some Opera alerts were XSS issues.)

And some sites don't work with Opera's Javascript, oh well... basically scripts aren't allowed to rewrite the page while you read it, I think. Or not when I last looked.

It is usually Javascript, isn't it?

1 0
Thursday 21st January 2010 14:26 GMT mhenriday

Microsoft is said to be releasing a patch today.

One can't hope wondering if those who try another browser will decide to go back to IE once this particular exploit has been patched or whether they will prefer to stay with their new Chrome, Firefox, Opera, or whatever browser. In any event, all the hullabaloo may bring some good in its train : users who never before realised that «Internet Explorer» isn't identical with «Internet» have been exposed to the fact that there does exist an alternative to a Microsoft product - who knows, there might even be some spillover from alternative browsers to alternative OS and/or alternative office suites !...

Henri

0 0
Thursday 21st January 2010 14:34 GMT jon 77

developers...

I have found a LOT of sites that rewrite the page 'in browser' at many times - they all work ok for me on Opera...

You can view the current page source at any time, and select your own viewer for this - I have mainly used this to track the URL of something I want to 'block content' of..

there ARE some debugging tools in Opera - have you not seen Dragonfly at tools, advanced, developer tools?? but dont ask ME about it... you should be posting on the opera forum, so people who know about it can guide you...

you can use 'customize' for the panel on the left to add an 'info' display, and if you add a status field to a toolbar, you will see loading pages as they go by...

But if you know debugging well, you should be using a *proper* tool, and only using the browser to test it...

@Neil 7: I defy you to find anything that is 'perfect' - stop making the wrong assumptions, and start making some posts in the RIGHT forum!

But I guess you are just too lazy to do anything except moan...

0 0