CIO —
Web surfers may start noticing some unusual behavior from their Internet Explorer (IE) browser after installing Microsoft’s next round of security patches, expected April 11. That’s because the software giant is planning to make changes to the way its browser handles dynamic content like Flash or QuickTime—changes that were made necessary following Microsoft’s highly publicized patent dispute with Eolas Technologies.
Microsoft has already made these changes available as an optional IE patch, but now they are being rolled into IE’s next security update, which will make them effectively mandatory for most users.
"Currently that update is in the testing phase and could be released as early as April," said Stephen Toulouse, security program manager with Microsoft’s security response center. "But of course, that isn’t final," he added.
There has been some confusion over the date of this next release. Earlier this week, Microsoft’s Customer Support Services group published a note saying that the changes were expected on April 11, but that announcement was pulled, because that date is "not finalized," Toulouse said.
In August 2003, an Illinois court awarded Eolas US$521 million in damages for Microsoft’s patent violations. Though Microsoft is appealing this ruling, and challenging the validity of the Eolas patent with the U.S. Patent Office, the court ruling forced Microsoft to make the changes or risk being found in contempt of court.
The ActiveX changes will gum up the way some Web surfers interact with dynamic content by forcing them to click on a pop-up "tool tip" dialog box before being able to interact with things like Flash or QuickTime.
Microsoft, Apple Computer and Adobe Systems have published work-arounds for the changes, which means that websites that have coded these work-arounds will appear as normal to IE users.
But the IE changes will probably take some by surprise, according to Jon Galloway, a Web developer with San Francisco’s VelocIT. "A lot of websites are not going to update their Flash right away," he said.
The changes will certainly be an annoyance, but they will not prevent users from running Flash or QuickTime files, he said. "It’s the kind of thing that’s going to upset a marketing department that wants everything to look perfect," Galloway said.
Most of the pain from the IE update will be felt by Web developers who may find themselves scrambling to implement the work-arounds. "Once this rolls out to everybody, suddenly things that used to work automatically will have to be manually done," said Richard Smith, an Internet security consultant based in Boston. "The bottom line is websites are going to have a lot of work to do here."
