Subject: MSIE crash

From: Alon Altman <[email-masked]>
Date: Fri, 2 Nov 2001 23:26:42 +0200 (IST)

Hi,
  I would like to make my site visitable to any browser but MSIE. To do that
I need to add an MSIE-only feature that will either crash the browser(best),
display a blank page (not that good), or annoy the user via lots of popups,
annoying sound, etc...
  Is there any way to do this *without* depending on the user-agent field.
Many browsers spoof their user-agent, so I don't want to block them by
mistake.
  Please don't preach me about why browser blocking is wrong...

  Alon

-- 
This message was sent by Alon Altman ([email-masked]) ICQ:1366540
The RIGHT way to contact me is by e-mail. I am otherwise nonexistent :)
--------------------------------------------------------------------------
Events are not affected, they develop.
		-- Sri Aurobindo

---

From: Tzafrir Cohen <[email-masked]>
Date: Sat, 3 Nov 2001 10:18:02 +0200 (IST)

> display a blank page (not that good), or annoy the user via lots of popups,

One thing that is probably very legitimate of you to do is to use some
known weaknesses of MSIE that allow execusion of arbitrary (?) code:

* write a small activex componnent that issues a scary "now formatting
  your hard-disk" message
* Use the hole that is used by the worm nimda. It was patched by MS, by I
  figure that most users never botherd updating

> Many browsers spoof their user-agent, so I don't want to block them by

DHTML is said to be one aera where MSIE is setting its own standards. It
is also one place where 100% CPU utilization is not a hard target.

I saw one such annoying example recently, but I don't remember where.

-- 
Tzafrir Cohen
mailto:[email-masked]
http://www.technion.ac.il/~tzafrir

---

From: mulix <[email-masked]>
Date: Sat, 3 Nov 2001 11:15:11 +0200 (IST)

> > display a blank page (not that good), or annoy the user via lots of popups,

i am curious, alon, why?
feel free to respond in private if you'd like.

> known weaknesses of MSIE that allow execusion of arbitrary (?) code:

how is this legitimate tzafrir? it's technically feasible, but does that
make it legitimate?

> > Many browsers spoof their user-agent, so I don't want to block them by

it can be argued that anyone who *wants* to be treated as MSIE *should*
be treated as MSIE. unless MSIE users can also spoof their user-agent
field, which i doubt.
-- 
mulix

http://www.pointer.co.il/~mulix/
http://syscalltrack.sf.net/

---

From: Tzafrir Cohen <[email-masked]>
Date: Sat, 3 Nov 2001 11:36:07 +0200 (IST)

On Sat, 3 Nov 2001, mulix wrote:

> > > I would like to make my site visitable to any browser but MSIE.

Note that for many people this means "unaccessible".

> how is this legitimate tzafrir? it's technically feasible, but does that

It is legitimate IMHO if the code itself is harmless and gives a scary
warning.

I consider this a service to the user.