Slashdot notes IE7 Released As High-Priority Update. jimbojw writes, “Internet Explorer 7 was finally released this morning and is available via automatic update or download from Microsoft.”
Archive | November 2, 2006
IE7 Breaks Older QuickBooks
Over at Shedding Some Light, Rick Schummer blogs IE7 Breaks Older QuickBooks: “I use FireFox as my primary Web browser and really like it… A couple of weeks ago at Southwest Fox I learned a bunch of things about IE7 from Rick Borup. His session got me excited about some of the changes and new features. So I have been looking forward to the automatic update about to hit my machine. Then I accidentally ran across a blog from one of my technical partners about how IE7 breaks QuickBooks Pro. No email from Intuit (they hit me up with lots of offers to upgrade, but I guess this little detail was not that important, or I seriously overlooked it)… I use QuickBooks Pro to manage the accounting books here at White Light Computing. I have used this product for years to keep track of the hours I bill, invoicing, tracking accounts receivables, printing checks to my vendors and subcontractors, and reporting the financials to my wife and our accountant. I use this program all the time. It is almost as important to me on the administrative side of the business as Visual FoxPro is to the technical side of the business.”
Rick goes on to point out some work-arounds to prevent IE from “upgrading” itself and making your accounting system inoperable. Thanks for the tip, Rick!!!
Browser vulnerabilities get stealthy
Over at DDJ.com, they're reporting that “New Hacker Toolkit Cloaks Browser Exploits” No real surprise there – polymorphic browser exploits can avoid primitive signature detection techniques that just look for “DO BadCode()” in the payload. Code that runs in a browser has to run in a safer environment, like the “security sandbox” design of Java. ActiveX controls are just Windows executables that run with the permissions of the user. That won't work, no matter how many “digital signatures” or “Are you sure” dialogs MS layers on top of their insecure design. JavaScript isn't much better with the potential for downloadable JavaScript network scanners implying that every device on the network must be firewalled from every other.
There are no easy solutions in sight. Run with the least privileges practical. Firewall off unneeded services. Scan for unacceptable activity in memory and on disk. Turn off runtime capability in the browser except when needed – Flash, ActiveX, JavaScript and Java should only run with permission of the user.