back to article Disabled by default: Microsoft ups the ante in its war against VBScript on Internet Explorer

Microsoft is dealing with the seemingly never-ending dribble of security problems with VBScript by muffling its cries. In Internet Explorer 11, at least. The browser gang had already deprecated the tech in Internet Explorer 11 unless you really, really wanted it but, as of July, upped the ante by disabling it by default for …

  1. fnusnu

    Edge for surface RT?

    Would be good to have a secure browser for Surface RT users. All 3 of us...

    1. Mage Silver badge

      Re: Edge for surface RT?

      Doesn't Firefox work (or Waterfox on 64 bit Win10, though my Win10 tablet with 64bit Atom is 32 bit Win 10)?

      1. Sandtitz Silver badge

        Re: Edge for surface RT?

        Windows RT runs on ARM and allows only software downloaded from the store.

        Firefox wasn't ported & submitted to the store, and neither were any other browsers.

        1. Mage Silver badge
          Coffee/keyboard

          Re: allows only software downloaded from the store

          I did put a ? as I did wonder. So the Surface RT is really a tablet sized unsupported Windows phone rather than a Win 10 tablet. I see.

          Right, so a VERY niche & doomed product!

          1. Sandtitz Silver badge
            Meh

            Re: allows only software downloaded from the store

            "So the Surface RT is really a tablet sized unsupported Windows phone rather than a Win 10 tablet"

            Not unsupported - just unloved.

            The RT tablets are still supported since they're just an ARM build of Windows 8, and they're set to receive security updates until 2023 - the only redeeming feature in the ecosystem in the end - 10 years of updates would be nice in Android and IOS as well. (some perspective: iOS 6 and Jellybean 4.1 were released in 2012 as well)

          2. AceRimmer1980
            Windows

            Re: a VERY niche & doomed product

            I'll see your VBScript / Surface RT

            and raise you, Visual J++.

        2. karlkarl Bronze badge

          Re: Edge for surface RT?

          This is a good learning experience for you 3 guys to never buy a locked down device in the future...

          </condescending>

          You can jailbreak that device easily and perhaps try: https://forum.xda-developers.com/showthread.php?t=2353048

          Firefox would be semi-trivial to port to ARM, including Windows RT ARM (WARM) *if* there was enough interest to warrant about 20 hours development time. Unfortunately due to its artificial limitations, all they are really good for now is filling up more landfills. Good job Microsoft.

      2. jelabarre59 Silver badge

        Re: Edge for surface RT?

        I would expect the way for Microsoft to give Surface RT users (and themselves) a way out would be to release a Linux bootloader for it (on GitHub of course), so that at least some of the users could switch to Linux and stop bothering Microsoft about it.

    2. J27 Bronze badge

      Re: Edge for surface RT?

      The current Edge is being taken out back and shot. They're replacing it with a version of Chrome with Edge painted over-top. I can't imagine that would be easy to port to RT. It would probably be cheaper to just give everyone with a working Surface RT a new Surface Go.

    3. Anonymous Coward
      Anonymous Coward

      Re: Edge for surface RT?

      And me! RT on Nokia 2520. Would love Edge.

  2. amanfromMars 1 Silver badge

    Doors Unlocked. Stable Horses Bolted ...... Pandoras' Boxes Opened

    we understand that writing secure non-trivial code is difficult, and even when problems are clearly identified, they're not easy to completely fix. ....

    Unless and until one accepts that complete fixes are not possible, one will always be battling the past in the present whilst the future plays out free reign in the ...... well, shenanigans of others that continue to appear and multiply ever stronger and more persistent than just anything almighty?

    And only shared there/here as a question for you to ask yourself.

    Just ask Intel

  3. jelabarre59 Silver badge

    revisited

    So now that we're finally sprinkling the holy water on MSIE and putting the garlic necklace on it, the next step is to start doing the same with "MSIE.Revisited", aka Google Chrome.

    1. Chronos Silver badge
      Devil

      Re: revisited

      The actual take-away point here is that Webkit, which started as the rendering engine in Konqueror before being Borged by Apple (along with CUPS), is becoming the de-facto web standard renderer. Only Firefox stands alone with Gecko now that IE's awfulness has bitten the proverbial dust.

      Chrome is just a trojan horse for Google's services, as is Edge for MS'; regardless of IE's undead state (Un-bloody-dead! What's the bloody point?) you still can't trust a web browser to have your best interests front and centre.

  4. Anonymous Coward
    Anonymous Coward

    Of course, if VBScript hadn't been proprietary ....

    We wouldn't be here now ....

    1. Anonymous Coward
      Anonymous Coward

      Re: Of course, if VBScript hadn't been proprietary ....

      VBscript would have had to go through similar security changes to JavaScript even if it wasn't proprietary, making it effectively a JavaScript clone without the cross-platform support.

      Interacting with applications outside of a restricted browser sandbox seems useful up until it's obvious that it's a massive security hole.

  5. J27 Bronze badge

    I'm very surprised VBScript support has hung around this long. Silverlight, which came out to replace VBScript as Microsoft's proprietary anti-compatibility system is long gone. I've been a professional web developer for 10 years and even before that I don't recall a time where VBScript was a reasonable option for programming client-side scripting. Even thinking back to when I was in high school having a web application that only works in IE doesn't make any sense.

    1. Donn Bly

      Internet Web Version = No.

      Intranet Web Version = Maybe.

      In the days before .Net and modern web development languages, it was a viable tool in the toolbox of things that could be used to for automating custom business processes.

      HTA files were a way to duct-tape different systems together using Internet Explorer. I once wrote a system to integrate an internet-facing online store (it used Zen Cart or OS Commerce, I forget) with UPS Worldship running on a shipping station in a warehouse. It would automatically download new orders (via xml over https), print out the barcoded picking tickets, insert the customer information into the shipping software and read the weights and tracking numbers out of the UPS Software via ODBC, update the shopping cart with shipment status and tracking information, print invoices to include in the box, send shipping notices to customers with their tracking numbers and estimated delivery dates, etc. -- all automated and running in background. The only thing the warehouse picker had to do was pick up a box and picking ticket at one end of the line, fill it with product, stick it on the scale, stick the picking ticket under the barcode scanner, press enter after the last box was weighed, tape up the box and apply the labels (which were automatically printed as well)

      There was even a automatically refreshing web-based dashboard that the front office could use to see how many orders were queued, how long the oldest order had been in the queue, any products that were nearing re-ordering points, etc. -- but that part used Javascript and PHP so that it could be pulled up from anywhere,

      It was relatively simple to design and implement using HTA and VBScript, but to do the same thing today using "modern" development tools would take 4 times as long and would be harder and more expensive to maintain. If I remember the hardest thing to do was figure out a way to automatically print the invoices on a local printer and the picking slips on a remote network printer.

      Of course there were disadvantages too - but just like anything else you had to weigh and pros and the cons and determine the fitness for the application.

      (and yes, this was all done more than 10 years ago)

    2. Pascal Monett Silver badge

      "having a web application that only works in IE doesn't make any sense"

      It never did make any sense, except to Microsoft.

      We are here today because Microsoft couldn't be arsed to bring itself to respect web standards, and now it's coming back to bite its ass.

      About time too. No sympathy for the poor, poor managers at Microsoft who have to juggle with all the legacy leprosy that is IE while trying desperately to pull MS into the 3rd millennium. There is only one solution : burn it down. Cut the limb off. Protect the rest of the body.

      1. baud

        Re: "having a web application that only works in IE doesn't make any sense"

        If they only could just kill ActivX support, perhaps we would have at last the necessary budget to replace our old ActivX app by something that can run on a modern browser.

    3. david 12 Bronze badge

      VBscript wasn't just for web applications. It was for Apps. And before the iPad, the environment where you needed to run Apps was the Windows Desktop.

      But VBscript didn't have a native GUI. IE had a scriptable GUI. VBcript+IE=Windows App

  6. mark l 2 Silver badge

    If Microsoft were truly serious about killing off IE they would remove it as pre-installed on Windows 10 and make people actively have to go and download it if they require it for a specific use. 99.99% of home users have no need for IE anymore and it wouldn't be an issue for business users to have to download it if it was required.

    1. arctic_haze Silver badge

      I recently used successfully IE on a government site with certificates that outdated no other browser wanted to touch it. But generally, I agree that most people should not even have the option to open it.

      1. Pirate Dave Silver badge
        Pirate

        Same here. We've got an ancient Intranet site built on Sharepoint running on WinServer 2003 that steadfastly refuses to work on the Firefox or Google line of browsers, but opens right up in IE 11.

  7. Anonymous Coward
    Anonymous Coward

    Microsoft is dealing with the seemingly never-ending dribble of security problems with VBScript by muffling its cries

    FIFY.

  8. a_yank_lurker Silver badge

    It's a Start

    Now if Slurp can get rid of more their useless garbage the world would be a better place.

  9. lolix38

    Edge for Windows errr.. Server ?

    No sign of Edge in Windows **Server** 2019 !!, even with the RDSH role installed....

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Biting the hand that feeds IT © 1998–2019