Microsoft Windows XP SP2 Changes that affect web pages

If you use ActiveX, popups, Java, window JS functions or downloads, read on

[CritterNYC]

Microsoft has published a list of the changes made to IE in XP Service Pack 2 that may affect web pages that use certain features. The full article can be found here:
[msdn.microsoft.com...]

You should be concerned if you use:
- ActiveX controls: the modal dialog will no longer popup automatically. Users must specifically click on the pageholder to install controls
- Downloadable Files: The file download ability can only be initiated by a user click. Pages that say "your download will begin in 10 seconds" and have an ad before launching the file will now fail.
- Popup Windows: These may now only be initiated by a user action, not automatically, and only one popup will be created based on that user action... so a popup cannot spawn a popup, even if the original was spawned by a click.
- MS Java Virtual Machine: This is no longer distributed. You should direct your users to java.sun.com.
- Browser Windows Alterations: You can no longer do a fullscreen window, it will only launch a maximized window. You can no longer move the statusbar, titlebar or toolbar off of the visible screen.

All good changes to be sure, but some of us may be bitten by one of them (like the downloadable files one). So, it makes sense to start updating our pages now.

Regards,
John

[tedster]

Thanks for the heads-up. I heard about the others, but the downloads issue is a biggie for some. I've already sent an alert to a few friends thanks to this thread.

All in all, this sounds like good moves from MS - toward a "kindler gentler" surfing experience for all their many customers.

[richlowe]

Excellent. About time.

[Compworld]

Think this will kill the CPM rates for Pops?

CompWorld

[PatrickDeese]

Pop unders and other naughty stuff still works in XP SP2 RC2.

[ogletree]

All it does is send the bad guys to the drawing board. Sounds like they are already prepared for it if it works on the beta.

[amznVibe]

Fortunately I am not using any of those "techniques" on any of our client websites. (And pop-ups started a spiraling death months ago anyway.)

But I'm looking forward to this adding fuel to the Mozilla (FireFox) rebirth with webmasters saying, well if this can change, what next.

[lawman]

So what's the point of no full screen windows?

[mars9820]

full screen means that the window control buttons (minimize, maximize and CLOSE) are not visible.

Ever been stuck in a annoying full screen flash movie with no way to exit and just waste a couple minutes waiting before that!@#@#%ing [x] button appears.

[kaled]

Download pages use a meta redirect don't they? Where is the security problem?

Sounds to me like they've fixed something that isn't broken (i.e. they've broken something). Surely, all that is required is to :-
a) ensure that the user is prompted before downloading is initiated.
b) ensure the download file is not run automatically.

Perhaps I'm missing something.

Kaled.

[helenp]

wow, I supose this will affect some images that I had on an map if I understood it correct,
this is my code for these image links;
target="_blank" onClick="window.open(this.href, 'map', 'width=550, height=350, scrollbars=yes, toolbar=yes, resizable=yes')

[rytis]

Re downloads, I'm not an expert to say this was absolutely necessary for security reasons.

But politically this is very good and necessary move by MS, majority of users will be happy to just download the file, without throwing more advertisements at them.

R

[RonPK]

helenp, you're safe: the user specifically asked for the popup by clicking the link.

I'm actually more worried about the nasty alternatives advertisers will come up with: floating ad layers, huge ads on pages.

[Notawiz]

Ok guys (and girls), about time to use Firefox
And use your keyboard shortcuts (esc, alt+f4, alt+left arrow etc.) when stuck on a webpage without toolbars or buttons.

[Adam_C]

where there's a will there's a way

won't be long before workarounds are in place i would reckon

[surfgatinho]

Good to hear full screen will be disabled. I know a few sites that spawn full screen windows and have no obvious way of getting rid of them.
Personally I use ctrl+alt+del but I'm sure this must be a real fustration to some users.
Most of the other fixes sound OK as well, not too happy about the whole Java thing but whatever.

As for using another browser - go ahead, however 90+% of users will be on IE so you'll only be fooling yourselves!

[oldskool79]

wow, I supose this will affect some images that I had on an map if I understood it correct,
this is my code for these image links;
target="_blank" onClick="window.open(this.href, 'map', 'width=550, height=350, scrollbars=yes, toolbar=yes, resizable=yes')

This should still work fine since the user must click a link in order to open the window. The new code only blocks scripts that are executed automatically (through OnLoad for example).

I think these new changes are good ideas, although they are certainly going to affect the usability of some legitamite sites.

I can even see some lawsuits brewing because Microsoft could be accused of interfering with the core business of some sites - such as exit exchanges or pop-up ad sellers.

I don't think that technology is ever going to be able to solve the 'annoyance' problem of these practices. The people that use these features for malicious purposes will just find a new (and possibly more annoying) way.

[Herath]

- MS Java Virtual Machine: This is no longer distributed. You should direct your users to java.sun.com.

Thats going to bite us hard. :(

[HowlingWizard]

Ever been stuck in a annoying full screen flash movie with no way to exit and just waste a couple minutes waiting before that!@#@#%ing [x] button appears.

Use Alt-F4 to close it. This is a Windows standard keyboard shortcut to close any program.

[PatrickDeese]

I am sure that sites like download.com are going to have to re-design major section of their site.

[rich42]

I am sure that sites like download.com are going to have to re-design major section of their site.

I've been looking at this for about a month since I knew it would effect me.

I think it can be pretty effectively worked around if your intent is to display some content (advertisement, instructions, etc) before launching a download the user requested (as opposed to forcing them to install malware upon landing on your site)

<a href="/download.exe" onMouseDown=(do something to the current page)>Click Here to Download</a>

To have this work the action will need to happen between the mouse going down and coming back up - so the content will probably have to already be loaded / cached.

After some tweaking I got this working with Firefox and IE - whether it flies with the actual XP SP2 hasn't been tested yet.

If it doesn't work for all users or javascript is off - the download should still start.

[ByronM]

I think its about time the downloads are stopped - as the downloads allowed activex to install "crap" to your pc - usually spyware, browser bars or takeover apps.

I think SP2 may rejuvinate the industry since the fraud of affiliate take overs and spyware taking over your pc will be less and less.

Hopefully inroads of Mozilla projects will put the browser war back into the light of day and bring about some robust, secure application frameworks.

[LateNight]

I have a script in the <HEAD> that rotates images that is called with a OnLoad="rotateImage('rImage')" in the <BODY> and I also have user intiated js image links on the page. I am wondering if the rotate script would be blocked.

[vkaryl]

I can't remember the last time something installed itself to my machine without intervention on my part. What ARE people doing, anyway?

I literally can't remember the last time it happened. And in this case, I really don't think you can blame it on age - I have a VERY good grasp of machine/software/net basics, and am not bad on the advanced stuff either!

[tedster]

A friend of mine who is a free-lancer just made a couple thousand dollars this week cleaning an office full of computers, contaminated with, in some cases, hundreds of mal-ware programs. The IT man there was increasingly frustrated because the machines' performance was ranging from sluggish to impossibly slow. Now, the IT guy might have known better, maybe, but he's a networking person, not a web person.

What are people doing? A lot of ill-advised actions based on misplaced trust. The web in general LOOKS civilized, but many predators are running on the loose and the average Josephine/Joe does not appreciate the real situation.

This is a well thought out move from MS, I think. In an earlier draft of this change, they also proposed a dHTML shift that would not allow a div's visibility to go from hidden to visible unless there was operator action - in other words, treat css div ads the same as pop-up windows. I'm sorry they didn't find a practical way to do that, too.

[vkaryl]

Ted - me too. That would have been a STERLING action - an example for the "masses" as it were. Though assuming the postulated "clean-ups" actually happen, MS is still doing a good thing I think.

[Not ENOUGH of a good thing to make me want to migrate BACK to IE though! *laughing*]

[stcrim]

This is an absolute bummer - we just rolled out software that defeats all pop-blockers, except this.

-s-

[ByronM]

This is an absolute bummer - we just rolled out software that defeats all pop-blockers, except this.

Why not just switch to contextual advertising where people are presented an ad and have to click through or wait - much like alot of the gaming sites do on premium content -- you know, the "click here to continue".. please support our sponsor below..

There are millions of better ways to monitize your traffic.

Personally, i think circumventing measures your "customers" put in place is not only wrong, but poor business ethics.

[vkaryl]

Personally, i think circumventing measures your "customers" put in place is not only wrong, but poor business ethics.

Pretty much what I wanted to say, Byron M - and didn't, because I couldn't manage to be as polite as you were!

[ITarena]

Hi CritterNYC

You can no longer move the statusbar, titlebar or toolbar off of the visible screen...

Would you please elaborate?
Regards