Microsoft issued yet another security patch for its Internet Explorer 6 (IE6) browser this week. It now has a record of over 150 security holes discovered in the three years since it launched. That's a scary average of roughly one hole every week since it went live! There is a Service Pack (SP2) in the works for Windows XP which should help - provided people who are using XP apply it. However, this doesn't really fix the IE6 security problems, it just tries to prevent them by adding a barrier between the browser and security attacks. Microsoft has been very slow fixing IE6 security vulnerabilities, and there are some still unfixed.

Microsoft's problem is that ages ago it took a marketing decision to integrate the browser application into the operating system. Now it is faced with a situation where fixes to the browser would break other bits of the operating system which rely on services from the browser library. It's ironic really, because the security problems engendered by integrating applications into the operating system were known about and extensively discussed as long ago as the 1960s. The irony is that Microsoft programmers (and the ones I know are extremely good programmers) know all about the discussion and the lessons learned, but the decision to tie the browser to the operating system was made by marketing weasels at a very high level.

One possible way out would be to re-write the browser from scratch for the much delayed 'longhorn' version of Windows. This is currently slated for release in 2006, but to meet that deadline a substantial number of new features have been dropped already, so it's arguable whether Microsoft could embark on a writing an entirely new component at this stage. And that doesn't address the problem of what to do about all the people out there who are using IE6 and who have no intention of upgrading their computers in the foreseeable future. It's a nasty mess with no obvious way out.

Microsoft, having sown the dragon's teeth is now reaping the whirlwind.

Alan Lenton
25 July 2004

Read other articles about computers and society

Back to the Phlogiston Blue top page

If you have any questions or comments about the articles on my web site, click here to send me email.