Spyware Sucks : Internet Explorer 8

What can I say … but…

sandi — Sun, 06 Sep 2009 08:14:38 GMT

Ouch. I haven’t seen a mess this bad since IE7 first came out in beta… (yes, IE8’s Compatibility View fixes the display issues).

IE8 has hit Microsoft Update and Windows Update

sandi — Wed, 01 Apr 2009 05:10:43 GMT

Cite: http://support.microsoft.com/kb/894199/en-us (Offers to existing IE8 Beta and RC users only)

For those of you that need it:

IE8 Group Policy spreadsheet
Toolkit to Disable Automatic Delivery of Internet Explorer 8
Using and troubleshooting the IE8 blocker toolkit
How to set IE8 blocker policy

Are you ready for IE8 to go gold?

sandi — Thu, 19 Mar 2009 04:05:24 GMT

Ready or not, here it comes:

http://blog.seattletimes.nwsource.com/techtracks/2009/03/18/with_internet_explorer_8_microsoft_turns_up_web_br.html

http://news.cnet.com/8301-13860_3-10199582-56.html

http://www.pcmag.com/article2/0,2817,2343409,00.asp

Internet Explorer 8 Release Candidate 1 has been released

sandi — Tue, 27 Jan 2009 02:15:07 GMT

So far, so good on my systems.

The install was quick, although there was a disconcertingly long period, during the restart after RC1 was installed, when my primary system displayed a black screen. The nervous or impatient could conceivably do some damage if they powered down the system during that time.

As always, don’t forget to read the Release Notes. There are some “gotchas” in there for users of Intuit TurboTax Online, Windows Live Essentials, HP Smart Web Printing, Google Toolbar, Roxio Drive Letter Access, Skype, Real Networks RealPlayer 11 and Asus NBProbe.

Also, note that IE8 RC1 cannot be installed on Windows 7.

Finally, be warned. If you installed IE8 Beta 1 or 2 and then installed WinXP SP3, you will be able to install IE8 RC1, but once installed, you will not be able to uninstall either IE8 or Windows XP SP3 later. To avoid this situation, uninstall WinXP SP3, uninstall IE8 Beta 1 or 2, reinstall WinXP SP3, then install IE8 RC1. Yes, it is a pain having to do all that uninstalling and reinstalling, but believe me, its for your own good and will help avoid the charmingly named disaster that is "DLL HELL".

I further advise that you shut down all running programs, close any programs that are running in your system tray (not including Windows notifications such as ‘safely remove hardware’ icons and whatnot) and disable your antivirus software before running the IE8 RC1 installer.

IE8 RC1 can be downloaded from the Microsoft web site.

ALERT: Out of band security patch to be released tomorrow, 17 December at 10.00am Pacific time

sandi — Tue, 16 Dec 2008 21:14:56 GMT

Announcement here:
http://blogs.technet.com/msrc/archive/2008/12/16/advance-notification-for-december-2008-out-of-band-release.aspx

The patch resolves the actively exploited vulnerability that has been in the press so much in recent days, and which is the subject of this Security Advisory:
http://www.microsoft.com/technet/security/advisory/961051.mspx

Facebook doesn't like IE8

sandi — Mon, 01 Dec 2008 14:53:48 GMT

<sigh> This is what happens when the code used by a web site to detect (and adapt to) different browser versions is not properly written. According to Facebook I am running IE6 - I'm not, I'm running IE8 Beta 2 (as you can see from the screenshot).

If I view the Facebook site using Compatibility Mode, the problem goes away. Compatibility View simply changes the User Agent String from:

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; Media Center PC 5.0; .NET CLR 3.5.21022)

to:

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; Trident/4.0; SLCC1; Media Center PC 5.0; .NET CLR 3.5.21022)

There is an article on the MSDN site that explains how best to detect Internet Explorer versions. By using Conditional Comments you can code your web site to recognize a particular version of IE and later versions, which is infinitely preferable to coding a site so that it only recognizes up to a particular version (a subtle but important distinction). Obviously, if a site is coded to only recognize up to a particular version, the site will be unable to recognize any newer versions that are released and may misdetect it, as has happened in the case of Facebook.

Update about plans for Internet Explorer 8

sandi — Thu, 20 Nov 2008 01:18:29 GMT

This announcement was posted to the IE Team Blog a short while ago:

"We will release one more public update of IE8 in the first quarter of 2009, and then follow that up with the final release. Our next public release of IE (typically called a “release candidate”) indicates the end of the beta period. We want the technical community of people and organizations interested in web browsers to take this update as a strong signal that IE8 is effectively complete and done. They should expect the final product to behave as this update does. We want them to test their sites and services with IE8, make any changes they feel are necessary for the best possible customer experience using IE8, and report any critical issues (e.g., issues impacting robustness, security, backwards compatibility, or completeness with respect to planned standards work). Our plan is to deliver the final product after listening for feedback about critical issues.

We will be very selective about what changes we make between the next update and final release. We will act on the most critical issues. We will be super clear about product changes we make between the update and the final release.
The call to action now for the technical community is to download beta 2 (if you haven’t already) and let us know about your experience. Next, please prepare for final testing with public update so you can let us know – quickly, loudly, and clearly – if you find absolutely critical issues with it before the release of the final product."

Cite: http://blogs.msdn.com/ie/archive/2008/11/19/ie8-what-s-after-beta-2.aspx

Where to report problems:

The newsgroups:
http://www.microsoft.com/communities/newsgroups/list/en-us/default.aspx?dg=microsoft.public.internetexplorer.beta&cat=en_us_2BAF8EC5-645C-4477-A380-0F1CF6C102F9&lang=en&cr=us

Report a web page problem:
http://www.microsoft.com/downloads/details.aspx?FamilyID=a950a427-d16c-4379-b641-2f319a69f70d&displaylang=en

The IE8 Beta Feedback web site (you will need to log in):
http://connect.microsoft.com/

Internet Explorer 8 Guidebook

sandi — Tue, 21 Oct 2008 08:19:19 GMT

Its all marketing spiel, but somebody may find it useful ;o)
http://www.microsoft.com/downloads/details.aspx?familyid=75973693-9a7f-4a42-9ddd-8b029361e766&displaylang=en&tm

Time for another quick look at InPrivate blocking

sandi — Mon, 06 Oct 2008 02:23:34 GMT

I thought I would take another look at what InPrivate is blocking on my primary work computer, now that I have been running IE8 Beta 2 for a while. My decision to take a look was actually prompted by a correspondent who told me about this newspaper article at businessweek.com, an article which includes a quote by a Tim Vanderhook, the CEO of behavioral targeting service Specific Media.

The screenshot to the left of screen was taken using SnagIt 9, using a feature that can capture any "scrolling window". Unfortunately, the InPrivate Blocking window cannot be resized to allow me to grab the full file name, and SnagIt 9 does not seem to be able to capture sections of a scrolling window that are out of view.

Tim Vanderhook is quoted in the businessweek.com article as saying that InPrivate "won’t block Google or Microsoft’s own cookie tracking services".

Now, I know for a fact that the above statement cannot be true, because on all of my own systems Google was the FIRST to be blocked. But, what about Microsoft services? Are they blocked? Lets take a look.

You can see in the list to left of screen that a "pixel.gif" from "atdmt.com" is blocked. The URL http://atdmt.com/ loads an Atlas Solutions web site. Atlas Solutions is owned by Microsoft. You can also see that various Google URLs are included.

Therefore, Tim Vanderhook's statement is incorrect.

A quick explanation of the text "Undecided (Allowed)" that appears in the screenshot is required. "Undecided (Allowed)" does not come into effect unless and until the user decides to use the "manually block" option for InPrivate. Manually block allows a user to control what sites are or are not blocked, once they appear in the InPrivate blocking list.

It should be noted that if a user decides to "allow" a web site by using "Manually block", if they change back to using "Automatically" all allowed sites that appear in the list will be blocked. It should also be noticed that "Automatically" is the default mode for InPrivate. Finally, it should be noted that InPrivate does not come into effect unless and until the user specifically chooses to surf using that mode, and opens an InPrivate window by clicking on the InPrivate button or by using the Ctrl / Shift / P key combination. It is possible to manually create a shortcut that opens IE in InPrivate mode but, of course, the end user has to know how to do this in the first place. At time of writing, an InPrivate shortcut is NOT automatically created when IE8 Beta 2 is installed.

There is further information about the inner workings of InPrivate at this url:
http://msmvps.com/blogs/spywaresucks/archive/2008/09/06/1646897.aspx

Uh oh... IE8 Beta 2, plus SBS RWW, plus a password that requires a working shift key = FAIL

sandi — Mon, 08 Sep 2008 01:38:52 GMT

Susan picked up on this one...

Let's take a closer look at some IE8 features and option changes...

sandi — Fri, 05 Sep 2008 15:35:35 GMT

InPrivate browsing

One of the new IE8 features that is garnering a lot of interest is InPrivate. Even before IE8 Beta 2 was released to the public, there was much speculation about the possibility of a new "porn mode" making its debut (thanks, in some part, to some sharp eyed people spotting that Microsoft had lodged a couple of new patents).

An InPrivate browsing session is started via the Safety Button , or by using the keystroke combination of Ctrl/Shift/P.

Ctrl/Shift/P is the default keystroke combination used by the popular SnagIt program to trigger captures. If SnagIt is running, and you are using the default key combination to trigger a capture, then you will only be able to start an InPrivate IE setting using the Safety button.

You can create a program shortcut that will open Internet Explorer in InPrivate mode by adding "-private" to the program's target path, eg on an x64 Vista system the path would be:

"C:\Program Files (x86)\Internet Explorer\iexplore.exe" -private

When you surf using InPrivate mode, any cookies are automatically set as "session cookies" (and deleted when the InPrivate window is closed). No History is saved, and any temporary internet files are also deleted when you close the browser window. Autocomplete data such as form data and passwords are not saved, nor are typed addresses or search terms.

If you open the History Pane when surfing using InPrivate mode, and select the setting "View By Order Visited Today", you will see that no entries are being added to your History as you go from page to page. Any pages that you have already visited during a "normal" browsing mode can still be seen in the History pane.

It is important to note that the InPrivate session can read *existing* cookies, and that those existing cookies are not deleted once you close the InPrivate session. You can also access pre-existing history when using InPrivate mode - it is new data that is created during an InPrivate session that is protected by InPrivate Browsing.

InPrivate browsing includes two features in addition to the automatic deletion of local data - InPrivate Blocking, and InPrivate Subscriptions.

InPrivate Blocking stops web sites from potentially gathering data about your web movements via javascript, tracking gifs and whatnot. The IE team blog uses the example of a tracking javascript to explain how InPrivate Blocking works. Blocking is not triggered until a particular javascript, tracking gif or whatnot is detected on at least 10 web sites.

InPrivate Subscriptions are XML (commonly known as RSS) feeds that contain a list of sites to block and allow. It allows you to use "Manually block" without having to make a site by site decision about what status to assign each site.

InPrivate's impact on advertising

Some people have expressed concerns that InPrivate might block advertising - concerns that are proving to be justified. The first domains to be blocked on my primary work machine were Google AdSense and Google Analytics. Quantserv.com was the third site to be blocked. The fourth site was 2mdn.net (owned by Doubleclick).

Let's take a closer look at the way that InPrivate works. We have three choices - Automatic, Manual and Off.

Automatically block
InPrivate will automatically block a data sharing URL once it has been detected on 10 or more sites.

Manually block
You choose which URLs are allowed to share data, and which are not - a data-sharing URL will not appear in the list until it has been detected on 10 or more sites.

If you use the "Automatically block" option, all sites that you see listed in the "Manually block" list will be blocked from sharing details even if you have set the website as "allowed" via the "Manually block" option. For example, see the screenshot below - you can see that I have set two sites as Allow in the Manually block list, but these sites will still be blocked when I use the "Automatically block" setting. Setting a site to "Allow" via "Manually block" will not over-ride blocking when using the "Automatically block" setting.

I admit that it worries me that advertising is being impacted by InPrivate Blocking. I have always said that every (wo)man deserves their wage, and it worries me that web sites risk losing what may be, for them, an important income stream. I also worry that web sites may stop using popular services like Google AdSense text adverts and move to a more risky advertising model. For example, I chose the Google text ads and Microsoft Affiliates advertising campaigns because I know that visitors to my web sites will not have their web browsers hijacked by a malvertizement and dumped at a fraudware site. I could not be sure that visitors to my sites would always be safe from such activity if I used dynamic advertising such as banner advertisements or pop-ups. BTW, even Google's infrastructure has been used to display malvertizements, which is just one more reason to stick to text advertisements (here is the original report, and the follow-up report).

The big players in the online advertising world will not be very happy if InPrivate Blocking begins to have a noticeable effect on their businesses, especially if other advertising services are not being impacted as quickly. For example, InPrivate Blocking is blocking the Google advertisements on my web site, but it is not blocking the Microsoft advertisements:

IE-VISTA IN IE8 IE-VISTA IN IE8 (INPRIVATE MODE)

A special note for the conspiracy theorists amongst us:

I must stress here that there is nothing nefarious in the fact that Google is being impacted upon by InPrivate Blocking while the Microsoft advertisement is not - I have no reason to believe, or suspect, that there is a secret plot to give Microsoft advertising preferential treatment, or to exclude Microsoft domains from InPrivate Blocking. The reality is that Microsoft advertising campaigns like the ones on my sites are simply not as widespread as Google advertising, so you can put your tinfoil hats away now.

New option - show the Stop and Refresh Buttons before the Address Bar

Personally, I don't like having the Stop and Refresh buttons to the left of the Address Bar, but to each his own :o) Right click on Command Bar and turn on the relevant option... (note that the Links Bar is gone, replaced by a Favorites Bar.

Compatibility button

I see that Opera, or more precisely, Opera's CTO, is complaining about the new Compatibility button, and the fact that *Intranet* sites are, by default, displayed in Compatibility View. Hakon Lie doesn't like the fact that the graphic on the Compatibility button looks like a broken page (or, as some users I speak to describe it, a torn piece of paper), but let's look at this from the end user's perspective, shall we? I've been watching people use IE8 Beta 2 over the past few days, and the only time that they pay any attention to the Compatibility button is... wait for it... when a web page doesn't display properly (that is, when it is "broken"). They then click on the "broken web page button" and voila, the web page displays correctly. If it happens to appear for a page that displays ok, then they invariably don't notice that it has appeared.

To be honest, Hakon's suggestion to use the Acid Test Smiley Face simply does not make sense when you think of things from the perspective of the end user - after all, the average user is not going to think that a "broken" web page warrants a smiley face - if anything they would expect to see a frown - and you can bet that, more often than not, they will have no idea what the Acid Test is!

Why does IE8 "break the Web"?

The original plan was for Standards Mode to be "opt in" for IE8, a plan that coincided well with Chris Wilson's oft-stated desire to "not break the Web", but then a vocal developer community complained, and complained, and complained, about the decision until the IE team deferred to their desires and made Standards mode "opt out" (effectively breaking many pre-existing web pages). Back when the decision was announced I wrote:

"Thinking back to when IE7 was in beta, I remember all of the pain that the changes to IE7 caused for web surfers etc, when we saw things like this:

and this

My primary concern now is how the Mums and Dads out there are going to react to these changes. They are not developers. They do not understand page rendering, and CSS, and the developers' desire for "standards compliance". All they know is that the web site that they are viewing is broken and they will not understand why."

Source: http://msmvps.com/blogs/spywaresucks/archive/2008/03/05/1533456.aspx

Microsoft is trying to make it easier for the end user to cope with the who-knows-how-many web pages around the world that will not display properly in Standards Mode. It would be, dare I say it, a death knell for IE if end users are not given an easy way to view broken web pages that they encounter. The end user needs to know that they do not have a faulty installation of Internet Explorer and that they need not waste time trying to "fix" things by uninstalling and reinstalling, and whatnot. If MS does not show the end user that their installation of IE is not broken per se, then the end user just might uninstall IE8 because they think that it doesn't work, and that is NOT something that I want to see... in the end I don't give a damn about the IE versus Firefox versus Opera fisticuffs, or who has the highest user count, or who is winning or losing the browser war - what I *do* care about is the safety of end users - safety that could be compromised by not having the latest version of Microsoft's web browser installed.

Delete Browsing History

Note the new options to delete "InPrivate Blocking data" and "Preserve favorite website data".

Tabbed browsing settings

Note the options available for new tabs, and the option to enable Tab Groups.

What are tab groups? These are tab groups - note the different colors.

Tab group controls:

Accessed by right clicking on any tab:

Close This Tab Group: will close the tab that is currently open, and all others of the same color.

Ungroup This Tab: ungroups the tab and changes it to the default color.

Duplicate Tab: opens a new tab at the same URL.

Browsing History

Manage Add-Ons

This is much improved - note that you will be able to manage your "InPrivate Blocking List" and "InPrivate Subscriptions", as well as Accelerators, Search Providers and Toolbars/Extensions (as you can see, I work with a lot of different search engines). Also, note that you can "Prevent programs from suggesting changes to [your] default search provider".

Security Settings

A new ActiveX Security Setting - ActiveX changes are explained in detail here:
http://blogs.msdn.com/ie/archive/2008/05/07/ie8-security-part-ii-activex-improvements.aspx

Phishing Filter is now SmartScreen

More info about SmartScreen here:
http://blogs.msdn.com/ie/archive/2008/07/02/ie8-security-part-iii-smartscreen-filter.aspx

New XSS filter enabled by default (XSS = "cross site scripting") - more info here:
http://blogs.msdn.com/ie/archive/2008/07/02/ie8-security-part-iv-the-xss-filter.aspx

Disable InPrivate Blocking data

New Feed and WebSlice settings

Advanced Settings

New option: Enable Caret Browsing for new windows and tabs

Note: "Enable personalized favorites" menu option is gone.

New options: Display Accelerator button on selection, Enable automatic crash recovery, Enable Suggested Sites.

Note the blue Accelerator button...

Inline Auto Complete - stipulates "outside of Internet Explorer"

New options: "Enable DOM Storage" and "Enable SmartScreen filter".

IE8 Beta 2 has been released...

sandi — Wed, 27 Aug 2008 14:39:00 GMT

Enjoy:
http://www.microsoft.com/windows/internet-explorer/beta/

Upgrading notes:

PLEASE READ THE RELEASE NOTES!!!
Compability issues: HP Smart Web Printing (some versions); Google Toolbar (some versions); DriveLetterAccess (Roxio) (some versions); Skype add-in (some versions); Visual Studio .NET Version 7; Real Player 11; Windows Live Mail; Netflix; VB6.0 ActiveX Controls; Window-Eyes; Hotmail log-off - details are in the Release Notes, but I know some of you won't read them 'cause they're too long or you're too busy, or too impatient, or whatever...
The IE8 Beta 2 installer *should* remove IE8 Beta 1 automatically *if you are running Windows XP or Windows Server 2003*. There will be two reboots - one after removing IE8 Beta 1, one after installing IE8 Beta 2.
There is 1 update that should be installed before IE8 Beta 2 on multi-core XPSP2 x86 computers. It will be installed automatically if you select “Install the latest updates” option in IE8 Setup Wizard.
If you are running Windows XP or Windows Server 2003, and you have IE8 Beta 1 installed, and you have Automatic Updates turned on, IE8 Beta 2 *will* be offered for installation via Automatic Update.
If you are running Vista or Server 2008 you will need to manually remove IE8 Beta 1 before installing IE8 Beta 2. There are 3 required updates that should be installed before installing IE8 Beta 2 - again, this will happen automatically if you have selected the option to install the latest updates.
IF YOU INSTALLED XP SP3 AFTER INSTALLING IE8 BETA 1 IT IS RECOMMENDED THAT YOU REMOVE WINDOWS XP SP3, AND THEN IE8 BETA 1 BEFORE INSTALLING IE8 BETA 2. IF YOU DO NOT DO THIS YOU WILL NOT BE ABLE TO REMOVE IE8 OR WINDOWS XP SP3 AFTER IE8 BETA 2 HAS BEEN INSTALLED.
RECOMMENDED STEPS: REMOVE XP SP3, REMOVE IE8 BETA 1, REINSTALL XP SP3, INSTALL IE8 BETA 2
If you use WSUS to manage security updates, you may be offered security updates relevant to IE7 after removing IE8 Beta 1 and installing IE8 Beta 2. These updates are not necessary and will probably fail if you try to install them. Affected computers will stop prompting to install the updates as soon as the PC synchronizes with WSUS.

There is a LOT of new stuff in IE8 Beta 2, so this is going to be a very brief run-down. More detailed information will be posted on this blog, and at www.ie-vista.com, as time goes by.

Web slices: The icon has changed from this to this .

Find bar: Opened via Ctrl F.

Add-Ons:

To enable an add-on such as a toolbar, right click on the Command, Favorites or Menu Bar and turn on the toolbar that you want. Note the warning about enabling "related add-ons":

Add-on toolbars have a close button - click on the X to quickly and easily disable the add-on - again, you will see a dialogue window:

Suggested Sites: Note - turning on Suggested Sites is also turning on Automatic Feed Synchronization on my test system - you will be asked if you want to turn on Suggested Sites the first time that you run IE:

This open is enabled by turning on Suggested Sites:

InPrivate:

I've been reading some of the recent discussion on various sites about what some are calling "porn mode", and about how advertisers are worried that InPrivate may block some advertisements.

I admit to some concern about this feature; I have always said that every (wo)man deserves his wage, and I have always spoken out against wholesale blocking of advertising. It is certainly possible to quickly block services such as Google Adsense using InPrivate's "block and allow" feature. I'm still experimenting with this feature and am not sure what InPrivate will block, or how long it will take before blocking occurs, *if the user does not take advantage of the "manually block" option*.

Compatibility View:
IE7 Compatibility View is, by default, per site. If a site does not display properly, click on the Compatibility View Button:

If the Compatibility View Button does not appear (it is dynamic), use the menu option (Tools, Compatibility View Settings):

Note that you can set IE to display all intranet sites in Compability View, or all web sites.

Changes to about:Tabs

about:Tabs is the default URL for new (empty) tabs. Note that about:Tabs contains a lot of new content, including the ability to open previously closed tabs from that browsing session, start InPrivate Browsing, or use an Accelerator.

Tab groups:

This is cool - note the different colored tabs. Each color indicates an separate tab group - it is probably easiest to describe them a parent and child tabs.

Tab group controls:

Accessed by right clicking on any tab:

Close This Tab Group: will close the tab that is currently open, and all others of the same color.

Ungroup This Tab: Ungroups the tab and changes it to the default color.

Duplicate Tab: Opens a new tab at the same URL.

Smart Address Bar:

Note that the search results are divided into categories. It makes it a heck of a lot easier if, for example, you're trying to find something you read via an RSS feed, as distinct to a web page.

Search Suggestions (with images):

There are lots of new Search Providers choose from, and many include the new Search Suggestions. I recommend you visit the Internet Explorer Gallery to choose some new providers. Note that if you have already installed a Search Provider, and that Provider has introduced support for Search Suggestions, then you will need to upgrade that Provider - that can also be achieved via the Internet Explorer Gallery.
http://www.ieaddons.com/en/searchproviders/

Example of Search Suggestions:

Note: When you install the Search Provider, make sure the option to "use search suggestions from this provider" is enabled. If the Search Provider already exits, an "Upgrade Provider" button will appear instead of"Add Provider":

Also, note this setting, accessible via Manage Add-Ons, which was not enabled by default on my system. You may want to turn that option on:

Smartscreen Filter: I hold great hopes for the feature - I can see it making a big difference in the fight against Rogue Security Software:

FIX: msfeedssync.exe crashes (RSS synchronization - IE7 and IE8)

sandi — Thu, 31 Jul 2008 02:02:46 GMT

I have over 400 RSS Feed subscriptions that I keep an eye on, and which need to be checked regularly, sometimes every 15 minutes. A couple of days ago, msfeedssync started crashing every time a synchronization was due. The errors were:

Faulting application msfeedssync.exe, version 8.0.6001.17184, time stamp 0x47ccc712, faulting module msfeeds.dll, version 8.0.6001.17184, time stamp 0x47ccc720, exception code 0xc00000fd, fault offset 0x00002046, process id 0x1c98, application start time 0x01c8f1484814c945.

Faulting application msfeedssync.exe, version 8.0.6001.17184, time stamp 0x47ccc712, faulting module msvcrt.dll, version 7.0.6000.16386, time stamp 0x4549bd61, exception code 0xc00000fd, fault offset 0x00009bb2, process id 0x1ec0, application start time 0x01c8f1471a9905e9.

Faulting application msfeedssync.exe, version 8.0.6001.17184, time stamp 0x47ccc712, faulting module WININET.dll, version 8.0.6001.17509, time stamp 0x481c0708, exception code 0xc00000fd, fault offset 0x00004062, process id 0x2604, application start time 0x01c8f146dc893df3.

Faulting application msfeedssync.exe, version 8.0.6001.17184, time stamp 0x47ccc7a5, faulting module kernel32.dll, version 6.0.6000.16386, time stamp 0x4549d328, exception code 0xc00000fd, fault offset 0x0000000000037b93, process id 0xe94, application start time 0x01c8efbadb2c6b9a.

Faulting application msfeedssync.exe, version 8.0.6001.17184, time stamp 0x47ccc7a5, faulting module ntdll.dll, version 6.0.6000.16386, time stamp 0x4549d372, exception code 0xc00000fd, fault offset 0x00000000000529c5, process id 0x10f4, application start time 0x01c8ef973bc855f2.

As you can see, things were a real mess. These are the troubleshooting and diagnostic steps that I used to solve the problem:

Check if the Feed Task is corrupt by running the following command:

schtasks /query | findstr /i "user_feed"

Results:
User_Feed_Synchronization-{C73963F9-62BB-4 27/07/2008 10:15:00 Could not start

Ok, that is not good.
Stop and restart the Feeds Task:

C:\Windows\system32>msfeedssync disable
C:\Windows\system32>msfeedssync enable
Check Feed Task status again:

schtasks /query | findstr /i "user_feed"

Results:
User_Feed_Synchronization-{B70B1824-595E-4 27/07/2008 10:14:00 Ready
User_Feed_Synchronization-{C73963F9-62BB-4 27/07/2008 10:15:00 Could not start

Ok, not good - now I have two tasks - there is definitely an issue with the original task which is unable to start.
Disable the Feeds Task:

msfeedssync disable
Check to make sure that both Feed Tasks are gone:

schtasks /query | findstr /i "user_feed"

Results:
No tasks running - that is good
Restart the Feeds Task and check to see what we have got:

msfeedssync enable

schtasks /query | findstr /i "user_feed"

Results:
User_Feed_Synchronization-{B70B1824-595E-4 27/07/2008 10:23:00 Ready

Ok, this is good.. the bad Feed Task is gone, but msfeedssync is still crashing - something else is wrong.

Tried disabling Antivirus - that didn't fix the problem.
Tried running IE in "no add-ons" mode - msfeedssync is still crashing.
I fired up Fiddler, which records RSS activity. It turns out msfeedssync was crashing on the same feed every time - I deleted that feed but the subscription was cached somewhere that wasn't updating properly because IE8 continued to check the same feed despite it being deleted (and IE shut down and restarted, and the computer being restarted as well).
Ok, the fact that IE continues to check a feed that I have deleted from my Feeds subscriptions indicates that we are most likely dealing with a corrupt file, but which one?

I exported my list of feeds to an OPML file, then deleted the file "FeedsStore.feedsdb-ms" that is located in \Users\%username%\AppData\Local\Microsoft\Feeds. Next, I ran "msfeedssync forcesync".

Results:
msfeedssync continued to crash, but now it was crashing immediately instead of when it hit a particular feed :o( Ok, I just made things worse.
Using Process Monitor, I could see that msfeedssync was crashing immediately after it (apparently successfully) closed this file:

\USERS\%username%\AppData\Local\Microsoft \Feeds Cache\index.dat

I deleted the entire contents of that folder, including index.dat.

Results:
msfeedssync stopped crashing - YAY!!

Process Monitor is a free Sysinternals program available from Microsoft. You can download it here:
http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx?PHPSESSID=d926

IE8 - information posted to the IE blog

sandi — Wed, 02 Jul 2008 18:26:42 GMT

The Internet Explorer team have published 3 new articles about IE8 that are well worth a read.

First, the SmartScreen filter:
IE8 Security Part III- SmartScreen® Filter

The feature that I want to call out about the SmartScreen filter is the antimalware support - SmartScreen not only blocks access to known phishing and malware sites, it will block downloads from known malicious sites, meaning that victims are protected even if they don't visit a known malware site directly. For example, if a victim is tricked into clicking on a link in an email or Instant Message window that will download malware, then as long as IE is your default browser, SmartScreen will block the download. I can think of a whole slew of fake security software aka fraudware aka betrayware that I believe should be blocked via the SmartScreen filter.

Of course, such blocking can be overridden if need be (for example, because of false positives). For those of you that are responsible for network management and security, you will be pleased to know that Group Policy can be used to stop users from overriding the SmartScreen Filter.

The SmartScreen user interface has also been improved.

Second, cross site scripting (XSS) vulnerabilities - XSS filtering
IE8 Security Part IV- The XSS Filter

"When the filter discovers likely XSS in a cross-site request, it identifies and neuters the attack if it is replayed in the server’s response. Users are not presented with questions they are unable to answer – IE simply blocks the malicious script from executing."

Third, security improvements:
IE8 Security Part V- Comprehensive Protection

"As we were planning Internet Explorer 8, our security teams looked closely at the common attacks in the wild and the trends that suggest where attackers will be focusing their attention next. While we were building new Security features, we also worked hard to ensure that powerful new features (like Activities and Web Slices) minimize attack surface and don’t provide attackers with new targets. Out of our planning work, we classified threats into three major categories: Web Application Vulnerabilities, Browser & Add-on Vulnerabilities, and Social Engineering Threats. For each class of threat, we developed a set of layered mitigations to provide defense-in-depth protection against exploits."

Important information about Windows XP SP3 for Internet Explorer users

sandi — Tue, 06 May 2008 05:00:00 GMT

You will be unable to remove IE8 Beta or IE7 after installing Windows XP SP3 because Microsoft wants to make sure that you do not encounter a problem commonly known as "DLL Hell".

IE8 Beta 1 users

You will NOT be offered Windows XP SP3 unless and until you remove IE8 Beta 1. This is because if you install windows XP SP3 without removing IE8 Beta 1, then you will no longer be able to remove IE8 Beta 1 and the Remove option will be greyed out in Add/Remove Programs.

Internet Explorer 7 Users

You will be offered Windows XP SP3 as a high priority update BUT if you install it you will not be able to remove IE7 without removing Windows XP SP3 first. It is recommended that you remove IE7, then install Windows XP SP3 then re-install IE7.

Internet Explorer 6 Users

You will be offered Windows XP SP3 as a high priority update. Windows XP SP3 ships with an updated version of IE6. No need to do anything else.

Welcome to the world of betas....

sandi — Sat, 29 Mar 2008 06:54:11 GMT

I received the following email today:

"I need to uninstall ie 8 beta it sucks ..

<<name removed>>
addressremoved@thevillages.net
Ie 8 is the worst program from Microsoft EVER"

Our (un)friendly correspondent doesn't seem to understand the implications of downloading and installing a BETA program - especially an early beta that is called Internet Explorer 8 for Developers.

The Internet Explorer 8 Web site's download page states that "This beta is aimed at web developers and designers to help them take advantage of new features in Internet Explorer 8 that will enhance their websites." Not only that, the Download Centre itself warns that "This beta release is available to everyone, but is primarily for Web developers and designers to test the new tools, layout engine, and programming enhancements."

Assuming our (un)friendly correspondent is actually a web developer or designer, he seems to have failed to heed the suggestion on the IE8 web page that he check out the Internet Explorer 8 Readiness Toolkit which is a pity, because if he had looked at the Toolkit he would have found a link to the Internet Explorer 8 Release Notes which include removal information for Internet Explorer 8.

Perhaps availability of Internet Explorer 8 for Developers should have been restricted to Technet and MSDN subscribers and a limited pool of experienced beta testers - then I wouldn't be getting emails from people like our (un)friendly correspondent who want to install betas but can't be bothered with reading the documentation.

Oh well, I may as well answer the guy's question - here is a copy of the relevant segment of the Internet Explorer 8 Release Notes:

Loosely coupled IE (LCIE) and Automatic Crash Recovery

sandi — Sun, 16 Mar 2008 12:37:00 GMT

Andy Zeigler posted a comprehensive article about Loosely Coupled IE (LCIE), a new feature of IE8 that is designed to improve the reliability (and scalability and performance) of Internet Explorer. He also briefly mentioned a benefit of LSIE called Automatic Crash Recovery (ACR)

http://blogs.msdn.com/ie/archive/2008/03/11/ie8-and-loosely-coupled-ie-lcie.aspx

I saw ACR in action today, and took the chance to grab some screenshots for you, and experiment a little with ACR.

The first thing you will see is, of course, an error window:

Historically when we have seen this error IE has closed completely, and unless we have something like IE7Pro installed, which remembers what tabs we had open when IE crashes and offers to open the same set, we have invariably had to use IE's History feature to reopen the lost tabs.

With IE8, if one particular tab causes a problem, IE8 does *not* close completely. Instead, the one problem tab is closed and reopened, and the end user will see an alert warning that this has occurred:

One thing to bear in mind is that although IE8 does not close completely, all open tabs will be refreshed as part of the ACR process, but the way that it refreshes is different to normal (yes, I know, "different" is not a very technical explanation, but I haven't worked out why I am seeing what I am seeing).

For example, normally if the compose pane for my blog is refreshed I see this message:

I do *not* see the above message after an ACR - that being said, I still lose non-saved text. Therefore, although we can describe what we are seeing as a "refresh", that is not a truely accurate explanation. Hopefully the article Andy has promised to write about ACR will explain this difference in greater detail.

Yay, me.dium loves me....

sandi — Tue, 11 Mar 2008 13:35:30 GMT

Look what I've got :o) Yep, that's IE8 Beta 1 with Me.dium running.....

Here's the official blurb re me.dium. I don't have time to check it out tonight... but will soon....

"Me.dium was selected as one of a small handful of partners to get access to IE8 in pre-beta form. At Mix08 Me.dium demonstrated how it has leveraged new features in IE8 to empower people to find information together in radical new ways.

WebSlices allow IE8 users to subscribe to portions of a page. Users can receive updates from that page whenever any content changes. Me.dium has implemented WebSlices on its user-profile pages (e.g http://me.dium.com/user/tobiaspeggs). User profiles – across many social sites – typically show news-like information about a friend’s activity. In Me.dium, users can now subscribe to a WebSlice from their favorite friends’ profile and be alerted instantly of any updates. The WebSlice helps Me.dium form a deeper connection with its users, and gives users a simple but powerful way to stay in touch with their friends.
WebSlice adoption will be assisted by ease of discovery. In other words, users need to know that WebSlices exist on a page if they are going to use them. The Me.dium IE8-sidebar-extension helps massively with the WebSlice discovery process. Me.dium alerts users to the presence of WebSlices on any page – and even allows users to read the content of that WebSlice and (it will soon allow users to) subscribe to that WebSlice, right within the Sidebar. Even better, utilizing the Me.dium Matching Engine, Me.dium also makes real-time recommendations for other WebSlices on other relevant webpages – and gives users a simple means to surf to them. No user need ever miss an available WebSlice again.
Activities in IE8 allow users to quickly access a contextual service from any webpage. For example, with one click, users can map directions found on a webpage, or search on keywords they have highlighted. Me.dium offers IE8 users a powerful “Social Discovery” Activity from any webpage. You can get it at http://me.dium.com/ie8/ The “Discover with Me.dium” Activity delivers content recommendations, related to the page or selected key words,that are influenced by the real-time surfing activity of Me.dium users. Along with the social discovery recommendations, the “Discover with Me.dium” Activity also displays a “map” of real-time user surfing patterns, meaning users can easily visualize how popular related web pages are with other users right now – based on where people are hanging out online at any point in time. It’s like a real time view of “what’s hot” around the topic you are surfing."

Now, as the article says, Tobias has added a Webslice to his page - here's a screenshot:

You can see the purple WebSlice icon, yes? If you click on it you will see this:

Select ok, and a WebSlice will be added to the Favorites Bar in IE8. Unfortunately, I can't capture a screenshot of the WebSlice content itself - it closes as soon as it loses focus.

I'm so pleased to get my favorite add-on back. Now it is time to start experimenting with activities...

It's fixed - I've got my Emulate IE7 button

sandi — Fri, 07 Mar 2008 14:31:20 GMT

So there I was, waiting for my laptop to reboot after a very frustrating evening - I'd been disabling or deleting every piece of third party software I could think of - beta, alpha, pre-alpha and (what the heck do you call pre-pre-alpha).

Anyway, my system was taking a LONG time to reboot after removing IE8 Beta 1 - I'm talking 20 minutes stuck at "shutting down".

After 5 minutes of waiting I decided I may as well make good use of the down time and start reading through the 2 inches of reading that is waiting for me - release notes, beta notes, alpha notes, whitepapers, "this message will self destruct 30 seconds after reading" tomes ... all sorts of stuff related to what I had just removed from this laptop...

And there it was ... just one sentence buried in that two inches of paper ... one sentence that revealed the reason why I did not have an Emulate IE7 button. I read it once, I read it twice, I read it three times... but yes, there it was.

So, then I went through that "oh sh*t... please don't tell me it was that simple..." stage. You can bet that when the team find out just what it was that caused the problem (yes, I can tell them, but not the world at large) they'll have ammunition sufficient to tease me for the rest of my natural life.

Boy, when I screw up I screw up *real good*, and I do it in public ;o)

Welcome to Internet Explorer 8

sandi — Fri, 07 Mar 2008 12:30:14 GMT

Well, here's an interesting problem... I've seen it on two machines so far (a Vista x64 machine and a Windows XP machine).

Both installs are missing the Emulate IE7 button - despite it apparently being impossible to remove... :o)

I suspect that the presence of an add-on button on the toolbar at the time of the IE8 install may be implicated in the mystery of the missing button - I'm remembering how the Haute Secure install routine always failed if the command bar had been customized with non-standard content.