July 09, 2004

You know you've got a browser problem when …

CERT and even Slate say that users should switch to another browser until IE is secure

The U.S. Department of Homeland Security, otherwise known as Dancing with Big Brother, tells the world to stop using the Web browser you fought long and hard to tie into your operating system. That’s what happened to beleaguered Microsoft when the department's Computer Emergency Readiness Team (CERT) recently recommended users switch to alternate browser platforms to avoid the security holes in IE caused largely by ActiveX.

And Microsoft isn’t objecting. Microsoft's own Slate even posted an article advocating Firefox, a Mozilla offshoot, in favor of IE until Microsoft gets its security act together.

Naturally, those alternate browser platforms have leaped on this opportunity with enthusiasm. Apple, Mozilla, and Opera jointly announced their development of an extension to their plug-in API that will handle ActiveX scripts differently -- and apparently more securely -- than IE does. All this work is being done in conjunction with Adobe, Macromedia, and Sun Microsystems, specifically to allow support for the companies' plug-in versions of PDF, Flash, and Java. 

I stopped using IE almost a year ago after downloading Mozilla and finding that it really works. But taking a cue from Slate, I downloaded Firefox, and frankly, I’m hooked. First, there’s no support for ActiveX, which is fine by me. It even blocks executable downloads by default -- which can be a pain until you figure out how to change it. If you really need ActiveX, you can always run IE just for that specific site visit.

What got me about Firefox is that it’s obviously the result of folks who haven’t given up on improving the Web browsing experience. Microsoft hasn’t made any major functional changes to IE in several years -- aside from opening additional security holes. Firefox doesn’t contain any miracle features either, but that tabbed browsing feature shows it is at least still thinking. Tabbed browsing is like Web browsing through an Excel workbook. You can load several sites in several tabs and then flip through much more easily than if they were all separate windows.

Frankly, though, Mozilla beating Microsoft at browser functionality is to be expected. After all, since its inception, Mozilla has been thinking of nothing else, whereas Microsoft dusted itself off after the 1990s browser wars and victoriously marched off to different frontiers. The question isn’t, Which is the best browser? It is, Does it make sense to go through the trouble of a browser swap on a corporate level?

The answer: Hell, yes. If you’ve got even just a semi-decent software distribution mechanism as part of your Windows desktop management tool kit, then installing Firefox is well-worth the effort. User training is either minimal or nil depending on your users’ PC literacy level. The security benefit is huge. The only downside is ActiveX.

In my networks, the only site that requires ActiveX is Windows Update. Because we instituted a centralized patch management schema, however, users don’t have the Windows Update service installed any longer, so I’m not worried. But that’s me. Plenty of businesses require access to any number of sites that may be running ActiveX plug-ins exclusively.

If that’s you, then educating users to load IE only when visiting those sites may or may not be an option. Configuring desktop shortcuts to those sites, using IE, and steering users to the Firefox or other browser icon for general Web browsing is one method, although hardly guaranteed. Discussing the situation with the companies behind those sites is certainly an idea, and it never hurts to look for alternatives. The point is that the browser is back on IT radar.

Microsoft has too many problems in IE to fix them with just another patch. To regain my trust, the company must release an entirely new platform, and that’s not happening anytime soon. In the meantime, Firefox is a godsend, and those folks looking to do Web business solely on ActiveX better revamp their business plans.

Sign up to receive Networking Resource Alerts

Subscribe to the Technology: Networking Newsletter

The one-stop resource center for IT professionals.

©1994-2009 Infoworld, Inc.