When Internet Explorer 8 Beta 1 launched in March, I wrote a post describing the permissive intellectual property licensing approaches we took for components of that release, such as Creative Commons licenses for copyrights in selected specs and the Microsoft Open Specification Promise (“OSP”) for implementations of those specs. 

Now with the launch of Beta 2, I’m happy to highlight a few ways we’re continuing to make our innovations available to the community.   By doing so, we hope to continue to foster the type of collaboration in the community that is so important to the “generativity” of the Internet, to borrow a term from Jonathan Zittrain (whose new book, by the way, is an important and worthwhile read).

Creative Commons License for Copyright in the Search Suggestions Specification

For Search Suggestions, we’re licensing copyright in the XML Search Suggestions Format Specification under the Creative Commons Attribution-Share Alike License.  This license lets others copy, distribute, modify and build upon the specification, even for commercial uses, as long as they give credit to Microsoft and license their own changes under the same terms.  Special thanks to DeWitt Clinton and other contributors to the OpenSearch JSON Search Suggestions extension, whose work relates to the XML Search Suggestions Format spec.  Visit Creative Commons for more information about their licenses, including how to use Creative Commons licenses on your own work.

Microsoft Open Specification Promise for Implementations of the Search Suggestions Specification

Microsoft has developed the Open Specification Promise (“OSP”) to provide a simple and clear patent promise to reassure the broad audience of developers and customers that a given specification can be used for free, easily, now and forever.  The OSP was developed with feedback from customers and the open source community, and we’re happy to make the XML Search Suggestions Format Spec available under the OSP.  The use of the OSP confirms that Microsoft patents needed to implement this specification can be used for free.  More complete information about the OSP can be found here.

Web Slice Icon Guidelines

Internet Explorer 8 introduces Web Slices as a way for web sites to allow users to subscribe to specific content directly within a Web page.  Users can see when content changes and view the updated portion of the Web page directly from the Favorites bar of Internet Explorer.  The Web Slice icon provides a common visual cue that a web page supports web slices.  Developers may freely use the icon under the Web Slice Icon Guidelines that we have developed, which are intended to promote the integrity of the icon as a common symbol for Web Slice functionality.  We made it easier to use the icon in accordance with the Guidelines by making available for download .png and .gif renderings of the icon in various sizes.

We are pleased to continue to contribute to the web community and, as always, look forward to your feedback.

Tom Rubin
Chief Counsel for Intellectual Property Strategy

Tor Arne Vestbø is now a qualified WebKit Reviewer. Tor Arne has done a huge amount of work on the Qt port of WebKit, including advanced work such as a Phonon port of the media back end for the <video> element. He’s also helped to enhance our cross-platform abstraction layer. Please join me in congratulating Tor Arne on his reviewer status and thanking him for all of his contributions to WebKit.

At this week’s Firefox 3 / Gecko 1.9 meeting, endgame scheduling was set for the upcoming Beta 2 release. The plan is to hold the tree closed and let nightly builds “bake” for a few days with minimal changes as a way to identify and fix regressions or major bugs before handing off to QA. If all goes well, the code will be handed off to the Build and QA teams for Beta 2 release in late December.

Notable dates for all developers working on trunk are:

• December 4th, 11:59 PST: the tree will be closed to checkins
• December 5-7th: endgame drivers will twice daily triage approval1.9? requests, accepting only minimal changes
• December 7th: trunk freeze, endgame drivers will re-evaluate scheduling for Beta 2 release

As always, you can keep up to date by monitoring the Firefox 3 / Gecko 1.9 meetings, or by lurking in #granparadiso on irc.mozilla.org

Hi all,

Last week, I blogged about installing Windows XP SP3 and how it affects different versions of Internet Explorer (See my earlier blog post here). Today I will be discussing installing branded/custom versions of IE7 on machines with Windows XP SP3 installed. This post is primarily aimed towards folks who use the Internet Explorer Administration Kit 7 (IEAK7) to create custom IE7 packages, like Internet Service Providers (ISPs) and web developers. If you ever installed the IEAK7, built a custom version of IE7 or distributed a version of IE7 to others, this post is for you.

When installing a branded version of IE7 (like the one you get on a Comcast or Qwest CD when you sign up for their services) on Windows XP SP3 machine for the first time, the IE7 install might fail with the following error:

“Process 'xmllitesetup.exe /quiet /norestart /er  /log:C:\WINDOWS' exited with exit code 61681”<!----><o:p></o:p>

The reason is that the IE7 package you are trying to install uses old IE7 files. As you may recall, in October of 2007 we released an IE7 update, which in addition to turning on the menu bar by default and removing WGA validation also addresses the XMLLite issue above.

XMLLite.dll is one of the components that ships with IE7. This DLL is necessary to run IE7, and IE Setup installs this component as part of IE7 installation. XPSP3 contains an updated version of XMLLite.dll, so when you try to install an older version of IE7 on XPSP3 machines, IE Setup fails to install XMLLite since it’s already on your system; hence, you get the error. In the IE7 update, we modified the install logic to only install XMLLite if it’s not already present on the system.

Call To Action

If you produce custom IE7 packages, you need to ensure that those packages will install successfully on Windows XP SP3. You can either try installing IE7 on a Windows XP SP3 system, or for a quick test, you can verify the cache of the IE7 files that were downloaded when generating custom IE7 packages. To verify the cache, on the machine that has the IEAK7 installed, go to C:\Program Files\Microsoft IEAK 7\Download\Win32\<Language>\iebin and search for IESetup.msi or IEBrand.msi.

If those files are not present, then you need to perform the following:

1. Download the new IEAK7 available at TechNet.
2. Run the new IEAK7 wizard.
3. Open the INS file you generated for custom IE7 packages. (You can re-use an existing ins file or create a new one, in which case this step is optional.)
4. On the Automatic Version Synchronization screen, click on the Synchronize button. This step downloads the latest IE7 setup files that it will use to generate a new branded package.
5. Complete the rest of the wizard, and click Finish.

The new packages will be created in the directory you specified during the beginning of the IEAK Wizard. These new packages will work on XPSP3, so you are ready to distribute them to all your customers.

Thanks,

Jane Maliouta
Program Manager

For those of you that haven’t seen, Dev Opera has just published a two part article series on styling form controls, by Christopher Schmitt. The first part covers using attribute selectors (which work in IE7, Opera, Safari and Firefox) to slim down your markup by providing a way to identify certain form controls without the addition of a class value. An example of this is using input[type="text"] in the CSS, rather than adding class="text" to the HTML file. The second part takes this further, by taking advantage of the :enabled, :disabled and :checked pseudo-classes, and a dash of opacity. The browser support for these pseudo-classes are not as strong however. According to Christopher, Opera is the only browser that supports all three correctly.

If you are not aware of Dev Opera (known lovingly as Devo internally at Opera), it is Opera’s new developer site. Look out for a fantastic article on CSS3 from CSS3.info’s very own Peter Gasston in the near future.

The IE Cumulative Security Update for October 2008 is now available via Windows Update. Alternatively, you can receive this and all other Microsoft updates via the new Microsoft Update. I encourage you to upgrade to Microsoft Update if you haven’t already to ensure that you receive the latest updates for all Microsoft products.

This update addresses six vulnerabilities. The security update addresses these vulnerabilities by modifying the way that Internet Explorer handles the error resulting in the exploitable condition. For detailed information on the contents of this update, please see the following documentation:

• Microsoft Security Bulletin MS08-058
• Microsoft Knowledge Base Article 956390

This security update is rated Critical for all supported versions of Internet Explorer 6 and earlier. The security update is rated Important on Internet Explorer 7 on Windows XP and Internet Explorer 7 in Windows Vista.  Beta versions of Internet Explorer are not vulnerable. 

IE security updates are cumulative and contain all previously released updates for each version of Internet Explorer.

I encourage everybody to download this security update and other non-IE security updates via Windows Update or Microsoft Update. Windows users are also strongly encouraged to configure their systems for automatic updates to keep their systems current with the latest updates from Microsoft.

Terry McCoy
Program Manager
Internet Explorer Security

It is well understood that page loading speed in a web browser is limited by the available connection bandwidth. However, it turns out bandwidth is not the only limiting factor and in many cases it is not even the most important one.

The graph above shows the time it took to fully load the Wall Street Journal front page (chosen for its complexity which well represents many modern web sites) with a recent WebKit. Browser caches were cleared before each page load. Mac OS X dummynet facility was used to simulate various network conditions by introducing packet latency and capping the available bandwidth. Since the testing was done against a live web site the actual connection latency is a factor as well (ping time to wsj.com was ~75ms).

From the figure it is clear that while available bandwidth is a significant factor, so is the connection latency. Introducing just 50ms of additional latency doubled the page loading time in high bandwidth case (from ~3200ms to ~6300ms).

Latency is a significant real world problem. Wireless networking technologies often have inherently high latencies. Packet loss and retransmits due to interference makes the situation worse. Geographical distance introduces latency. Just the roundtrip delay between US East and West Coast is somewhere around 70ms. Loaded web servers may not respond immediately.

Why does latency have such a huge impact on page loading speed? After all, to load a page completely a web browser just needs to fetch the page source and all the associated resources. The browser makes multiple connections to servers and tries to load as many resources in parallel as possible. Why would it matter much if it takes slightly longer to start loading an individual resource? Other resources should be loading during that time and the available bandwidth should still get fully utilized.

It turns out that figuring out “all the associated resources” is the hard part of the problem. The browser does not know what resources it should load until it has completely parsed the document. When the browser first receives the HTML text of the document it feeds it to the parser. The parser builds a DOM tree out of the document. When the browser sees an element like <img src> that references an external resource it requests that resources from the network.

Problems start when a document contains references to external scripts, <script src>. Any script can call document.write(). Parsing can’t proceed further before the script is fully loaded and executed and any document.write() output has been inserted into the document text. Since parsing is not proceeding while the script is being loaded no further requests for other resources are made either. This quickly leads to a situation where the script is the only resource loading and connection parallelism does not get exploited at all. A series of script tags essentially loads serially, hugely amplifying effect of the latency.

The situation is made worse by scripts that load additional resources. Since those resources are not known before the script is executed it is critical to load scripts as quickly as possible. The worst case is a script that load more scripts (by using document.write() to write <script> tags), a common pattern in Javascript frameworks and ad scripts.

The latest WebKit nightlies contain some new optimizations to reduce the impact of the network latency. When script loading halts the main parser, we start up a side parser that goes through the rest of the HTML source to find more resources to load. We also prioritize resources so that scripts and stylesheets are loaded before images. The overall effect is that we are now able to load more resources in parallel with scripts, including other scripts.

You can see from the graphs above that these optimizations significantly reduce the impact of network latency and generally improve page loading speed.

An advantage of not posting for a while is that there are usually plenty of good subjects to talk about when you get back to it…

With a kind nod of the head to our post from way back in 2006, Andy Clarke has posted a screencast (with full transcript and code examples) of RGBa values in action on his website For A Beautiful Web.

Over at Javascript Kit they’ve produced an exhaustively in-depth look at structural pseudo-classes.

On the subject of Javascript, Eric Meyer has written about how it can be leveraged to extend CSS3 support across browsers.

And Helen from Helephant.com writes a good introduction to the box-sizing property.

In this issue…

• Firefox 3.1 Alpha 1 now available
• Reviewing l10N goals
• Becoming an AMO editor
• Canvas text goes bidirectional
• Mozilla funds SA translation team
• Firefox 3.1: Smart Location Bar improvements
• Mozilla’s localization dashboard
• Developer calendar
• Subscribe to the email newsletter

Firefox 3.1 Alpha 1 now available
The first developer milestone of the next release of Firefox - code named Shiretoko Alpha 1 - is now available for download. Shiretoko is built on pre-release version of the Gecko 1.9.1 platform, which forms the core of rich internet applications such as Firefox. Please note that this release is intended for developers and testers only. For more information, including a list of new features and links to release notes, please see the DevNews blog post.

Reviewing l10N goals
Seth Bindernagel writes, “Last week, a subset of the l10n-drivers team met in Paris to discuss many things related to l10n, including a review of goals that had been set last November before the lead-up to the release of Firefox 3. The goals were ambitious and listed many ways in which the team could create positive impact. Part of our work week was to review these goals and to find out what we did well, didn’t do well, and could do better as we create goals for the upcoming quarter.” Seth’s weblog post continues on to go through each goal in detail, discussing what went well and where things can be improved in the future.

Becoming an AMO editor
Mozilla Add-ons (AMO) is one of Mozilla’s most popular and important sites, and our Add-ons Editors are critical to maintaining a great experience for millions of add-on users. Justin Scott of the AMO team has posted an overview of what Editors do and how to get involved with with that aspect of Mozilla over at Justin’s weblog.

Canvas text goes bidirectional
Eric Butler writes, “The patch for the last of the major outstanding bugs with the WHATWG Canvas text API landed in time for a nearly spec compliant implementation to make it into Firefox 3.1 Alpha 1. I am pleased to say that Canvas now supports right-to-left text and bidirectional text resolution on its text drawing functions.” Canvas has undergone and will be undergoing other changes, as well. More information is available at Eric’s weblog.

Mozilla funds SA translation team
As reported by Tectonic, “South Africa’s award-winning multilingual software developer, Translate.org.za, has been awarded a grant by the Mozilla Corporation to extend its translation tools. Mozilla awarded the grant to Translate.org.za to further its work on Pootle, a web-based translation tool, as well as the Translate Toolkit. The grant also covers a still to be released offline translation tool.” For more details, read the full article at Tectonic, and Seth Bindernagel’s original blog post.

Firefox 3.1: Smart Location Bar improvements
Edward Lee, one of the primary developers of the Smart Location Bar (aka “Awesome Bar”), has written a blog post outlining some of the upcoming Smart Location Bar changes that will appear in Firefox 3.1. “[T]here’s some new ways to change what shows up in the Smart Location Bar such as restricting results to show only your history (and not your unvisited bookmarks) or matching only in the URL instead of also in the title. Additionally, you can see your Smart Keywords queries show up in the drop down.” For details, see Edward’s full blog post.

Mozilla’s localization dashboard
Seth Bindernagel has posted about Mozilla’s new “localization dashboard” that was created by Axel Hecht. “As our team tries to improve efficiency and outreach/service to localizers in our l10n process, this tool will greatly help in how we focus on and respond to community needs related to localization.” Seth’s post goes on to describe some of the features of the dashboard to help you get started.

Developer calendar
For an up-to-date list of the coming week’s Mozilla project meetings and events, please see the Mozilla Community Calendar wiki page.

Subscribe to the email newsletter
If you would like to get this newsletter by email, just head on over to the about:mozilla newsletter subscription form. Fresh news, every Tuesday, right to your inbox.

Security is a top priority for the WebKit project. As contributors to the project have grown, it has become apparent that we need a process for safely reporting security vulnerabilities to the WebKit project in addition to the process for reporting vulnerabilities to Apple. Today, we are announcing a new mailing list for this purpose, security [at] webkit.org. In addition, you can now safely report vulnerabilities over https to our bug tracker, https://bugs.webkit.org, by placing the bug in the Security component. The people privy to the mailing list and the Security component are members of the Security group. It currently includes vendors shipping products that include WebKit, active port owners and trusted security experts. If you are shipping a product that includes WebKit and would like to be notified of security issues, please email security [at] webkit.org.

In this issue…

• Fennec M8
• Camera Input Tag
• TraceMonkey for Fennec
• Add-ons for Mobile

Fennec M8
Mark Finkle has written about Fennec M8 being released. M8 is the latest
pre-alpha milestone release of the Fennec mobile browser which will
eventually become Firefox Mobile. M8 includes a new set of icons that Sean
Martell and Madhava Enros wrote about, improved rendering performance, UI
improvements and a pile of other items. You can find a full summary in
Mark’s post.

Camera Input Tag
As discussed on a post on Ajaxian, Brad Lassey has put up a screenshot of
Fennec taking input from a camera and making it available to web
applications. This kind of functionality would work much like a file input
tag that uploads pictures instead of files off your hard drive. This means
that web sites could easily include support for uploading pictures directly
from the browser instead of having to go through a cumbersome gallery and
file upload procedure. Read Brad’s post for full details.

TraceMonkey for Fennec
Vladimir Vukićević has posted about the work that he did to bring
TraceMonkey to the ARM platform. TraceMonkey is Mozilla’s fast JavaScript
implementation that will be included in Firefox 3.1. The speedup on ARM is
similar to what was measured on x86-based systems. Some operations are 30x
faster with a roughly 2x speedup on the whole of the SunSpider test. These
speedups will offer many user-perceptable improvements for web sites. But
because much of Fennec is written in JavaScript, it will also improve the
performance of the browser as a whole. Read Vlad’s post for more
information.

Add-ons for Mobile
Extensions are one of the best parts of Firefox on the desktop and Mozilla
has been working hard to bring that same extension experience to Fennec.
Early initial support for extensions was included in Fennec M7 and has been
improved in M8. Mark Finkle has a post up about what’s going to be required
by extensions authors and a couple of sample add-ons that people can build
off of.

The latest browser market share data is in, and Safari has hit 6.25%, breaking 6% for the first time. Last month’s share was 5.81%, so this is a significant increase. It was only nine months ago that Safari broke 5%. Safari market share has now almost tripled from 2.14% in June 2005, when the WebKit Open Source project launched.

This growth, combined with recent WebKit adoption in projects such as the Iris Browser, Qt 4.4, Android, Adobe AIR, Epiphany, KDE Plasma, iCab and more, is breathtaking and shows huge positive momentum for the WebKit project. Thanks and congratulations to everyone who has contributed to the project.

While browsing the admin section of this site, I saw an incoming link titled Fun with CSS3. It includes three examples of creating a recipe card mock up using CSS3 that is currently implemented in browsers. Due to the various levels of implementation, no browser can create the whole design using the CSS3 techniques, which is why it was split in three parts.

Because no single browser supports all the innovations in CSS3, I’ve split the Recipe Card page into several examples, each with unique markup. No point in looking at these in IE or Firefox - fire up the latest Safari or Opera instead.

I’m looking forward to a time when examples like this can be displayed fully by one browser. As for improvements to the examples, I’d like to see the heading images replaced with Web Fonts, and the images in the footer should be trivial to turn into SVG and added using list-style-image. The most difficult parts would be the effect the main title has inside the text (a transparent background image should be able to make this work) and the rotated main menu text. There is currently no way to rotate text in CSS. The example is making me hungry though.

Using a different approach, there are also some nice CSS3 examples on the CSS section of Dev Opera show casing what can be done with CSS today using progressive enhancement.

Do you know of any nice CSS3 demo, or have you created your own? If so share them in the comments. I’d love to see them.

An advantage of not posting for a while is that there are usually plenty of good subjects to talk about when you get back to it…

With a kind nod of the head to our post from way back in 2006, Andy Clarke has posted a screencast (with full transcript and code examples) of RGBa values in action on his website For A Beautiful Web.

Over at Javascript Kit they’ve produced an exhaustively in-depth look at structural pseudo-classes.

On the subject of Javascript, Eric Meyer has written about how it can be leveraged to extend CSS3 support across browsers.

And Helen from Helephant.com writes a good introduction to the box-sizing property.

In this issue…

• Extend Firefox 3: There’s Still Time!
• Status of AMO Editor Reviews
• Dangers of Using eval() on Downloaded JavaScript
• Add-on Statistics Since Firefox 3’s Release
• AMO 3.4.3 and 3.4.4 Pushed Live
• 1.9 SDK Now Available
• Firefox 3 for Theme Developers
• New CSS Features in Firefox 3.1
• New Documentation

Extend Firefox 3: There’s Still Time!
There’s still time to submit your new or updated extension to the Extend Firefox 3 contest ending on July 4. You can read the official rules and contest information at extendfirefox.com.

Status of AMO Editor Reviews
The AMO editors have been hard at work, reviewing 255 add-on updates and submissions in the 2 weeks before Firefox 3’s launch, and 238 updates/submissions between launch day (Tuesday) and Sunday. Please be patient as our editors work through this backlog. Thanks to all of the AMO editors for their hard work. You can read more about review and submission statistics at Justin Scott’s blog.

Dangers of Using eval() on Downloaded JavaScript
Many add-ons don’t make it past the review phase because a reviewer finds the add-on using eval() on downloaded JavaScript or JSON. A new MDC article talks about the dangers and how to avoid them.

Add-on Statistics Since Firefox 3’s Release
Over 16 million new add-ons have been downloaded from AMO (addons.mozilla.org) since Firefox 3 was released last Tuesday (June 17). You can read about add-on stats since the release of Firefox 3 at Justin Scott’s blog.

AMO 3.4.3 and 3.4.4 Pushed Live
addons.mozilla.org was updated recently with a number of bugfixes and new features, including a new theme browser, advanced search, and a beta of the new Developer Tools. You can read more about the new features on Basil Hashem’s blog and more about the Developer Tools beta on Justin Scott’s blog.

1.9 SDK Now Available
If you are building binary components for your add-on then the 1.9 SDK is the official way to build. It’s available for download in Linux, Windows and Mac flavours.

Firefox 3 for Theme Developers
Gavin Sharp has put together some of the highlights of new features in Firefox 3 for theme developers to use. Take a look and see how you an make your themes that much better.

New CSS Features in Firefox 3.1
The current development builds of Firefox 3.1 have more of the CSS 3 selectors implemented including nth-child, first-of-type and default. David Baron discusses the selectors and other new CSS features landing in Firefox 3.1 builds.

New Documentation
Some tricks with laying out XUL boxes are explained. A list of the parts of XUL that are now deprecated and replaced by better objects is now available. A new code snippet section on creating background processes using setTimeout and threads has been added.

Subscribe
Haven’t subscribed to the about:addons newsletter? Sign up here!.

In preparation for the Professional Developers Conference, the IE team recently authored some articles for a special issue of Code Focus magazine.  The articles cover everything from cross-version compatibility to performance, and include new sample code. You can read the articles online at the following locations: Welcome to CoDe Focus for Internet Explorer 8! What’s New in Internet Explorer 8 Beta 2? Making Your Web site Compatible Across Multiple Versions of Internet Explorer Introducing Compatibility View Create Your Own Web Slices Accelerators in Internet Explorer 8 Beta 2 New Search Features in Internet Explorer 8 Beta 2 Developer Tools in Internet Explorer 8 Beta 2 Better AJAX Development with Internet Explorer 8 Beta 2 AJAX Performance Measurement Methodology for Internet Explorer 8 Beta 2 Performance Improvements in Internet Explorer 8 Beta 2 Reliability and Privacy with Internet Explorer 8 Beta 2 Secure Coding with Internet Explorer 8 Beta 2 Internet Explorer 8 New Accessibility Features Or, if you’d prefer, you can also download the entire issue as a single PDF file.  Enjoy! Eric Lawrence Program Manager

Update 11:50 am - fixing a formating issue.

Many commonly used applications and Windows system components depend on the MSIE WebBrowser control to render webpages from within their program. Unlike live sites, pages loaded within these controls are typically static resources stored in libraries and executables on a system. While webmasters can easily alter their site to render properly in the new version of IE, many software vendors do not have the resources to instantly push out new versions of their applications with updated internal pages. In order to ensure that these existing applications remain in working order, IE8 renders pages running within instances of the WebBrowser control in IE7 Standards Mode by default.

The test container shown above uses the IE7 Standards Mode run by default within WebBrowser control containers. While this mode works well with existing applications, developers building new applications may want to use the new IE8 Standards rendering mode as shown below.

When an executable loads an instance of the WebBrowser control it scans the registry to check whether the executable wants IE7 Standards or IE8 Standards mode.

To run a WebBrowser control in IE7 Standards Mode, insert the following values into the registry:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_NATIVE_DOCUMENT_MODE]

"MyApplication.exe"=dword:11170

To run in IE8 Standards Mode insert the following registry value:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_NATIVE_DOCUMENT_MODE]

"MyApplication.exe"=dword:13880

In both of these instances, MyApplication.exe should be replaced with the name of the executable that will be running WebBrowser controls in a specified mode.

Specification of an IE rendering mode also applies to IE5 Quirks Mode. To run instances of a WebBrowser control in IE5 Quirks Mode, insert the following value into the registry:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_NATIVE_DOCUMENT_MODE]

"MyApplication.exe"=dword:C350

Due to a known bug in the IE8 Beta 1 build, the User-Agent String returned by the browser instance will state that it is “MSIE 8.0” (as shown in the screenshot above). Knowledge Base Article 183412 provides a workaround for this scenario.

As with webpages displayed in an IE window, pages hosted in a WebBrowser control can also override rendering settings by using the X-UA-Compatible meta tag to specify a rendering mode. For more information on formatting and values for the version targeting META tag see Scott Dickens’ latest post here.

Matthew David Crowley
Program Manager
Internet Explorer Extensibility

It’s that time of year again! If you are a Mac OS X developer, a browser hacker, a web developer, or just someone with an interest in cool technology, then come have a drink and some snacks, and meet WebKit contributors from Apple and around the world. This event is open to anyone who is interested, free of charge.

Don’t miss out on the nerd party of the century!!!!

Place: Thirsty Bear Restaurant & Brewery (map)
Date: Tuesday, June 10th
Time: 7:30 PM
upcoming.org

WebKit now supports reflections in CSS. Continuing the trend of using adorable baby photos to make features appear more impressive, let me introduce Kate again.

A reflection is a replica of the original object with its own specific transform and mask. The box-reflect property can be used to specify the specialized transform and mask that should be used for the replica.

-webkit-box-reflect: <direction> <offset> <mask-box-image>

<direction> can be one of above, below, left or right.
<offset> is a length or percentage that specifies the distance of the reflection from the edge of the original border box (using the direction specified). It can be omitted, in which case it defaults to 0.
<mask-box-image> is a mask-box-image that can be used to overlay the reflection. If omitted, the reflection has no mask.

Reflections will update automatically as the source changes. If you hover over links, you’ll see the hover effect happen in the reflection. If you reflect the <video> element, you will see the video playing in the reflection.

Giving an element a reflection has the effect of creating a stacking context (so it joins opacity, masks and transforms). The reflection is non-interactive, so from the point of view of hit testing, it’s like it isn’t there. The reflection will have no effect on layout (other than being part of a container’s overflow), and can be thought of as similar to box-shadow in this respect.

The example above uses a gradient mask. Here is the sample code:

<img src=”bubbles.jpg” style=”border:5px solid white;-webkit-box-reflect:below 5px -webkit-gradient(linear, left top, left bottom, from(transparent), color-stop(0.5, transparent), to(white));”>

Hi, I’m Eric Lawrence from the Internet Explorer Security Team. With the RSA security conference kicking off this week, I wanted to start sharing more information about the security features and benefits of Internet Explorer 8 Beta 1. Over the next several weeks, we’ll blog in greater detail about some of the security improvements in Beta 1, such as the new Safety Filter, greater control over ActiveX controls, and new AJAX features for safer mashups (XDomainRequest and XDM). This is not a complete list of our security investments for the release; we will have more to talk about during future milestones.

Internet Explorer 8 security features target three major sources of security exploits: social engineering, Web server, and browser-based vulnerabilities. This post will cover IE8 Data Execution Prevention (DEP), a feature that mitigates browser-based vulnerabilities.

DEP/NX Memory Protection in Internet Explorer 8
Internet Explorer 7 on Windows Vista introduced an off-by-default Internet Control Panel option to “Enable memory protection to help mitigate online attacks.”  This option is also referred to as Data Execution Prevention (DEP) or No-Execute (NX). 

We have enabled this option by default for Internet Explorer 8 on Windows Server 2008 and Windows Vista SP1 and later.

DEP/NX helps to foil attacks by preventing code from running in memory that is marked non-executable.  DEP/NX, combined with other technologies like Address Space Layout Randomization (ASLR), make it harder for attackers to exploit certain types of memory-related vulnerabilities like buffer overruns. Best of all, the protection applies to both Internet Explorer and the add-ons it loads. No additional user interaction is required to provide this protection, and no new prompts are introduced.

DEP/NX Compatibility
For Internet Explorer 7, DEP/NX was disabled by default for compatibility reasons.  Several popular add-ons were not compatible with DEP/NX and would crash when Internet Explorer loaded them with DEP/NX enabled.  The most common problem was that these add-ons were built using an older version of the ATL library.  Before version 7.1 SP1, ATL relied upon dynamically generated code in a way not compatible with DEP/NX.  While developers of many popular add-ons have since released updated extensions compatible with DEP/NX, some add-ons may not be updated before Internet Explorer 8 becomes available.

Fortunately, new DEP/NX APIs have been added to Windows Server 2008 and recent Windows Service Packs to enable use of DEP/NX while retaining compatibility with older ATL versions.  These new APIs allow Internet Explorer to opt-in to DEP/NX without causing add-ons built with older versions of ATL to crash. 

In rare cases where an add-on is not DEP/NX compatible for reasons other than outdated ATL usage, a group policy option will be available to allow an organization to opt-out of DEP/NX for Internet Explorer until an updated version of the broken add-on can be deployed.  Local Administrators can control DEP/NX by running Internet Explorer as an Administrator and unchecking the Tools > Internet Options > Advanced > “Enable memory protection to help mitigate online attacks” option.

Checking Your Protection
You can see which processes are protected by DEP/NX on Windows Vista Task Manager’s Process tab; on earlier versions of Windows, you can use Process Explorer.  In either case, ensure that the “Data Execution Prevention box” is checked in the View > Select Columns menu.

Developer Call to Action
If you build Internet Explorer add-ons, you can help ensure users enjoy a smooth upgrade to IE8 by taking the following steps today:

1. If your code depends on older versions of ATL, please rebuild it with ATL v7.1 SP1 or later (Visual Studio 2005 includes ATL 8.0)
   
2. Set the /NXCompat linker option to indicate that your extension is compatible with DEP/NX
   
3. Test your code with DEP/NX enabled using IE8 Beta 1 on Windows Vista SP1. (Alternatively, test with IE7 on Windows Vista after enabling the DEP/NX option. To enable DEP/NX for IE7: Run IE as an administrator, then set the appropriate checkbox in the Tools > Internet Options > Advanced tab)
   
4. Opt your code into other available defenses like stack defense (/GS), safe exception handling (/SafeSEH), and ASLR (/DynamicBase)

Thanks for your help in securing the web!

Eric Lawrence
Program Manager