| Date: | March 4, 2004 / year-entry #84 |
| Tags: | tipssupport |
| Orig Link: | https://blogs.msdn.microsoft.com/oldnewthing/20040304-00/?p=40403 |
| Comments: | 63 |
| Summary: | In a comment to yesterday's entry, someone asked about the customized icon that appears in the address bar... sometimes. There's actually method to the madness. I was going to write about it later, but the comment (and misinformed answers) prompted me to move it up the schedule a bit. (The originally-scheduled topic for today -... |
In a comment to yesterday's entry, someone asked about the customized icon that appears in the address bar... sometimes. There's actually method to the madness. I was going to write about it later, but the comment (and misinformed answers) prompted me to move it up the schedule a bit. (The originally-scheduled topic for today - the history of Ctrl+Z - will have to wait.) Each web site can put a customized icon called favicon.ico into the root of the site, or the page can use a custom LINK tag in the HTML to specify a nondefault location for the favicon, handy if the page author do not have write permission into the root directory of the server. In order for the favicon.ico to show up in the address bar, (1) the site needs to offer a customized icon, (2) you have to have added the site to your favorites, and (3) the site icon must still be in your IE cache. IE does not go and hit every site you visit for a favicon.ico file; that would put too much strain on the server. (Heck, some people got hopping mad that IE was probing for favicon.ico files at all. Imagine the apoplectic fits people would have had if IE probed for the file at every hit!) Only when you add the site to your favorites does IE go looking for the favicon and stash it in the cache for future use. |
Comments (63)
Comments are closed. |
Makes sense. Although it doesn’t do much good for people like me who keep their cache size intentionally low.
This is one of those things I always see/hear IE getting knocked for – generally the icing on the cake after a round of "CSS support" this and "ActiveX vulnerability" that. I’d certainly love to hear an empassioned rebuttal. :)
I once wrote a very handy dialer partly implemented as an asynchronous pluggable protocol (type or link to ‘tbox:123-456’ and IE would dial the right number).
I wanted to use a favicon for such phone numbers stored in favorites but it didn’t work :-(
I guess it’s due to the lack of ‘site’ concept in my custom URLs. Or maybe IE just plainly skip favicon support for APPs. Too bad…
favicon works only for http. After all, what is the "root" of the "server" for the tbox protocol? What is the "root" of the "server" for the mailto procotol?
I believe you can still create a favicon for the shortcuts by binding to IShellLink on the *.url file and setting the icon properties. It just won’t be automatic.
I use MyIE2 (IE engine + bolted on stuff), and every website is hit for favicon
For a while, favicon seemed to be IE-only. Firebird (or whatever it’s called now) also supports it. It sometimes loses track of the icon (similar to when it drops out of IE’s cache), but Firebird will sometimes reload it. I haven’t figured out the method to its madness yet, but it seems to request favicon much more frequently than IE does. Frankly, IE’s approach of requesting it only when the URL is added to favorites is virtually worthless. But I understand the desire to not request it excessively.
way to break the w3c standard MSFT.
Firefox and Mozilla also support PNGs and GIFs as favicons. IE only seems to like 16 colour ICOs for use as favicons.
The "disappearing favicon" problem seems to affect Mozilla and IE alike, however.
Just proves you can’t please everyone. sd complains "Stop looking for favicon", others complain "Look harder for favicon". (Is sd also angry at Firefox and Mozilla for looking for favicon?)
And then when IE conforms to standards people get mad, too. Per RFC 2068, IE will not create more than two connections to a server simultaneously, but people want more.
Favorites that have had a favicon and lost it appear differently to those that have never had one. It looks like IE loads the 32×32 version of the HTML page icon and squashes it to 16×16, rather than using the genuine 16×16 version.
Moz and firefox (and konqueror, etc) were forced to look for favicon b/c the average user sees IE added this ‘feature’ (but doesn’t realize MSFT broke a standard in doing so) and complains that something is wrong with their favorite browser for NOT including it. As a result other browser developers conform to keep their users happy.
Lets take a look at RFC 2068 shall we?
—
SHOULD
This word or the adjective "recommended" means that there may exist valid reasons in particular circumstances to ignore this item, but the full implications should be understood and the case carefully weighed before choosing a different course.
…
Clients that use persistent connections SHOULD limit the number of simultaneous connections that they maintain to a given server. A
single-user client SHOULD maintain AT MOST 2 connections with any server or proxy. A proxy SHOULD use up to 2*N connections to another server or proxy, where N is the number of simultaneously active users. These
guidelines are intended to improve HTTP response times and avoid congestion of the Internet or other networks.
—
Tell me again where people are asking for IE to break a standard?
sd: Just google for "MaxConnectionsPerServer".
Favicon being a Windows ICO file flies in the face of web standards.
I thought it was already established that favicon was nonstandard.
It is arguable that only looking for favicon.ico when someone bookmarks a site has privacy implications:
http://www.magnux.org/~flaviovs/sec/favicon/privacy.html
Personally I don’t see this as a problem but I am sure some people would.
It is interesting that such a simple feature could have other implications.
Jonathan
Remember that the browser zeitgeist of the time was to "innovate" outside of the w3c because they took too long to approve standards that developers and users were clamoring for.
Microsoft and Netscape both did this to differentiate their products, and now we’re all saddled with compatibility. Making it seem like a random behavior that only Microsoft would ever do is hiding the larger reality.
Old versions of IE don’t check the validity of the .ico file header before expanding it: result, favicon fetching is enough to run arbitrary code on the end user’s machine.
Moral: dont assume one bit of code (::LoadIcon()) is actually robust and/or secure.
IMHO, sd doesn’t understand what "SHOULD" means.
In an internet draft or RFC, "SHOULD" means "Treat this as a "MUST" unless you have a REALLY REALLY REALLY good reason". The usual "REALLY REALLY REALLY good reason" is that the underlying platform can’t support the desired operation.
"Because I want my client to browse faster" isn’t a valid reason to violate a SHOULD.
If the standard authors truly wanted the behavior to be optional, they would have made it "MAY".
Forgot to add this: If the user sets the MaxConnectionsPerServer flag, that IS considered to be a legitimate reason to violate a SHOULD – the user has explicitly requested that your application violate the standard.
But the out-of-the-box configuration SHOULD conform to the standard :)
The feature should have been done so that the icon would only be requested if there actually were a <link rel="shortcut icon">. This way, no excess requests would result.
Could’ve been done that way, but then people would have complained, "Why is it so hard to add a favorite icon to my site? I have to edit EVERY SINGLE PAGE on my site! I should be able to set a global favorite in one place."
You can’t win. Some people want you to do less, some people want you to do more.
What if somebody goes into your folder and deletes a favorite without using IE? If the icons were kept in a permanent place then they would be leaked.
Isn’t cache a bad place for storing info associated with favorites? Why the icon should disappear?
Larry: your definition goes against the definition provided in the RFC. "there may exist valid reasons" was put in to allow interpretation.
However I find it humerous that you feel:
"Because I want my client to browse faster" isn’t a valid reason to violate a SHOULD.
yet:
If the user sets the MaxConnectionsPerServer flag, that IS considered to be a legitimate reason to violate a SHOULD – the user has explicitly requested that your application violate the standard.
Why exactly would a user set the MaxConnectionsPerServer then? I hope its a "REALLY REALLY REALLY REALLY good reason."
Personally I have no opinion on whether IE should use more connections or not. My point is that Raymond’s argument of how fickle and contradicting users can be doesn’t hold up in this situation.
I think it’s important to note that while favicons are not standard, they don’t necessarily go against the w3c specs as sd seems to imply.
The section on link types specifically says that an author can use whatever link types it wants in a document.
The fact that almost no author uses a profile when they specify an icon through the link is not ie’s fault.
raymond: that is for w3c to decide though.
Some users say "I want IE to create more connections! Stupid Microsoft, intentionally slowing down my web browsing." Other users say "I want IE to limit to 2 connections! Stupid Microsoft, intentionally ignoring the spec." No matter what IE decides, Microsoft gets called stupid.
This seems like a feature that wasn’t completely thought through before it was hacked into the product. How is the user supposed to get the icon back if it drops out of the cache? Remove the site from the favorites and add it back again?
I think it comes back if you revisit the favorite but I may be mistaken.
No, it does not come back. I visit Google every day but its favicon disappeared long time ago.
I think that the problem of deletion of links without deletion of its icon could be solved in one way or another.
I’m sure it could be solved but it would add still more complexity.
As someone noted above, both IE and Mozilla/Firebird mix up the favicons in my bookmarks menu. They either lose a site’s favicon or show a different site’s favicon. Why is this so difficult? Why do two different browsers have the same bug? sigh..
In Internet Explorer, you can get the favicon to appear by dragging the Address Bar icon to itself.
I suppose this works because the dragging action invokes the "create a shortcut" mechanism, which fetches the favicon, even though no actual shortcut file is created.
I discovered this by accident.
Why can’t they just store the ico in a different directory, have it check for changes when you visit the site, and delete it only if you delete the bookmark?
I don’t understand why it should be subject to the same rules of the cache. By that logic, your bookmarks should be deleted if you don’t visit them in the same way any file in the cache would.
And then you have the "somebody deleted the shortcut outside of IE and its icon file never gets cleaned up" problem. Sure you can say "Well IE should periodically recheck all the shortcuts on your Favorites list and delete any icons in this special directory that don’t have a favorite referring to them" and then corporations which put user profiles on remote servers will get mad because all this "revalidation" of Favorites hammers their servers to death. And it means taht users who organize their favorites someplace other than the Favorites menu, like say the desktop, will never have working favorites icons.
sd, I’m having trouble figuring out something here…
Just exactly what W3C standard did Microsoft allegedly break by adding support for looking for a favicon.ico at the root of a site?
It’s certainly not the HTTP spec.
It’s certainly not the HTML spec.
So what is it?
The obvious solution would be to store the icons *in* the shortcut files.
I don’t use bookmarks in any browser, so I know I’ve never added sites to "my favourites" yet IE shows their favicon. I feel like this isn’t the whole story somehow.
I’ve not seen firebird mess up the favicon, but that may be because my cache is sufficiently large to cover it.
You’re right Simon, favicon is not to be found in the HTTP or HTML spec. What is your point again?
A standard defines what is required of an appication to provide all the features and functionality of a protocol, and be compatible w/other applications using that protocol. Extending a standard by adding features is breaking that standard (Embrace and Extend).
I guess I shouldn’t be suprised that someone from Microsoft would argue otherwise. You wouldn’t happen to be the guy who came up with embedding HTML (and scripts) into email, would you?
Why couldn’t you save the icon in the shortcut? Then it would never leak.
Where does it say that a client may not access content not explicitly referenced by HTML? (I can’t even find the place where it explicitly says that a client is permitted to download content referenced by an IMG tag or a LINK tag. Then again I didn’t look very hard.)
And if it indeed says that, then all web search engines are in violation, because they all read the robots.txt file in the root of the server without it having been referenced.
I’m with Simon and Raymond on this one. The behavior is so far outside the scope of the specs that it doesn’t make sense to argue if it’s conformant or not.
Well, robots.txt -is- approved by w3c:
http://www.w3.org/TR/REC-html40/appendix/notes.html#h-B.4.1
I don’t think they’d be so keen if it was stored in .doc instead of .txt tho, wouldntcha say?
So where does it say that clients may not access any content on the server not explicitly referenced by HTML? Does this mean that SOAP is illegal, since you are sending an HTTP request that was not referenced by a web page.
Raymond: Of course it doesn’t say anywhere that clients may not access any content on a server not explicitly referenced by HTML. I’m not arguing that at all (I request non-referenced content all the time).
The distinction is IE -always- requests said content, which just happens to be in a proprietary format. No the standard doesn’t explicitly prohibit this, but neither does the HTML standard strictly prohibit the "<sd>" tag (something I’m working on…).
I don’t see how you can say this is not a clear-cut example of embrace & extend.
Did I ever say it wasn’t?
If the .ICO format is so proprietary, why can so many programs read it perfectly? I’m not just talking windows programs, programs on MacOS and Linux can read .ICO files too.
.ICO may have once been proprietary, I’m not sure. But it seems pretty clear the format is out in the open now.
The disappearing FavIcons behavior is actually more complicated and fragile then just clearing your cache. The problem is http://msdn.microsoft.com/library/en-us/shellcc/platform/shell/programmersguide/shell_int/shell_int_programming/shortcuts/internet_shortcuts.asp Internet Shortcut objects do not necessarily need to have a .url file backing them. Anyone can CoCreate CLSID_InternetShortcut and call ::SetURL() and then start asking for properties. If there is no .url file backing it, the data you request about the url comes from the IE History database. Thus, if you clear IE History, fav icons go away as well.
I have no real opinion about existence, fetching, and (by IE) random losing of formerly used favicons, but do have a big question because of the following comment.
3/4/2004 10:42 AM Raymond Chen:
> I think it comes back if you revisit the
> favorite but I may be mistaken.
Surely anyone who uses IE frequently, and who ever visits sites such as Yahoo or others that have a favicon, would not make that mistake. The user would KNOW.
Mr. Chen, what browser do you use?
I don’t use Favorites. I just type URLs over and over again.
There is a 4th way to get the favicon to show in the address bar. If you start to drag the existing explorer icon away from the address bar as if you were going to drop it onto your desktop, favourites, toolbar, etc. But drop the link back in the address bar, IE will magically load the favicon for you. This seems to persist for a while aswell.
I use FavOrg – a utility from PC Magazine, which manages icons for IE favorites. It basically maintains its own cache of icons and modifies IE shortcuts to point to this cache. You periodically run it to refresh all icons.
http://www.pcmag.com/article2/0,1759,13999,00.asp
It used to be free, but now PC Mag requires subscribtion to download it.
As far as I know the mozilla derived browsers use up to eight connections. Netscape 4 used up to four if I remember correctly.
The rationale behind the "no more than two connections" is that with HTTP 1.1 you are supposed to _pipeline_ your requests, and a server that claims to implement HTTP 1.1 MUST implement pipelining.
The trouble is that tons of web servers out there fail in spectacular ways if you send them pipelined requests, even if they claim to support HTTP 1.1. So given that in the real world HTTP 1.1 pipelining doesn’t _work_, using more than two connections is perfectly reasonable, IMO.
Raymond:
> I don’t use Favorites. I just type URLs over and over again.
I’m with you on that one. Only thing is, why are all my URLs 4 keystrokes long?
I like brion’s idea, why not put the icon in the shortcut file itself?
Put ’em in a different cache folder, and allow them to be cleared out separately. Use an "icons" folder outside of the normal cache.
In the shortcut file sounds interesting, but some people might be offended when their IE shortcuts bloat to 64K.
If you put them in a different cache folder, then you’re back to the original problem: When do you purge this alternate cache? Why write two caches at all? Seems rather wasteful to have two caches.
The question still remains, though — why add a feature if it doesn’t work, and risks upsetting people over standards violations?
Speaking of caches…
How come IE’s cache will regularly fill up when you’re downloading files, making it impossible to download any more files until you clear the cache from the Internet Options control panel?
I know it’s not your dept., Raymond… but any ideas?
Thanks!
I’m just as clueless as you on this one.
OK; I’ll see if I can repro it and bug it in the XPSP2 beta.
And speaking of speaking of caches, how come when it’s full and you right-click on an image from a page to save it, you only get the choice of BMP no matter what the original filetype?
Jeff Davis already discussed this. http://weblogs.asp.net/jeffdav/archive/2003/12/08/53607.aspx
Commenting on this article has been closed.