Day: December 3, 2003

I’ve had Andrew Clover’s IE parasite detector installed on this site for quite a while. IE is notoriously susceptible to security flaws: it leaves itself open to all sorts of exploits and hacks by downloading and installing malicious software at the drop of a hat without a user’s knowledge. So in the interests of being a good net citizen–and to help debug this problem–I put it on sirens3.com a few days ago.

For the record: I have never, nor will I ever, put spyware, malware, or any other remotely shady piece of code on any website.

Today I got my first angry e-mail. The person accused me of installing a piece of spyware that I’ve never even heard of, which was actually just found by the parasite detection script. I explained, hopefully clearly, my position on spyware and that I will never be a party to its use; I haven’t received a response yet. But this negative feedback has put me in something of a moral bind: do I remove it from the site and let people who are infected go on their merry way, or do I do the ethical thing and leave it but risk having Sirens’ reputation damaged through similar misunderstandings?

Stating it like that, I think there’s only one choice.

How bad is this: I finally tracked down a problem some IE users were having with sirens3.com, and discovered that it’s caused by code I put on the site to work around other IE deficiencies.

For those who care, the problem seems to be related to using ECMAScript to traverse and modify the DOM. There are vague references to this all over the ‘net–the symptom is that IE will load a page, then pop up an error dialog reading Internet Explorer cannot open the Internet site http://example.com. Operation aborted.–but nothing in the way of official confirmation, or even acknowledgement, of the issue by Microsoft.

There is something resembling unofficial confirmation in a Microsoft Web Team Q&A from 2001:

Although we don’t fully understand the reason behind the error you are seeing… calling setTimeout to force the document update to occur after the onreadystate event handler has exited resolves the problem. This behavior is probably because you are modifying the document from within the onreadystate event handler.