The perils of using Internet Explorer as your default browser - Microsoft Tech Community

Chris Jackson

From time to time, I am asked by customers, “How do I ensure that all web traffic goes to Internet Explorer?” In fact, I was recently asked this question by someone trying to help a hospital. Now, I understand the scenario. In healthcare (as in many other industries), it’s often the case that you’re running with an extremely thin team. As a result, it can seem that using Internet Explorer be default for all situations is the “easy button” because, well, most of your sites were designed for Internet Explorer, so…just…always use it, ok?

In short, this seems like a deliberate decision to take on some technical debt. It’s true that most organizations have some technical debt lying around. (For example, if you’ve disabled User Account Control, require a 32-bit OS or 32-bit Office suite, or are paying for extended support for a legacy version of Java, you have some technical debt.) But this technical debt? Well, it’s different.

Creating technical debt by default

In the past, Internet Explorer was optimized for simplicity at the expense of technical debt. Looking all the way back to Internet Explorer 6, the very concept of “standards mode” vs. “quirks mode” comes from this “easy button” approach. All existing content (which had no DOCTYPE) would get quirks mode; you got standards mode by adding a specific DOCTYPE.

This, of course, had one little pesky problem: most people neither manually type HTML nor obsessively read the documentation to make sure they get the right DOCTYPE. You see, in the bad old days, you couldn’t just put in <DOCTYPE HTML>, you had to put in a full document type definition (DTD), and what you put in determined whether you’d get standards or quirks. So, it wasn’t just the presence or absence of a declaration, but also whether you put in a correctly formatted and properly chosen DTD, that would promote you to standards mode.

So, what really happened is that developer tools either added this in the skeleton code, or they didn’t. Which meant, if your tool didn’t add this in, you would get Internet Explorer 5 emulation (quirks mode) by default. Getting modern was opt-in because that was easier.

Fast forward, as Internet Explorer standards mode supported more and more standards, we decided not to just update the mode we called standards mode because, when we did, we risked breaking applications written for an older interpretation of the standards. So, with Internet Explorer 8 (IE8), we added IE8 standards, but also kept Internet Explorer 7 (IE7) standards. That meant, for sites in the Internet zone, it would default to IE8 standards, but, for sites in the local intranet zone, it would default to IE7 standards.

Another easy button.

As you can see, by going with the “technical debt by default” approach, we ended up in a scenario whereby if you create a brand-new webpage today, run it in the local intranet zone, and don’t add any additional markup, you will end up using a 1999 implementation of web standards by default. Yikes!

Enough is enough

When we introduced Enterprise Mode for Internet Explorer 11 in 2014, we made the very deliberate decision not to include wild card support. You must add all the sites that you want so that we don’t continue the chain of “debt by default” that was initiated back in 2001. But you’re probably even busier today when you were back then—if, in fact, you were working in technology in 2001, which many people weren’t!—so how do we do that without making you pay the price?

We had to simplify creating that initial blacklist (legacy by exception, not by default). First, we launched Enterprise Site Discovery so you could gather this data from your endpoints. We then enabled similar functionality from Windows Analytics Site Discovery so you could gather this data without needing to build a new set of infrastructure and processes. Once you have that initial list, it should be all downhill from there: simply remove sites as you modernize them.

By making it easy to take a blacklist approach (legacy by exception), we were finally able to move away from taking a whitelist approach (legacy by default).

Why shouldn’t I just keep doing what I have been doing?

So, why was it so important that we invert our approach to legacy? Because if we didn’t, you would end up in a predicament—and probably sooner than you think.

You see, Internet Explorer is a compatibility solution. We’re not supporting new web standards for it and, while many sites work fine, developers by and large just aren’t testing for Internet Explorer these days. They’re testing on modern browsers. So, if we continued our previous approach, you would end up in a scenario where, by optimizing for the things you have, you end up not being able to use new apps as they come out. As new apps are coming out with greater frequency, what we want to help you do is avoid having to miss out on a progressively larger portion of the web!

Oleg K

The problem is when a few most important apps require IE and even older IE mode. Yes, some personal apps won't work, so users can use Chrome for that. But then it creates a confusion what browser to use when. And sometimes it gets even weirder when such legacy app, that requires IE sometimes works better with Chrome (in some rare cases).. :) It is easy to say "just update your apps". Some are heavily modified 5+ years legacy SharePoint 2010 or older apps that can't be even easily moved to 2013+, not even saying Online. And in some cases legacy apps are enforced by government and you can't do anything about it. Enterprise Mode helped when moving to IE11 (and Windows 10 by making sites opened in Edge to forward to IE). Although i wish it would be a bit more admin friendly. I dislike doing GPO with registry modifications..

Martin_Geuss

This problem would not exist if Microsoft had delivered a competitive browser with Windows 10.
Now you tell the people not to use Internet Explorer, but you avoid to give an advice.
It's crystal clear: Everybody should switch to Google Chrome. I know Microsoft is building a new chromium based browser, but seriously: why?
Who should be trusted? A company which is struggling in browser development since years? Or the one that has proven it can deliver a modern an capable browser?

Chris Jackson

@Oleg K Hopefully you didn't hear me say "just update your apps" - I get that it's impractical to assume that we would have any business justification for updating everything all the time. My concern is that, to accommodate apps that do need IE, we use it for everything. We want you to use IE for the sites that need it - what I'm trying to say here is that I hope you don't use it for everything else. The candle is burning from the other side with that approach - now your new sites break while keeping your old sites fixed. I'd like to craft a solution where both your old sites and your new sites work!

@Martin_Geuss Similarly, I'm not saying don't use IE, I'm saying don't use it for everything - leverage the Enterprise Mode Site List to use IE where it's needed, and only where it's needed. I'm not here to enforce any browser on anyone. Windows gives you a choice in your browser, and you should choose the one that best meets your needs. There are plenty of customers who choose a Microsoft browser, for many good reasons, and when they do, I want to make sure that they configure that experience in a way that will lead to the best outcomes long-term.

Oleg K

The problem here is users. They get confused easily. "What, why do i have to open this link in Chrome to get Skype for Business broadcast working? (because it demands Flash, ugh..). I work 90% of time with that blue E icon program, why do i have to use that colorful icon for one other site i like to browse, why don't it work with blue E? Our IT is garbage!!" :D

Chris Jackson

@Oleg K Definitely don't want to have to force users to remember which browser to use for which app! That was key in the design of the Enterprise Site Mode and its surrounding policies - the right browser should always be open. We want to keep improving that experience so users don't have to get involved. Otherwise, we have a key externality which, across all of your users, can end up consuming a significant amount of unacknowledged cost!

win32_lean_and_mean

Windows gives you a choice in your browser

Windows 10 S mode gives user only the dying IE and dying Edge.

Scott Humble

Microsoft has given you the tools to manage the end user experience. If you want to use Chrome or Firefox and selectively instruct users to use IE, have at it. Or, you can manage where and when IE opens using the Enterprise Mode Site List. With Edge as the default, it will automagically open IE for sites where it is required.

Honestly, it isn't difficult. Just download the Enterprise Mode Site List tool, enter the sites that need to use IE, save the xml to a share, enable the feature in GPO and enter the path to the site list file. It is elegant and simple. When the site is able to run in Edge, remove it from the list.

Oleg K

If this is a reply to me, then i have implemented Enterprise Mode in the past. Although i certainly wouldn't call a solution having me to alter registry an elegant one. Also, how would you instruct Firefox\Chrome to open a site in IE? This only works for Edge\IE. Edge is only for Windows 10 (for now). Yes, Windows 7 is closing to an end, but i was implementing Enterprise Mode 4 years ago, when Windows 7 was the most common OS. And people just like Chrome better and are used to it. Edge would be a hard sell for them.

GoogleChrome

@Oleg K

>Also, how would you instruct Firefox\Chrome to open a site in IE?

Google has a feature to do this: https://support.google.com/chrome/a/answer/3019558?hl=en

"If your organization wants to take advantage of the Chrome Browser, but your users still need to access older websites and apps that require Internet Explorer, you can use this feature to easily switch between browsers. The Chrome Legacy Browser Support extension allows users to switch automatically between Chrome and another browser. When your user clicks a link that requires a legacy browser to open (such as a site that requires ActiveX), the URL will automatically open in the legacy browser from Chrome."

According to Chrome Web Store, there about 5.8M users today.

https://chrome.google.com/webstore/detail/legacy-browser-support/heildphpnddilhkemkielfhnkaagiabh?hl...

Oleg K

I've heard something about that, so was expecting similar suggestion. Firefox also has enterprise features (probably similar option also). But that's another browser/setting to install/maintain, on top of Enterprise Mode. A bit too many moving parts to my liking.

SuperCoco

For a desktop computer, I prefer a real Win32 'compatibility solution' than a mobile UWP app like Edge. I don't want or like mobile apps (UWP) on my desktop powerful computer.

adamwadesmith

A suggestion for Microsoft: Windows 10 still includes Internet Explorer as the default for some file types and protocols. The biggest category is HTML mail (.mht, .mhtml) - when Outlook 365 suggests that you open an email message in your browser, it will launch IE11 - which is then used for further browsing on the Internet. Perhaps Microsoft could update Edge to support HTML mail and other protocols served by Internet Explorer?

- Adam Smith

packeterrors

Internet Explorer (formerly Microsoft Internet Explorer and Windows Internet Explorer, commonly referred to as Explorer and abbreviated IE or MSIE was included in Windows since 1995. That is 24 years now and from day one it has had issues with compliance or keeping updated to standards of the time. It had features that only it supported at different times as I assume the team at the time thought the "standards" were behind. It really doesn't matter as the browser is very important today for every user regardless of platform they're on. Microsoft has more dedicated developers than any other software vendor on the planet and some amazingly smart and talented Engineers.

The real issue I would venture to say is that top level management in the past 24 years cannot be convinced to allocate adequate time, resources, and money to put an end to what I think most probably feel is an embarrassment for Microsoft that they have not been able to be the leader in this area after even 24 years of being at it.

I could be wrong but I would bet that most people don't really care what the underlying technology used is. They just want a browser that works with every applications that needs or calls that browser on Windows 10. If Chrome, Firefox, Opera, etc. can open or work with it and decode the request properly then Microsoft needs a single browser that can do it and replace all other browsers. Then as the technology changes, Microsoft needs a framework that this new browser can be updated too. Microsoft has made fantastic advances in cross-platform usability for applications etc. - look at Windows Defender. On XP, and Windows 7 it was a joke, on Windows 10 it's actually much closer to just about any other full antivirus suite out there in terms of protecting the computer. Stop ignoring the browser Microsoft and build a World class browser already, I know they can do it if given the chance and support from top management.

miloush

The problem is that by "browser" you seem to care about the web technology only, while browser is the host application too, and for many people it is only the host application that means "browser" to them. Edge does not, and no UWP can match Internet Explorer in that aspect for me, in both performance and features. Ironically, despite being developer for many years, I don't care about the engine. Feel free to put Edge or Chromium engine in IE by default if it is safer or better in any other way, but I will keep using Internet Explorer for as long I can for its user interface and features.

chadkillingsworth

So when will Microsoft announce a sunset date for Internet Explorer? That's the only way this scenario will change. Legacy IT departments will not change directions without a sunset announcement from Microsoft. This cannot go on forever.

David Jongsma

Try editing in Sharepoint with Chrome or Firefox, the webparts behave totally different. If you have a solution for that we will switch.

bostoninteractive

Well its clear that Microsoft as a company has abandoned the browser wars and the clear winner is Google Chrome, with Firefox as the only real alternative when it comes to a modern browser on the desktop. I think the "my apps are dependent on a really old, non-compliant, and insecure browser" is tired and honestly a crutch. If your applications are so dependent on legacy technology the investment needs to be made to move them to more modern and scalable frameworks. Or abandoned all together, as is the case with Adobe Flash or Oracle's browser Java plugin.

One of the biggest strengths of the Microsoft ecosystem with Windows/Office etc is its backwards compatibility. But that being said, one thing really holding it back is to continue to bundle Internet Explorer with the operating system, especially with Windows 10. This would give Microsoft the power to say, sorry you should use a secure and modern browser to suit your needs and not have these security issues. Or, even better, point people to VM's or container based versions of IE. That way you don't pollute the base OS with old and unsupported technology, but giving companies who just won't invest in updating their systems the ability to use the older browser.

Oleg K

It's clear to me that many don't understand the real situation by just assuming that it can be forced by MS (they will NEVER do this to millions of big company customers, it is shooting your own foot) or that you can just update or throw away apps. It's not apps really. It is platforms. SharePoint and others. You can't simply replace a platform if all of your apps or business critical apps rely on it. It is not a case of getting rid of Flash player. Apples and oranges. Replacing such platform requires not just investment, it will break business operation, require new expertize and service providers. There are also platforms managed by governments. I know at least one which is made with EU funds to manage EU funds and it only works correctly with IE (it is actually made with Java on Tomcat, so not some legacy platform here) and nobody is going to change that. You can't say to them that you want to use Chrome and throw away IE.

WilliamGarrisonBD

Microsoft Windows Server and IoT editions ship with Internet Explorer 11 as the only browser. Your LTSB/LTSC only supports IE11, not Edge. Some Office/Sharepoint integration only works with Internet Explorer. It is frustrating when one arm of Microsoft supports IE11 exclusively, while another arm tells us not to use it at all.

Ethan Powell

"Windows gives you a choice in your browser, and you should choose the one that best meets your needs." https://www.howtogeek.com/365983/windows-10-tries-to-push-firefox-and-chrome-over-the-edge/

jvillaro

What am I supposed to do with all the Silverlight Apps I created for customers? The only way they can use them is with IE (maybe a portable version of chrome that I created out of panic).
There was time and money involved in learning, developing, etc. I get that it's time to move on from IE but MS didn't even create a Silverlight plugin for Edge...

wolrah

@Oleg K what you're saying made sense years to decades ago when you first found out that those ancient apps didn't support standards-based browser engines. You've had this whole time since then to upgrade or replace them, since they clearly have no long term future. If you haven't yet that's on you.

Software requires maintenance, just like everything else. If your software is not being maintained, it needs to be replaced. If it is being maintained and yet somehow still manages to not work with anything modern then there's good reason to question the competence of those maintaining it. It's not a set it and forget it thing where you can expect to keep using the same stuff forever.

packeterrors

Actually many companies can and do @wolrah

If you're producing widget x and have been for 10 years and you're making money today just as you were 10 years ago, sorry there is no "business need" to upgrade to all these bells and whistles of technology today. Does that fit the model of most, no it does not, but neither does updating to the latest technology every 3 months as some new fancy eye candy technology comes out. The choices of technology available today are almost mind boggling and the marketing and hype trying to drive everyone to update to the latest and greatest is probably one of the biggest ventures out there making money convincing you that you need to update constantly. Don't get me wrong - there is a need for some to update but not on this crazy endless upgrade/update cycle the computing industry seems to have settled on. If Microsoft and other software companies don't update and remain stagnant then they don't make money, so what do they do? They create new stuff and try to convince everyone they need it for one reason or another.

Back to the IE discussion though. As said, there are core systems created by Microsoft that are in place today in many companies that spent hundreds of thousands of dollars to get it all setup, licensed and working well. Now you expect or want them to be happy telling them to forget about that and update/upgrade to something more modern? Microsoft states that SharePoint has 190 million users across 200,000 customer organizations. Even their latest version of SharePoint 365 is old from 2013. For sake of argument, even if you spent the thousands of dollars to upgrade to the latest you'd still be on old technology that would not fully utilize Microsoft Edge in it's current state. What then, Chrome or Firefox again?

bostoninteractive

@Oleg KApple did just that and almost single handedly killed Flash and pushed the web to more browser based standards, and also set the standard for the mobile web we all enjoy today. Its also hyper competitive, so to stay on top of the trends movement needs to be made on applications. If Sharepoint doesn't work, and Microsoft hasn't addressed it, users move to a competing product like Google Docs that allows them to collaborate and also gives users the ability to use their smartphones to manage it as well. I'm not saying its better, but there are viable alternatives that will replace a product like Sharepoint if it is too slow to innovate.

In IE's case, if a business still has ActiveX apps that they still haven't updated, I'm sorry, but Microsoft shouldn't be beholden to their needs and keep the rest of their user base held back and insecure by supporting and bundling it. I know Microsoft really wants to move forward from IE and leave it behind and also innovates on their own products like Sharepoint. They understand where the web is going. One good way of moving it forward is to abandon legacy apps like IE and not support them. Honestly its a miracle IE is still bundled with Windows 10, and frankly confusing for some end users that IE and Edge are on there.

Oleg K

We are talking about different scales and Flash is not a good example as it was mostly a consumer targeted tech.

documentationwhore

The problem with this article is the author distributing fake information in favor of the so-called "modern browsers" such as Edge or Chrome without giving you the full details behind that choice that Microsoft supposedly made.

Let's try to understand why Edge, even 4 years after development is still a poor browser just like Chrome. Both are made for home users and their role is to offer simplified, dumbed-down experience to the user while mining their browsing, search and computer data through various encrypted channels which was proven multiple times through 3rd party analysis.

Internet Explorer is still, to this day, the most secure and performance optimized browser among all the competition. I can't even imagine allowing Chrome to run on a RDS host with 40 concurrent users for that reasons alone.

Also, IE is very stable and has lowest amount of random crashes or freezes based on available information in environment of over 10000 endpoints.

It has the best group policy support and most important and functional features such as Active X controls, .NET, Java integration, ability to hook with additional software installed on the machine, custom zones and the list just goes on.

The browser is made for enterprise and every big or important company creates their apps and tools to work with it. I am not talking about your regular websites which are made by college freshmen who are wet about their new html5 / css / javascript or other skills.

The main problem is the reason why Microsoft decided to abandon IE, which is the result of Google leading in the big-data (telemetry) game and made their own data mining browser called Edge.

I am certain no system admin would approve use of those modern browsers which are here to obtain data from their users, dump them in the big-data database and use for marketing, research and sales purposes.

Therefore, please cease the Edge development and focus on important stuff, IE should get the version 12 because your team of kids fresh from university won't code a browser with half of IE 11 functionality in the next 10 years and you can mark my words.

nixkuroi

IE still offers the best debugging experience in Visual Studio. Trying to debug from Chrome or Edge is an awful, often bifurcated experience where you can't debug through from managed code to script, which makes tracking data flow problems incredibly difficult from client to browser.

Even though Edge is faster in many ways, it still falls down on simple rendering problems. Although those issues are now being resolved by punting to Google, it's disappointing to see that Microsoft is casting aside a browser that has already fixed many of these issues.

As a long time web developer (I still remember when IE4 was the GOOD browser), I completely disagree that adding <doctype HTML> is beyond most devs. Back in the day, this was the a problem because prior to HTML 4, nobody knew anything about doctypes, and if you did, you were probably using Transitional. In the intervening years, BECAUSE of the differences between IE and the other browsers, nearly all web developers learned that a <doctype> flag was required to know how your code was going to be handled.

Why not, instead of mothballing IE, just fully implement standards in it while in strict mode, and earn back your fans. Treat inconsistencies like event listeners, old AJAX calls, and css filters like polyfills and handle them - if encountered - as such? Then when a new developer opens up some old code that's running in IE, do what Chrome does and chastise them for using obsolete constructs? Shame them with "Does your mama know you still use filter:progid:DXImageTransform.Microsoft.Blur?" They'll love you for it.

Reza Ameri

The problem raised when Web Developers failed to follow software developer principles few years ago. The just develop a page and test it with Google Chrome not because Chrome was cool during those days but because they simply think Google is good so Chrome is good too. Then users complain why the website is not working with Internet Explorer and they add banner that it is recommended to use Chrome. Some third-party applications also forced Google Chrome, remember when we wanted to update or install some legitimate programs, they have checked box and it has been checked to install Chrome and make it default? If some call themselves web developers, they know they have to test their product before release and it is normal to test with well known browsers including Internet Explorer.

Time past and people switch to Chrome, now if someone is using Windows 10, I strongly recommend them to use Microsoft Edge as their default browser in term of security it is superior than both Chrome and Firefox and I am asking web developers to test their website with Microsoft Edge too. This shows professionality of developer , to show their clients we are supporting them and we won't force them to use specific browser. It is not professional to force user to switch to Chrome from Microsoft Edge because developer is lazy and don't want to do proper testing. I agreed in case of Windows 10, use Microsoft Edge and switch to Internet Explorer if you want to. However, you have to take a note that support for Windows 7 will be ended on January 14, 2020 and support for Windows 8.1 will be ended on January 10, 2023. Meaning, even they are on extended support. We have to make sure that all websites working great on Internet Explorer 11 and they have their functionality , while we concentrate more on Microsoft Edge and modern standard.

Microsoft has been leader in software development and web browser and I don't like to see indirect advertisement of competitors. Anyone is free to use any browser as they wish, but we as Microsoft Expert must be make sure users are having great experience with Microsoft Edge and Internet Explorer. So to clarify this while we need to move for new standard and make sure we use full potential on Microsoft Edge. We have to make sure our websites working great in Internet Explorer while it is the only Microsoft supported browser in Windows 7 and Windows 8.1. There is news of upcoming version of Microsoft Edge which would work on Windows 7 and Windows 8.1. However, we could only stop testing Internet Explorer when we make sure Microsoft Edge for Windows 7 and Windows 8.1 has been released and is stable version. Don't forgot that the only browser for Windows Server is also Internet Explorer. We know that people won't use Windows Server to browse website but you should consider this case that there might be certain cases when web administrator need to get certain data from your website and it doesn't feel nice, if you tell them sorry Internet Explorer is not supported.