Simon Willison’s Weblog


25 items tagged “ie8”


Why, for a decade of experience, can we not seem to see the IE 8 zombie coming? It’s not like it’s going to be some big surprise that unless we do something different, we’ll still be supporting it in 2015. That’s right: in 2015, you’ll still be thinking about a browser that doesn’t support canvas or video and doesn’t even have a JITing JS engine.

Alex Russell

# 11th October 2010, 11:01 pm / alex-russell, ie8, internet-explorer, recovered


Major IE8 flaw makes ’safe’ sites unsafe. IE8 has an XSS protection feature which rewrites potentially harmful code in HTML pages—I think it looks for suspicious input in query strings which appears to have been output directly on the page. Unfortunately it turns out there’s a flaw in the feature that can allow attackers to rewrite safe pages to introduce XSS flaws. Google are serving all of their pages with the X-XSS-Protection: 0 header. Until the fix is released, that’s probably a good idea.

# 22nd November 2009, 3:34 pm / ie8, microsoft, security, vulnerability, xss, xssfilter

Pwn2Own trifecta: Hacker exploits IE8, Firefox, Safari. You just can’t trust browser security: Current versions of Safari, IE8 and Firefox all fell to zero-day flaws at an exploit competition. None of the vulnerabilities have been disclosed yet.

# 19th March 2009, 3:30 pm / browsers, firefox, ie, ie8, pwn2own, safari, security

Ehy IE8, I Can Has Some Clickjacking Protection? (via) IE8 has built-in protection against clickjacking, but it’s opt-in (with a custom HTTP header) and IE only. It turns out the usual defence against clickjacking (using framebusting JavaScript) doesn’t work in IE as it can be worked around with a security=“restricted” attribute on an iframe.

# 29th January 2009, 1:39 pm / clickjacking, http, ie, ie8, iframes, javascript, security


IE8 Security Part IV: The XSS Filter (via) IE8 will include an XSS filter to identify and neutralise “reflected” XSS attacks (where malicious code in a query string is rendered to the page), turned on by default. Sounds like a good idea to me, and site authors can disable it using Yet Another Custom HTTP header (X-XSS-Protection: 0).

# 3rd July 2008, 9:37 am / http, ie8, internet-explorer, microsoft, security, xss, xssfilter

Google’s excanvas only works in quirks mode for IE8. IE8 in act-as-IE8 mode disables VML but doesn’t implement canvas, so there’s currently no 2D drawing method for that browser. UPDATE: The problem is Google’s excanvas library, not IE8 disabling VML; see comments.

# 30th March 2008, 6:24 pm / burningbird, canvas, excanvas, ie8

IE8 speeds things up. Steve Souders notes that IE8 downloads script files in parallel before executing them sequentially, giving it a significant speed boost over other browsers that download sequentially.

# 11th March 2008, 5:42 am / browsers, ie8, performance, steve-souders

JavaScript in Internet Explorer 8. John Resig’s analysis. News to me: IE 8 doesn’t support the W3C event model—I had assumed that would be a priority.

# 6th March 2008, 11:59 pm / ie8, javascript, john-resig, standards

Internet Explorer 8 Readiness Toolkit. The new built-in development tools look similar enough to Firebug to make me very happy. Also of interest: Selectors API (for fast getElementsBySelector), CSS 2.1 support, support for XHTML style namespaces in HTML, an interesting Web Slices feature based on the hAtom microformat and 6 connections per host (up from 2) which should make Comet easier.

# 5th March 2008, 6:28 pm / comet, css, hatom, ie8, javascript, microformats, namespaces, selectors, standards

Table-Based Layout Is The Next Big Thing. Kevin Yank points out that the inclusion of display:table in IE 8 will finally open up a powerful tool for creating CSS layouts that has so far been mostly ignored.

# 4th March 2008, 11:01 pm / css, displaytable, ie8, kevinyank, tables

Principles and Legality. Eric Meyer notes that language about legality in Microsoft’s recent IE announcement suggests that Opera’s much criticised EU threat may have helped positively influence the result.

# 4th March 2008, 7:45 pm / ericmeyer, ie8, legal, microsoft, opera, standards

We've decided that IE8 will, by default, interpret web content in the most standards compliant way it can. This decision is a change from what we've posted previously.


# 4th March 2008, 3 am / ie, ie8, internet-explorer, web-standards

Sunsetting Quirks Mode. Apparently proper standards support in IE (or at least the IE8 renderer) will be triggered by the HTML5 doctype, providing an alternative to those who don’t wish to pollute their markup with an IE-specific meta tag.

# 23rd January 2008, 2:56 pm / browsers, doctypes, html5, ie8, internet-explorer, sam-ruby, xuacompatible

Legacy. James Bennett has what I think is the most interesting analysis of the X-UA-Compatible header to date.

# 23rd January 2008, 2:14 pm / browsers, ie8, internet-explorer, james-bennett, web-standards, xuacompatible

If Web authors actually use this feature, and if IE doesn't keep losing market share, then eventually this will cause serious problems for IE's competitors — instead of just having to contend with reverse-engineering IE's quirks mode and making the specs compatible with IE's standards mode, the other browser vendors are going to have to reverse engineer every major IE browser version, and end up implementing these same bug modes themselves.

Ian Hickson

# 23rd January 2008, 10:07 am / browsers, hixie, ian-hickson, ie8, internet-explorer, web-standards, xuacompatible

HTML 5 published as W3C First Public Working Draft! A significant step, almost completely overlooked in the hubbub over IE8.

# 23rd January 2008, 2:15 am / html5, ie8, web-standards, whatwg

No matter what great leaps forward the Internet Explorer team make from now on, the majority of developers won’t use them and the majority of users won’t see them. By doing this the Internet Explorer team may have created their own backwater, shot themselves in the foot and left themselves for dead.

Andy Budd

# 22nd January 2008, 9 pm / andy-budd, ie8, internet-explorer, xuacompatible

<META HTTP-EQUIV="X-BALL-CHAIN">. Mozilla hacker Robert O’Callahan discusses the technical implications of freezing copies of older rendering engines, including the increased footprint and the terrifying prospect of documents in different rendering modes communicating through iframes and the DOM.

# 22nd January 2008, 6:55 pm / browsers, dom, ie8, mozilla, roberto-callahan, xuacompatible

Broken. Jeremy highlights the fly in the ointment: if you want IE 8 to behave like IE 8 (and not pretend to be IE 7), you HAVE to include the X-UA-Compatible header.

# 22nd January 2008, 6:42 pm / ie8, jeremy-keith, web-standards, xuacompatible

The versioning switch is not a browser detect. PPK: “In other words, the versioning switch does not have any of the negative effects of a browser detect.”

# 22nd January 2008, 4:34 pm / browserdetect, browsers, doctypeswitching, ie8, internet-explorer, ppk, web-standards, xuacompatible

Like DOCTYPE switching did in 2000, version targeting negates the vendor argument that existing behaviors can't be changed for fear of breaking web sites. If IE8 botches its implementation of some CSS property or DOM method, the mistake can be fixed in IE9 without breaking sites developed in the IE8 era. This actually makes browser vendors more susceptible to pressure to fix their bugs, and less fearful of doing so.

Eric Meyer

# 22nd January 2008, 2:24 pm / browsers, doctypeswitching, ericmeyer, ie8, internet-explorer, web-standards, xuacompatible

Beyond DOCTYPE: Web Standards, Forward Compatibility, and IE8. This has huge implications for client-side web developers: IE 8 will include the ability to mark a page as “tested and compatible with the IE7 rendering engine” using an X-UA-Compatible HTTP header or http-equiv meta element. It’s already attracting a heated debate in the attached discussion.

# 22nd January 2008, 12:40 pm / browsers, http, ie8, internet-explorer, web-standards, xuacompatible

IE7.js version 2.0 (beta). Dean Edwards has updated IE7, shifting enhancements that weren’t fixed by the real IE7 in to a new script called IE8. You can also now hotlink the library directly from Google’s servers, though I don’t know how intended Google Code’s subversion repository is for that purpose.

# 6th January 2008, 11:15 pm / deanedwards, goode, google-code, ie7, ie8, javascript


IE8 Passes Acid2 Test. This is huge. As Kevin Yank points out, this means IE8 includes proper support for the object tag, CSS table layout properties and generated content.

# 20th December 2007, 3:11 pm / acid2, css, generatedcontent, ie8, kevinyank, object, tablelayout, web-standards

Conversation with Bill Gates about IE8 and Microsoft Transparency. Molly asks the tough questions about IE8—it looks like there should be a lot of IE8 material at MIX08 next year.

# 6th December 2007, 11:47 am / bill-gates, ie, ie8, microsoft, mix, molly-holzschlag