resilience of rendering engines in internet explorer vs firefox and opera
There's bad markup all over the net. Unlike program code, which is strictly compiled or interpreted, HTML webpages are merely parsed by a browser to extract content. Until recently this hasn't been a problem. The market dominating browser, Internet Explorer has a very resilient and flexible parser that will deal with most crap that the web can throw at it. However, several new bespoke rendering engines have become popular on the net including Gecko (Mozilla, Phoenix/Firebird/Firefox) and KHTML (Konqueror, Safari). These rendering engines, for better or worse, have stricter, less versatile parsers, which means they will fail to render certain sites as the designer intended. For example, browsing www.asda.com in Firefox currently shows no shopping aisle options and is therefore unusable. The Odeon website shows nothing but a background image in Firefox. But the problems get more serious than simple rendering inconsistency:
I was interested to read a BugTraq submission by Michael Zalewski that compares the resilience of various browsers against bad markup. He has written a program which fires pieces of malformed HTML at various browsers, with no human intervention (except in the case of a browser crash). Michael sums up the results:
All browsers but Microsoft Internet Explorer kept crashing on a regular basis due to NULL pointer references, memory corruption, buffer overflows, sometimes memory exhaustion; taking several minutes on average to encounter a tag they couldn't parse.
It appears that the overall quality of code, and more importantly, the amount of QA, on various browsers touted as "secure", is not up to par with MSIE; the type of a test I performed requires no human interaction and involves nearly no effort. Only MSIE appears to be able to consistently handle malformed input well, suggesting this is the only program that underwent rudimentary security QA testing with a similar fuzz utility.
BugTraq Submission by Michael Zalewski
This may come as a surprise to people who have read the recent media hype about Firefox, which is touted as a more secure and robust alternative to Internet Explorer. However, the IE test manager offers an explanation:
I cannot speak for the other browsers talked about in this report, but I can speak to the IE portion of this report. It is no accident that IE is responding this way to the tests that were run against it because we intentionally take a number of steps to make IE resilient.
At the end of the product cycle for Windows 2000 and as part of the Secure Windows Initiative, Microsoft developed a set of tools called Prefix and Prefast to do dynamic source code inspection, which helps scour the source code for bad code and bad coding practices such as null pointer dereferences. These tools help us find obscure crashing code paths that manual code inspection may miss.
IEBlog entry by Scott Stearns, IE test manager
Microsoft have made Prefix and Prefast publically available. Perhaps Mozilla would consider swallowing its pride and running them on Firefox?
28/10/04 6:23pm
(8 years, 7 months ago)
3 comments
add photo
more journal entries from tech journal
You specifically stated that http://www.asda.com will not render correctly in FireFox. Maybe you should try it again, eh?
Every single one of your flaws youhave found with FireFox have been with beta versions. Now that we have got 1.0 out, none of them apply. I am embarressed for you.
Also, I have a sincere question for you. I am the sysadmin at my work, and I have been given the task of locking down Internet Explorer on all workstations so we dont get anymore Spyware. I have installed Spybot, but it requires the user to manually deny any maliscious code. Is there an automated, sure way to really secure these machines without switching browsers?
12:03am
Wow, not running malicious and bad code is a fault!??!
Though I'd have to say that Konqueror and Firefox (Mozilla engine and all that) make a pretty good job of most of the popular silly markup practices.
Your main contention seems to be that ability render bad markup is an indication of good programming in the rendering engine and a lack of bugs. In fact you contend that this adds up to a more secure web browser.
Good grief, the daftness of this is almost beyond words. If you want to learn about security and stability of browsers, their integration into the operating system, and why Internet Explorer is such a nightmare then I'd suggest you start reading. How about starting with RPC (Remote procedure calls) that IE uses liberally.
Try starting with this
Lastly, like the person in one of the prevous comments (joseph), I'd suggest that you learn the difference between beta releases and stable releases of software.
I'll stop here............
3:46pm
5:54pm