In-Depth

Behind the (IE)8 Ball

Under pressure from competitors in a high-stakes game, Microsoft is releasing Internet Explorer 8. But will the new browser scratch or run the table?

• By Doug Barney
• 05/01/2009

Windows 95 to Windows 7-Internet Explorer quickly gained dominant market share.

The Netscape crew was loath to give in, however. Turning the browser code over to open source developers resulted in the increasingly popular Firefox. More recently, Google Inc. unveiled the more-or-less built-from-scratch Chrome.

IE market share, while still the majority, is falling rapidly. Does IE8 have the goods to keep Microsoft in the game? We went to the best source we could find: you, the Redmond reader. More than 50 of you responded to our queries, and we talked in-depth to a dozen of the respondents who've spent the most time with the new browser.

This article was reported throughout the IE8 development process. Fortunately, the final version of IE8 shipped just as we were going to press, which answered some key questions about stability, performance and compatibility. Where the beta and release candidate (RC) were troublesome, the shipping product is aces, say many Redmond readers. Users report few crashes and increased speed in nearly all cases, and the bulk of Web sites and add-ins work just fine.

Protecting Privacy
Microsoft spent a lot of time securing the browser against hackers, but it's also working to secure your privacy through InPrivate, a feature that makes sure no cookies or history are left that point to where you've been.

While this seems like a tool designed for teenage boys, many of us care about our privacy, and we at least like the option of covering our tracks. Redmond readers we talked to seem less concerned, and many are downright skeptical as to whether it can actually work. "I'm not ashamed of where I surf! I might use it for checking my online bank accounts. I imagine it might be more secure ... I think. Maybe. It's also fairly easy to erase your browsing," says reader Daniel Marois.

In corporations, there seems to be less of a fit. "Even though this feature can be turned off using Group Policy, there's always the chance that the setting might not apply or Group Policy corruption may occur. Organizations that have traffic logging at the gateway have less to worry about," says David J. Calabro, information systems administrator for Transitional Work Corp. "I don't see any benefits from the corporate side. It would be nice if IE could be custom installed without this feature at all."

Redmond reader Saul Saturn sees InPrivate as offering only partial privacy. "I have nothing to hide, and if I did, I'd want to manually clean up. This feature presents a false sense of security given the ISP or firewall would have some indication of your activity. So [while] the next person that logs on to your machine won't have access to your history, the system administrator will definitely have access if they want," says Saturn.

Slicing the Web
Many of us visit Web sites based on search, but I'm sure every last one of you has a big batch of bookmarks and visits many of the same sites every day. So how do you know what's new? Do you search around, hunting and pecking for the fresh content?

Microsoft has an answer. Web Slices alert visitors of changes made to sites. If the changes intrigue, visit; if not, skip to another site. As cool as this seems, none of the readers interviewed was excited about it.

"I read up on these several times, and I'm having trouble mastering how to use them. I think they'd be a good feature if I could just get the hang of them," says Bernie Parsons, IT manager for Buys4Us.

Saturn is even less impressed. "This is an interesting feature but I think it's toppled by poor implementation, as it relies on the IE RSS feature, which is just inadequate and unusable," Saturn explains.

Tackling Tabs
Firefox gets credit for browser tabs, and now through an add-on, Firefox users can group their tabs. IE8 has this feature built right in, and users like it. "I initially thought this feature was a gimmick, but I like color grouping more as I've used it. I definitely like that new tabs open within their group, rather than at the far right," says reader David B. Nickason, who handles IT for a law firm.

Marois learned the ins and outs of grouping from Firefox. "I use colorful tabs on Firefox right now, though I must admit that you have to have many pages open in order for this feature to be really useful," he says. "So far, my experience has been so-so with a large number of tabs."

Cooling Crashes
Firefox users on Windows are probably familiar with its recovery features. When Windows crashes, Firefox saves all your tabs on the associated pages, an element IE8 is more than happy to duplicate. "This is my favorite feature and the most useful. Trying to get back to where you were, especially when you're doing research, can be frustrating," notes Marois.

Nickason has also seen IE8 recovery in action. "It works. I've had two or three crashes in the IE8 RC, and found the automatic crash recovery to be really useful," he explains. "Of course, it would be nice if the browser just didn't crash or hang, but this recovery feature is the next best thing."

Smarter Screens
Hackers don't always have to break into a machine to do damage; sometimes we invite them right in by going to bad Web sites or falling victim to phishing schemes. SmartScreen Filters recognize, block and alert users about these sites. "I like this feature, especially because so many Web sites are contaminated with malware. It has popped up the warning page a couple of times, and I chose not to access those sites," says Parsons.

The efficacy of such features depends on their accuracy. "[A feature like this is] always useful if it works properly," Marois notes. "You don't want it to block legitimate sites any more than you want it to miss bad ones."

Full Speed Ahead with Accelerators
Most Web sites are fairly static. You may see information you want to explore, but there are no links: the links are to things you don't care about. IE8 Accelerators aim to improve that situation. This tool can expand a bit of info -- say, a name -- to include a phone number, address and map. The associated information can be anything the Web designer desires. "The ability to select a word and look up the definition, or select a product name and get prices -- I can see tons of uses for accelerators in everyday browsing," says Nickason.

Accelerators may be one of the common ways many of us gather information. Nickason continues: "They have the potential to be one of the most useful features of IE8. I'll use them frequently to do things like look up definitions and find products. Doing these things from our firm's intranet site provides a good business use for Accelerators."

Of all the new features, Accelerators inspired by far the most response and the most honest enthusiasm. "Accelerators are an excellent way of increasing efficiency and finding information. My favorite is the Google Maps Accelerator. This as a great way for organizations to share information and get the information they need faster, if they're willing to create their own Accelerators," says reader Calabro.

Nash Browses IE Features

Once we had the customer view of Internet Explorer 8, Redmond lined up an interview with Mike Nash, Microsoft's corporate VP for Windows Product Management. Nash argues that IE8 is not just a great consumer browser, but has corporate features no other tool can match. Mike Nash, Microsoft's corporate vice president for Windows Product Management Nash on what IE8 has that helps the IT pro: The first thing is to make sure we have a high manageability of the browser. In particular, [we want to make] sure we have Group Policies as a way for the IT administrator to decide how the browser is going to be configured, because people are spending much more time in the browser running apps on the Internet and on the intranet. We can now support a hundred more Group Policy settings for browser deployment, configuration and customization. IT can specify the browser default-rendering mode: Is it compatibility mode by default, or is it standards mode by default? IT can configure which Accelerators and search providers are going to have control. IT can control the behavior of the SmartScreen Filter. We already had about 1,200 Group Policies before. Now, with 100 more, we've got about 1,300. The Group Policy work is part of the product by default. You have the ability to use the Group Policy management tools to control these things. There's a pretty healthy ecosystem of Group Policy templates out there, [such as] the ability to control connection limits, the ability to control in-private browsing, the ability to decide how compatibility is going to work. One of the key things is the continuing investment in the IE8 Administration Kit. In the enterprise, [the kit] gives me the ability to control what Accelerators are preinstalled, what Web Slices I want to have preinstalled and the language that's being used. As an IT pro, I may want to have multiple configurations of the browser. I may want to have one for the marketing department, with Accelerators that are appropriate for the marketing guys, and a different configuration for the finance department, with things that are appropriate for [it]. Combine [these configurations] with a new capability that we have between Windows and Internet Explorer called slipstream installation, which makes it very easy to configure and deploy IE8 in a customization that's part of a system image being deployed on desktops. If I wanted to build a custom image using Windows XP and IE7 today, that could take two or three hours. With Windows Vista and slipstreaming IE8, I can do that in about 15 minutes. On security in IE8: There are really two things. The first thing is reliability with security. From a reliability perspective, the thing we all have to remember is that in some sense, the browser is the place where a Web page executes. When those Web pages have issues, in the past the execution place was discredited. So a lot of work was done to reduce the ability for a Web page to bring a browser down. But we also changed the architecture so that when the Web site does impact the browser, rather than bringing the whole browser down, it's isolated to just the tab where the page was running. The second thing we've done is added something called the SmartScreen Filter. This is really based on a lot of the reputation charts we've built with the Microsoft Phishing Filter. We've all done a search for a word like "anti-spyware," and you're taken to a Web site that you think is a place where you can get an anti-spyware tool. Ironically, what people are doing is taking advantage of people in trouble and tricking them into loading more spyware. So we know what these sites are from our anti-phishing tool. We can actually use these to help use the browser to inform the end user that a Web site they might be going to is bad. Another security feature is a cross-site scripting filter. We've all talked about cross-site scripting as kind of an emerging threat, where you take script code from one page into another page. And this has been more and more of a threat in the way that personal information has been stolen-cookie stealing [and] other forms of identity theft. You think you're on your basic Web page, but in fact you're on a different page. [The cross-site scripting filter] is a way for us to stop those kinds of attacks. As part of that, remember, there's no one silver bullet with security. It's a number of different techniques, which together add up to be in-depth. With this approach, we have a new feature called clickjack prevention where I can actually tag my Web page to say I should never be embedded in another Web page. There's also data-execution protection in IE8. There's a form of attack where people inject code into a data buffer -- an unchecked data buffer -- and pass the data buffer with a piece of code that basically executes the code that was injected because of an unchecked buffer. With IE8, we can turn on data-execution prevention by default. Another security feature in IE8 is per-site ActiveX control. We all know that ActiveX controls are a very powerful way of programming Web sites. We also know that the ActiveX control for one site can be used in ways that [it wasn't] intended on another site. So now, with IE8, we can actually have a Web page ActiveX control that's only supposed to be used with a particular domain. -D.B.

But building Accelerators may be the rub. "It was a little confusing at first when trying to create my own Accelerator," Calabro adds. "It would be nice if page designers could tag chunks of information so we don't have to worry about users highlighting the correct text to use with an Accelerator. Something like <accelerator>123 my address st. city, state 12345</accelerator>, and when the user hovers or double clicks the information, it highlights and then shows the Accelerators to choose from."

Suggesting Sites
Microsoft must have thought it hit a home run with Search Suggestions. In some respects, Search Suggestions is like auto-fill on steroids. Similar to the embedded Google search box, as you type the system will suggest results. But readers interviewed just couldn't muster up a lot of emotion.

"I turned this off. I have enough experience to figure out what sites I need to go to, and I don't want to send any more browsing information out than I have to," says Craig Burgess, a systems and network administrator for healthcare firm Digital Infuzion Inc.

"I don't use this feature and don't like it. I'd rather do my own research and build my own site list via the links feature," says Parsons. And Nickason also gives the feature the ultimate diss: "I turned it off: not really interested."

Pushing Limits of Speed
One of the things drivers love about Porsches and IT pros love about Windows 7 is speed. IE8 is likewise pleasingly snappy. "It's very noticeably faster; most pages load a lot faster than they did in IE7," Nickason explains. "The scrolling issues with our intranet app in IE7 are gone -- IE8 scrolls as expected for all pages. Long delays or hanging when clicking links in RSS feeds are gone. This is a major improvement that justifies the upgrade all by itself."

Change IT Can Believe In
IT pros are rarely 100 percent happy with any piece of software, and IE8 is no different. Marois has a number of tweaks he'd like to see: "I'd modernize the interface without making it too busy. I'd remove its dependencies on the OS and make it completely modular. It should be completely removable." He adds, "I'd encourage more people to write add-ons or make it easier to do. I think existing add-ons for IE are somewhat uninspired."

User Nits
Some users don't like changes that impact compatibility. "I don't understand why Internet Explorer upgrades consistently cause Web applications to break or Web pages to render incorrectly. When upgrading from IE6 to IE7, most Web pages or Web applications required fixes to render and work properly," complains Saul Saturn. "You see the same updated Web pages or applications requiring additional changes to work properly under IE8."

Saturn sees this as an almost purely Microsoft issue. "Each browser upgrade shouldn't prevent a Web page from rendering properly when it worked perfectly under the previous browser version. I use other browsers such as Firefox and Chrome, and can confirm this rarely happens with those browsers," he explains.

Alleviating Admin Angst
In a pure feature-by-feature comparison, competitors such as Firefox match or arguably exceed the IE feature set. But IE is part of a Microsoft system that includes admin and update tools; tools that ease the management and development of pages and apps. These tools have a material affect on browser security, argues Nickason. "I don't agree with the blanket statement that Firefox is more secure than IE," he says. "As the network admin for a small firm with about 30 client PCs, I can open the Windows Server Update

Services console and immediately verify that IE is fully patched on every user's PC. I have no clue of the status of the Firefox installs on those same machines, unless I visit each one and check it manually. I know there are enterprise products that serve this purpose for Firefox, but for businesses whose IT budgets don't support such tools, IE is much more likely to be patched, making it the more secure option. I'd rather browse in Firefox than IE, but I'd much rather support IE," Nickason adds.

Bottom Line
There are two sides to every coin, and in the case of Microsoft, two sides to every browser. "If Web sites don't require IE8 for new specific functionality, I wouldn't bother updating to IE8 for any of the new features," reader Saturn says. "I'm more than happy with IE7, Firefox 3.x and Chrome. Personally, I think IE has continued to play catch-up with these other browsers.

"For example," Saturn adds, "the look and feel of IE8 is not much different from IE7. What happened to the ribbon? The Back, Forward, Home and Print buttons are all over the place. Firefox 3.x and Chrome have a much better, more intelligent user interface. The IE8 feature with the address bar auto-complete is a simple catch-up to Firefox and Chrome."

Yet some see IE8 as the beginning of a Microsoft browser rebirth. "IE8 is going to be a welcome improvement that addresses all my complaints about IE7," says Nickason.