IE Blog

You're right, looks like it did have an installable debugger way back when: http://www.rdwarf.com/users/wwonko/jscript/jsd.pdf Although the Developer Toolbar had dom explorer and all that jazz, way more than a console, it really was amazing when I first used it. Here's the release blogs: https://blogs.msdn.microsoft.com/ie/2005/09/16/developer-toolbar-for-i… https://blogs.msdn.microsoft.com/ie/2007/05/10/internet-explorer-devel…

And for some historical context for Microsoft's position on codecs in HTML5 video, see these posts on the IE blog by Dean Hachamovitch from 2010 and 2011: https://blogs.msdn.microsoft.com/ie/2010/04/29/html5-video/ https://blogs.msdn.microsoft.com/ie/2010/05/03/follow-up-on-html5-vide… https://blogs.msdn.microsoft.com/ie/2011/02/02/html5-and-web-video-que… I don't think Microsoft's approach with HTML5 video codec licensing can be faulted. You really do have to be careful about the licensing issues and it's more complicated than in an ideal world it should be. Today Microsoft Edge supports VP9 video (by default only when hardware acceleration is available). Hopefully AV1 can establish itself without any serious patent licensing problems and the complicated licensing around web video will be a thing of the past.

I have several somewhat orthogonal thoughts on this: 1. This is exactly what I've feared and suspected about JPEG-XR, webp, and JPEG-2000 (which Safari ever so quietly supports). I especially wondered about JPEG-XR after reading how Microsoft had done some great things with GPU-based hardware acceleration for JPEG decoding in IE11: https://blogs.msdn.microsoft.com/ie/2013/09/12/using-hardware-to-decod… I was puzzled by the fact that they never mention JPEG-XR and have never published a similar post about hardware acceleration for the more modern format. They've been incredibly lazy and unfocused on XR for years. It's effectively dead now. 2. The author of the don't use it post keeps saying it gets "software decoded". This implies that this is unusual. But it isn't. Does he think JPEGs are not software decoded? They are in Firefox, and probably every other browser but IE11 and Edge. Someone correct me if I'm wrong. Browser makers have been surprisingly inert on using GPUs for image decoding. libjpeg-turbo is used by Chrome and Firefox, and possibly Safari. It's pure CPU, albeit with some SIMD. That's "software decoding". Hardware acceleration normally means GPU, or a fixed function unit/ASIC like you see for some video codecs. 3. One percent? This was all about a -1% drop in some metric? What's the error margin? 4. He implies that there's a lot of JS in this SPA. This seems like a possible confound that won't…

> By the way iOS is the only popular operating system I know that doesn't allow to execute files downloaded from web or emails. Windows 8, 8.1, and 10 don't allow it either. SmartScreen will block unsigned executables by default[0]. Enterprise customers should be using AppLocker which does a lot of what SmartScreen does, but with more flexibility and control. The issue arises when [bad] System Administrators disable SmartScreen because it is a "hassle" and don't deploy AppLocker in its place. This effectively sends their users back to a Windows 7 level of security. If Microsoft forced either SmartScreen OR AppLocker, then we'd have people on here screaming about freedom, Microsoft is evil, "Embrace, extend and extinguish," year of the Linux desktop, and so on. This is the best they can without treating System Admins like babies (even when they're going to use that power for "evil"). [0] https://blogs.msdn.microsoft.com/ie/2012/08/14/microsoft-smartscreen-e…

This is a change in Chrome, so I doubt it affects windows. Also, EV certificates are for bypassing reputation checks for smartscreen[1], not for UAC dialogs. If the user has smartscreen disabled, there's no difference. [1] https://blogs.msdn.microsoft.com/ie/2012/08/14/microsoft-smartscreen-e…

Has nothing to do with what I said. IE couldn't handle XHTML until IE9 https://blogs.msdn.microsoft.com/ie/2010/11/01/xhtml-in-ie9/

> EV certificates is probably for auto-trust for smartscreen. Yes, that's correct. EV just skips the reputation building phase. Source: https://blogs.msdn.microsoft.com/ie/2012/08/14/microsoft-smartscreen-e… > Programs signed by an EV code signing certificate can immediately establish reputation with SmartScreen reputation services even if no prior reputation exists for that file or publisher.

It looks like fairly standard JS to me. I don't know where to read about it but there are some details on the deprecation blog article: https://blogs.msdn.microsoft.com/ie/2008/10/16/ending-expressions/

IE 10 supports an ealier version of CSS Grid Layout: https://blogs.msdn.microsoft.com/ie/2011/04/14/ie10-platform-preview-a… or you can use a polyfill: https://github.com/FremyCompany/css-grid-polyfill/

I would check if something in the signing process is going wrong, refer to this (very long) SO thread: https://security.stackexchange.com/questions/109629/deprecation-of-sha… We actually switched certificates (from StartCom to Globalsign) and the signing was wrong at first, so the message kept showing. When we fixed it, it went away immediately, even though certificate and author name changed... Here's the article:https://blogs.msdn.microsoft.com/ie/2012/08/14/microsoft-smartscreen-e… "Programs signed by an EV code signing certificate can immediately establish reputation with SmartScreen reputation services even if no prior reputation exists for that file or publisher."

Chrome has been prefetching & prerendering links since 2013. IE11 has also been prefetching & prerendering as well since 2013 ( https://blogs.msdn.microsoft.com/ie/2013/12/04/getting-to-the-content-… ) So it's not only possible to do, they've literally been doing it for 5 years now. Firefox doesn't appear to do prerendering, but it will happily prefetch as well and has since Firefox 23. AMP's cap on file sizes and other limitations helps these relatively ancient prefetching & prerendering work better, but you don't need AMP to get preloading. Not at all.

Soon after this was posted, I presume that Browsium was ordered by MS legal to stop using IE6 binaries. When EMIE was created two years later, "avoiding many performance, security, and other problems associated with running older Internet Explorer 8 binaries." was mentioned in https://blogs.msdn.microsoft.com/ie/2014/04/02/stay-up-to-date-with-en…

That's right, they don't have a pinning mechanism for site operators. They have something called Certificate Reputation[1] which works alongside SmartScreen and should theoretically be of use for attacks like this, but I haven't heard much about it and I don't know if it helped here. [1]: https://blogs.msdn.microsoft.com/ie/2014/03/10/certificate-reputation-…

You mean what was done in IE8 six months before Chrome? https://blogs.msdn.microsoft.com/ie/2008/03/11/ie8-and-loosely-coupled… More seriously—it's somewhat sad to see Chrome get all the credit for this, when it's undoubtedly the case that both IE and Chrome were working on this at the same time.

Some browsers might try to sniff the mime type, so an additional header would help : "X-Content-Type-Options: nosniff"[1] 1. https://blogs.msdn.microsoft.com/ie/2008/09/02/ie8-security-part-vi-be…

Microsoft introduced a similar feature in 2010. In that scheme, "file identifier" and the signature, if the application is signed, is sent to a cloud service [1][2][3]. Therefore they can track attempts for downloads, without having to know the URL itself. [1] https://blogs.msdn.microsoft.com/ie/2010/10/13/stranger-danger-introdu… [2] https://blogs.msdn.microsoft.com/ieinternals/2011/03/22/everything-you… [3] https://blogs.msdn.microsoft.com/ie/2011/03/22/smartscreen-application…

It's been true for a while on Windows, going back to IE9: https://blogs.msdn.microsoft.com/ie/2011/03/28/browser-power-consumpti…

Supported at least since IE 8 (2009) [1], not sure how multiple instances behaved before. [1] https://blogs.msdn.microsoft.com/ie/2009/05/06/session-cookies-session…

Not sure why you're being downvoted. WebKit actually implements the WHATWG HTML parsing algorithm [1], and so do Trident [2] and Gecko [3]. The W3C HTML 4 spec didn't waste a word on parsing and simply referred to SGML [4], which (for very good reasons) no relevant browser actually implemented. Obviously, browser developers did some crazy/remarkable things before the WHATWG came along, but a lot of credit for today's lenient HTML parsing certainly belongs with the WHATWG. [1] https://webkit.org/blog/1273/the-html5-parsing-algorithm/ [2] https://blogs.msdn.microsoft.com/ie/2011/07/06/html5-parsing-in-ie10/ [3] https://hacks.mozilla.org/2010/05/firefox-4-the-html5-parser-inline-sv… [4] https://www.w3.org/TR/html4/conform.html#h-4.2

SmartScreen is Microsoft's reputation system used both in IE (since IE9), Edge, and Windows 8 and 10. [1] is an introductory blog article about the system in general, revealing among other things that both the executable and the cert it's signed with gather reputation. [2] goes into some more detail on code signing, and [3] talks about EV certs (basically they are a massive reputation boost, both starting you higher (high enough to bypass the warning) and letting you gain reputation faster). A regular code signing cert can be bought for about $6/month, and an EV cert for about $25/month (if you shop around or buy multi-year certs). Both are expensive in the context of open source, but I'm not sure I'd call the cost prohibitive. 1: https://blogs.msdn.microsoft.com/ie/2010/10/13/stranger-danger-introdu… 2: https://blogs.msdn.microsoft.com/ieinternals/2011/03/22/everything-you… 3: https://blogs.msdn.microsoft.com/ie/2012/08/14/microsoft-smartscreen-e…

I wonder what do you mean by "not useful"? They just have to participate in the reputation system, but that's an issue only when the certificate is young. Here's an excerpt from MSDN: > Detractors may claim that SmartScreen is “forcing” developers to spend money on certificates. It should be stressed that EV code signing certificates are not required to build or maintain reputation with SmartScreen. Files signed with standard code signing certificates and even unsigned files continue to build reputation as they have since Application Reputation was introduced in IE9 last year. However, the presence of an EV code signing certificate is a strong indicator that the file was signed by an entity that has passed a rigorous validation process and was signed with hardware which allows our systems to establish reputation for that entity more quickly than unsigned or non-EV code signed programs. Source: https://blogs.msdn.microsoft.com/ie/2012/08/14/microsoft-smartscreen-e…

I'm not sure about this named capture group proposal. The idea behind the proposal is that regexp engines parse using the old grammar, but if a GroupName is found, re-parse using a different grammar: If the result of parsing contains a GroupName, reparse with the goal symbol Pattern[~U, +N] and use this result instead. But "the result of parsing" by definition cannot contain a GroupName because GroupName is not part of the initial grammar. Furthermore it appears that the named capture group backreference syntax `\k<groupname>` is in fact valid under the "old" (no-named-capture-group) syntax. Thus the interpretation of `\k<groupname>` depends on the future parts of the expression, similarly to how `\3` can be an octal escape or a backreference depending on the rest of the expression. JS regexp parsing is already underspecified [1] and requires two passes to disambiguate backreferences from octal escapes. Now it appears we potentially need a third pass to disambiguate named capture groups. [1]: https://blogs.msdn.microsoft.com/ie/2010/08/25/chakra-interoperability…

A two-tier JIT. Interesting to see tiered JIT compilation catch on the way it has. I seem to remember a few years ago reading that the Java HotSpot team had given up on tiered JIT compilation as being not worthwhile. How far we've come. A whirlwind tour of todays JITs (apologies for the million links): .Net Core seems not to use tiered compilation. It never interprets the IR; everything is run through the same JIT compiler. https://github.com/dotnet/coreclr/issues/4331 HotSpot uses three tiers these days (counting direct interpretation as a tier) - https://docs.oracle.com/javase/8/docs/technotes/guides/vm/performance-… JavaScriptCore/Nitro seems to use four - https://webkit.org/blog/3362/introducing-the-webkit-ftl-jit/ Edge's Chakra engine has two - https://blogs.msdn.microsoft.com/ie/2014/10/09/announcing-key-advances… V8 seems to use two - https://v8project.blogspot.co.uk/2017/05/launching-ignition-and-turbof… Firefox's SpiderMonkey JS engine uses two - https://developer.mozilla.org/en-US/docs/Mozilla/Projects/SpiderMonkey…