Google finally dropping support for IE6 on their sites. Maybe this will encourage people to move away from that awful browser (version).

Did Vista ship standard with version 7 of IE? It's nice to have a big vendor start to force the clueless to update, but IE 7 is also still a big POS. The fact that IE in general is lack-lustre aside, IE 8 just works better with all the CSS I've ever had to develop (for starters).

MSFT should really have insisted on updating IE6 to one of the newer versions in one of its many security updates. Most customers blindly update all their other MS stuff.

They did, didn't they? The IE6 constituency now is the people who don't run Windows Update -- plus (allegedly) those corporate users whose IT departments go out of their way to prevent the update to preserve compatibility with in-house web applications.

Peter

Really? My wife's corporate notebook had updates turned on but was still running IE6. As far as I'm aware they don't run any browser-version dependent software. Their crap software is all third-party and runs outside the browser. Lotus and/or some Netware garbage I think.

I gave her my old PowerBook, so we're all OK now at least within the home.

Windows Update does try to make you to upgrade to a newer version of IE. Does her notebook go to the main Windows update site or does it use a corporate WSUS server? You can block updates from being offered.

Like Trevor said, in the IT departments I've worked in, they would decide when to push updates out, after testing them to make sure they worked with any proprietary software or the network in general.

So yes, Windows Update most certainly pushes out Internet Explorer updates. It always has. But sadly, as Peter says, I've seen way too many people who simply leave that little yellow shield in their system tray untouched. I just installed Vista Service Pack 1 on someone's computer yesterday, and I had to leave before I could install SP2.

IE8, if I remember correctly, had serious problems in the beginning, though. I know several people who updated and suddenly couldn't visit a great number of sites anymore. Instead they'd just get a blank white screen with no error message. Fortunately, IE8 is the first version I can remember that was as easy to uninstall as any other application (listed in Add/Remove like anything else), and the OS would revert to IE7. I recommended that for many people until the browser got straightened out.

IE8 is okay now, but it's still so very annoying. I particularly hate the initial screens you get after installing it. You're forced to walk through about 8 different steps just to get started.

Too bad it's so hard to get the average computer user to switch to Firefox of Chrome.


As for the Google news, it seems this has something to do with the China attacks. I've gotten mixed reports, though, about whether this vulnerability was just in IE6 or all versions of IE. Maybe that was all versions of Windows...

It isn't actually certain that it was China behind the attacks.

It's even worse on servers. You get the same screens, then at the end, you get about 8-10 more popups warning you that IE Enhanced Security has blocked content to protect the server. What content? Files from microsoft.com and bing.com.


It was every version of IE and Windows. Thats why XP, 2003, Vista, 2008, and 7 users all received out of band security updates for it.

Windows Update does try to make you to upgrade to a newer version of IE. Does her notebook go to the main Windows update site or does it use a corporate WSUS server? You can block updates from being offered. [/quote]
There were also registry keys that you could set to turn of the auto install of IE7/IE8 for IT departments who didn't run WSUS, but still wanted to delay updating.

Okay, I think I understand what they're saying. First of all, a little side question, but it really annoys me when an article is updated and they don't indicate what the update is. At least Engadget will simply post any additional updates to the end of the article, not just put the word "UPDATE" in big bold letters and then post the article like normal. Was it just the first paragraph? Was it some random text elsewhere in the article? We have no way of knowing. That really bugs me.

Anyway, I understand their point, and can see why there's not a lot of evidence connecting the attacks to China. But the focus of the article seems to be the language issue, which doesn't seem to be strong proof to me. Only at the end do they talk about masking the origination.

As long as we're talking evidence, which is always going to be a lot more difficult than it was in the physical world, we should also talk about motive. It seems strange that another country would be spearfishing for dissident supporters. I suppose that other country could want to weaken relations between the countries, but that seems much less likely to me.

I don't know, I would love more evidence too, but I'm not a fan of how China treats its people, so I see little reason to trust them. I don't want to blindly trust our government either, and especially not a corporation, but if we're talking about ranking them all, I probably trust Google more than the other two

There is, however, one thing that I agree with most of the tech news people about: Google did a great job of covering their asses on this whole thing. They managed to shift the whole conversation off of "look how insecure the cloud can be."

In the end, regardless of the reasons, I support Google's decision to withdraw, and I hope they do.

I would have preferred to see Google's stance on censorship completely separate from this hacking fiasco. One doesn't really need to have anything to do with the other.

BTW, while I think Google is generally "good," I just don't trust that shifty Eric Schmidt.

I agree with all that. However, I think that Larry and Sergey have had a problem with China the whole time, and perhaps this was the first time they could convince the board that it might not be wise to be in there.

I agree. I don't want the Chinese being able to google minimum wage stats for other countries. Get back in the factory, your lunch break is over Qian!

I guess you didn't actually read the whole article because it tells you at the end. "This article was updated to include details from Schwaderer's book. Thanks to Philippe Oechslin, of OS Objectif Sécurité SA for alerting us to its contents."


The checksum routine was pointed out as being the smoking gun by an investigator of the worm. "Security researcher Joe Stewart said the algorithm "seems to be virtually unknown outside of China," As the article points out, it isn't conclusive that just because they used that routine does it mean it was China for certain. Take that out and you're left with the fact that the attacks originated from somewhere in Taiwan which doesn't mean much.


Mmm... You've not seen the extent that countries or companies will go to to sabotage somebody else or improve their personal position even it is through dubious methods. Go read up on the Zimmerman telegram to see what the British government did and what Germany was planning.

I rent a server in some random country and start DDoSing you. Does this mean that this random government is officially attacking you?

I'm not saying that it can't be China. I'm just saying it isn't certain that it is. If it does turn out to be them then boo bad China! If it isn't them then that poses the bigger more worrying mystery of who it actually was.


You don't like China so therefore don't trust them and implicitly believe anything that somebody else says about them? Nice.

No, I didn't say that. I said I don't trust them. I agreed with you that the evidence was far from concrete.

And DDoSing someone's server is very different from attempting to spy on a specific Stanford student's GMail account. At least in my book.

So dude, chill. I think I'm agreeing with you more than you're seeing. I'd like more evidence but I concede that there's not as much as they said there was. What I said was that to me it seems more likely that China did it, whether ordered by their government or not, than some third party.

And no, I didn't read the very last line in the article (I did read the rest, thanks very much). My brain is usually wired to skip italicized text at the very end of articles like that. I'm glad they mentioned what was updated, though I don't like that particular method. I much prefer to see the article as it originally was, and then have the additional information later and separately, rather than interspersed through the article. It makes it very hard for people to comment on news stories if the content changes.

My point is that just because you notice that the attack is coming from some specific country doesn't mean anything. You can rent a server in a country without ever stepping foot in it. I've got a server in the US and I'm not American. Doesn't mean that anything I do is backed by the US government.


You need to separate the questions you're asking. The questions you need to ask are:
1. What country did this?
2. Was it a government sponsored or backed operation?

If the answer to 1 is China and the answer to 2 is somebody random then this uproar about China as a country is meaningless. If it was an act by somebody not linked to the government then you can't tar & feather the entire country for their acts.

Yeah. Besides, there's more than enough reason to tar and feather the Chinese government anyway.

Either way, Google should never have agreed to censor their results in the first place. If that means not doing business in China, so be it. Maybe gaining a foothold and then pulling out will exert more pressure on the Chinese government. I doubt it.

It may not, but it does make the issue much more visible than it would have been a few years ago if they had simply not entered that market.

With regards to the hacking, I really have no idea. I have a pretty easy time believing it could have been Chinese people that did it (ie. Chinese individuals), but I'd have a much harder time believing it was something ordered/commissioned by the Chinese government.