September 23, 2004 4:00 AM PDT

Microsoft: To secure IE, upgrade to XP

If you're one of about 200 million people using older versions of Windows and you want the latest security enhancements to Internet Explorer, get your credit card ready.

Microsoft this week reiterated that it would keep the new version of Microsoft's IE Web browser available only as part of the recently released Windows XP operating system, Service Pack 2. The upgrade to XP from any previous Windows versions is $99 when ordered from Microsoft. Starting from scratch, the operating system costs $199.


What's new:
People using older versions of Windows can't get an important security update to the Internet Explorer browser without paying for an XP upgrade.

Bottom line:
Microsoft's policy could drive XP upgrades, but it also risks alienating Web surfers and prompting them to turn to free alternatives such as Firefox.

More stories on this topic

That, analysts say, is a steep price to pay to secure a browser that swept the market as a free, standalone product.

"It's a problem that people should have to pay for a whole OS upgrade to get a safe browser," said Michael Cherry, analyst with Directions on Microsoft in Redmond, Wash. "It does look like a certain amount of this is to encourage upgrade to XP."

Microsoft affirmed that its recent security improvements to IE would be made available only to XP users.

"We do not have plans to deliver Windows XP SP2 enhancements for Windows 2000 or other older versions of Windows," the company said in a statement. "The most secure version of Windows today is Windows XP with SP2. We recommend that customers upgrade to XP and SP2 as quickly as possible."

The Internet's security mess has proved profitable for many companies, particularly antivirus firms. Microsoft has declared security job No. 1.

By refusing to offer IE's security upgrades to users of older operating systems except through paid upgrades to XP, Microsoft may be turning the lemons of its browser's security reputation into the lemonade of a powerful upgrade selling point.

That lemonade comes in the midst of a painfully dry spell for the company's operating system business.

Three years have passed since Microsoft introduced its last new operating system, and its upcoming release, code-named Longhorn, has been plagued by delays. Microsoft last month scaled back technical ambitions for Longhorn in order to meet a 2006 deadline.

While Wall Street anxiously awaits an operating system release that can produce revenues until Longhorn appears, Microsoft is eyeing the nearly half of the world's 390 million Windows users who have opted to stick with operating systems older than XP, including Windows versions 2000, ME, 98 and 95.

"Ancient history"
Microsoft denied it was deliberately capitalizing on the Internet's security woes to stimulate demand for XP.

"Microsoft is not using security issues or any security situation to try to drive upgrades," said a company representative. "But it only makes sense that the latest products are the most secure."

Microsoft has maintained that the browser is part of the operating system, a point of contention in its antitrust battle with the U.S. government.

Last year, the company ruled out future releases of IE as a standalone product. This week, the company reiterated that stance.

"IE has been a part of the operating system since its release," said the Microsoft representative. "IE is a feature of Windows."

When asked about IE's origin as a free, standalone product, the representative said, "You're talking in software terms that might be considered ancient history."

Microsoft promised "ongoing security updates" for all supported versions of Windows and IE.

The ongoing security updates do not, as Microsoft points out, include the latest security fixes with Service Pack 2, released last month. Those include a new pop-up blocker and a new system of handling ActiveX controls and downloaded content.

And it's those more substantial changes, rather than the bug fixes that come with routine upgrades for supported products, that security organizations have lauded for addressing IE's graver security concerns.

Now it's unclear whether even half the Windows world will have access to the shored up IE.

"It's particularly bothersome if a product is in mainstream support, because what does mainstream support mean then?" said Directions on Microsoft's Cherry.

Microsoft currently commands about 94 percent of the worldwide operating system market measured by software shipments, according to IDC. (That number factors in revenue-producing copies of the open-source Linux operating system, but not free ones).

Of Microsoft's approximately 390 million operating system installations around the world, Windows XP Pro constitutes 26.1 percent, Windows XP Home 24.7 percent, IDC said.

The remaining 49.2 percent is composed of Windows 2000 Professional (17.5 percent), Windows 98 (14.9 percent), Windows ME (6.5 percent), Windows 95 (5.4 percent), and Windows NT Workstation (4.9 percent).

That 49.2 percent of Windows users are left out in the cold when it comes to significant updates to IE and other software.

People running Internet Explorer without SP2 face an array of security scenarios, many of them linked to lax security associated with the ActiveX API, or application programming interface.

SP2 also brought IE up to date with its competitors with a robust pop-up blocker.

"Although I can understand the reasons why Microsoft would like to simplify its internal processes, I'm not in favor of bundling security patches, bug fixes and new features into one package," said IDC Vice President Dan Kusnetsky. "Organizations wanting only security-related updates or just a specific new feature are forced to make an all-or-nothing choice."

Firefox in the hunt
While organizations and individuals weigh the merits of all and nothing with respect to Windows and IE, a competing open-source browser may benefit from Microsoft's decision to reserve SP2's browser upgrades for XP users.

The Mozilla Foundation's Firefox browser is potentially eroding Microsoft's overwhelming market share even prior to its final version 1.0 release. Last week's release of the first preview release of Firefox 1.0 blew past its 10-day goal of 1 million downloads in just more than 4 days.

Firefox, Apple Computer's Safari browser and Opera Software's desktop browser together command a mere sliver of market share. But features such as tabbed browsing and earlier adoption of pop-up controls have won them adherents among potentially influential early adopters and technology buffs.

Even some Microsoft bloggers have admitted to liking Firefox.

With Longhorn still years away, Microsoft is feeling the heat to produce a browser.

That heat has come in many forms, from grassroots campaigns by Web developers urging people to switch from IE to Firefox and other alternatives, to Mozilla's own marketing push, to a steady drumbeat of lacerating Web log and newsgroup posts decrying IE's years of stagnation.

"I've always wondered what the problem is with the IE team," one respondent wrote in a feedback thread on IE evangelist Dave Massy's blog. "I mean, it's just a browser. You need to render a page based on well-documented standards...and that's it! You've opted to not have tabbed browsing or any other personalization. It's just a window shell and the browser content...I wonder if there are only like four people who work on IE or something? I seriously don't get it."

Massy and others have defended the company by explaining that recent development efforts have been geared at security improvements.

A representative for Firefox, which will face security scrutiny of its own should it make good on its competitive threat to IE, said any pressure it was exerting on Microsoft to update IE was evidence of its success.

"IE users need all the help they can get," said Mozilla Foundation spokesman Bart Decrem. "And we're trying to help them. If Microsoft will help them, all the better. At the end of the day, the mission of the Mozilla Foundation is to provide meaningful choice, and the reason there hasn't been a lot of innovation from the dominant provider is because of their monopoly position. So if they are forced to innovate and respond to the success of Firefox, we are achieving our mission."

Some analysts say Microsoft's reluctance to issue SP2's browser security features to non-XP users has as much to do with being shorthanded as wanting to drive XP adoption.

"Their main focus now is on Longhorn IE," said Matt Rosoff, another analyst with Directions on Microsoft. "It's a staffing and a cost issue."

Rosoff agreed that Firefox and other second-tier browsers might benefit from Microsoft's IE distribution policies, but he noted that the vast majority of consumers are far less likely to download a browser than the typical Firefox early adopter.

"From a consumer standpoint, I think evaluating other browsers makes sense," Rosoff said. "And Microsoft is going to face more and more users who are on dual platforms, who won't see any reason to upgrade once they see that Firefox offers the pop-up blocker and other features they'd have to pay for in IE. But most consumers don't download anything if they can avoid it."


Join the conversation!
Add your comment
Yet another reason to move to a different browser
Who says that Microsoft isn't trying to monopolize the browser/os market? If it weren't for the fact that I provide tech support to the less technical members of my family, certain friends and work contraints, I'd probably have dumped Windows long ago for a different os. I only use IE when forced to like when I have to log into the company for off hours support functions or to pay my mortgage (neither company supports/recognizes Mozilla Firefox).
Posted by jeaninej (11 comments )
Reply Link Flag
I switched to Firefox a year ago & never looked back
About a year ago, I switched to Firefox, and found that I had a browser that was lean and mean. It was fast, and didn't allow pop-ups. It also didn't allow spybots or any other such junk onto my PC. I then switched to Thunderbird for e-mail, and was again pleasantly surprised. My next switch is to Linux -- Then I'll be free of the Redmond mental midgets.
Posted by (1 comment )
Link Flag
Complain to the bank...
You should complain to the bank that they don't support Firefox for mortgage payments...
Posted by (4 comments )
Link Flag
Re: mortgage, try User-Agent Switcher.
This is an extension that you can easily install for FireFox that will make the Web server <i>think</i> that you're running IE (or Netscape Confusicator 4.7 if you should have any reason to do so, or, if you're willing to add your own USER-AGENT strings to the menu, any other conceivable combination of browser and platform -- you can even make Firefox on Windows look to the server like Safari on a Mac if you want!).

Of course, this will not fix any problems caused by actual incompatibilities with the Web standards that Firefox supports so well, or any sites that require ActiveX, etc. But it will fix problems with sites that check the USER-AGENT string to see what browser you're running, and either reject you outright or load a reduced-functionality or even faulty version of the page if they don't see that you're running IE.

Case in point: if you go to a YahooGroup and click on "Chat," IE will take you to that group's specific chatroom. But Firefox (with Sun Java installed) will take you to a generic chatroom instead, and you would have no easy way to get to the group-specific chatroom.

But, just switch the USER-AGENT to IE with this handy-dandy Extension, and go back to the YahooGroup page and click "Chat", and voila! You go right to the GROUP-SPECIFIC chatroom, just as if you were using IE!

This proves that the problem is with YahooGroups itself, and the fact that they try to detect your browser, not with the browser itself.

Another cool extension is Launchy, which gives you a right-click option on any link, allowing you to pick what to open it in. This way, you can use Firefox for your casual browsing, and when you come across a link that you know works in IE only, simply right-click and open it in IE instead!
Posted by COMALite J (16 comments )
Link Flag
Hell yes!
Just don't use their browser ... Firefox works great.
Posted by jm808 (12 comments )
Link Flag
Time fer a change.
IE is most secure with XP? IE is more secure with XP?

How about IE is less secure than all other browsers, period?

Yee gads, IE is the world's version of the internet Petri dish.
Posted by (55 comments )
Link Flag
Upgrade to WinXP not an option for some...
I still use Win2K, because I use several COTS software packages in my work that do not officially support WinXP yet. I guess Micro$oft believes they don't need to support all of their Fortune 500 customers?! How many people do you know that bought Win2K for a home PC?

Win98 SE support was scheduled to end at the beginning of this year, until Microsoft realized how much of their international customer base was still using it. As we all know, you can't load WinXP on every PC currently running Win98, because WinXP requires more hardware resources than Win98, and while WinXP will run on many older PCs, it is painfully slow. I guess Micro$oft has now reversed their earlier decision that continuing support for their international customer base is important? Looks like a golden opportunity for lean &#38; mean Linux desktop distros, in addition to Mozilla et al, to secure more market share.

Posted by C.Schroeder (126 comments )
Reply Link Flag
Now people will move to Firefox
I have been monitoring the reviews of Firefox preview and thought people will adopt it at an average rate. But now the policy of Microsoft will make IE to fall ; now people will turn to Firefox or other alternatives once they know have to pay to upgrade for better security whereas alternative browsers are better secured and free !!!

Lets see what time will say. But we are all sure IE dominance will be deeply hurt within the years to come.
Posted by tomal_rocks (7 comments )
Reply Link Flag
Firefox vs. Microsoft (Now, no contest.)
Okay, this does it. I have used Firefox on and off for a year now. Quite frankly, I prefer I.E. as a browser, but I much more prefer Mozilla's attitude toward their users. Micro$oft would keep me as a user of their browser if they cared one iota about their customers. They very obviously do not. Goodbye, I.E. I'm back, FireFox.

Indeed, may lightning strike me dead should I use I.E. any time other than when *absolutely* necessary. And even then, I will first decide whether I really need to visit a "Micro$oft-compliant" web site. That said, I foresee removing a few bookmarks. So be it. *Anything*, even the devil himself, has now become a better choice than Mico$oft. Indeed, may lightning also strike me dead if I ever again buy a Micro$oft-based operating system. Goodbye, WinWoes. Hello, Linux. (And I may even return to Macintosh.)
Posted by ZenWarrior (23 comments )
Reply Link Flag
Microsoft is really pushing XP. Too bad they're alienating all the millions of businesses and users that have Win2k Pro. Businesses paid big money for all of their win2k licenses, and now microsoft is refusing to fix their own holes in their software. Bummer. Looks like they're SOL.

I wholeheartedly agree that this gives Linux, and Linux based Mac OSX a chance to shine. Linux is powerful, stable and secure, and Apple Packs that with their superior Aqua Interface and PPC Platform.
It actually seems kind of stupid of M$ to anger their customers by refusing support, because this gives businesses a reason to switch to a better environment.
Posted by eviltoaster (31 comments )
Link Flag
That's the spirit!
That's the spirit!
Let's hope others follow!

Posted by (27 comments )
Link Flag
Thank you Microsoft. Now more people will switch
I love this move from Microsoft. I'm a website developer. I develop primarily for FireFox/Mozilla/Netscape, and then I test on other browsers.

With this move MS has made my life easier. More people will move away from IE which is a piece of (...) old technology way behind the curve.

Thanks MS.
Posted by thetruth1960 (18 comments )
Reply Link Flag
Hmmm free better browser or $99-$199
Yah that's a really hard choice.
Posted by Jonathan (832 comments )
Reply Link Flag
Security patches cost money.
Wait till next year when MS starts charging all customers for
security patches not just upgrades.

Hmm, that does beg the question. What exactly is an upgrade
for a windows user anyhow? Switchng to OS X, perhaps.
Posted by (55 comments )
Link Flag
Non-Techie Users will not upgrade anyway
I think that most non-technical users will simply continue on using Windows 95 (or whatever version they have). We all know by now that the majority of regular users need auto updates to secure their systems. What makes M$ think that they will pay to upgrade their OS??? It looks like spam-zombies are here to stay!

Businesses with IT departments will now seriously look at switching browsers.
Posted by (1 comment )
Reply Link Flag
An exception to your suggestion
My technologically backwards company doesn't have the money to pay for upgrades to XP for all our computers (we're a non-profit), but that's the extent of your correctness. We began recommendint a switch in our office to Mozilla &#38; Firefox months ago, and I'm now going to force the last hold-out (my 75-yr-old boss) to learn the new system. I'm also going to start investigating Linux systems. So just a note - even though we may not upgrade, I think more and more casual computer users will be moving away from both IE and Microsoft's OS.
Posted by AbbyMac (1 comment )
Link Flag
so EZ to stup Firefox
The less teckie of the peoples should ask their pc guru how to install firefox <a class="jive-link-external" href="" target="_newWindow"></a>
or just click on install.....
i guess its like when touch-tone phones came out.
only the "brave" left their old Rotary Dial Phones for the ease and operation of the new phone, did i mention "faster" also
Posted by rockinrob5150 (3 comments )
Link Flag
XP Upgrade and IE
I have used windows 98 for a long time and have not upgraded to XP because of the continued mess that Microsoft calls an operating system. If I can not get an upgraded IE without spending the money to buy another OS that is full of holes, I guess I will try another Browser! Microsoft needs to concentrate on getting it right, not creating new versions of the same mess to sell to people stupid enough to believe that Microsoft cares one bit about security and everything about selling new operating systems.
Posted by neal_r_smith (1 comment )
Reply Link Flag
product placement
the most ironic part; under all these direct comments about how people will avoid SP2 or XP or IE or a link:

"Improve your PC with SP2"

Posted by (1 comment )
Reply Link Flag
Typical tech industry tactics.
Whoever heard of a car manufacturer saying that it no longer will service a 2000 Ford Mustang for faulty brakes it installed in the car? (Remember, Windows 2000 is only 4 - 5 years old)

Only in technology can a company simply ignore its past mistakes and instead try and push consumers to buy more of its products...

Key word here is "try". I truly believe Microsoft is at the height of its existence and it is going to be a long slow decline from here... I'm not an open source advocate, nor am I anti-Microsoft - rather I'm a business man who gets irrated when tech companies feel they can do business anyway they please...
Posted by (1 comment )
Reply Link Flag
Problem with your analogy
The problem is you are talking about having to physically bring in cars to replace a physical part where as the IE changes are software only which can be distributed just like everything else form Microsoft.

The big thing I see is this tries to force people into an OS that allows Microsoft to control the upgrade times. Once on XP, when they decide to drop support for it, and you need to reload your PC, you can no longer get the authorization number from Microsoft and this would force you to migrate to some other OS (in their eyes, that would be a Microsoft OS of course). At least with Win 98 or Win 2000, I can still re-install my machine and not have to beg Microsoft for the key to unlock what I have already bought. It is just another step in their desire to make you rent the software and have no ownership in it.

Posted by jekyl20 (3 comments )
Link Flag
New Market for White Hats
Microsoft is big-business. Why not look at this (and get pissed off--again) as an opportunity to do them in on the Browser Market.

If so many Black and White Hat hackers can rip into the Browser they can also provide oppotunities to close those rips.

I don't care if it free or not, but somebody with skill could make some cash off providing patches.

It's could lead to extortion of course, but isn't that what MSoft is doing? It would be more a question of whose your protector Big Biz/Gov or the Mafia Don down the street?
Posted by (1 comment )
Reply Link Flag
I agree that Microsoft is trying to force people to upgrade to XP. If someone can offer a XP like platform that is not so intrusive. I personally would adopt it. I want the IE upgrades without beinig forced to upgrade. Mozilla, here I come again.
Posted by stephan6969 (3 comments )
Reply Link Flag

Join the conversation

Add your comment

The posting of advertisements, profanity, or personal attacks is prohibited. Click here to review our Terms of Use.

What's Hot



RSS Feeds

Add headlines from CNET News to your homepage or feedreader.