The next public update of IE8 (for Windows Vista- and Windows XP-based operating systems as well as the Windows 7 Beta) includes improvements to Compatibility View that help end-users when they visit web sites that are not yet ready for IE8’s new, more standards-compliant defaults. This blog post describes the technical background and how this new functionality works.

A Brief History of Standards, Interoperability, Compatibility, and IE8

As we improve the interoperability of Internet Explorer by delivering better implementations of web standards, some users may face compatibility issues with sites that rely on the behavior of previous versions of Internet Explorer.

With IE8’s Beta 1 release, Microsoft demonstrated its commitment to interoperability by making the most standards-compliant default view for web pages IE’s default. This is a good thing for the next billion web pages. We think that developers will have an easier time building interoperable sites on top of IE8’s strong platform work (like CSS 2.1, a better Document Object Model,  ARIA, and cross-domain requests (XDR) and cross document messaging (XDM) and our start on HTML5 support).

The problem is that some of today’s web pages might expect the old, less interoperable behavior from IE. These web pages might not function correctly, in ways ranging from just looking a bit misaligned to not working at all.

This scenario is exactly why we’re committed to interoperability and doing the standards work we’re doing in IE8. People who develop web sites and people who use sites want them to just work. Previously, some versions of IE released while some key standards were still under construction and before standards efforts had started for other key technologies. The most important thing we can do now is deliver better interoperability for a better web, with as few compatibility issues as possible so that end-users adopt it.

We really want the new more standards compliant default to be a great experience. We have many, many people engaged in reaching out to hundreds and hundreds of websites. Our goal with IE8 was to make it easy for sites to deliver a great experience, either by testing with IE8’s new standards-compliant functionality or by adding a tag or HTTP header to their site to instruct IE8 to use IE7-compatible mode.

With IE8’s Beta 2 release, we introduced the Compatibility View button. This button enables savvy end-users to resolve compatibility problems they encounter with sites that rely on legacy IE behavior. Specifically, the button enables users to treat specific websites in a non-default way so that they work in the browser. This is a good thing – with Beta 2, a site that relies on IE7 behavior from IE8 but has not specified it explicitly can still work for someone visiting it in IE8.

Despite all the outreach to sites, we saw from the telemetry data that IE8 Beta 2 users still have to use Compatibility View a lot. Looking at our instrumentation, there were high-volume sites like facebook.com, myspace.com, bbc.co.uk, and cnn.com with pages that weren’t working for end-users with IE’s new standards compliant default.  We could also see from our instrumentation that not all IE8 visitors to those sites were clicking the Compatibility View button.  So, large groups of people were having a less than great experience because they weren’t aware of the manual steps required to make certain sites work.

Community to the Rescue (or, applying telemetry and customer feedback to make this experience better)

We wanted to make the experience of defaulting to standards mode better for the end user.

The IE8 approach here focuses on using customer feedback to make the compatibility experience better. In addition to listening to the end-user community, we’re also engaging the site development community as well.

When users install Windows 7 Beta or the next IE8 update, they get a choice about opting-in to a list of sites that should be displayed in Compatibility View. Sites are on this list based on feedback from other IE8 customers: specifically, for what high-volume sites did other users click the Compatibility View button? This list updates automatically, and helps users who aren’t web-savvy have a better experience with web sites that aren’t yet IE8-ready. Some details:

1. The sites on the list are based on objective criteria applied to telemetry data as well as product support channels. For example, in addition to the top sites worldwide, we determine high-volume on a market-by-market basis; the top 50 sites in one region of the world might be very low on the world-wide list of top sites, but are important to include for those customers.
2. The data we collect from IE8 beta users is the top level domain of the website and whether the user chose Compatibility View while visiting that site (please see the IE8 Privacy Policy for more information).
3. We will regularly revisit the need to offer this list to users at all.

We reach out to those sites (beyond all the other outreach we’ve already done!) to make sure they know the experience their IE8 visitors have by default and what steps they (the sites) can take to make it better. We also tell them that in the meantime, we’re adding their site to this compatibility list and provide instructions on how the site can opt-out. (If a domain notifies Microsoft that it’s choosing to opt-out, we remove it from the list at the next scheduled list update.)

IE8 is not the first browser to consider making website compatibility fixes for specific highly trafficked sites. Opera has “a feature that allows Opera to automatically fix incompatible Web pages.” It’s “automatically distributed by Opera Software ASA, and can be used to apply fixes to specific Web sites.”

User Choice: Some Details and Screenshots

Users can make a choice about the list during IE’s first run experience as well as in Compatibility View Settings dialog. During the first run experience, neither ‘Express’ nor ‘Custom’ is selected by default. The user must choose one:

The Compatibility View Settings dialog box reflects the user’s choice, and the user can turn updates to the list on or off at any time:

Users who choose to get the list receive it via Windows Update packages, just like IE security updates. The list package is separate from, but on the same schedule as, security updates (typically, every 2 months). Our goal here is to provide predictability by following a regular, known update cadence.

Enterprise customers running WSUS and other management software can control the download and installation of these packages. Enterprises can also use group policy to provide their users an additional list of sites that should be displayed in Compatibility View. Other customers can control the download and installation of these packages as well by choosing to install only Internet Explorer updates marked as ‘Critical’.

When the user browses to a web site and this list is active, IE checks the list to determine if the site should be shown in Compatibility View. If the site is on the list, IE uses Compatibility View, as if the user had clicked the Compatibility View button. If the site isn’t on the list, IE uses whatever setting the site indicates in its content. And, just as with websites on the user-populated Compatibility View list, the presence of a <META> tag / HTTP header “wins” over whatever mode Compatibility View on the client would have resulted in. So, if a site starts on this list but does great work to take advantage of IE8 and now wants IE8 to use the most standards-compliant mode, then the site can specify it and override this list.

Also, the Compatibility View Settings dialog shows only the entries in the user-populated list. Users interested in seeing the contents of the active list can navigate to res://iecompat.dll/iecompatdata.xml from IE’s address bar.

Some Closing Thoughts

Life as one of the people who builds the web is hard. Developers have a lot of things competing for their scarce time: making their sites more secure, or faster, or richer using some of the new functionality that new browsers like IE8 are starting to support. In some cases, for a new browser, developers have to spend time to add a tag or header to make their sites compatible. Starting back in March 2008 with IE8 Beta 1, Microsoft has been actively engaging site developers about how they can make sure that users continue to have a good experience on their sites.

Whether developers get around to doing this work or not, the people who use the web expect that the web will keep working. They want the benefits of interoperability and standards. They don’t want to deal with compatibility issues.

To that end, IE8 Beta 1 offered end-users a large compatibility toolbar button that required a browser restart. In Beta 2, IE8 offered a more discreet button that didn’t require a browser restart for a more end-user friendly compatibility experience. This latest compatibility view update refines the experience by offering users the choice to have a community-driven list that reduces the amount of manual work involved in browsing the web with compatibility.

Scott Dickens
Program Manager

A few of the startups building browser Add-Ons have organized the first ever Add-On Con, to take place in Mountain View on Dec 11, 2008.  We thought it was such a cool idea that we decided to co-sponsor the event (Mozilla is the other sponsor).  We will be giving some sessions about extending Internet Explorer, and Mozilla and Google will be presenting about their respective web browsers.  Many companies with successful Add-Ons will be sharing their stories and experiences, so it’s a great education and networking event. 

Matt Crowley, Program Manager for Extensibility, will cover all of the extensibility options available in IE8.  I will be discussing the lessons learned porting Firefox extensions to IE.  

Come say hi to us if you’re attending!

If you can’t make it to Mountain View, or even if you can, be sure to check out Christian’s blog post, the IE developer center, and the IE forums for other great info about building add-ons.

Joshua Allen
Technical Evangelist

The announcement of IE8 Beta 2 started an important and public phase of the product development cycle getting broad public feedback. The team is providing detailed information and answering questions about the product in many different places. Now’s a good time to talk about what comes next.

Since the release of Beta 2, the team has been absorbed in the data we get from real people about the product. We have combed through instrumentation of over 20 million IE sessions and hundreds of hours of usability lab sessions. Together with IE MVPs, we have scrutinized thousands of threads from user forums and examined the issues that people are raising (not to mention all the times users opt to “Report a Webpage Problem…”). We have also spent hundreds of hours listening and answering questions in meetings with partners and other important organizations. We simply could not deliver IE8 the way our customers and developers want us to without all this information. We also received a lot of feedback about how we transitioned from the IE7 beta releases to the IE7 final release, and as a result, we want to be clear about the plan for IE8.

We will release one more public update of IE8 in the first quarter of 2009, and then follow that up with the final release. Our next public release of IE (typically called a “release candidate”) indicates the end of the beta period. We want the technical community of people and organizations interested in web browsers to take this update as a strong signal that IE8 is effectively complete and done. They should expect the final product to behave as this update does. We want them to test their sites and services with IE8, make any changes they feel are necessary for the best possible customer experience using IE8, and report any critical issues (e.g., issues impacting robustness, security, backwards compatibility, or completeness with respect to planned standards work). Our plan is to deliver the final product after listening for feedback about critical issues.

We will be very selective about what changes we make between the next update and final release. We will act on the most critical issues. We will be super clear about product changes we make between the update and the final release.

The call to action now for the technical community is to download beta 2 (if you haven’t already) and let us know about your experience. Next, please prepare for final testing with public update so you can let us know – quickly, loudly, and clearly – if you find absolutely critical issues with it before the release of the final product.

Thanks –

Dean Hachamovitch
General Manager, Internet Explorer

P.S. If you’re a developer, or service provider, or IT professional, how do you prepare for the final release of new software? Leave a comment – we’d like to know.

Join members of the Internet Explorer team for the last  Expert Zone chat  of 2008 this Thursday, November 13th at 10.00 PST/18.00 UTC. These chats are a great opportunity to have your questions answered by members of the IE product team.

Thank you to all who have attended the chats through the year! Look for us to start these chats up again in January 2009. If you can’t join us online, all chat transcripts are published here.

Kristen Kibble
Program Manager

P.S. Upcoming IE chat dates are posted here.

Edit: Refreshed the links in the post and adjusted the UTC time.

In preparation for the Professional Developers Conference, the IE team recently authored some articles for a special issue of Code Focus magazine.  The articles cover everything from cross-version compatibility to performance, and include new sample code. You can read the articles online at the following locations: Welcome to CoDe Focus for Internet Explorer 8! What’s New in Internet Explorer 8 Beta 2? Making Your Web site Compatible Across Multiple Versions of Internet Explorer Introducing Compatibility View Create Your Own Web Slices Accelerators in Internet Explorer 8 Beta 2 New Search Features in Internet Explorer 8 Beta 2 Developer Tools in Internet Explorer 8 Beta 2 Better AJAX Development with Internet Explorer 8 Beta 2 AJAX Performance Measurement Methodology for Internet Explorer 8 Beta 2 Performance Improvements in Internet Explorer 8 Beta 2 Reliability and Privacy with Internet Explorer 8 Beta 2 Secure Coding with Internet Explorer 8 Beta 2 Internet Explorer 8 New Accessibility Features Or, if you’d prefer, you can also download the entire issue as a single PDF file.  Enjoy! Eric Lawrence Program Manager

Update 11:50 am - fixing a formating issue.

When Internet Explorer 8 Beta 1 launched in March, I wrote a post describing the permissive intellectual property licensing approaches we took for components of that release, such as Creative Commons licenses for copyrights in selected specs and the Microsoft Open Specification Promise (“OSP”) for implementations of those specs. 

Now with the launch of Beta 2, I’m happy to highlight a few ways we’re continuing to make our innovations available to the community.   By doing so, we hope to continue to foster the type of collaboration in the community that is so important to the “generativity” of the Internet, to borrow a term from Jonathan Zittrain (whose new book, by the way, is an important and worthwhile read).

Creative Commons License for Copyright in the Search Suggestions Specification

For Search Suggestions, we’re licensing copyright in the XML Search Suggestions Format Specification under the Creative Commons Attribution-Share Alike License.  This license lets others copy, distribute, modify and build upon the specification, even for commercial uses, as long as they give credit to Microsoft and license their own changes under the same terms.  Special thanks to DeWitt Clinton and other contributors to the OpenSearch JSON Search Suggestions extension, whose work relates to the XML Search Suggestions Format spec.  Visit Creative Commons for more information about their licenses, including how to use Creative Commons licenses on your own work.

Microsoft Open Specification Promise for Implementations of the Search Suggestions Specification

Microsoft has developed the Open Specification Promise (“OSP”) to provide a simple and clear patent promise to reassure the broad audience of developers and customers that a given specification can be used for free, easily, now and forever.  The OSP was developed with feedback from customers and the open source community, and we’re happy to make the XML Search Suggestions Format Spec available under the OSP.  The use of the OSP confirms that Microsoft patents needed to implement this specification can be used for free.  More complete information about the OSP can be found here.

Web Slice Icon Guidelines

Internet Explorer 8 introduces Web Slices as a way for web sites to allow users to subscribe to specific content directly within a Web page.  Users can see when content changes and view the updated portion of the Web page directly from the Favorites bar of Internet Explorer.  The Web Slice icon provides a common visual cue that a web page supports web slices.  Developers may freely use the icon under the Web Slice Icon Guidelines that we have developed, which are intended to promote the integrity of the icon as a common symbol for Web Slice functionality.  We made it easier to use the icon in accordance with the Guidelines by making available for download .png and .gif renderings of the icon in various sizes.

We are pleased to continue to contribute to the web community and, as always, look forward to your feedback.

Tom Rubin
Chief Counsel for Intellectual Property Strategy

Design criteria such as standard compliance, performance, reliability and security framed the design of IE8 as whole, for new as well as existing features. As a result, CSS expressions are no longer supported in IE8 standards mode. This change was announced previously on the IE blog, however, this post will provide a few more details about that decision. The following FAQ will give a quick overview of the feature, the rationale behind our design decision and what it may mean for your own site.

What is a CSS expression ?

Also known as ‘Dynamic Properties’, this proprietary CSS extension was introduced in Internet Explorer 5. Long before JavaScript libraries such as jQuery or Dojo were conceived, it allowed web developers to dynamically bind script to the page through CSS selectors. As an example, the following CSS declaration updates the background color of certain page blocks depending on the time of day :

div.title { background-color: expression( (new Date()).getHours()%2 ? "#B8D4FF" : "#F08A00" ); }

Why end support for expressions ?

• To comply with standards
  • Expressions are proprietary to Internet Explorer and as such not interoperable.
  • A common use-case for expressions was to fix IE bugs or to emulate those CSS 2.1 features not yet supported by the browser, for example, min-width and max-width. We have not only worked hard to fix these bugs in IE8 but our new layout engine supports the missing features natively.
• To improve performance
  • Expressions evaluation has a high runtime cost; web performance experts like Steve Souders recommend avoiding them to improve front-end performance
• To reduce the browser attack surface
  • Because they expose a script execution context, CSS expressions constitute a possible script injection attack vector.

Are expressions still available in IE7 and Quirks mode ?

Yes. For backward compatibility, CSS expressions are still executed in Quirks and IE7 Strict modes. But starting with IE8 Beta 2, they are ignored in IE8 Standards mode.

Pages on my web site depend on CSS expressions.  How does this affect me ?

Thanks to IE8’s new layout engine, most expressions written to work around CSS 2.1 bugs and shortcomings should no longer be needed; we expect unsupported or incorrectly interpreted properties to work in a standard, interoperable way. For those expressions supporting more specific purposes, anything they do is inherently achievable using standard JavaScript, usually interoperably and at lower runtime costs. The specifics will of course depend on your application. Based on your feedback to this post, we may visit examples in future installments.

Ending support for expressions - a feature often used to fix the very issues we have worked hard to address in this release – helps make IE8 more standard, faster and more secure for our users.

Sylvain Galineau
Program Manager

The IE Cumulative Security Update for October 2008 is now available via Windows Update. Alternatively, you can receive this and all other Microsoft updates via the new Microsoft Update. I encourage you to upgrade to Microsoft Update if you haven’t already to ensure that you receive the latest updates for all Microsoft products.

This update addresses six vulnerabilities. The security update addresses these vulnerabilities by modifying the way that Internet Explorer handles the error resulting in the exploitable condition. For detailed information on the contents of this update, please see the following documentation:

• Microsoft Security Bulletin MS08-058
• Microsoft Knowledge Base Article 956390

This security update is rated Critical for all supported versions of Internet Explorer 6 and earlier. The security update is rated Important on Internet Explorer 7 on Windows XP and Internet Explorer 7 in Windows Vista.  Beta versions of Internet Explorer are not vulnerable. 

IE security updates are cumulative and contain all previously released updates for each version of Internet Explorer.

I encourage everybody to download this security update and other non-IE security updates via Windows Update or Microsoft Update. Windows users are also strongly encouraged to configure their systems for automatic updates to keep their systems current with the latest updates from Microsoft.

Terry McCoy
Program Manager
Internet Explorer Security

Join members of the Internet Explorer team for an Expert Zone chat next Thursday, October 16th at 10.00 PDT/17.00 UTC. These chats are a great opportunity to have your questions answered by members of the IE product team. Thank you to all who have attended the chats to date!

If you can’t join us online, all chat transcripts are published here.

We want to hear your feedback on IE8 Beta 2!

Kristen Kibble
Program Manager

P.S. Upcoming IE chat dates are posted here.

Sunava Dutta here, a program manager focused on improving AJAX in the browser! Now that Internet Explorer 8 Beta 2 is out, I want to write about some of the latest rounds of enhancements we’ve made. As many of you may recall, back in March we discussed a set of developer experiences in AJAX across scenarios such as client-side cross-domain data access, local storage, and navigation state management among many others. The good news is our team has been working since Beta 1 to tweak and update our implementations based on feedback from developers (thanks for your contributions!) and ongoing updates to the W3C standards drafts on which most of these implementations are based or have been submitted for consideration. Not content with doing just that, we also added a few new features for developers. More on that later…

The AJAX updates we’ve chosen for Beta 2 focus on maintaining cross-browser compatibility and the feature sets that developers have thought would be the most useful. Without further ado, here they are.

XDomainRequest (XDR)

This is an object built from the ground up to make client-side cross-domain calls secure and easy. To reduce the chances of inadvertent cross domain access, this object requires an explicit acknowledgement for allowing cross domain calls from the client script and the server. Additionally, it reduces the need for sites having to resort to the dangerous practice of merge scripting from third parties directly into the mashup page. This practice is dangerous because it provides third parties full access to the DOM. All this comes with the added benefit of improved client-side performance and lower server maintenance costs thanks to the absence of a need for server farms for proxying.

During the Beta 1 timeframe there were many security based concerns raised for cross domain access of third party data using cross site XMLHttpRequest and the Access Control framework. Since Beta 1, we had the chance to work with other browsers and attendees at a W3C face-to-face meeting to improve the server-side experience and security of the W3C’s Access Control framework. As a result, we’ve updated XDR to be explicitly compliant with syntax and directives in the sections of Access Control for requesting simple public third-party data anonymously on the client! (Section 5.1.3 in the Access Control Process Model)

The updates to XDR from Beta 1 allow IE8 to request data from the domain's server by sending an Origin header with the serialized value of the origin of the requestor. IE8 Beta 2 will only return the response if the server responds with Access-Control-Allow-Origin: *, instead of allowing the XDomainRequestAllowed: 1 header as we did in Beta 1. Other changes include support for relative paths in the open method, and restricting access to only HTTP and HTTPS destinations.

Cross-document Messaging (XDM)

Cross-document messaging is another powerful cross-domain feature that I’ve blogged about in the past. Rather than make a backend request to a remote Web service, this allows sites hosting third-party IFrame-based "gadgets" or components to communicate directly with the parent, without unsafely violating the same site origin policy. This has advantages including improved performance and reliability, as developers don’t have to resort to workarounds that behave differently between browsers and have unwanted side-effects. This technique also removes the need for embedding third-party script in your page, lessening the chance of potential information disclosure vulnerabilities like the disclosure of your sensitive data (such as information in your social network profile) to third parties without your consent.

Beta 2 updates here include moving the onmessage handler from the document object to the window object to better align with the updated HTML 5.0 draft.

window.attachEvent("onmessage", HandleMessage);

We also replaced e.URI with e.origin, which is serialized form of “scheme” + “host” + “non-default port”. This is far safer as the URI can carry potentially sensitive information from the origin site that is not needed by the recipient for the decision to grant or not grant access.

if (e.origin == 'http://www.contoso.com') 
        { 
               // process message text     
        }

Finally, the HTML 5.0 draft also mandates that the targetOrigin parameter for the postMessage method now be made a required parameter, as opposed to an optional one. This will make it difficult for developers to make errors by requiring an explicit acknowledgement of the target destination of the message by specifying the origin <URL> or wildcard <*>.

 frameOther.postMessage("This is a message", "http://example.com");

DOM Storage

Today, web pages use the document.cookie property to store data on the local machine. Cookies are limited in capability by the fact that sites can only store 50 key/value pairs per domain. Furthermore, the cookie programming model is cumbersome and requires parsing the entire cookie string for data. While cookies are useful for marking transitions and changes on the client to the server as they are sent with the request headers in chunks of up to 4KB, IE8 brings better alternatives for scenarios involving persisting data on the client and distinctly maintaining sessions in different tabs. The W3C’s HTML 5 DOM Storage objects provide a much simpler global and session storage model for key/value pair string data. Sites can store data for the life of a tab or until the site or user clears the data.

Updates for Beta 2 include changing the name of the persistent globalStorage attribute to localStorage and the removal of the need to specify the domain when writing to the localStorage

// Store a key-value pair.
localStorage.setItem("FirstName","Sunava");

Finally, we also included improved support of the updated onstorage HTML 5.0 event returned when the storage is changed. We now return the URI when the local storage is changed, so that handlers for pages can know who carried out the latest transaction in the storage space in addition to providing the source to the window of the origin. Furthering the good news, the HTML 5.0 Working Group has incorporated the clear method, which we shipped in Beta 1, into the draft. This essentially allows for script to clear all items accessible in its storage space without having to iterate though the keys.

Connectivity Event

The navigator.onLine property and online/offline events now work on Windows XP as well as Windows Vista. The work to enable this was not trivial, as connection awareness in Windows XP is not quite as advanced as Windows Vista. That said, this will be extremely beneficial for developers, who we believe shouldn’t have to worry about OS differences. The value of connectivity events is particularly appealing when used in conjunction with the localstorage, where data can be cached in case of network loss!

XMLHttpRequest

Introducing the XDomainRequest object in IE8 hasn’t diverted our attentions from constantly tweaking and improving XMLHttpRequest, which will continue to be our flagship object for same-domain communications. Post-Beta 1 energies here have focused on a few bug fixes around reliability and working with the Web Apps Working Group to clarify and improve the draft specification, our compliance with it, and W3C public test cases. A timeout method introduced here in Beta 1 for the convenience of developers is currently being evaluated for adoption in the XMLHttpRequest spec.

// Sets timeout after open to two seconds.
xhr.timeout             = 2000;

ToStaticHTML, to JSON, and fromJSON

What do you do with the strings returned from third parties using XDomainRequest or Cross-document Messaging? In today’s world of increasing script injection and Cross-site Scripting (XSS) attacks, having the option of passing these through a safe parser comes as a welcome relief. As detailed in Eric Lawrence's post on Comprehensive Protection for IE8 Security, toStaticHTML provides a powerful way of sanitizing your strings by purging potentially executable content.

//Calling:
window.toStaticHTML("This is some <b>HTML</b> with embedded script following... <script>alert('bang!');</script>!");

//will return:
This is some <b>HTML</b> with embedded script following... !

In addition, IE8 Beta 2’s toJSON and fromJSON methods provide improved performance as opposed to non-native Javascript deserializers and serializers. Our implementation is based on the ECMAScript 3.1 proposal for native JSON-handling which uses Douglas Crockford’s json2.js API. In addition to the performance benefits of going native, the JSON parser provides a safe alternative to the eval() method, which has been a common and dangerous way to revive JSON objects, and could allow arbitrary script functions to execute.

Other Features

AJAX Navigations has undergone minimal changes since Beta 1. We’ve got some new code samples and overview documentation on this for Beta 2 on MSDN. Improved connection parallelism per host has also undergone a few tweaks and will command its own post soon.

Summary

We’ve worked in standards to make the AJAX experience for developers better. Beta 2 implements the changes mentioned above. Moving forward, we will continue to partner with members in the W3C on a variety of topics including advancing draft specifications. Strong developer adoption of these features is a priority and we’re focusing on help sites transition to integrating these features. For code samples for the AJAX feature set, please refer to our IE8 AJAX Beta 2 Hands on Labs. In case you’ve wondered who the ‘we’ in the AJAX core development team is, below is a photo (unedited, red eyes included) that puts a few faces to the names that pop up occasionally on blogs and mailing lists! Enjoy!

Sunava Dutta
Program Manager

From top left: Sharath Udupa (Developer), Gideon Cohn (Test), Zhenbin Xu (AJAX Senior Developer, Alex Kuang (Test) and Karen Anderson (Test)
From bottom left: Sunava Dutta (Program Manager) and Ahmed Kamel (Developer)Missing from this photo are Françoise Louw (Test), Adrian Bateman (Program Manager) and Gaurav Seth (Developer)

Hi. In previous posts I talked about the IE8 IEAK and new event logging for IE8 in the Application Compatibility Toolkit. Today, I’m going to discuss the improvements we made to Group Policy support for Internet Explorer 8.

Background

For those of you who might be new to Group Policy, here is a quick background. Let’s first assume you use an Active Directory environment to administer the computers in your corporate network. If that is the case, Group Policy provides a wide set of policy settings to manage IE8 after you have deployed it to your users' computers. These settings are locked down and cannot be changed by users, as they are always written to a secure tree in the registry.

The IE Group Policy node in GPEdit.msc (GPEdit.msc is one of the tools used to configure Group Policies):

Group Policy allows you to create IE (and other software) configurations as a part of Group Policy objects (GPOs). The GPOs are linked to hierarchical Active Directory containers such as sites, domains, or organizational units. A client-side extension ensures that your policies are applied and refreshed regularly.

Tools

You might be wondering how to configure Group Policy? All the tools to configure create, manage, view, and troubleshoot GPOs are provided in your Windows operating system. Please check the Windows Server Group Policy site to find a list of the tools that are built into your OS.

The IE8 Deployment Guide, a very important resource itself, is now updated to include content for IE8 Beta 2. For instance, as there are more than a thousand IE GPs, configuring these policies for the first time may seem like a daunting task for a new IT Professional. For this very reason, the Group Policy section of the Deployment Guide has been updated to include recommended Group Policy settings for security, performance and compatibility with IE6 and IE7.

Group Policy support in IE8

In IE8, we have added more than 100 new Group Policies, bringing the total Group Policies supported in IE8 to 1300! Virtually all new IE8 features have Group Policy support, whether it is Compatibility View, Accelerators, or InPrivate Browsing Mode. These policies allow administrators to fully control IE8 features: hide the feature completely, preset the default, lock the user to only use the defaults, etc. For example, an administrator could turn off InPrivate Browsing by enabling the Turn off InPrivate Group Policy.

We understand that organizations have different needs. We provided extra granularity in the form of additional policies, so that features can easily be configured to best suit your needs. For instance, Compatibility View has five Group Policies:

• Turn off Compatibility View
• Turn off Compatibility View button
• Turn on Internet Explorer 7 Standards Mode
• Turn on Internet Explorer Standards Mode for Local Intranet
• Use Policy List of Internet Explorer 7 sites

As an example, if you are confident all your internal line of business applications and web sites work best with IE8, you can enable Turn on Internet Explorer Standards Mode for Local Intranet Group Policy. This will overwrite the intranet standards mode to be IE8. As usual, each policy comes with descriptive explain text that allows you to fully understand what the policy has been designed to do.

The Explain Text for Turn on Internet Explorer Standards Mode for Local Intranet Group Policy:

IE8 plays an important role in helping protect users against a range of attacks by offering new security features like the SmartScreen Filter, Data URI and Encryption support.  All of these security features are GP enabled so the administrator can ensure their users are safe and secure in corporate environments.

Based on the feedback we received from customers, we have Group Policy enabled some of the legacy settings like secondary home pages, something that wasn’t available in IE7. We’ve also given extensive Group Policy support for the Favorites Bar and Command Bar; an administrator now has firm control over how the IE UI will look.

We have refined our Group Policy support in this release and look forward to your feedback once you’ve had a chance to try it out.

Thanks,

Jatinder Mann
Program Manager

Hi, my name is Helen Drislane, I am a program manager on the IE team responsible for some of the user interface including tabs and I‘m going to discuss the new Tab Grouping feature (tab color!) with you. We had a lot of fun putting this feature together, so I am going to explain a little bit about the process involved in designing it and then describe the things you can do with it.

EVOLUTION OF THE DESIGN AND ALGORITHM

After shipping Internet Explorer 7, the IE team collected data from user reviews, from IE Feedback on MS Connect, and from other Microsoft product teams. We formed a list of top user requests which included the new Reopen Closed Tab feature, the new tab Crash Recovery feature, work to ensure that a bad tab would not hang the other tabs, the new Duplicate Tab feature, and many others. That list also included the following two observations:

• Today, a tab that is opened from another tab is always put at the end of the tab row. Since it is related to the first tab, it is odd that one has to go searching all the way at the end of the tabs to find it.
• When a tab is closed, the next tab given focus is always the one to the right (it has no relation to the tab just closed). Users found this to be odd.

Based on this feedback, we decided to rework the tab open algorithm so a link opened in a new tab,  open a new tab adjacent to the original tab and not at the end of the tab row. Here’s a picture to explain where the link on the page opens in IE7 and where it opens with IE8:

The result is the following:

Based on the above feedback, we similarly reworked the tab close algorithm so that tab selection is not always placed to the right when a tab is closed, but it is placed on a tab related to the recently closed tab, to get the following behavior:

In addition to listening to different IE Feedback channels, we worked with user researchers here at Microsoft to hold Usability Studies in which users came in, browsed the web, and explained why and how they were accomplishing their browsing tasks.

During these usability studies, we found a few interesting trends:

• Users queue up a set of tabs. In other words, users will search for something and open up a handful of the search results to read later. This trend also happens with online news sites; users queue up a set of articles they’d like to read later.
• Users use one window to handle multiple tasks (i.e. I have 4 tabs open on work-related sites, 3 tabs for news articles I want to read later, and 3 tabs for restaurants I’d like to take my mother to when she visits)
• After switching from another application, users frequently spend a lot of time looking for a specific tab

In the trends described above, the related tabs (whether they are search results or news articles opened from the same website) would ideally not only be placed adjacent to one another but would also have some visual indication of being grouped together so that different tasks could be more easily identifiable. This is when colors came in to play.

The idea behind tab grouping is that tabs originating from the same source are grouped together. The image below shows MSNBC with two articles from it opened in green, and a Windows Live search on Seattle restaurants with two search results from it opened in blue:

Now with visual indicators on my tabs, I can quickly identify the groups of tabs that are related to different tasks. So if I am switching back to Internet Explorer after using another application, I will quickly identify the blue-colored tabs as information related to the hunt for a good restaurant.

Another important aspect of designing this feature was deciding upon the visual indicators for groups. A common question we get is “How do color blind users use tab grouping?”  We made sure to include these users in our design. The difference between the colors below is great enough that many color blind users can differentiate between the different groups:

In addition, for users who have a screen reader running, we include names of the tab groups (i.e. Tab Group 1, Tab Group 2) on each of the tabs after the title. The picture below shows the two tab groups and the tooltip on the fourth tab containing the tab group information:

Now that you know a little bit about the design of tab groups, I will explain how tab groups are created and what you can do with them.

HOW IS A TAB GROUP CREATED?

If, for example, you're viewing a newspaper website, and would like to queue up some articles to read, there are a few ways in which you can open these articles (links to articles) in new tabs and keep them grouped:

• Right-click on a link and select the “Open in New Tab” option
• Ctrl-click on a link
• Middle-click on a link (The middle-click can be done by either by pressing the mouse scroll-wheel, or if your mouse does not have a middle button/scroll-wheel, simply right and left-click at the same time)

In addition, if you right-click on a specific tab and select the “Open a New Tab” option, a new tab will open up and will be grouped with the aforementioned source tab.

If you do any of the above in IE8, the original tab and all tabs opened up from it will be grouped.

WHAT CAN I DO WITH TAB GROUPS?

If you accidentally close a tab within a group, using the new “Reopen Closed Tab” option in the menu will not only restore that recently closed tab, but will also restore that tab into the right group.

Also, when you have completed a task, tab grouping now makes it easier to close everything related to that task by allowing a one click “Close this Tab Group” option in the tab context menu.

If you would rather have a tab not be associated with the other tabs in the group, you can easily “Ungroup This Tab”.

All of these options are available in the context menu that appears if you right-click on a tab:

In addition to the right-click context menu options, users can drag and drop tabs. Although the main appeal of this feature is that it works seamlessly in the background (there is no work on the user’s side to get this enhanced tab functionality), there are a couple of us who like to over-organize. For the over-organizers out there, dragging tabs into an existing group will make them part of that group. In addition, you can ungroup a tab by dragging it between two un-grouped tabs.

FREQUENTLY ASKED QUESTIONS

Why does the tab stay in the group if I navigate to another page on that tab?

If you are using a specific tab to navigate, the algorithm assumes that your new destination is somehow related to the group. If you don’t want the new navigation to be part of the group, you can either ungroup the tab, or open a new tab to navigate.

Why does duplicating a tab not group the two identical tabs together?

The new duplicate tab feature (found in the right click context menu for tabs) allows you to take the same tab down a completely different path. So although the tabs are identical, the idea is that the user wants to take them in two different directions.

Why are my home pages not grouped together?

Similar to the response above for duplicating a tab, the home pages usually consist of your mail client, your online newspaper, etc. They are not usually related (except that you’d like them all to open when you start the browser).

How can I turn Tab Grouping off?

From the “Tools” button in the Command Bar select “Internet Options”. Select the “Settings” button under Tabs. Uncheck the “Enable Tab Groups” setting.

I hope the content above not only provides a bit of background into the evolution of this feature but also is informative in explaining what you can do with tab grouping.

Thank you for trying out the Beta and I look forward to hearing your feedback!

Helen Drislane
Program Manager

Greetings, I’m Russ McRee of Microsoft’s Online Services Security & Compliance Incident Management team. My team serves as incident handlers for the various types of attacks our online services face. High on the list of incidents we handle are cross-site scripting attacks. 

There’s an unfortunate misconception surrounding cross-site scripting (XSS) attacks that result in them being perceived as less impactful than other types of attacks, and often more theoretical than practical. I believe this mindset increases inherent risk for Internet users. I wanted to share some statistics that show why I think the addition of the XSS Filter to Internet Explorer is so significant.

The Web Application Security Consortium (WASC) recently released its findings from the Web Application Security Statistics Project 2007. The data in this report adds to the statistics I cited in The Anatomy of an XSS Attack, for the June 2008 ISSA Journal.

Some highlights from the WASC study:

• Of the most prevalent vulnerabilities, including SQL injections, information leakage, predictable resource location, and cross-site scripting, XSS was the most prevalent at 41%.
  
  
• Of 10,297 sites analyzed for the WASC study, 28,796 XSS vulnerabilities were discovered, accounting for 31% of all sites surveyed.

Additional statistics:

• According to the Internet Security Threat Report from Symantec, during the last six months of 2007, 11,253 site-specific, cross-site scripting vulnerabilities were documented, compared to 6,961 between February and June in the first half of the year, for a 62% increase in six months.
  
  
• According to a WhiteHat Security Statistics Report, 90% of all websites have at least one vulnerability, and 70% of all vulnerabilities are XSS.

While statistics can always be used to prove a point, more important are the actions taken to alleviate a problem. Since XSS vulnerabilities are of epidemic proportions, the XSS Filter in IE8 (intended to protect consumers from this massive attack vector) is a great thing.

David Ross, Security Software Engineer on the SWI team has driven the effort that discovers likely XSS in a cross-site request, and identifies & neuters the attack if it is replayed in the server’s response. Users are not presented with questions they are unable to answer – IE simply blocks the malicious script from executing.

Simply put, IE 8’s XSS Filter seeks to provide defense in depth via automatic detection and prevention of common XSS attacks, a pervasive security threat facing Internet users, without deterring performance or compatibility.

Referring back the statistics above, this translates into 70% of possible threats faced by IE 8 users deterred by the XSS Filter.  I’m really excited about the work that the Internet Explorer and SWI teams have been doing  here to provide new levels of protection for users.

Russ McRee

The latest Application Compatibility Toolkit (ACT) release, ACT 5.0.5428.1080 is publicly available and can be downloaded here.

To give you some background, ACT helps customers understand their application compatibility situation by helping identify which applications are compatible with Vista, IE7, and IE8 and which require further testing. ACT allows compatibility data to be uploaded from individual machines to a central location for analysis, grouping and reporting. Once an issue has been identified, help will be available on how to resolve a particular issue or create a workaround. Furthermore, partners and customers using ACT are able to post comments to the Online Application Community, where they can share data and information about application compatibility testing.

The IE components of ACT are:

• Internet Explorer Compatibility Test Tool (IECTT). The IECTT helps identify your Web-based issues, shows your results in real time, and allows you to upload and view the data in the Application Compatibility Manager (ACM), a part of the ACT toolkit. As you test your application or site, the IECTT records events in real time when compatibility issues occur. For instance, if one of your sites injects JavaScript to another site and the IE8 Cross-site scripting (XSS) filter detects this as a reflection attack, a Cross-Site Scripting Filter event would be logged in the IECTT UI.
  
  
• Internet Explorer Compatibility Evaluators (IECE). The IECE can be deployed within an enterprise and will help identify Web-based issues in the background. As you test your application or site, the IECE records events in the background as they occur. You will be able to view the logged events in the ACM after you upload them.

Overall, these tools help customers lower their costs for application compatibility testing, prioritize their applications, and deploy Internet Explorer more quickly.

The work flow for identifying application compatibility issues before rolling out a new version of IE8 is shown below:

1. Install the latest version of ACT and IE8.
2. Either deploy the IECE to a body of testers or use the IECTT and enable logging.
3. Begin a regression test pass of all line of business applications and sites.
4. Once a compatibility event has been encountered, diagnose the problem and create a suitable workaround or fix.

New Application Compatibility Events added in IE8

We added logging for twelve new Application Compatibility Events in IE8, as shown in the table below. Including the IE7 events, we now currently log 31 compatibility events. The Internet Explorer Compatibility article contains more information on these events.

Internet Explorer Application Compatibility article

In the past, we noticed that the ACT tool helped identify the compatibility issues that occur in a line of business application or website, however, the tool itself did not provide any guidance for remediation. In IE8, we are providing a resource that gives exactly that information. The article is linked directly in the IECTT logged message or is directly available here. The article covers the following topics for all IE7 and IE8 compatibility events:

• Logged Message – This is a copy of the event description that you’ll see in the Internet Explorer Compatibility Test Tool.
• What is it? – This is an elaboration of the logged message explaining what the event is. Additional references are provided when available.
• When is this event logged? – This is a short description of what has to happen in your Web page for this event to be logged in the Internet Explorer Compatibility Test Tool.
• Example – Most events include examples that demonstrate how to make the corresponding event create a log entry in the Internet Explorer Compatibility Test Tool. These examples help make the description of the event more concrete.
• Remediation – Guidance on what you can do to eliminate the incompatibility from your Web site.

We will be adding additional examples and remediation to this article before the final IE8 release.

As you can see, we refined our Application Compatibility logging in IE8 and have provided a useful resource in the IE Application Compatibility article. We look forward to you trying it out and giving us feedback in the IE newsgroups.

Jatinder Mann
Program Manager

Hi, my name is Jatinder Mann and I work on the Internet Explorer Administration Kit (IEAK) and Group Policy. Back in June, James Pratt and Jane Maliouta alluded to IEAK improvements for IE8. Today, I will be talking about the work we have done in this area.

Internet Explorer Administration Kit 8 Beta

IEAK8 Beta is now available publically for everyone to try. To give you some background, the IEAK allows you to deploy customized packages and manage IE settings post deployment within corporations and among Internet Content Providers (ICP) and Internet Service Providers (ISP). For instance, Acme Corp could use IEAK to create a custom IE package for their employees that has Acme favorites, search providers, home pages, Web Slices, Accelerators, and more.

We simplified creating, deploying and managing branded IE packages. We optimized the IEAK to help you build your customized IE packages more quickly and to allow you to configure and customize new features in Internet Explorer 8, like Accelerators and Web Slices.

In this post, I will be talking about how the IEAK:

• Helps customize new features in IE8
• Provides full language and platform support
• Builds IE8 packages more quickly and is more intuitive.

Customize New Features in IE8

The following new features can be now customized via the IEAK8:

Accelerators

You can easily include custom defaults for Accelerators: simply point to an XML file for the desired Accelerator, or import existing Accelerators from a local machine.



Web Slices

In the Favorites, Favorites Bar and Feeds dialog you can now add custom Web Slices by simply clicking on the Web Slice radio button and specifying the Web Slice information.





Compatibility View

Internet Explorer 8 Beta 2 introduces Compatibility View which is a significant enhancement over the “Emulate IE7” functionality from IE8 Beta 1. You can customize this feature in the Compatibility view dialog.

Search Enhancements

 IE8 supports search providers which offer rich text and image suggestions; through IEAK 8 you can add search providers with suggestions and configure default search providers.

Additional IE8 Features

Many other IE8 features, like InPrivate Browsing, Developer Tools and Delete Browsing History, can be customized in the Additional Settings page available in the corporate license mode. For example, in a corporate environment you might want to encourage users to delete saved passwords; you can chose to have the Delete Passwords checkbox in Delete Browsing History checked by default. Similarly, you may want to turn off InPrivate Browsing mode by default.

Build Your IE8 Package More Quickly

Internet Explorer 8 Customization Wizard has fewer pages than the Internet Explorer 7 Customization Wizard: you’ll be able to build your customized package faster now.

Furthermore, we have redesigned some screens to simplify the overall flow of the wizard. Custom Components is a good example of this. Compared to the original screen, this dialog box now displays a list of custom components and allows easy addition and removal of items through a pop-up window.

The IEAK7 Custom Components Screen:



The simplified IEAK8 Custom Components Screen:



Full Language and Platform support

The IEAK8 Beta can build IE8 packages for all platforms and 24 languages supported by IE8 Beta 2. Please refer to the blog posted titled IE8 Beta 2 Available in 25 Languages for a complete list of supported platforms and languages.

How does the IEAK apply branding?

Customers have often asked me how the IEAK applies branding to IE. Branding in this case can be defined as any customization of IE, including all the customizations mentioned above. The IEAK generated IE package contains both the IE8 setup files (unless you are using the configuration only package, in which case IE8 would already be installed on your computer and you wouldn’t need the setup files) and customizations. The IE8 setup is used to install IE8. Upon restart, customizations are applied per user to the registry and branding files.



The customizations are stored in the install.ins file found under the Custom or Signup folders in the Internet Explorer directory. The install.ins file contains all types of branding including IEAK and unattend branding. IEAK branding consists of ISP, ICP and corporate branding, while unattend branding consists of the manufacturer defaults.

Branding is also applied when the user chooses to Reset Internet Explorer settings (RIES). This can be done by selecting Reset under the Advanced tab in the internet options dialog. RIES will apply the branding found in the install.ins file. If a user were to remove the install.ins file and reset IE, the branding step would get skipped. In IE8, RIES comes with a Remove Branding option; however, this option only removes ISP, ICP and Corporate branding; unattend branding will not be removed.

We refined the IEAK in this release and look forward to your feedback once you’ve had a chance to try it out.

Jatinder Mann
Program Manager

P.S. James discusses what's new in IE8 for IT Pros in his screencast here

edit: modified first paragraph under "Build your IE8 Package More Quickly"; added P.S.; trimmed down the Compatiblity View section


[Developers IT PRO ]
View original post|Add to del.icio.us | Share

Hello,

My name is Sébastien Zimmermann. I’m the developer owner for the Visual Search Feature, which Sharon already described in detail. I also own the Accelerators Button Feature, and during IE7 worked on Setup and Phishing Filter—now “SmartScreen® Filter”.

In this post, I would like to get you started on creating your own Visual Search service/provider for Internet Explorer 8. If you own or develop websites of any kind—even if it’s a small website or an intranet site—this post is for you.

Making your website available for search from within the browser enables your customers/users to access your website whenever they need a service from it, without having them type your full web address. Additionally, you (and your brand) are always there with them, right in their browser. The more useful the service, the more likely users are to install it to have an ongoing connection with your website.

To keep things simple, I will take the “Hello, World!” approach: give you the basics so you can quickly get your service running. To keep things simple, this service won’t even be dynamic at first. Once the foundations are there, it will be easy for you to tailor the sample to your own needs, no matter what language your pages are written in.

For the sake of simplicity, I assume in this post that your website is at http://www.example.com—please replace all references of this domain with your own website domain.

Before users can install your service, you’ll first need to define it in a way the browser can understand, i.e. through the OpenSearch Description XML file.

Copy the following code and paste it into a file that you’ll put at the root of your website. We’ll name it opensearch.xml, so it will be accessible by anyone at http://www.example.com/opensearch.xml:

<?xml version="1.0" encoding="UTF-8"?>
<OpenSearchDescription xmlns="http://a9.com/-/spec/opensearch/1.1/">
    <ShortName>example Search</ShortName>
    <Url type="text/html" template="http://www.example.com/results.aspx?q={searchTerms}" />
    <Url type="application/x-suggestions+xml" template="http://www.example.com/suggestions.xml"/>
    <Image height="16" width="16" type="image/icon">http://www.example.com/favicon.ico</Image>
</OpenSearchDescription>

There are three important pieces we define in this file:

• A Results Page URL whose MIME type is text/html, where the user will land after a search—here, results.aspx. The “{searchTerms}” part will automatically be replaced by IE with the user’s search terms. In this sample, I assume your website has an integrated search engine. If it doesn’t, and unless it’s an intranet website, you may replace that URL with the following one instead, which will search your domain using live.com:
  http://search.live.com/results.aspx?q=site:www.example.com+{searchTerms}
  
  
• A Suggestions Service to assist users while typing their search queries—here, suggestions.xml. If you do not want to have a suggestions service, you may omit this line—IE will handle it just fine. Also, if you already have a suggestion service available that uses JSON instead of XML, you may use its URL instead—just replace the application/x-suggestions+xml MIME type with application/x-suggestions+json.
  
  
• An Icon—here we made a reference to a favicon.ico file in the root of your website. This is the icon that will be used as a button in the QuickPick—the row of search provider buttons at the bottom of the search dropdown, pictured above. If you don’t have an icon for now, IE will choose a non-descript default for you, just remove the whole line. But it’s better if you have one—this allows users to recognize your website and/or brand.

Note: for your OpenSearch file to work properly in IE7, it is important that the URL of type text/html appears first in your file, before the one of type application/x-suggestions+xml or application/x-suggestions+json.

Next, you’ll need to tell the browser where to find your service description—i.e. the opensearch.xml file you just created. This is easy; just add the following line somewhere in the <head /> section of any web page where you want to make your service available:

<link rel="search" type="application/opensearchdescription+xml" href="http://blogs.msdn.com/opensearch.xml" title="example Search" />

That’s it. Try loading the page: you’ll notice that the down-arrow next to the search box has lit (). Click the arrow and you’ll now be able to add your very own service in IE!

In addition, you may want to programmatically enable the user to add your provider to IE. Just add a hyperlink or button on your page that calls the AddSearchProvider() method, referencing the description file:

<a href="javascript:window.external.AddSearchProvider('/opensearch.xml')">Click here to add my search engine to IE8!</a>

Note: to check if the user has already installed your provider, you’ll want to use the IsSearchProviderInstalled() method.

Finally, when your service is installed, you’ll automatically be featured on the Accelerators button () without any additional work. Select some text, click on the button, then on “More Accelerators.” Choose your service and it will be called with the text you just selected. Note that you may add support for Accelerator Previews directly from the OpenSearch file. This is beyond the scope of this post, but more information is available here.

Now that your service is described, let’s implement suggestions.xml. Here, I’m going to use a sample that goes over most features to give you the basics.

Ok, so let’s copy the following and paste it into suggestions.xml, at the root of your website:

<?xml version="1.0"?>
<SearchSuggestion>
    <Query>test</Query> <!-- Note: This sample will only work when you type "test" in the search box! -->
    <Section>
        <Item>
            <Text>Hello, World!</Text>
            <Url>http://www.webstandards.org/files/acid2/test.html#top</Url>
            <Description>Your Visual Search service is working!</Description>
            <Image width="100" height="100" alt="Acid2 Smiley" align="top"
                   source="http://ieblog.members.winisp.net/images/acid2smiley.png" />
        </Item>
        <Separator title="This is a separator" />
        <Item>
            <Text>This is a simple text suggestion</Text>
        </Item>
        <Item>
            <Text>And another one with description</Text>
            <Description>This is the description</Description>
        </Item>
        <Item>
            <Text>This is a text suggestion with an image</Text>
            <Image width="16" height="16" alt="Acid2 Smiley" align="middle"
                   source="http://ieblog.members.winisp.net/images/acid2smiley.png" />
        </Item>
        <Item>
            <Text>This is a suggestion with a link and an image</Text>
            <Url>http://www.live.com/results.aspx?q=Hello+World</Url>
            <Image width="16" height="16" alt="Acid2 Smiley" align="middle"
                   source="http://ieblog.members.winisp.net/images/acid2smiley.png" />
        </Item>
    </Section>
</SearchSuggestion>

And voilà! If you type “test” in your search box after selecting your service, you’ll see the cool suggestions featured at the beginning of this post. Note that anything else but “test” won’t work, because IE checks if the <Query /> tag matches what’s in the search box.

If you are using ASP.NET, try this for something a little more dynamic (pictured on the left): rename suggestions.xml to suggestions.aspx, change the URL of type application/x-suggestions+xml in the OpenSearch Description file to http://www.example.com/suggestions.aspx?q={searchTerms}, and re-install your service in the browser (remove it first through Tools->Manage Add-Ons). Then, replace the first couple lines of suggestions.aspx with the following and try searching with your service again:

<%@ Page ContentType="text/xml" Language="C#" %>
<%@ OutputCache Location="None" %><?xml version="1.0"?>
<SearchSuggestion>
    <Query><%=HttpUtility.HtmlEncode(Request["q"])%></Query>
    <Section title="example Search">
        <Item>
            <Text>You typed: <%=HttpUtility.HtmlEncode(Request["q"])%></Text>
        </Item>
        <Separator />

        <!-- The rest of the file comes here -->
        <Item>
            <Text>Hello, World!</Text>
            <Url>http://www.webstandards.org/files/acid2/test.html#top</Url>
            <Description>Your Visual Search service is working!</Description>
            <Image width="100" height="100" alt="Acid2 Smiley" align="top"
                   source="http://ieblog.members.winisp.net/images/acid2smiley.png" />
        </Item>
        ...

The first step being the hardest, I hope this post succeeded in making it easier for you to get started. I look forward to see how you will creatively use the features in IE8 Visual Search to help your users quickly get to things they want on your site. If you need to dig deeper after reading this post, our writers created an excellent “Search Provider Extensibility” article on MSDN.

Now, it is up to you to develop amazing services using this feature. Inspire yourself from the services already available on the IE8 Gallery, and explore the possibilities.

The QuickPick menu makes “vertical” searches—such as Wikipedia, Amazon, and most likely your website—more visible and accessible, and enables users to quickly target their search on your service. So whether your website is about stock quotes and financial news, or sells music, auto parts, or cake… you can provide a way for your customers to have a deep, useful, ongoing relationship with your website.

I sincerely hope you will have as much fun developing for this feature as we’ve all had designing it. We are interested in learning about the services you create. Let us know about them, and do upload your OpenSearch Description File to the IE8 Gallery once finished for everyone to use.

Happy coding!

Sébastien Zimmermann
Software Design Engineer

edit: updated first image

In August 2008, Dean announced the release of IE8 Beta 2 in English, Japanese, Chinese (Simplified), and German. Today the IE team  is pleased to announce the availability of Internet Explorer Beta 2 in 21 additional  languages. The languages released today are fully localized versions of the IE8 English Beta 2.

The Complete List of IE8 Beta 2 Languages

Note: Please visit the Internet Explorer 8 homepage on Microsoft.com to download IE8 Beta 2 in your language of choice. Alternatively, you can download all languages from the Microsoft Download Center.

Supported Platforms

This release is supported only on x86 versions of the following platforms with the exception of Hebrew which is also supported on 64-Bit versions of Windows Vista and Windows Server 2008. 

• Windows Vista
• Windows Vista SP1
• Windows XP SP2
• Windows XP SP3
• Windows Server 2008

When installing localized versions of Internet Explorer 8 Beta 2 on XP or Windows Server 2003 please remember that the base language of the operating system must match the IE8 language you are trying to install; otherwise the Setup Wizard will display an error. For Windows Vista and Windows Server 2008, the base language of Windows does not need to match the Internet Explorer 8 language version in order for a successful install. When your user active language matches the Internet Explorer 8 language you installed, then IE8 will appear in the desired language. You will still be able to use IE8 in all other scenarios, but it will appear in English as a fall back version.

For further details on install guidelines, please see the How to Install localized versions of Internet Explorer 8 Beta 2 section in the IE8 Beta 2 release notes and the Upgrading to Internet Explorer Beta 2 blog post.

For IE8 Beta 2 support, please consult the list of IE8 Frequently asked questions or visit the IE Beta Newsgroup. The Report a Webpage Problem add-on is available for download and allows you to report a website issue. Additionally, you can sign up through MS Connect to vote on IE8 Beta bugs or request to be added to the IE Technical Beta Program by following instructions found at the bottom of the IE8 Beta Feedback blog post.

With the release of these additional languages, the IE8 IEAK can now build an additional 20 language packages. Download the IEAK and learn more about how to customize IE8 here.

We're excited to enable more users to download IE8 Beta 2 and use it in their native languages! You're feedback is always welcome, so please leave us a comment on this post.

Vishwac Sena Kannan
International Program Manager

Edit: Added the link to the Internet Explorer 8 homepage and removed individual language links

Hello World! I’m Sharon Cohen, Program Manager for Search in Internet Explorer 8. 

If you’re already using IE8 Beta 2, you’ve probably already seen the new search features available in IE8, perhaps you’ve even tried them out. Today I’d like to show you these features in greater detail and fill you in on some of the things we were thinking about when we created them.

Our goal for IE8 is to make searching for what you need faster and easier. We want you to search for the right term on the right provider and get the right information as quickly as possible. Here’s how we make that happen in IE8:

• Search Suggestions present you with suggested queries as you type which help you compose and research your query.
• Visual Search Suggestions are suggestions which include an image and additional text. These can help you visualize what you are searching for and sometimes even get you the information you need without even leaving the search box.
• The QuickPick menu enables you to easily switch to your secondary, non-default, Search providers allowing you to search with the right provider every time.
• History results, directly accessible from the search box, show you pages you’ve already visited and save you a click or two. 
• Automatic Search Accelerators allow you to send selected text on a webpage to any of your search providers skipping the cumbersome copy and paste step.    
• Search query synchronization keeps the search box up to date with your most recent query term even if you search within a webpage instead of the search box. You can quickly edit or redirect your searches.

Search and Visual Search Suggestions

Search Suggestions allow your installed search providers to suggest different queries to you while you are typing. This is great when you aren’t sure of how to spell someone’s name or you can’t quite remember if the movie was called “The Birdcage” or “The Bird’s Nest”. You might already be familiar with textual search suggestions as they are already in use on some popular websites and in some toolbars. (IE8 supports JSON suggestions which some of these use.) 

In IE8, we expanded the notion of a suggestion. In addition to providing text suggestions, search providers can now deliver visual suggestions, suggestions which include an image. The picture below shows text suggestions from Live Search and visual suggestions from Amazon.

Check out how Amazon customized the title of their suggestions section allowing them to indicate how many product matches are available for a given search term. You’ll also notice below how search providers can add additional separators to their suggestions. Both eBay and The New York Times have included separators which distinguish query suggestions from product or article results. 

Above, you can see that some of the suggestions include some additional gray italic text. This text is simply a description, and provides some additional information about the suggestion or result. These allow you to make an informed decision about which selection might be most useful to you. 

To try out these, and other search providers, head over to the new IE Gallery site. 

If you own a website and are interested in supporting search suggestions, you can read more about how it works and how to implement suggestions on MSDN. Also, stay tuned to the IE blog for more info on this topic.

QuickPick Menu

Searching on the right provider, at the right time, is a key factor in helping you find the right information. Searching on Live Search for “The Office” returns good results for sites about the show or NBC, but if what you are really interested in is DVDs of The Office then you probably want to be searching on Amazon or eBay. With the QuickPick, searching on your secondary providers is just two clicks away. 

As soon as you click in the Search box, the QuickPick menu will appear. This menu shows the icons of your installed search providers. When you hover over them, you will see a tooltip with the provider’s name. 

Click on the search provider you want to switch to and you’ll be off and searching on that new provider. Find on Page is also accessible from the QuickPick menu when you click on the “Find…” button. The QuickPick will drop below search suggestions after you start typing so you can access it at all times.

The QuickPick always remains a single line regardless of how many search providers you have installed, and in the default search box size, will hold up to eight providers on the QuickPick menu. To allow more providers on the menu, simply increase the size of the search box by hovering your mouse between the search box and address bar; you will see a horizontal arrow appear at which point you can click to drag the search box to your preferred size. 

Additionally, the order of your search providers can be changed, so you can choose to place your most frequently used providers upfront for quick access. To change the search providers order from Manage Add-ons; click the search box dropdown arrow and select Manage Search Providers.

History Results

The last section that you’ll notice in the search box dropdown contains results from your local History. Imagine you’ve already visited a site, you just can’t remember exactly what it was. This is where history results can be helpful, they show you where you’ve already been. The results are searched on by the URL and the title of the page. They are the same results you’ll see when you type in the address bar. Christopher and Seth posted some details earlier this week about how the address bar uses Windows Search to give you great results.

Search Accelerators

By now, hopefully you’ve read about and tried out Accelerators (“Activities” in Beta 1). We hope you’ve noticed that all your search providers are now available as Accelerators. Your default search provider will always be your default search Accelerator and your secondary providers will always be available in the Accelerator overflow menu. 

If you own a website, you may be thinking “well that’s great… but I want my search provider to support Accelerator Previews. Does that mean that I need to build both an Accelerator and a search provider?” Actually, no, you don’t need both of these! If you want to build a search provider which supports an Accelerator preview, you can do that by adding the Accelerator preview URL to your OpenSearch description file. Details can be found here.

Search Query Synchronization

One last cool feature you may not have noticed yet is search query synchronization. As you search on your installed search providers, IE will track queries done from within the websites of those providers. For example, if Live Search is one of your installed search providers, try this:

1. Navigate to www.live.com
2. Search for something from within the webpage
3. Check out your search box

The term that you searched for is now populated in the search box. (Note that this may not work on all search providers due to redirections or changes in the URL that IE isn’t able to recognize and correlate to one of your installed providers.)

With this nifty little feature, if you ever need to switch search providers, your latest search query term is already waiting for you up in the search box. 

Hope you are out there enjoying all these great search features. Happy Searching!

Sharon Cohen
Program Manager

edit: Updated link in first paragraph under Accelerators

In an earlier post, we introduced the new IE8 Smart Address Bar dropdown functionality. Now we thought we’d spend some time discussing some of its less obvious features in more detail.

More about the IE8 Smart Address Bar Autocomplete Suggestion

With Windows Search installed, IE8 makes an attempt to determine what site you’re trying to get to. The site that it determines is most likely the one you’re looking for is called the “Autcomplete Suggestion.” This entry is given the SHIFT+ENTER shortcut, so it’s very easy to go to your most recommended site. But how do we determine what’s most relevant?

We use a variety of factors to determine what site you’re trying to get to. IE8 takes into consideration what you’re typing in the Address Bar and weighs the results based on how well what you’ve typed matches against a variety of fields. For example: an exact match against the domain is ‘worth more’ than a match against a fragment down in the querystring part of the URL. We’re not going to give the exact rules for our algorithm (to avoid people gaming the system), but basically, some parts of the URL are more important than others. All matches are returned as part of the potential set of results, but “how good” a match helps determine the order.

Once IE has narrowed down the set of hits based on what you’ve typed, it uses a bit more data to determine what you’re looking for, including how often you go to a particular site, and whether or not you’ve selected it from the list before. All of these are part of the relevancy model.

But what’s most important to any user? Their History, a Favorite, or a Feed? Since your History tends to be a super-set of all your other data (every Favorite you visit, or Feed you read also ends up in History), IE8 gives precedence to the top History item. If no matches are available in your History, the Autocomplete Suggestion will return your top Favorite. If no Favorite matches, it will return your top Feed.

This feature was designed as the replacement for Inline Autocomplete, which was removed in IE8 Beta 1. Inline Autocomplete had no smarts: it just completed what you were typing with the first complete match from your history, sorted alphabetically.In IE8 Autocomplete Suggestion is essentially the same thing (only now you use SHIFT+ENTER instead of just ENTER), and because of relevancy, we’ve found that it’s the address users are looking for over 2/3 of the time.

Search from the IE8 Smart Address Bar

For those of you who may or may not have noticed, whether you type in the Address Bar or Search Box, the dropdown underneath is the same control. Although it looks a little different depending on where it is, it’s all the same code running. One difference in how the dropdown acts is that, for example, under the Address Bar, it shows the keyboard tips section at the bottom, but under the Search Box, it shows the QuickPick menu.

But did you know that you can flip the dropdown into Search Box mode, even when typing from the Address Bar? Just type a question mark followed by any word, string, or phrase, and it will act just like you opened the Search Box, with one exception: the keyboard shortcut section is visible and the QuickPick menu is not. Otherwise it’s the same – you get search suggestions (if available) from your default search provider and IE8 only shows you matches from your typed addresses and History. If you don’t rely on the QuickPick menu, it’s a great way to quickly do a search. Here’s a screenshot of Visual Search results coming back from an Am