18 ms·
Microsoft Edge: Building a safer browser
- chasing 12y agoMicrosoft has one helluva hole to dig themselves out of, here.
- nivla 12y agoFor us techies, sure, but I wonder how many average joes have written off IE? For them the 'e' logo is and always have been the door to the internet. Now since Microsoft is planning on bundling both the new and the old browser in Win10, I am curious to see how many of these people will still stick with the old one over the new.
- Turing_Machine 12y ago"I wonder how many average joes have written off IE?" Lots of them. Many surveys show it down in the Safari region, for instance: http://gs.statcounter.com/#all-browser-ww-monthly-201504-201504-bar http://gs.statcounter.com/#all-browser-ww-monthly-201504-201...
- adventured 12y agoMore likely closer to 25% to 30% Every other major source than that one reports IE well above 12% http://www.zdnet.com/article/the-most-u-s-popular-web-browsers/ http://www.zdnet.com/article/the-most-u-s-popular-web-browse... https://www.netmarketshare.com/browser-market-share.aspx?qprid=2&qpcustomd=0 https://www.netmarketshare.com/browser-market-share.aspx?qpr...
- Turing_Machine 12y agoThe first one is limited to .gov websites, and lots of government agencies still use IE for internal use. The second one excludes mobile, for no good reason that I can see. Mobile is huge.
- mynameisvlad 12y agoBecause the browser landscape is completely different in mobile? There isn't really any reason not to separate them. They're completely different markets.
- Turing_Machine 12y agoNo, they aren't different "markets" They're not even different code. Safari on iOS comes from the same code base as Safari on desktop, and I'm pretty sure the same is true for Chrome on Android (Chrome on iOS, like other iOS browsers, is just a wrapper around the Safari engine). The old Android browser was different code, but that's been on its deathbed for a while now. Mobile users use the same sites as desktop users, to a very large degree. They use the same browser code (again, to a very large degree). The only reason to separate them that I can see is to artificially inflate the number of IE users.
- yohui 12y agoNo, NetMarketShare/NetApplications is the exception: https://en.wikipedia.org/wiki/Usage_share_of_web_browsers https://en.wikipedia.org/wiki/Usage_share_of_web_browsers Of course, they're also the only source that tries to count "unique visitors" rather than traffic, and uses country-level weighting to attempt to correct for sampling bias. But personally, I still find StatCounter more useful.
- nbevans 12y agoIt looks like they have one arm already over the top edge of the hole though...
- kid0m4n 12y agoI believe that Microsoft not releasing versions for Linux / Mac OS X is going to not allow Edge to get maximum adoption. How am I supposed to test that my website works on Edge properly? The only option thus far is to setup a VM with Windows 10 on it so that I can run a browser to test my website. I dont even bother testing stuff on IE x for that reason.
- 0x0 12y agowww.modern.ie And even if they did release linux or osx versions you would still want to test in windows, for the differences in font engines etc. Just like testing safari really requires osx.
- EugeneOZ 12y agoand there's no analogues of modern.ie in Apple world :) One can even try to test it remotely, without downloading and installing VM, but in some cases, such as animations testing, VM is more comfortable.
- cleverjake 12y agoTHey actually discussed this at the recent spartan summit. A lot of the team would like to make a version for non windows, they just want to make a great one for windows first. beyond that, there are a ton of ways to easily test IE. http://dev.modern.ie/tools/ http://dev.modern.ie/tools/ browserstack, saucelabs, free virtual machines for local testing, the azure remote tester amongst others.
- mikhailt 12y agoThe same way as before, Microsoft will release an Edge-dev optimized VM builds on their site here: http://dev.modern.ie/tools/vms/ http://dev.modern.ie/tools/vms/ They have other tools there to help as well. Microsoft is pretty good about helping devs here. It's not like testing sites in Safari is better, Apple isn't even bothering to update Safari on Windows as it has been dead for nearly more than 2 years. At least Microsoft is updating more often than Apple. They already have IE11 on Win10 dev VM there.
- comex 12y ago> MemGC (Memory Garbage Collector) is a memory garbage collection system that seeks to defend the browser from UAF (Use-after-free) vulnerabilities by taking responsibility for freeing memory away from the programmer and instead automating it, only freeing memory when the automation has detected that there are no more references left pointing to a given block of memory. Interesting; I don't think this has been announced before. It sounds similar in concept to Chrome's Oilpan (still not shipped AFAIK).
- Animats 12y agoWhat is Edge written in? I would have assumed Microsoft would use C#, which is garbage collected.
- nbevans 12y agoHighly unlikely. It would be written as a native C++ app. Whilst the .NET CLR is very powerful and highly performant these days, there just wouldn't be enough justification I don't think to design their web browser on it. Remember this thing will be targeting mobile devices too. So every little performance optimisation can save minutes of battery life which all adds up. That said, I've always wondered what a JavaScript implementation built on top of the CLR might behave like.
- latiera 12y agoNot enough justification? How about 0 security? All their measures are totally useless, there is no safety here just same old bullshit that can be trivially bypassed.
- nerraga 12y agoThe fact that the article is mentioning MemGC as a defense against use-after-free attacks (something I don't believe managed languages need be concerned) and the way Control-Flow-Guard is described leads me to think it's primarily C++. Probably a mix of native/managed, but I suspect that any managed code is kept to a minimum given the emphasis on native protection and countermeasures. If this is the case then I'd be interested in their rationale in deciding not to go 100% managed.
- lawnchair_larry 12y ago"A broad variety of memory corruption mitigations have been devised since the mid-1990s, and in the 2000s Microsoft has lead the way with advances including ASLR, DEP, and SeHOP." No, they didn't lead the way. PaX beat them by at least 5 years, yet they still take credit for this. They didn't even create the Windows version of ASLR in house. "including industry leading sandboxing" They're really going to claim that the Edge sandbox is better than Chrome, with no basis?
- wyldfire 12y ago> They're really going to claim that the Edge sandbox is better than Chrome, with no basis? Edge has yet to be exploited at Pwn2Own and Chrome gets exploited every year. Clearly that's a better record. ;)
- yeukhon 12y agoI will take it being sarcastic...otherwise, Edge has only been made available for less than two months.
- burnte 12y agoThis is just marketing puffery. The defense would be "Microsoft was the first to implement ASLR and DEP on Windows, and Edge's sandboxing is the best sandboxing technology available from any Microsoft browser product." Just like AT&T stating they have the "strongest" signal (which is a meaningless metric by itself), or car makers calling their car gets "40% better mileage!" and the * tells you "compared for a 1978 AMC Pacer."
- zyx321 12y agoHas the Win 8 app store sandbox been broken? There's a "Win8 RT Jailbreak" on XDA, but the author says there's no risk of regular apps compromising your system using the same exploit.
- rmtew 12y ago> The largest change in Microsoft Edge security is that the new browser is a Universal Windows app. .... This provides the user and the platform with the confidence provided by other Windows store apps I see it's going to be a Windows Store app. I wonder how this will affect the usability for people like myself, who never see the metro side of windows unless I accidentally move the mouse near the wrong side of the screen, or accidentally hit the Windows key. Any time I see a metro app like the horrendous metro version of Windows Update, I moan that it's there like a false positive, close it and find the normal version that isn't awkward to use.
- cobalt 12y agoWidnows 10 does not have fullscreen apps like windows 8 did
- ossreality 12y agoThis is categorically incorrect.
- AdeptusAquinas 12y agoOr rather fullscreen view is now optional.
- joshuapants 12y agoThat said, a lot of modern apps are really annoying to use even when windowed.
- stokedmartin 12y agoFeatures built or under consideration [0] [0] http://dev.modern.ie/platform/status/ http://dev.modern.ie/platform/status/
- craigds 12y ago> Microsoft Edge provides no support for VML, VB Script, Toolbars, BHOs, or ActiveX. Years too late of course, but good to see this finally happening.
- haswell 12y agoThis is definitely a case of "better late than never", IMO. Microsoft browsers will always have a foothold in enterprise environments, and the prospect of developing against a "real" browser when working with enterprise customers is rather exciting.
- adventured 12y agoMicrosoft ships their browser on 250-300 million new PCs and tablets every year, or roughly 200% more computing devices than in 1999. Most of those go to consumers. I'd say Microsoft will continue to have a foothold (of some scale) with consumers by default as well, even if it's just 10%-20% of PC/laptop/surface consumers that will use the Microsoft browser by default, that becomes a big installed base.
- ethana 12y agoThere are people that swear by VB script. But new extension engine would be nice.
- JoshTriplett 12y ago> There are people that swear by VB script. And many more who swear at VBScript...
- velodrome 12y agoVBScript needs to die. Microsoft has been trying to kill anything VB-related for years. It's a zombie. The guys who swear by it are not programmers. Sorry.
- Navarr 12y agoBut you know, new Microsoft proprietary "Microsoft Passport" authentication stuff >|
- jedberg 12y agoHaving met the engineers who actually built Edge, I can say with some confidence that I think this will the Microsoft browser people actually like. They built it from the ground up with security in mind, and with standards compatibility at the expense of backwards compatibility. In other words, they have finally decided that it is ok to tell their lagging enterprise customers to get with the times.
- ossreality 12y agoYeah, I've met some of them too. Edge is still slow and missing a thousand niceties that everyone takes for granted in Firefox and Chrome.
- joshuapants 12y ago> In other words, they have finally decided that it is ok to tell their lagging enterprise customers to get with the times. Well, they're still maintaining IE as a separate browser for those corporate users who rely on it, but it is a first step toward that.
- JustSomeNobody 12y agoI thought they started with IE and cut out parts. That's not ground up.
- Osiris 12y ago> But Microsoft Edge has done more than just re-write the rendering engine... > Microsoft Edge hosts a new rendering engine, Microsoft EdgeHTML > The largest change in Microsoft Edge security is that the new browser is a Universal Windows app. Everything they'd said in their press releases, including this one, says that the browser is a completely rewrite from scratch, though leveraging lessons learned on security. edit: I stand corrected. Is there evidence that the application (Edge) itself is based on IE or just the rendering engine?
- azakai 12y agoActually, the information said that they forked their existing rendering engine, and started to remove all the cruft they didn't care about any more. That led to a lot of new code and faster development - but it isn't entirely from scratch. edit: See for example http://en.wikipedia.org/wiki/EdgeHTML http://en.wikipedia.org/wiki/EdgeHTML that mentions it beginning as a fork of Trident.
- ethana 12y agoI was hoping they would open source Edge at Build, but that was a bit optimistic of a time frame. There are still core components yet to be finished. Hope it will get done soon and have a solid code base to be released as open source.
- bobajeff 12y agoThey don't seem to want to open source it. When I asked, they told me that they had no plans to and now they are hand-selecting companies to contribute code to their engine.
- kijin 12y agoA bit off topic, but I really hope that Microsoft and Samsung have reached some sort of understanding regarding the name "Edge". A trademark dispute involving their new browser is the last thing Microsoft needs at this time. It was confusing enough when they had to change SkyDrive to OneDrive.
- vinceyuan 12y agoI don't think it is a problem. The new browser's name is not Edge. It's 'Microsoft Edge'. The samsung phone's name is 'Galaxy Edge'. Now tech companies like to use the compound name, e.g. Apple Watch, to avoid the trademark issue.
- kijin 12y agoSkyDrive was Microsoft SkyDrive too, but the British court ruled that it infringed BSkyB's trademark.
- yeukhon 12y agoWell, the "Edge" actually reminds me of Lenovo Edge series, because on the laptop it marks "Edge".
- akandiah 12y ago> building a sun porch onto your house without locking the door to the sunporch Love the tongue-in-cheek swipe at Java applets. Perhaps I'm reading too much into this line.
- latiera 12y agoI don't see anything safer here, same old garbage + snake oil. Sandboxes are totally useless when the kernel is riddled with exploitable bugs. ASLR 64bit bla bla is totally useless when you have a million information leak bugs. Somebody wake me up when they implement an entire browser 100% in a memory safe language and there's no way to hit kernel surface from there.
- johnwfinigan 12y ago"Microsoft Edge is also 64-bit, not just by default, but at all times when running on a 64-bit processor." After 32-bit Windows Server went away as of 2008 R2, I didn't expect MS to keep shipping 32-bit client for this long. Anybody have a convincing argument as to why? 16-bit legacy apps in large businesses? Obviously it's not free to do this, especially since they'll be producing every patch for two PC platforms for probably another decade.
- wtallis 12y agoDrivers would be the only justification. If they really cared about 16-bit apps they would have supported them on 64-bit Windows: it's only real mode and virtual 8086 mode that are hard to support on a 64-bit OS; 64-bit compatibility mode can handle 16-bit protected mode software just as easily as 32-bit software. Additionally, virtualization works fine for application-level code, but not drivers.
- zvrba 12y agoMy guess: compatibility with existing ActiveX and BHO plugins.