IE vs Chrome: Drawing the Enterprise Management Battle Lines

I had the pleasure of meeting up with Simon May and Martin Beeby, two Microsoft evangelists earlier this week. Martin handles some of the ISV related issues for IE (particularly IE9) and Simon proselytises for the IT pro side of life.

Their blogs can be found here: 

For Simon, look here: http://simon-may.com/

For Martin, here: http://blogs.msdn.com/b/thebeebs/

We discussed a number of topics including IE rendering on Windows 7 mobile (more coming soon on that) and how IE9 compared to Google's Chrome browser in the enterprise.

While I don't want to dive into a full feature comparison between the two browsers, there was a striking difference between the management story for Microsoft IE9 and Chrome.

Internet Explorer 9 (IE9) of course though recently released, already has the Internet Explorer Administration Kit (IEAK) which is available here: 

http://technet.microsoft.com/en-us/library/bb219517.aspx

Reviewing this kit, we discussed that IE9 integrates into Active Directory (of course) and includes over 1800 configurable settings for IE. Some of the new settings for IE9 include;

• Disable Browser Geolocation
• Turn off ability to pin sites
• Turn on ActiveX Filtering
• Configure Tracking Protection Lists
• Tracking Protection Threshold
• Turn off Tracking Protection

You can find Chromes take on Enterprise readiness positioning or "Ready for Business" blog posting here: http://googleenterprise.blogspot.com/2010/12/chrome-is-ready-for-business.html

Parsing through this posting, I think that we have to set the "enterprise quality" bar a little higher these days - as "Hey, we now have an MSI Installer for our application" is hardly something to shout about. In addition, whereas IE has over 1800 AD GPO's, Chrome only contains the 56 configurable Active Directory settings. 

This list of Chrome's AD settings can be found here:  http://www.google.com/support/a/bin/answer.py?hlrm=en&answer=187206

More interestingly, and perhaps a little expected is the number of requests for Active Directory policy updates in the Google Issue tracker. The Enterprise Request filter for the Chrome issues list can be found here: http://code.google.com/p/chromium/issues/list?can=2&q=Feature=Enterprise&colspec=ID+Stars+Pri+Area+Feature+Type+Status+Summary+Modified+Owner+Mstone+OS&sort=&x=mstone&y=area&cells=tiles

I have filtered a short (and non-exhaustive list) of some of the AD policy requests included in the Chrome issue tracker here: 

• Need policy to supply predefined bookmarks
• Customize content of new tab page
• Add policy for disabling Cloud-Printing.
• No extra roundtrip after device becomes unmanaged   device_management_policy 
• Add policy for "click to play"
• Add a policy to lock full-screen mode
• Add policy to manage max number of concurrent connections
• Add a policy to force or disable any importing of data from other browsers on first run
• Need policy to disable bookmark editor
• Fine-grained control over content settings.
• Add policy for controlling displaying the bookmark bar.
• Add policy to restrict save/open dialogs

Taken as whole list, additional policy requests make up more than 25% of all the enterprise issues for Chrome - so, it seems like other people (the likes of you and me) feel the same way.

Chrome - Get your Active Directory Templates on!

Windows 7: SP1 Update Redux

I wrote a short blog entry a little while ago about the potential application compatibility issues with Windows 7 Service Pack 1.

You can find the post here:  http://aokcompat.blogspot.com/2011/02/windows-7-sp1-application-compatibility.html

The update has been out for a while now (though not everyone is getting it - you are going to have to email me about that) and we are really not seeing many application compatibility issues reported. And, given that the Service Pack update is essentially the same for both the workstation and server platforms - we are not seeing any differences between updated workstations or servers.

Microsoft has released a KB article about the few (possibly too few) applications that have been reported to have had compatibility issues with the Windows 7 Service Pack. You can find this bulletin here: http://support.microsoft.com/kb/2492938

Interestingly, only 2 programs (IncrediMail and Ninja Trader) were reported as not running correctly after the Windows 7 SP1 update and a further 2 applications experienced a loss of functionality (Alibre Design Express and Ideazon Z Engine) with the update. And, From our own application compatibility analysis, we have not seen many causes for issues with the Service Pack update.

You can find out more about Windows 7 SP1 here:

Notable Changes in SP1 for Windows Server 2008 R2 and Windows 7

Release Notes for Windows 7 with SP1

Release Notes for Windows Server 2008 R2 with SP1

We will continue to monitor the results from our clients - as Windows 7 SP1 encompasses more machines and applications we may find a few application compatibility issues. My initial concern was that the large collection of updates might cause a problem with application dependencies. That said, if you have kept you machine current and updated, then you should have already installed most of these changes.

For the complete list of hotfixes and updates included in Windows 7 SP1, you can find the release documentation here: 

Hotfixes and Security Updates Included in SP1 for Windows Server 2008 R2 and Windows 7

IE9 Released to the World March 14

I was fortunate enough to attend a great session today on IE9 Readiness, which you can find the link here: 

http://blogs.msdn.com/b/ukisvdev/archive/2011/02/23/internet-explorer-9-readiness-live-meeting-on-march-10th-at-11am-for-uk-isvs.aspx

Most importantly, it's now official: IE9 will be released on March 14th!

Martin Beeby was the presenter and did a great job walking through some of the new benefits of IE9 and how both JavaScript and graphic rendering performance have been dramatically improved.  As a result of the graphic rendering enhancements, IE9 will NOT be supported on windows XP due to the way that IE9 capitalizes on Vista and Windows 7 graphics cards.

We also how IE9 has scored on the standards driven ACID 3 test with the screen-shot captured from the session below.

Why not 100%? This is due the fact that IE9 does not support SVG fonts. 

That said, we saw some great examples of improved CSS support with the CSS3 Selectors Test results. 43 out of 32 tests were passed - which is great news. Here is a quick snap-shot of that screen-grab.

As I mentioned, Microsoft Internet Explorer Version 9 (IE9) will be released next week on March 14th at the South by South (SXSW) 2011 Event.

You can find the link for that event here: http://sxsw.com/home

Patch Tuesday: March 8th 2011

With this Microsoft Patch Tuesday update, we see a relatively small set of updates in comparison to those lists of updates released by Microsoft for the month of January and February. In total there are three Microsoft Security Updates with the following rating; 1 Critical, and 2 rated Important. This is a small update from Microsoft and the potential impact for the updates is likely to be very small. As part of the Patch Tuesday Security Update analysis performed by the ChangeBASE AOK team, we have seen very little cause for potential compatibility issues; in fact, this patch update raised no issues against our sample database. Given the nature of the changes and updates included in each of these patches, most systems will require a reboot to successfully implement any and all of the patches and updates released in this March Patch Tuesday release cycle. As part of the testing Summary for this March 2011 Patch Tuesday update, here is a quick snap-shot the AOK Summary results page generated from these 3 Plugins on a small sample database: Testing Summary MS11-015 : Vulnerabilities in Windows Media Could Allow Remote Code Execution (2510030) MS11-016 : Vulnerability in Microsoft Groove Could Allow Remote Code Execution (2494047) MS11-017 : Vulnerability in Remote Desktop Client Could Allow Remote Code Execution (2508062) Patch Name Total Issues Matches Affected Reboot Rating RAG Microsoft Security Bulletin MS11-015 <1% <1% YES Microsoft Security Bulletin MS11-016 <1% <1% YES Microsoft Security Bulletin MS11-017 <1% <1% YES Legend: No Issues Detected Potentially fixable application Impact Serious Compatibility Issue Security Update Detailed Summary MS11-015 Vulnerabilities in Windows Media Could Allow Remote Code Execution (2510030) Description This security update resolves one publicly disclosed vulnerability in DirectShow and one privately reported vulnerability in Windows Media Player and Windows Media Center. The more severe of these vulnerabilities could allow remote code execution if a user opens a specially crafted Microsoft Digital Video Recording (.dvr-ms) file. In all cases, a user cannot be forced to open the file; for an attack to be successful, a user must be convinced to do so. Payload Encdec.dll, Sbe.dll Impact Critical - Remote Code Execution MS11-016 Vulnerability in Microsoft Groove Could Allow Remote Code Execution (2494047) Description This security update resolves a publicly disclosed vulnerability in Microsoft Groove that could allow remote code execution if a user opens a legitimate Groove-related file that is located in the same network directory as a specially crafted library file. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. Payload Groove.exe, Groovedocumentsharetool.dll, Grooveutil.dll, Groovewebplatformservices.dll, Groovewebservices.dll Impact Important - Remote Code Execution MS11-017 Vulnerability in Remote Desktop Client Could Allow Remote Code Execution (2508062) Description This security update resolves a publicly disclosed vulnerability in Windows Remote Desktop Client. The vulnerability could allow remote code execution if a user opens a legitimate Remote Desktop configuration (.rdp) file located in the same network folder as a specially crafted library file. For an attack to be successful, a user must visit an untrusted remote file system location or WebDAV share and open a document from this location that is then loaded by a vulnerable application. Payload 2k3mstsc.exe, 2k3mstscax.dll Impact Important - Remote Code Execution *All results are based on an AOK Application Compatibility Lab’s test portfolio of over 1,000 applications.

Friends don't let friends use IE6

Microsoft has given us a nice little marketing "toy" with their tongue in cheek "Internet Explorer 6 Countdown"  website. This is a great marketing tactic and I think it's extremely well done.
You can find the link to the IE6 countdown page here: http://ie6countdown.com/
The page has great demo-graphic information on the current usage of IE6 including a global chart reproduced here;

Some interesting points to note from this chart. Finland and Norway lead the way with the lowest IE6 usage - well done them! But, is this due to high Opera usage?
Also, China has the highest usage of IE6 across the world. I am assuming that these people represented here are using Windows XP - So, I don't want to appear too snarky here - but, with the culture of pirated software in China, you would think that these people would be using Windows 7 Super Duper Ultimate Version Service Pack 3.8 pre-loaded with the pre-release build of the not yet released version of Office 2013.
Not the case. It appears that even free software (a pirated version of Windows 7) is not tempting enough for some to upgrade. In case you are interested, here are the country by country break-downs;

And, here is the most interesting illustration of global IE6 usage;

I think these number tell a story here - of a giant leap forward to Windows 7 that I bet will come in the next 18 months... Speaking of migrations, I wonder if Dell and HP are listening. I smell an opportunity here.

IE8 Compatibility - Get your encoding sets correct!

On the hunt for more (more, more) information on Internet Explorer compatibility issues, I found a great  article from one of the Microsoft IE team, Eric Law.

His blog can be found here: http://blogs.msdn.com/b/ieinternals/

On of his posting related to HTML character encoding sets (such as UTF7 and UTF8). I have been working on this problem for a while. Specifically looking at mechanism where could identity character streams that may not match the declared encoding set.

Looking at Eric's posting, found here: http://blogs.msdn.com/b/ieinternals/archive/2011/02/28/script-error-c00ce56e-means-you-have-specified-an-invalid-charset-utf8-is-not-utf-8.aspx

And quite helpfully, the class of errors reviewed in that post are referenced in the following Microsoft KB article, found here: http://support.microsoft.com/kb/304625

You can see that he has found a simple (and by definition; great) example of what happens if you  improperly define your character sets in a document parsed by IE8. I took this issue to heart as you can quite easily determine if your stated character set is not in a pre-determined list, then BANG! You are in trouble.

Meaning that your page probably won't look right and your scripts won't run right.

You can find this list of accepted character encoding aliases here; http://www.iana.org/assignments/character-sets

My favorite encoding alias is csEUCPkdFmtJapanese which is an alias for the "Extended_UNIX_Code_Packed_Format_for_Japanese" character set.

And, with that I say, "Get your  Code Packed Japanese Formatting on!"