A jQuery plugin for crashing IE6 | Hacker News Reader

A jQuery plugin for crashing IE6

plugins.jquery.com

72 pointsbensummers80 comments

Why must everything be a JQuery plugin for the love of god?

  function crashIE6() {
    for(x in document.open);
  }

Because it wouldn't get voted up if it was just "Javascript function for crashing IE6"?

jQuery is sexy? Its like a nerdy but hot chick that carries a shotgun in case of zombie... err... IE6 attacks.

Oh yeah, jQuery is far sexier than plain ol' Javascript (look at the amount of tutorials on sites like Smashing Magazine), because messing around with jQuery is far easier for the beginner than playing with Javascript

"messing around with jQuery is far easier for the beginner than playing with Javascript"

Also, because getting awesome work done with jQuery is far easier for the seasoned professional than messing around with plain Javascript DOM traversal.

Of course, you still have to use native JS functions for a lot of stuff, so you're not taking a shortcut around JS. You're just skipping the parts that are time-consuming, awkward, and inconsistent across browsers, and getting right to the useful stuff: shorter, more powerful, more expressive code.

Or is that just 'for beginners'?

Javascript DOM traversal is simple, very standard, and extremely powerful IMHO

Depends what you're into I guess. To me there doesn't seem much point having a largely pointless abstraction layer in between.

As a Javascript developer, I totally agree. Something that is easier for beginners doesn't imply it's not useful for seasoned professionals though.

Because there's a body of misinformed devs who think jQuery's not JavaScript, or that it's some route around having to learn JavaScript.

It's monads!!111!!!

sad.. but true

It depends what you mean - if you only mean "learn JavaScript" in the sense of learning the language itself, then no, jQuery doesn't change a thing, you've still got to figure out your way around the (rather minimalistic, esp. given the lack of significant standard libraries) language.

But if you mean "learn JavaScript" in the pre-jQuery sense, then what you really mean is "accumulate encyclopedic knowledge of all sorts of browser dependent bullshit that constantly thwarts every attempt to write clean, reusable code that actually works." In that case, jQuery (and other similar libs, of course) really does change the game. You can get pretty damn far without ever knowing a thing about the various incompatibilities; this, IMO, is one of the best things about the new sets of Javascript tools out there, they really are starting to bring us towards the point where you can just write clean code that does what it's supposed to, without working around bugs (features?) in other people's code.

>> "accumulate encyclopedic knowledge of all sorts of browser dependent bullshit that constantly thwarts every attempt to write clean, reusable code that actually works."

That point is overplayed to the point of insanity. Unless you're targeting IE5, browser differences in js are minimal. Most of the inconsistencies are in layout.

Hmmm, then this plugin is broken because it doesn't crash any browser _except_ IE6!

resume padding.

Does it even need to be a function? :) On a side note, it seems

  for(x in open);

works too. The trick also seems to work on window.alert and window.close so I'm guessing you'll get a crash on all native functions

I honestly believe that too much is being made of the supposed work involved in supporting IE6 theses days. Granted I would rather not have to support older browsers for a number of reasons but the fact is that supporting it hasn't been terribly difficult. With the javascript and css frameworks that are available, compatibility is much less of an issue. We recently rebuilt our site and had to include support for IE6. While developing the site we mainly looked at IE8, Firefox 3.5, Safari 4, and Chrome. Only at the end did we look at IE6 and I believe I had to create 1 stylesheet that has probably less than 30 lines of CSS to fix a few minor visual issues (mainly dealing with widths, margins, and paddings). It took me less than a day. Yes I wish IE6 would fade much faster than it seems to be but I think it is overblown on how hard it is to support.

I've seen people spend somewhere between weeks and months purely on IE6 support.

Thinking about it more, a problem that personally cost me a couple of days was investigating a problem where AJAX calls intermittently fail on IE6. It took a while to find, and was something obscure with keepalives I forget.

Is this a web app or a static site?

If a static site, yes, it isn't too hard. But a web app is another matter all together -- not only working around the issues but stopping you use features that better browsers offer.

It's a full blown web-app and it is the core of our business. It is also used worldwide with one of our fastest growing user bases being China. In China, at least for our app, IE6 and Maxthon (which like IE is based on Trident) are the most popular browsers. I'm sure there may be features we will miss out on but off the top of my head I can't think of anything that we couldn't accomplish. Are there specific features you have in mind that are impossible in IE6?

If you restrict yourself to the IE6 feature set, then yes, it should be relatively easy. But if a complex web app is this easy, why is Google giving up on it for it's web apps?

What is your site's address? I'd be curious to see it.

At this point, it's less of a compatibility issue and more of a:

- Security issue (this is internal to the installation site of IE6, and doesn't affect development all that much) - Performance issue (if you're doing something complicated in JS, it won't work in IE6. It will just be way too slow)

Let's start with PNG alpha transparency. If you allow yourself the use of PNG alpha transparency it makes many things possible and many things much easier or more maintainable. There are hacks to make alpha transparency work, but none are universal across all the ways to use image asset files.

As for basic CSS, yes, if you know the major pitfalls then IE6 isn't so terrible (when it was released a decade ago it was a breath of fresh air actually), but even that requires a constant vigilance against dozens of bugs that are a minefield for anyone who is not anticipating them due to years in the trenches. Oh you might be lucky and avoid them, or you might stumble upon them and rue the day you ever posted such a dismissal to HN.

Javascript has a number of similar pitfalls that are hard to be aware of and are fairly arbitrary limitations to place on your development. Frameworks paper over some of this stuff, but some of them are hard limits.

In my case for instance I am the lead dev on a VOD site showing feature-length films. You could watch one film on IE6, but if you watched 2 without restarting it would usually crash. We weren't using some bloated JWFlv player, we had a minimal, custom flash player designed to squeeze out maximum performance. There's absolutely nothing we could do about that, and just the support costs of reading emails from people whose browser crashed when they were watching movies was not worth it.

Here's another crash bug.

Just link the following URL as an image somewhere on a page (works on third-party sites that pass image URLs directly to browsers):

http://grack.com/crash.py

There's a crash in IE's URL parser that takes down the browser if it attempts to process this URL: "ms-its:%F0:". The above script returns an image to every browser, but a Location: redirect to IE6. If a site doesn't proxy images for its users, it'll send them to the link and take down the browser. Known by Microsoft, doesn't require scripting, still unpatched.

Source, for anyone interested:

  #!/usr/bin/python
  # http://grack.com
  import os
  import sys

  if os.environ["HTTP_USER_AGENT"].find("MSIE 6.0") != -1:
        print "Content-Type: image/png"
        print "Location: ms-its:%F0:"
        print ""
  else:
        print "Content-Type: image/png"
        print ""
        print open("crash.png").read()

Awesome. I will use this image for profiles =)

Now all you need to do is create an argument to the url so that it takes dimentions in case profiles have a dimention limitation. This way we can crash IE on many sites all over the internets.

If you can control the src attribute of an <img> element on someone else's site where people use IE6, they're way more fucked than just having their browser crash.

In IE6, <img src=FOO> is a superset of <script src=FOO>. Really.

The unfortunate thing with this IE6 bashing is that not everyone can upgrade. There are still people out there running legacy systems at their workplace. I, for example, am still running IE6 due to it being the standar at work. Why should I not be able to read websites?

Just don't style for IE6 anymore, there is no reason to make sure your website won't work on IE6!

The obvious answer is that there’s nothing stopping you from running two browsers. Install Chrome or Firefox and you can access the modern web as well as your legacy systems.

It's pretty common for IT departments to restrict what can be installed on a computer, so the obvious answer is that there's a lot stopping you.

That is true. I have no administration permissions on my computer at work. Installing another browser is just not an option. Hence the problem (I would not be using IE6 if I had the choice!)

Can you not run portable versions, too?

Hah, my obvious answer seems to be less obvious than I thought :) No admin rights? Enter portableapps.com:

http://portableapps.com/apps/internet/firefox_portable

http://portableapps.com/apps/internet/google_chrome_portable

Obviously the usual caveats apply to software from 3rd party sources, but portableapps.com has been going for years with no complaints.

Again, in corporate networks the policy on downloading and running executables of the internet tends to be "don't do it" - regardless of whether the .exes are harmless or not.

For places like yours, what we need is a web-browser (probably Webkit/Gecko) that works off a single executable, does not require installation, does not need admin privileges, has no library files, no large caches, does not save to registry, does not have addons, does not write anywhere except for a single file in temp folder. It should check for an admin config file in a specific read-only location and save user config/bookmarks to user's "Document & Settings."

If such a browser existed and explicitly mentioned the above restrictions/features, it would be trivial for most IT departments to put the browsers's .Exe in a read-only network share and put an icon for it on every user's desktop. The problem is that other than IE, every other browser is a pain to setup on a Windows network. I have Chrome installed on a couple of Terminal Servers and it took almost two full days to make it put the cache files in the right places. And I had to write my own script to empty the cache because there is no easy way to automate it. On the other hand, it is very easy to deploy IE7/8 but since many intranet sites have been custom written for IE6, it is not possible to upgrade to other versions of IE. Things break and it's very costly to fix them. I've seen a $400k software system that only works in IE6. The pages don't even load in IE7+ or other browsers. The upgrade to a version that is IE7-compatible is $300k. So for the IT department, it's either IE6 or $300k. Management does not care and should not care about IE6 working for all sites. They need IE6 to work on this expensive piece of software that runs their business.

Despite what people here on HN say, IT departments don't mind users using alternate browsers. Their problem is that Firefox, Chrome, Opera, and Safari aren't easy or even possible to setup in a server environment like IE is. Depending on which user belongs to which department and logs in from which location, I can configure their IE to automatically set homepage, proxy settings, privacy/cookie settings, and lots more. Forget features like these, with other browsers, I don't even get to set the location of the config files and cache folders. When you have 100 people logging on to a terminal server, you need to be able to configure these things or the entire server goes down because some user downloaded a partial 2GB file which is still in their cached folder and now the server is trying to save it back to their user-profile folder.

TL;DR version: Give me a browser that I can setup easily in corporate environment and I will set it up.

I'd say your company got gypped if they spent $400k on such a fragile piece of software. What company produced this software, so the rest of us can steer clear of their incompetence?

If it was written to work with IE6 (as was a lot of software in the day) it was likely written in the era when IE6 was THE target market. Simply put, IE6 was the only game in town, really. If you wanted to make dynamic applications that were worth a damn, you wrote it for IE6.

That said, I agree that in this day and age, it is inexcusable.

One other point, you may be unaware (as I was until pointed out to me) that 'gypped' is a racial slur against Romani (or broader, Italians).

It was not my company and I had nothing to do with the purchase of the software. Also, if that $400k piece of software is unique and gives the company a tremendous competitive advantage, who cares if it's only compatible with Lynx? Not every app has to work everywhere. It has to be stable within its own system requirements.

A couple years ago, I saw it was possible to download and run Firefox in a corporate environment without admin rights (downloading and unzipping the zip archive, then just starting the exe without any installation).

Not sure if this still works, but here's an old thread from when it seemed to work: http://forums.mozillazine.org/viewtopic.php?f=38&t=27113...

I, for example, am still running IE6 due to it being the standard at work.

When almost nothing will work on IE6, I hope that would encourage the "standard" to be updated. If all sites "sorta work" in IE6, there's no pressing motivation to upgrade.

While crashing people's browsers isn't exactly mature, dropping support for IE6 to the point of sites/apps not working in it is the right move (as Google has recently decided).

"When almost nothing will work on IE6, I hope that would encourage the "standard" to be updated."

I also have to use IE6 at work. The problem is that the folks in charge say "Our entire intranet works in IE6. It may (or may not) work entirely in other things." So by their standard "everything" already works.

So by their standard "everything" already works.

This assumes a policy of not needing to access anything on the wider Internet, and if there's a such a policy, it's for those in charge to determine or change.

This is what I meant. It is more the intranet and the systems that we use over that intranet that works with IE6 and it costs money to make sure it works with IE7/IE8/IE9/Firefox/Opera/Chrome... And that money isn't available anytime soon.

I have been told by clients who work for Cisco that the company still includes IE6 in their default image for all new workstations.

Let me just stop you right there.

If you bash IE6 hard enough, those legacy systems will HAVE to be upgraded because they'll be so monstrously expensive. It's a free market, if you want to affect change then manipulate the price of stuff.

I'm in favor of everybody using this plugin because it saves _me_ money (and time) as a developer if legacy systems have to be upgraded. I don't care if other people have to pay, you and I both benefit!

The unfortunate truth is a lot of IE6 users don't have a choice. They're behind corporate or government networks and that's all they have and are allowed to have, for a variety of reasons-some legitimate, some not. Others are people who are far less web/tech/computer savvy and wouldn't know how to upgrade, wouldn't know, or even care why they should. You can and should try to educate your users, but there will always be some that just don't get it and others that just don't care, and plenty that are helpless to do anything about it anyway.

Here's how we handle IE6 support: We have several large apps that are used by a lot of corporate/government offices. They have to fully work in IE6, no questions asked, that's just non-negotiable. At each new phase of development, we thoroughly test in IE6 before moving on to make sure things work. After doing this enough, you start to learn what will work and what won't and IE6 support becomes easier over time, and since the codebase is built with IE6 in mind from the beginning, it's not so bad, most of the time.

We have another large app that's not as restricted in where and how it has to work. It has a public-facing side and an admin interface. The public-facing side works fully in IE6 in terms of function. There may be a few pixels difference here and there in visuals, but as long as it still looks good and functions properly, we don't stress it if it's not pixel-perfect. The admin side is meant for users who are more tech savvy and the percentage of IE6 users is very low. What we do in that instance, and this is pretty much our standard aproach when IE6 support isn't essential, is make all of the core functionality of the app work with IE6 and then disable the bells and whistles that give the app additional functionality that adds convenience. We then let the user know that upgrading their browser will give them access to this additional functionality and make their user experience better. Hopefully, they choose to upgrade, but if they don't or can't, they can still do everything the app is designed to do. It just won't be as pleasant/intuitive/seamless of an experience.

As much as I hate IE6, I hate the idea of giving its users the finger and not allowing them to browse/use my app/site as best as their antiquated browser will allow them to even more.

The web was made for making information more accesible. Discriminating against users of older browsers by crashing their software doesn't seem very productive to me. And what if 10% of your visitors still use IE6? You're basically giving them the finger and send them to your competitors.

PS. I'm all for newer, better browsers; I myself use FireFox. But content should at least be usable on every browser, that's more important than that the site looks pixel-perfect in those older browsers.

Its not just about being pixel perfect. IE6 will struggle with a heavily javascript'd up web app.

Newer web apps rely heavily on javascript and css, and it might take you 20% longer to make your site work for 5% of users. Its just not worth supporting in my opinion as the time you spend on IE6, could be spent making much cooler things for the newer browsers.

What if 10% of your visitors still use IE6? You're basically giving them the finger and send them to your competitors.

Exactly. IE6 is a pain, but the extra work is worth it to me so as not to send away potential customers. Perhaps when IE6 gets below 5% marketshare we'll revisit the issue.

BTW - if any of you guys are getting hung up on a particularly nasty IE6 bug, feel free to drop me a line (within reason). I'm adept at fixing them.

Any site that uses this should be classified as malware. Is this really the sort of relationship web developers want to have with users?

I hate IE6 as much as the next guy, but most people running it don't have the choice. If you choose to be hostile to helpless users subject to poor management, they're going to blame you and your site, not their browser.

While I agree with most of what you are saying.

>> but most people running it don't have the choice

how do you know this ?

I know from personal experience and previous threads here that most people running IE6 are doing so in a corporate environment they have no control or influence over. My wife is a great example. Large company with 10s of thousands employees, all running IE6 with no other options. Sure there are some home users out there still running it that don't know any better, but I'm betting they pale in comparison to the number of corporate IE6 instances.

Not to mention that this could get you in some legal hot water depending on where you live.

Where, Iran?

What if you want to iterate over the return value of document.open? It's perfectly legal ECMAScript.

If I write a program that randomly crashes when I type in the URL of your website, should you be liable for that? Of course not. Any crash is Microsoft's fault, not the web developer's.

And I'm sure your users will instantly recognize that.

Intent matters. You won't get in trouble for exploiting buffer overflows while taking a computer security class, but you sure would if you used it against someone maliciously. (And, like it or not, intentionally crashing someone's browser is malicious (and the intent is not hard to prove, given that it's done with $.crash).)

Both are correct.

1) Intent matters. Clients won't go to your site.

2) It is MS' fault. No amount of JS should ever crash the browser, at worst it should replace the page with "sorry this page has crashed, please continue browsing elsewhere" like what chrome does.

Any citations here?

Probably not the best approach to get people to upgrade, but entertaining nonetheless.

My two hats are conflicted:

As a technology lead and entrepreneur, this is a disaster, and I'd have to ask serious questions if anyone on my team were to go anywhere near it.

As a developer, LOL.

Ok honestly, while you may lol, this is just a IE6 bug. I have a more generic function that will guarantee to crash ANY browser... Ok won't crash it, but it won't be responsive for a few days.

Interesting. Is it possible to share it here?

Absolutely... give me some time though I have to find it. Its a special regular expression where basically the regex engine can't decide which greedy quantifier to use leading in an insanely long evaluation. I opened a firefox bug for it a while back.

Ok found the link:

https://bugzilla.mozilla.org/show_bug.cgi?id=520086

Strangely this does not crash google chrome. Impressive!!!!

Err, correction, the regex now runs reasonably fast in the most recent of regex engines but I think on a long enough string it should still fail.

The string "dead:parrot(skit = 123372398547895743957574395743957439579435" now kills the browser.

However, unlike firefox in which regex runs in C space not JS space, google chrome/chromium recognizes that the page is unresponsive completely and kills the process, only the one process is unresponsive the rest of the browser works. Good job google!

Edit: This will kill Opera, Firefox (any), IE (any)

bc; dr (browser crashed; didn't read)

Having to support Firefox 2 is just as awful as having to support IE 6 (no inline-block). Just wanted to share that. Yes I have to support Firefox 2 where I work. Safari 3 is also a pain.

at least the uptake of new version is a lot faster with Firefox users.

Heh, had a FF 1.5 bug happen a month ago. Turns out the user had auto updates enabled and THOUGHT he had the latest FF. He just didnt realize that it won't upgrade major versions automatically.

I had a friend who I was talking to and he was having trouble with Firefox. I asked him to check what version he was running, he told me 1.9.1. It was a minor miracle I realized that that was his Gecko version, because I was stuttering around like a crazy man, trying to understand how his browser was that out of date.

you can also crash IE6 with pure CSS, no javascript needed

http://raven-seo-tools.com/blog/2675/crash-ie6-with-only-css

And if you want to crash ie 8, try this jquery plugin http://haecker.me/trac/blog/2009/12/crash-ie7-with-javascrip... to get them to upgrade to a decent browser </shameless plug>

Instead of destructive, why not be helpful?

Tell the visitor to install google chromeframe and give them a download link:

http://dl.google.com/update2/installers/ChromeFrameSetup.exe

Why would I want that?

Because IE6 has stolen hundreds of non billable hours of your life you'll never get back?

You're doing it wrong..

If they're non-billable hours, you're missing a 'Full IE6 support is a chargeable extra, not core functionality' bit to your agreements ;-)

Not very realistic. If you put it forth like that 1-3 years ago you would have the argument, "we want IE6 support, skip the others, and of course this will not cost extra".

Edit: I'm surprised to be down-voted. Many clients that have standardized on IE6 still exists. 3 years ago there were even more clients that used IE6, and probably forbid other browsers, including IE7/IE8.

I've personally fought for making my web apps work on every reasonable browser, and gotten the arguments that the client will not pay for anything but excellent IE6 support.

I think a line should be drawn between 'works on IE6' (not too much extra work) and 'looks as good on IE6 as on a modern browser' (a fair amount more work). I, too, ensure all my stuff works on IE6, but whether it looks as good is down to the client's call/budget.

Its true. We pitched this exact thing. You want IE6 support, we need 30% more time on UI work at least. They either agree or take away IE6 support. And I don't make this crap up.

YES. This is exactly the right approach. It DOES take more work to support. If they want to pay for it, fine. But it also exposes the internal "upgrading is expensive" excuse as fallacious. NOT upgrading is also expensive. At some point the balance tips and it's time to move on.

To be honest, I'd rather not support IE6 than getting paid for supporting it. No (realistically paid) amount of money can offset the pain and frustration of supporting the browser-like piece of near-software that is IE6.

Reply on news.ycombinator.com