Firefox - The Platform

Strudelkugel writes "Business 2.0 reports Firefox is becoming a problem for Microsoft. But FF is not just a problem as a browser; its potential as a platform is significant. From the article: 'It all adds up to a business opportunity for startups, established software companies, and Web giants alike. Though Ross and the nonprofit Mozilla Foundation don't stand to make money, Firefox's open platform gives it enormous potential to hatch a new class of applications that live on the desktop but do business on the Web.'"

Comments

no, the cat HASN'T got my tongue.

[flynns]

The potential for development within firefox is fairly impressive...microsoft had better be concerned.

Maybe Firefox is like the third-party candidate of browsers. Sure, it may not ever hold a dominant market share, but it will guide those who DO towards the right issues...

Re:no, the cat HASN'T got my tongue.

[CanadianCrackPot]

Like security, stability, and compliance with actual standards.

Re:no, the cat HASN'T got my tongue.

[LWATCDR]

"and with ActiveX controls"
There is the rub. Active X is a nasty locking that should be avoided at all costs. It locks you in to not just an OS but also an ISA.

Re:no, the cat HASN'T got my tongue.

[Ploum]

Maybe Firefox is like the third-party candidate of browsers.

But who are the two others ?

You must say : Firefox is the other candidate !

Re:no, the cat HASN'T got my tongue.

[kcb93x]

But to compare ActiveX and XPI/Plugins, you have to look at their requirements:

ActiveX:
Microsoft OS (98/ME/2000/XP/2003) 250MB - 3GB
Internet Explorer No additional - included in above

Firefox:
Your choice of OS (so no additional needed - it works with whatever you're running)
Mozilla Firefox itself: 10-20MB (16MB for me, on XP Pro, with some extensions installed)

Plus...one's open source, so if it doesn't have functionality that should be added at the api layer (or any layer for that matter) you can easily do it yourself.

Security aside, XPI/Plugins would beat ActiveX in a logical comparision.

Re:no, the cat HASN'T got my tongue.

[Fnkmaster]

No, they are fundamentally different in intention and use. XPI entensions are installed into your browser to give you extra functionality. In that sense they are much more like browser plugins than ActiveX objects - plugins that have access to browser structures, DOM tree, menus, etc. Since many of these things are by definition browser specific structures, it doesn't really make sense to talk about cross-browser browser extensions.

You will never go to a random company's web page and see an XPI object on the page. And FF won't even let you install or use an XPI object from a random page as a security measure - by default you can only download them from the officially maintained archive. You have to override this if you want to download XPI files from some other source.

You may some day go to a random company's page and see a XUL application as part of their interface in the same way that ActiveX is used sometimes today. But A) XUL is a standard (I don't know if it's de facto or de jure at this point) that others can implement if they choose and B) doesn't suffer from the kinds of broken-by-design security model that ActiveX has, C) will in practice probably never be used as the only way to do something, just a way to enrich existing web UIs, whereas ActiveX is used as a crutch for things like delivering 'secure' video and audio content.

Re:no, the cat HASN'T got my tongue.

[Compact Dick]

But who are the two others ?

Microsoft Internet Explorer and iexplore.exe.

Re:no, the cat HASN'T got my tongue.

[XMyth]

Actually, now you can embed .NET controls in webpages. Would be an alternative to ActiveX.

Speaking of which....would be nice to see a Firefox extension which can embed .NET controls using Mono on *n*x. May be a security risk, but it'd just be an extension and would allow intranet apps built using it to run on *n*x

Re:no, the cat HASN'T got my tongue.

[Apro im]

Netscape uses the same engine as Firefox - any "platform" changes on Firefox quickly find their way into Netscape.

Opera, maybe?

Re:no, the cat HASN'T got my tongue.

[jrockway]

Compliance with standards, yes. The other things, not yet. I'm doing a security audit of KHTML right now (not Firefox), but from what I hear from people looking at Gecko/FireFox is that there are more than enough security/stability problems to be ... problematic. Look at the securityfocus posting from a few weeks ago... firefox crashes on random HTML. All those crashes are potentially exploitable.

To be honest, the more I use Firefox, the more I dislike it. It really isn't that great. It has the potential to be great, but we need to get past all this "add more features" and fix security programs. The browser is the most dangerous program you use (it goes out and ASKS for malicious input); let's fix that.

(As an aside, Konqueror is looking good, but I'm sure I'll get the 10 exploits I need for the class.)

Re:no, the cat HASN'T got my tongue.

[swillden]

so is it the concept or the implementation [of ActiveX] thats flawed?

Yes.

The concept is fundamentally bad (for everyone other than Microsoft): using operating system and hardware-specific code to build web sites is a bad idea, unless your goal is to promote eternal lock-in to that platform. From a security standpoint, the notion of running automatically-delivered-over-the-net native machine code that runs outside of any kind of protective sandbox is sheer insanity, and code signing doesn't really help much, because since *all* ActiveX controls have to be signed to have any chance of being safe, the user has to either get used to zombie-clicking the approvals or else just configure the damned thing to assume that every signed control is safe.

Not to mention (getting back to lock-in and monopoly preservation here) that whoever controls the signing process and keys has a semi-veto power over what can or cannot be done with the platform.

The implementation sucks primarily because it's integrated into such an insecure environment to begin with.

But even if the implementation were perfect, and even if we didn't care about the platform lock-in aspectes, the basic idea is just bad. With Java and Javascript, the downloaded code runs in a protected environment. Malicious code has to first break out of that jail before it can even begin trying to compromise the system. Javascript further provides "data tainting" to reduce privacy risks. Most importantly, because 95% of the useful stuff you'd like to do in a web-based application doesn't require breaking out of the sandbox, signed Java applets that do are rare, so users can be appropriately cautious about them (actually Java applets are rare, and for good reasons, but that's another rant). Javascript + XUL actually has no way to break out of the sandbox, AFAIK (someone please correct me if that's wrong).

Re:no, the cat HASN'T got my tongue.

[Begemot]

But to compare ActiveX and XPI/Plugins, you have to look at their requirements: ...
Firefox:
Your choice of OS (so no additional needed - it works with whatever you're running)
Mozilla Firefox itself: 10-20MB (16MB for me, on XP Pro, with some extensions installed)

This is true under the assumption that you compile your plugins and extensions for each and every OS separately (unless it's a pure XUL). Not every developer has the ability to support all the available platforms (the company where are work - don't). Of course even then it's a huge plus for Firefox 'cause there is no XP ActiveX.

Re:no, the cat HASN'T got my tongue.

[Anonymous Coward]

Three years ago I had a fairly full function IDE for creating XUL applications working in Mozilla (project creation, form designer etc.). It was written in XUL+CSS+Javascript+RDF+XML.. I even demonstrated it at Netscape in Mountain View - Zero interest. At that time Netscape was entirely engaged in finishing the Browser, nothing else mattered.

The problem is that Mozilla was designed as a platform to develop a browser (unsurprisingly), not a platform to develop applications. I believe they were wrong in this decision as they could have finished the project sooner if the platform had been powerful enough to bootstrap itself. Unfortunately the rush to finish the browser lead to a mish-mash of api's which treat HTML, XUL, XML and now probably XHTML documents entirely differently. For example, some api's had a large number of unimplemented functions. Embedding HTML documents in XUL or visa-versa led to bizarre problems. Also the parsers did not have a round-trip mode in which DTD, entities, comments, CDATA etc. were preserved. Writing an XML editor was an exercise in frustration.
Application development in Mozilla/Firefox is possible. However, I believe that the current technologies seem to have been designed for excessive hand crafting - lots of exceptions and hard to comprehend mechanisms for overlaying functionality. Robert Ginda's excellent Javascript debugger was a labor of love and a triumph over adversity. It shouldn't be that hard.

Unless Mozilla.org has had a change of heart, MS has nothing to worry about.

Re:no, the cat HASN'T got my tongue.

[Anonymous Coward]

Holy christ your whole post is just generalizations with nothing solid at all. Like this gem of a comment.
To be honest, the more I use Firefox, the more I dislike it. It really isn't that great.

And instead of actually telling what's wrong with it or maybe a reason for disliking it. You whine about security problems that were discovered less than a week ago?? Christ man give us some time to fix it. I don't see you slamming any code out to fix the problem. It's always easier to be a critic. And anybody who uses xanga is a fuckin idiot by association alone.

Re:no, the cat HASN'T got my tongue.

[coaxial]

I'm no microsoft lover, but I'm not going to tolerate friendly fud either.

ActiveX:
Microsoft OS (98/ME/2000/XP/2003) 250MB - 3GB
Internet Explorer No additional - included in above

Firefox:
Your choice of OS (so no additional needed - it works with whatever you're running)
Mozilla Firefox itself: 10-20MB (16MB for me, on XP Pro, with some extensions installed)

Comparing Firefox's footprint of "10-20mb" to IE's footprint of "250mb-3gb" is absurd. You're comparing a browser to a browser with a complete OS. Without all that other 250mb of stuff, Firefox is worthless. A fairer comparison would be:

Microsoft OS with IE: 250mb-3gb
Microsoft OS with Firefox: 260mb-3gb

Not nearly as compelling now is it? Of course it doesn't matter, because of the group think here is "Microsoft Bad. Open Source Good." Microsoft is no nice guy, but open source stuff isn't some wonderful panacea that automatically makes it superior in everyway to proprietary code.

Plus...one's open source, so if it doesn't have functionality that should be added at the api layer (or any layer for that matter) you can easily do it yourself

I wouldn't say you could "easily" do it yourself. It may be possible, but it's not necessarily easy. Plus if you do change the API, you have to patch the client, then distribute your customized client to everyone. Complicating things you'll have to explain to all the lusers, that just because both are mozilla version x, they aren't really the same.

Re:no, the cat HASN'T got my tongue.

[CaptainZapp]

and code signing doesn't really help much, because since *all* ActiveX controls have to be signed to have any chance of being safe

Even if signing the code would be secure it doesn't help a hell of a lot if the good burgers at Verisign hand out the keys to every pimply faced teenager walking in.

This advisory describes this spectacular goof in detail. I quote:

In mid-March 2001, VeriSign, Inc., advised Microsoft that on January 29 and 30, 2001, it issued two VeriSign Class 3 code-signing digital certificates to an individual who fraudulently claimed to be a Microsoft employee. The common name assigned to both certificates is "Microsoft Corporation". The ability to sign executable content using keys that purport to belong to Microsoft would clearly be advantageous to an attacker who wished to convince users to allow the content to run.

Re:no, the cat HASN'T got my tongue.

[rjshields]

Look at the securityfocus posting from a few weeks ago... firefox crashes on random HTML. All those crashes are potentially exploitable.

That doesn't really pose a real problem for using Mozilla as a development platform. The HTML parsing engine is a tiny part of the platform. Besides, crashes are simple to fix. Please remove your tinfoil hat now.

To be honest

You mean you were lying before?

the more I use Firefox, the more I dislike it. It really isn't that great

That's lovely, thanks for your opinon. Do you have any expanded points or references to back that up, or are we to take your opinion as the gospel truth?
Where is the -1 fuckwit mod option?

Google?

[sh1ftay]

Though Ross and the nonprofit Mozilla Foundation don't stand to make money, Firefox's open platform gives it enormous potential to hatch a new class of applications that live on the desktop but do business on the Web.

Can you say google?

Re:Google?

[Conspiracy_Of_Doves]

Can you say google?

Yes, we can. And so can the article -- In the paragraph immediatly above what you quoted.

Bring it on!

[TheShadowHawk]

Anything to attack Microsoft is good!

Go firefox!

Let's see:
Pro firefox - ding!
Anti MS - ding!

Good slashdot post! :)

Security of Online Apps a Hurdle?

[spin2cool]

Online applications clearly have many benefits, especially with the recent surge in broadband, but adoption and support has been slow in coming. Why is this?

Well, I think many companies are hesitant to move to online platforms, though, because they feel that it's a security risk. Putting sensitive data on a closed intranet seems safer in many ways, especially to those unfamiliar with encrpytion and other modern security measures.

Re:Security of Online Apps a Hurdle?

[kent_eh]

Well, I think many companies are hesitant to move to online platforms, though, because they feel that it's a security risk. Putting sensitive data on a closed intranet seems safer in many ways, especially to those unfamiliar with encrpytion and other modern security measures.

As someone who has a reasonable understanding of "modern security measures", I don't do any online financial stuff.

I do have a reasonable trust in the security of the data in transit. What I don't trust (yet) is the security of the transaction information once it's stored on someone else's server.
I've lost count of how many times there have been news reports of credit card info (among other things) "leaking" off some supposedly secure system. Or of some worm taking out a bank's system, or some other breach of data storage.

Nope, I'll keep moving my money around the old fasioned way for a while longer.

Re:Security of Online Apps a Hurdle?

[aldoman]

Have you ever worked in a real office before?

Most companies now use at least one IE (sadly, almost all are heavily locked into ActiveX atm) based app.

I'd guess that most of new big backoffice apps are being developed for the web now. The benefits are so big.

Firefox is what we should be focusing our attention on. Not Linux. Linux is at this stage a pipe dream on the desktop, at least for now. All Firefox needs to get is killer installs in the office, which I don't see too hard especially with the status of IE patching, and those tricky ActiveX issues can be got round with the use of an icon that opens IE only for that certain site and for the rest of the things, Firefox is the default.

But, I've thought this for a long time that Linux is harping up the wrong tree. Look how quickly FF has got hold - this is the sort of real changes OSS can do. However, I'm not undermining Linux's achievements in the server room. I think that is where it will get hold next.

Anyway, this is what I think we as an OSS 'people' should evangelize:

1) Use of Linux in the server room. Mail servers, web servers. Anywhere that it works.
2) Use of XUL in Firefox/Mozilla. Get Safari to support it.
3) Get BigVendor (tm) cooperation. Show them how XUL is really a lot better than using ActiveX, especially as Microsoft is really not a great partner to work with.
4) Watch as the books, tutorials etc for XUL gathers up. Watch the small developer presence increase.

Basically what we want is XUL/PHP/mySQL (a very strong combination) is to become the new VB. Once we have this, it's going to be a cakewalk to get Linux on the desktop everywhere. Then the hardware support jumps up, and boom, desktop too.

Re:Security of Online Apps a Hurdle?

[stephanruby]

Firefox is what we should be focusing our attention on.

I disagree. We should focus on whatever tool is right for the job. That may end up being Firefox, or that may not. Focussing on the tool first is ass-backward.

Re:Security of Online Apps a Hurdle?

[mrjohnson]

You're absolutely right. My company, before I started, was using several Windows-only applications. One major DNA-based app died off when the software company was bought-out (which I've rewrote for the web, like you mentioned) and others have been moved to web-based services. That wasn't even at our prodding, soap and xmlhttp are getting huge in the Financial Industry.

I've recently started in on a XUL app (though not PHP and MySql -- JSP, LDAP and PostgreSql since we had that architecture). I think if the XUL interface designer gets some more polish and support for IDE functionality, this platform could be huge. Firefox is just getting started, but as it becomes popular this could be the next popular wave of free software usage.

Where I think you're wrong, though, is the amount of ActiveX/DNA apps companies are still locked into. They're shrinking rapidly. We've seen a large number of them get converted into webservices. At least in Banking, the software vendors seem to have realized we mostly all have our own internal apps anyway, and we don't want to admin yet another client install. I'd wager that's the same thing happening in other industries, albeit a bit slower. Banking is often among the first to implement new tech.

The main point is that admins are less likely to buy and implement anything that's not web-based since it means more work for them, so many apps are being rewritten. So far, that hasn't meant increased ActiveX usage, since banks are pretty hard-core about security and like to keep it turned off.

There's only one app that I can think of where there's not much of an alternative: ACT. I hate that program, but the sales people are addicted to it. :-)

Re:Security of Online Apps a Hurdle?

[Erik Hollensbe]

I really think you missed the point.

The tool for the job does not really leave room for an all encompassing smorgasborg of half-assed features.

The tool for the job is sed, or awk, or perl. It's cp, not mv. It's FreeBSD on the server but not on the Desktop. It's Windows for gaming.

Really, is this so hard to understand? Are you really advocating that your multi tool have a soldering iron, ball peen and crow hammers, cross-cut and standard tooth saw, and everything else that might be in your belt?

Frankly, I am concerned with my desktop performing window management and placing things in spots and in ways that make sense. Everything else is just shit and fluff in a nice little glossy package. The OS, being a more complete idea, should be something for a desktop role that makes sense for my needs. It should not be something that's also my first choice for a server, unless it truly merits that.

Really, how many of you would willingly use X11 if it was not free?

Re:Security of Online Apps a Hurdle?

[Azghoul]

I think you're spot on. The less you have to do on the client side, the better, in every possible case.

I'm forced to do an app in Swing currently, and it's absolutly abhorrent. I'll take any sort of web service in an instant.

Re:Security of Online Apps a Hurdle?

[mrjohnson]

Personally, I have never used or considered using ActiveX since it only runs on Windows. What I know is it's a program, usually Visual Basic cab file, running within the browser. There have been several security problems, mainly stemming from the fact that once running, it has programatic access to the whole computer.

Other than the security issues, and that it only runs on Windows and within IE, I understand it's generally a pain to work with and debug. But it does allow you to run programs on the client and use normal Windows widgets in your design. Painfulness is measured differently by me than somebody who programs for Windows. I imagine they would disagree.

Somebody will correct me if I'm wrong on the ActiveX details here, I'm sure. :-)

XUL is meant for addressing the same problem -- bad interfaces on the web, but it takes a drastically different approach. The dialogs are described by lightweight XML files that are pretty painless to develop. The client programming is done in Javascript, which is not as bad as it sounds. The main problem Javascript faces is cross-browser support, which is negated by only using gecko. There's also a decent Javascript console which make it a lot easier to fix script errors in Mozilla than in IE.

The main advantage is everything is still done on the server, only a little user interface junk is left to the client to handle in Javascript, which is arguably where it belongs. You'd do the same in a normal webapp, write html and use Javascript to manipulate objects for a better user experience.

Also, I've seen far too many ActiveX programs that do database access from the client, for example. Typically, there's no security or verification of who's doing what at that level, a difficult thing to get right in any client. Often times you can take the ActiveX object and use it's own objects to access the database and change whatever you like. XUL leaves all of that up to the server which makes it easier to manage and more difficult for bad programmers to leave gaping security holes.

Anyway, there's no 'trusted' environment. All companies should prevent internal users from abusing the system. :-)

Re:Security of Online Apps a Hurdle?

[smitten0000]

Really, how many of you would willingly use X11 if it was not free?

Not fair. If X11 was not free, it would have the possibility of being a better/different product. It is open source, and therefore it discloses all kinds of information to the general public, including video hardware details. If X11 was not-free they could enter into all kinds of NDAs with hardware vendors, and provide both better support for video cards and a more rapid development cycle.

Re:Security of Online Apps a Hurdle?

[dr_d_19]

Basically what we want is XUL/PHP/mySQL (a very strong combination) is to become the new VB

Well, in that case, what we need is an IDE as good as Microsofts Visual Studio. And no, I don't want at emacs/VI war here :) Let's just face, newbie developers (and experienced ones as well) likes vstudio and it's a major reason people are hooked in the windows environment later on.

Re:Security of Online Apps a Hurdle?

[arendjr]

OK, shameless plug ahead...

Currently I'm working on the Aukyla PHP Framework which is hosted at http://aukyla.sf.net/. Besides stuff like Login management and Configuration management, it also contains a Widget model. These widgets give output in Aukyla XML, basically a custom XML schema designed to be easily exportable to XHTML 1.1, XHTML 2.0 and XUL. While the actual XUL support will follow later it will allow you to write webapplications which can seamlessly exported from one codebase to different formats. While I don't really focus on MySQL myself, I know of others who are already using this framework in combination with MySQL, so there you have your XUL/PHP/MySQL combination ;)
I hope to do a beta2/rc1 release (depending on the stability I can get this week) the first of November, this release will show the first progress towards multiple output support.

Good Show, Mozilla!

[LegendOfLink]

It's about time the Mozilla foundation is getting the recognition they deserve. As a Windows user (yes, flame me), Internet Exploder has been nothing but a giant general protection fault.

Just goes to show, when you take out competition, you get stale, passionless software. Thank you Mozilla.

Re:Good Show, Mozilla!

[ScrewMaster]

Actually, we don't call them "general protection faults" any more. That sounds too much like ... a problem with the operating system or something. Really, there's no need to burden the user with awareness of such things. In fact, one of XP's many improvements is in the way malfunctions are presented to the user. No outright lies, you understand, but we've dispensed with technical-sounding terminology and hexadecimal numbers. We simply say, "We're sorry, but your application needs to close." Much friendlier that way, don't you think? Wouldn't want the user calling tech support or anything. Best if they think that spontaneous application "closures" and loss of data is standard operating procedure.

Re:Good Show, Mozilla!

[pommiekiwifruit]

This was Bill Gates response to the Justice Department ruling... from now on, Windows does not perform illegal operations!

let it be just a browser

[xlyz]

as soon a browser reach a bit of popularity, everybody seem to try to have it substitute his OS. why can't it just be a browser???

Re:let it be just a browser

[SimplexO]

The title is a catchy one because Firefox is "new and cool". Really, it's Mozilla as a Platform, and that just really means XUL as a Platform. XAML is Microsoft's attempt at XUL, because it's XUL's a "Good Idea".

Re:let it be just a browser

[FuzzzyLogik]

It is a browser. But the components that were used to BUILD the browser are very cross platform (hence you have firefox on 3 major different platforms, windows, linux, and mac). in doing so the backend of all of this is cross platform and can be used to create other applications besides just a web browser. you only really need to know javascript, xul, and a few other things and you can use the stuff that was used to build firefox and make your own application. it's a novel idea and hopefully it'll be put to good use.

Re:let it be just a browser

[mikael]

as soon a browser reach a bit of popularity, everybody seem to try to have it substitute his OS. why can't it just be a browser???

Because in the corporate environment, system administrators are completely fed up of the constant battle with spyware, adware, trojans, email spam, viruses and popups that users inadvertently download while using web based applications (E-mail, web browsing). Since at least one of these applications is web-based, having a secure browser is manna from heaven. And as the other applications (calendar/diary, group conferencing/whiteboard, voicemail) need network access anyway, there is no reason why these shouldn't be accessed through the same browser. If all of this is possible, then it eliminates the need for all the applications to be stored/run on a PC, thereby eliminating the need to buy licenses for the "professional" release of a certain OS whose vendor maintained a web browser is a basic part of the OS.

Re:let it be just a browser

[DrVxD]

> everybody seem to try to have it substitute his OS

I like FireFox, but it ain't never gonna replace XEmacs as my OS of choice ;)

Re:let it be just a browser

[mcrbids]

as soon a browser reach a bit of popularity, everybody seem to try to have it substitute his OS. why can't it just be a browser???

A browser is one of those things that strictly follows the 80/20 rule - it's 80% of what we need to provide a decent application framework, and decent, centrally managed software.

Many, many MANY developers would LOVE to have the browser be that extra 10-20% that would make the difference between a "web-based widget" and a "widget".

One thing that a web client simply can't do well is populate a form with data based on a selection. Yes, javascript can be made to do it, but javascript is retarded as an application.

Java allows for alot of control, but has its own problems. If a PHP or Perl app could be emebedded into a browser, I'd have to change my pants.

A light, rich-UI interface that's portable across O/S boundaries, is stable, and reasonably secure?

Where do I sign? Alas, Java is a boondoggle, Active-X is riddled with vendor lock-in, and javascript is a horrible hack thought up by some drunk, off-duty engineer on toilet paper one day while reading the graphiti over the urinal at work.

It's lousy, and not advancing. XUL had my interest, until I learned that javascript was the back end for it.

Gimme some smarts, dammit! Why can't a java VM be modularized so that language modules (javascript, PHP, Perl, Python, Ruby, etc) can be ported to the VM and let us use our language(s) of choice?

Re:let it be just a browser

[Mant]

Someone missed the point. The point isn't to build all these things into Firefox that everyone downloads.

The point is Firefox is an environment you can run these things on in XUL. Firefox already does this.

God knows how you managed to get marked as insightful.

Re:let it be just a browser

[rjshields]

javascript is a horrible hack thought up by some drunk, off-duty engineer on toilet paper one day while reading the graphiti over the urinal at work

Nice troll! Seriously, what exactly is your problem with JavaScript? It is a standardised language that is quite powerful enough to handle anything reasonably expected of it. It's easy to learn and quite pleasant to work with.

Perhaps your beef with JavaScript lies with the variety of interpretations of the API, and bastardisation thereof. Don't confuse a language with an impementation of an API. Obviously the developers of XUL think that JavaScript is worthy, and so they should. I'll be sideing with them, rather than your righteous self.

It's lousy, and not advancing

Taken from http://www.mozilla.org/js/js15.html: The next version of JavaScript will be the 2.0 release. 2.0 represents a rewrite of both the language specification and engine implementation... Your opinion that it's lousy is just that - your opinion. Please engage with some more considered argument before spouting your opinions.

Why can't a java VM be modularized so that language modules (javascript, PHP, Perl, Python, Ruby, etc) can be ported to the VM and let us use our language(s) of choice?

Yeap, because with a helthy dose of sarcasm, waiting half an hour for a VM load up which then consumes a tonne of system resources is really in the best interests of the user, not to mention that it's not complete overkill for simple maniplation of data and UI widgets.

What about security?

[Anonymous Coward]

I love Firefox. It's fairly fast (not startup, but in use), it has a decent UI and the extensions are amazing. However, I'm becoming increasingly dismayed by the sheer amount of security holes being found. I mean - shockingly - if you look at sites like Secunia, there have been _MORE_ vulnerabilities in Firefox than IE in the last six months!

That isn't good. Sure, the FF crew may fix them faster, but ATEOTD it's getting hard to advocate FF over IE when effectively it's no more secure at present. I've already suffered this; a couple of people to whom I recommended FF have come back at me pointing out the recently discovered holes.

Being a 0.x release doesn't really count, as the Moz Foundation is pushing this to the masses - even looking for a NYT ad. It'd just be interesting to hear some thoughts on this. I'll be using it for years no doubt, but how do others promote it considering it has had more vulns than IE?

Re:What about security?

[Bad Ad]

maybe because it isnt even released yet?
its been beta forever, and been a PR for like a month tops.

mozilla foundation dont have the man power of MS to internally test their product, so they release it for testing, if it worked ok for you during the test period then you got a bonus.

Re:What about security?

[FuzzzyLogik]

The reason so many holes are found are due to the Bounty that the mozilla foundation puts forth for each security hole found. this means that people are actively looking for security holes to turn them in and get i think $500.

Why are they doing this? Simple really. Find the holes now and lock firefox down pretty good. Better that the holes are found and fixed ASAP than found but not fixed at all... say.. like internet explorer. they're simply trying to make it more secure and this is a pretty good way of doing it.

Look at it this way, if you develop software you look at the same code all the time and once you see it so many times you don't potentially see the security holes that you might otherwise see because you've looked at it so much that you kind of become numb to the fact that something could be wrong there. by having new eyes looking at the code you are having new eyes put on that older code and they're finding the problems, $500 is just an incentive to get people to look at the code.

Re:What about security?

[jsebrech]

However, I'm becoming increasingly dismayed by the sheer amount of security holes being found. I mean - shockingly - if you look at sites like Secunia, there have been _MORE_ vulnerabilities in Firefox than IE in the last six months!

The reason there have been more security vulnerabilities is because of the security bug bounty, which rewards people monetarily for finding security bugs. They're simply trying to shake out the security bugs in advance, before it goes big.

Plus, there's been more interest in firefox recently from security firms who see it as a rising star, and think they can get some fame and draw to their consulting business by finding and
publicly revealing security bugs.

I doubt mozilla/firefox is as insecure as IE. It doesn't have the same structural design problems, like activex, and "zones".

Re:What about security?

[darnok]

Your points are valid, but I can see a potentially huge market for Firefox in intranet applications. Many browser vulnerabilities are simply irrelevant in an intranet context, where users' PCs are already locked down.

Most/all large customers have internal-only applications that have been client-server or n-tier with a custom front end. These apps tend to be brutal to deploy, particularly the front-end, as they are prone to DLL hell and various interdependency issues with other applications (it'd be nice if a customer's IT was mandated to only ever use version X of app Y to develop all apps, but that never is the case). In many cases, customers have resorted to deployment "hacks" such as deploying these front-ends to a small number of servers, then using e.g. Citrix terminal services to expose them to their users.

Enter Firefox and other Mozilla browsers. Now it's practical to build your front-end GUI using XUL and related stuff, and have it talk to the backend over sockets, XML-RPC, SOAP, etc. The only thing that gets deployed to the end user is the Firefox/Mozilla/etc. browser (plus possibly a few addons, typically JavaScript), which is self contained and very easy to deploy.

This is a potentially huge market, which is why MS is keen to grab it with Avalon. Unfortunately for MS, Mozilla is here now and Avalon is over a year away; Mozilla is easy to deploy, and Avalon will presumably be bundled with Longhorn and all the installation/testing issues that go with it.

Finally, I suspect that it will be relatively easy to develop an XUL-based app solution and later retrofit it to Avalon using XSLT and not a huge amount of extra effort - an investment in Mozilla app development now *won't* be lost if a later decision is made to jump to Avalon.

Re:What about security?

[Anonymous Coward]

Here's (part of) what one of Mozilla's own developers has to say about their push to market themselves as more secure than IE: "How can you say its built with more security in mind? There is no proof, and we've had holes in pretty much every component ... The whole activex install angle is pure bullshit ... Note that IE has never ever tried to delete anyone's Windows desktop, for example. A user bitten by that may not think Firefox is secure..."

Re:What about security?

[cmeans]

Plus, Firefox is still in prerelease...kind of silly not to expect bugs (security or otherwise) in incomplete software...

I use Firefox, it gets better on each release.

I expect more bugs will be found, but I also expect they'll be fixed much, much quicker!

Re:What about security?

[DigitalRaptor]

I agree totally.

To say FF is more buggy and less secure than IE because of the number of bugs found is higher is as stupid as it is inaccurate.

I spent 4 HOURS at my inlaws house on Saturday removing OVER 800 different bugs and viruses (750 removed by Ad-Aware, 50+ had to be removed by hand) from their XP machine. I would never have believed it if I didn't see it.

This is an old man and an old woman. ALL they do on that computer is suck in pictures from their camera, read email, and occaisionally surf the web. They never download and install programs.

Firefox is infinitely more secure than IE in real world usage. The vast majority of bugs are only minor issues and do not lead to the entire computer being owned.

Compare that to IE, where the vast majority of bugs ARE doozies and DO lead the machine being compromised. Tying IE so deeply into the OS was the stupidest thing MS could have done. I'd like to send them a bill for my 4 hours, just to see if I get a response.

November 9 lauch day

[solferino]

Blake Ross's minimal website reveals that November 9 is the day we "take back the web" i.e. the launch date for Firefox 1.0.

Shhhh! We awe hunting wabbits...

[coupland]

People need to be vewy, vewy quiet, we awe hunting microsoft...

Firefox as a platform...

[OneDeeTenTee]

Is it possible that we could see a distributed OS where Firefox on one computer acts as an interface to multiple computers which act in concert to "simulate" a much more powerful machine?

No this would not be a beowulf cluster.

The maximum amount of processing power available to any one process would be limited to the fastest machine in the group, but it could be useful for anyone who can give thier computer difficult tasks faster than the computer can complete those tasks.

Every new task would be automatically given to whichever node has the lightest load.

Mozilla?

[cubicledrone]

Wasn't this tried once? XUL + Javascript + CSS + XML + XHTML = the greatest programming platform?

Must everything become an operating system? How about quitting trying to become a brand and just make a simple quality browser?

Re:Mozilla?

[FuzzzyLogik]

a development platform doesn't necessarily mean operating system. look.. the idea is simple, write your code in XUL + javascript using the backend of Mozilla and 99% of that will work on every platform that mozilla/firefox already support. write once, run in all those other places... it's not an OS, it's a development platform. why does everyone think it'll become an OS? Seriously.

Re:MPL is holding up Firefox

[Anonymous Coward]

Most of the Mozilla code base is trilicensed under GPL, LGPL and MPL. So although Firefox can't use GPL code, other GPL projects can use Firefox code.

The MPL license, like the BSD license, means a company can incorporate Firefox into a commercial product, which encourages companies intending to do so to devote resources to Firefox development.

Re:Shhhh! We awe hunting wabbits...

[sburnett]

Shouldn't that be "Mycwosoft"?

catch-up has slowed down in my opinion

[jdkane]

From the article: Along the way, Firefox is fast becoming the browser of choice for anyone fed up with all the nasty things polluting the Web (pop-ups and viruses and spyware, oh my!).

However XP Service Pack 2 has taken a big bite out of many security, spyware, etc types of issues that formerly plagued Microsoft's IE browser. That said, users on other versions of Windows do not benefit from these new features.

Going forward, I would say that Firefox has more of a fight on its hands, now that Microsoft is starting to listen to the browser crowds.

I went strictly Firefox about seven months ago, and for the last few months have not even had the IE icon available on my desktop or in my menus. However since XP SP2, I've started moving back to using IE sometimes, because it blocks pop-ups, ActiveX controls, etc. Of course Firefox still has many extensions available which I (not the average user, but a developer user) have fallen in love with. However from the average Windows XP user's point of view, why would they switch to Firefox when Microsoft just made IE more secure for them and blocked annoying popups for them? It's definitely going to be harder to market those Mozilla features now that they doen't represent the edge over IE (XP SP2) anymore.

Re:catch-up has slowed down in my opinion

[Jay Carlson]

Going forward, I would say that Firefox has more of a fight on its hands, now that Microsoft is starting to listen to the browser crowds.

"Going forward" is corp-rat speak. People who speak English prefer the phrases "in the future" or "from now on". The first of those two has become quite unfashionable; I'm not sure why.

You may begin your speculation here. (Or not; lord knows I've missed the moderation and conversation window already.)

I'll start. The word "future" was tarred by association with a set of know-nothings who oversold their products. Unfortunately, "going forward" has now been tarred by association with a different set of etc etc etc

Re:catch-up has slowed down in my opinion

[killjoe]

"However since XP SP2, I've started moving back to using IE sometimes, because it blocks pop-ups, ActiveX controls, etc."

Huh? You are going back to IE because it blocks popups? Firefox blocks popups too. Why would you stop using a browser you have used for seven months and go back to IE because it blocks popups?

As for activeX controls I don't let anybody run activex controls on my browser. I have then disabled in IE. By the way MS put out an advisory not too long ago telling people to disable activeX controls. You knew about that right?

"However from the average Windows XP user's point of view, why would they switch to Firefox when Microsoft just made IE more secure for them and blocked annoying popups for them?"

Search as you type, tabs, block images from this server, better management of saved information, better management of privacy, download manger, and last but not least faster startup time (with the preload) and rendering.

2004? 1996 calling...

[YetAnotherAnonymousC]

Uh oh. Didn't I hear this ~1996 from Netscape supporters? Not that Business 2.0 at all represents the average Firefox supporter or maintainer. But still, gives me shivers.

Deja Vu...

[D-Cypell]

enormous potential to hatch a new class of applications that live on the desktop but do business on the Web.

This sounds a lot like late 90's, .com era speak to me.

I am using firefox to type up this comment, and yes it is a great browser, but it's not going to change the way the world does business.

Nearly every business application that has been developed for the last 10 years does business on the web.

I hereby petition for a change to this article text so that it reads 'do business in a tab'. Now that's innovation!

Re:Deja Vu...

[Erik Hollensbe]

I'll be happy doing it the old way.... ... doing my business in the bathroom.

sshh

[guet]

Yet here was Andreessen publicly proclaiming in the summer of 1995 that Netscape's plan was to reduce Windows to "a poorly debugged set of device drivers." "They didn't save it up," Myhrvold said. "They fucking pulled up alongside us and said, 'Hey, sorry, that guy's already history.'"

"The tactic drove Redmond into a rage. The day after Andreessen's quote appeared in the press, John Doerr, the prominent venture capitalist and Netscape board member, received a chilling email from Jon Lazarus, one of Gates' key advisers. In its entirety, it read: "Boy waves large red flag in front of herd of charging bulls and is then surprised to wake up gored."

from Wired

Memory leaks.

[Anonymous Coward]

Sure, Firefox is great, I love it, I use it all the time, but before adding any more features could the Firefox team fix up the major memory leaks? PLEASE?

Re:Memory leaks.

[jesser]

If you're interested in helping find memory leaks, look at how David Baron has been finding them:

http://www.mozilla.org/projects/xpcom/MemoryTool s. html
http://www.mozilla.org/performance/leak-brow nbag.h tml
https://bugzilla.mozilla.org/show_bug.cgi?id= 25682 2#c2
https://bugzilla.mozilla.org/show_bug.cgi?id =25721 8#c0

Or e-mail David Baron and say "I'd like to help find memory leaks in Firefox. How can I help?".

If you're not interested in helping, and you're just trying to get people already volunteering to shift their priorities, that's ok too.

They could start with W3C validation

[hsoft]

Before taking back the web, I think Firefox team should start by making their website W3C valid.

I noticed that today: Firefox page and "spread firefox" page are both invalid html code. Is it just be or they are supposed to be the ones caring about standards?

great browser, but...

[geg81]

Firefox is a great browser, and there are a number of useful plug-ins available for it. It's also supported on many platforms.

But I have my doubts whether it's a good applications development platform as it is. Out of the box, you get, what, XUL and JavaScript? I'm sorry, but that doesn't strike me as a good platform for application development. In particular, JavaScript is just far too flaky to develop anything significant or complicated in it, and a lot of libraries just don't exist for JavaScript at all. And, like it or not, even if you put part of the application on the server, things still get complicated if you want a high quality GUI.

Maybe if Firefox shipped with a small, efficient JVM or CLR runtime and JIT that tie into the DOM, XUL, HTML, SVG, and event handlers (but without most of the bloated class libraries that Sun or Microsoft want to force on you), it could become a full platform. It would be even better if it included a small IDE out of the box.

As it is, I think it will remain limited to simple web apps created by rather dedicated Firefox hackers (and thank you for it, it is a great browser).

Re:great browser, but...

[Anonymous Coward]

In particular, JavaScript is just far too flaky to develop anything significant or complicated in it

Flaky? Have you ever actually written anything non-trivial in it? It's actually quite a nice language if you are developing a client application rather than worried about cross-browser issues on the web.

Can you elaborate on your "flaky" accusation?

Re:great browser, but...

[the quick brown fox]

I thought this too, based on plenty of experience writing DHTML in JavaScript 1.1/1.2, but I was recently forced to write a Firefox extension (using JavaScript 1.5) and it was surprisingly painless.

Unless one of your criteria for a nice language for big and complex projects is static type checking (or static anything checking, I guess), you might be surprised how far JavaScript has come along. It actually has a coherent OO model (though it's different than the class/instance model used by most mainstream languages these days), it's got closures, exception handling... many programmers have written complex things in languages that gave them much less.

Re:great browser, but...

[the quick brown fox]

But that potential will remain unrealized unless Firefox gets some kind of additional client-side programming platform. Again, one of the open source JVMs, but without Sun's bloated class libraries, could do the trick. JavaScript by itself really just doesn't.

Just curious if you've actually tried XUL + JavaScript. I've done some Swing work, a ton of C#/Winforms work, and about a month and counting of XUL/JS work, and so far the XUL/JS experience has actually been pretty good. You might be surprised how much you can get done in the XUL without dropping into JS at all; in Winforms and (especially) Swing, the general purpose programming language (C# or Java) is responsible for declaring the UI, which most Swing developers will tell you is just incredibly painful. (Winforms isn't as bad because of RAD tools, otherwise it would be.)

So for many applications, the amount of JavaScript you have to write is pretty small compared to the amount of C#/Java. And anyway, JavaScript isn't a half bad language anymore; C# and Java could learn a couple of tricks from it (closures in particular are invaluable for GUI programming, and neither C# nor Java have them yet).

Re:Worries me..

[damiam]

FireFox is already extremely bloated (on Windows) compared to other Windows applications

Firefox is a 4.5MB download. That may be bloated compared to sol.exe, but it's tiny compared to IE, and not much bigger than Opera (3.5MB).

The developers will make out fine

[Ars-Fartsica]

I can't think of a more bullshit-proof resume bulletpoint than to point to your commit log on a high profile project.

Anyone using Mozilla code as a basis for a product will pay out to people with a commit history.

Re:Worries me..

[spuzzzzzzz]

FireFox is already extremely bloated (on Windows) compared to other Windows applications and the source code is hundreds of meg in size, the reason - it has an entire platform.

I'm not quite sure where you get that "hundreds of megs" thing. As a gentoo user, I have source tarballs available and they're all about 30 meg:

$ ls /usr/portage/distfiles/firefox-* -l
-rw-r--r-- 1 root portage 33945173 Aug 6 00:06 /usr/portage/distfiles/firefox-0.9.3-source.tar.bz 2
-rw-r--r-- 1 root portage 32396291 Sep 14 17:27 /usr/portage/distfiles/firefox-1.0PR-source.tar.bz 2
-rw-r--r-- 1 root portage 32380173 Oct 2 16:07 /usr/portage/distfiles/firefox-1.0PR.1-source.tar. bz2

In addition, the source tarballs contain lots of non-code stuff. The actual executable on my system is less than 80 kB. There are quite a few supporting libraries, of course. Oh, and the binary download is 8.1 megs (for linux/x86).

Firefox is just a browser. That's all it does. The point of this article is that we can use a browser as a platform for other stuff. This doesn't involve bloating the browser; it involves writing applications that run on top of it.

A few really good Apps could make the difference..

[Coryoth]

After seeing this demo of exactly what Firefox and XUL can do in the way of fast, rich applications, I think its only going to take a few significant applications in XUL to get people moving to Firefox just to get it.

Does anyone know if someone is writing a webmail client in XUL? If not, someone really needs to (I've even started looking at trying to do it myself, and I'm no coder). Compared to current webmail interfaces a XUL interface would be almost indistinguishable from a local mail client. All you need to do is have browser detection send users to the old style webmail client if they aren't using a browser that supports XUL.

Now, imagine if GMail started doing that... IE users of GMail get the standard webmail interface, but Firefox users get a full fast XUL interface. Have a look at that demo site again, and do some clicking around ... then tell me that that wouldn't be an absolutely killer app for Firefox.

Jedidiah.

Believe it when I see donations

[sphealey]

I stayed with Netscape through the disaster years, started using Mozilla at 0.7, and do my best to implement Mozilla (and perhaps soon Firefox) in the corporate environments where I work.

But - until I see some significant donations to The Mozilla Foundations, including some substantial in lieu payments from corps that are using Mozilla or Mozilla technology, I will have serious doubts that Mozilla will last in the long run. Serious cash is needed to fund a serious development effort.

sPh

Huh? Who isn't online yet?

[Ars-Fartsica]

Your bank? Check. Your brokerage? Check? Your government? Check. Your doctor? No, but thats because your doctor is still using Win95 and Office 97. Once someone consolidates the IT operations of law offices and medical practices, this will happen too...the cost of handling paper records is killing these industries.

Re:Huh? Who isn't online yet?

[WarwickRyan]

Be thankful. Our Doctors in the UK are still using MS-DOS 6.22 and Word Perfect.

Re:Huh? Who isn't online yet?

[cduffy]

Your bank? Check. Your brokerage? Check? Your government? Check. Your doctor? No, but thats because your doctor is still using Win95 and Office 97. Once someone consolidates the IT operations of law offices and medical practices, this will happen too...the cost of handling paper records is killing these industries.

It's not all that bad. Practice management systems (for patient scheduling and billing) have almost 100% market share already. It's only electronic medical record systems that are next to unheard of -- and there are plenty of folks (such as the startup I work for) working hard to fill that gap.

Cute

[Dark Lord Seth]

Reminds me of a teacher at college. Well, not exactly a teacher, mind you. Teachers teach stuff, this guy just stood in front of the class and told us all to go learn ASP.NET from w3schools.com. If the guy was even at college to start with. But I digress. I recently argued with him as to why the hell we were learning ASP.NET while the course read "advanced programming". The moron gave me the following reasons why ASP.NET was to be the "entlösung" to all problems, including war, famine and dropbears*:

• Web-based I: Everything will go over "the web" with .NET, ranging from word processors to databases.
• Web-based II: Other programming languages like C/C++, Delphi, Java and anything not .NET will die because of this web-based 'paradigm-shift'.
• Python: Python (my suggestion) was a joke programming language by amateurs and hobbyists.

That's pretty much when I stopped listening and just started to stare in sheer amazement. The guy seems to be a bit right after all though, considering the possibilities that are now available for XUL regarding web-based applications. But hey, let's be fair; .NET isn't all that bad but riding the .NET car with ASP.NET is like driving a Ferrari with wooden wheels. C# would have been nice enough, instead. But this whole "everything will be web-based" idea was utterly shit and I KNEW there was a better solution than ASP.NET to web-based solutions. Then I saw a site with XUL elements plastered all over it and I was impressed. No more silly tricks with HTML forms and parsing it all through CGI scripts. It seemed like a clean enough solution for lots of things. Think of a small company; Items need to be tracked, clients need to be contacted and managed, rosters needs to be kept up to date and plenty more. Now all that can be done by HTTP with a standard webserver and a Mozilla platform.

The compant where I worked as intern could have used that. Instead they adopted a win2k3 server with office 2k-something premium, using it as a terminal server to log in to single Access database using remote desktop, which would function as a POS system with the aid of heavy VBA scripting. Not exactly an elegant solution, though it sure is a creative way to make an Access database centralized. Now imagine the same trick with a cheapo webserver running Apache 1.3.something, serving XUL documents that read/write data from an MySQL database... ( It WAS a rather small shop, after all... )

Re:Cute

[YE]

The moron gave me the following reasons why ASP.NET was to be the "entlösung" to all problems...

The Entlösung? As in "solution involving ducks"? Or "the Duck solution"? Is there a Monty Python + Holy Grail reference I'm missing here?

Mozilla?-Luddites on parade.

[Anonymous Coward]

" Wasn't this tried once? XUL + Javascript + CSS + XML + XHTML = the greatest programming platform?"

What do you mean "tried once"? It's still there, and has been used. Just because every new use doesn't come with a press release, doesn't mean people aren't using it.

As far as why? Rich-clients are the future, even if all the luddites rally against them.

"Must everything become an operating system? How about quitting trying to become a brand and just make a simple quality browser?"

Must every bit of FOSS have a scripting capability? I'm browsing with Mozilla now. I'd say it reached "quality" when the majority of the "were's my browser?" posts dropped severely about two years ago. And YES brand is important. Quick! What is LINUX? Quick! What is Apache? Much better than "a browser" or "an operating system".

Mozilla Amazon Browser

[CanadaDave]

"Amazon (AMZN) could build a search application into the browser that lets users buy books without visiting its website."

That already exists! Ok, it doesn't let people buy book yet, but you can search. I wonder if the author of the article knew that. Check it out here and here. I've actually tried it out and it works really well.

Get the firefox extension here.

Re:Mozilla Amazon Browser

[emjoi_gently]

Why is it a big deal to buy books from amazon without visiting thier website anyway? What's so terrible about their web site? Or are we talking Power-Buyers here who just don't have time to look at a web page? Just buy the book NOW! As for writing applications that are crossplatform compatible and accessable over the net? Ummm... me and thousands of others have been writing JSPs and PHP and Cold Fusion and so on for years. In many cases serverside apps, rather than applets or plugins, are the way to go to avoid OS, Java or Browser compatibility issues.

BZZT, you are already digital

[Ars-Fartsica]

If you really were an "expert" like you claim to be, you would know that financial services have been computerized for years. Do you use ATMs? LEt me guess, you'll lie in a response and say no just to stick to your party line, but it doesn't matter, going and dealing with the teller just means you strip off one layer of the digitization. It still happens upstream whether you like it or not.

Now let me guess you will tell me you keep it all under your mattress and don't deal with banks at all.

Re:BZZT, you are already digital

[kent_eh]

*sigh* 1) I never called myself an expert 2) Obviously financial services are computerized.
What I intended, and apparently should have explicitly said, was that I don't (yet) trust the security of systems that are directly connected to the public internet. At least I don't trust them enough to bet my own money.

Re:BZZT, you are already digital

[Technician]

It still happens upstream whether you like it or not.

Walking cross the street involves risk. I try to not spend all day playing in the street.

The same for my finances. I do use banking services now and then, but most of the time it's cash and carry. The fewer debit registers I use, the fewer of them that have my information. If one is compromised (Open Wireless registers at Home Depot for example) the fewer chances my data will be compromised.

It's about reducing risk, not elimination of risk for the truly paranoid.

In most places you can't rent a car or hotel room without a credit card. For most everyting else, cash works.

Re:Worries me..

[shadowmatter]

FireFox is already extremely bloated (on Windows) compared to other Windows applications and the source code is hundreds of meg in size, the reason - it has an entire platform.

Maybe the Mozilla suite, but not Firefox. In my downloads folder at work:

FirefoxSetup-0.8.exe: 6348KB
FirefoxSetup-0.9.exe: 4845KB
Firefox Setup 1.0PR.exe: 4630KB

These are the setup executables for Windows. And if memory serves me correctly, the Thunderbird client has been getting smaller with each new version even more dramatically...

- sm

apt metaphor

[geg81]

What an apt metaphor: an intelligent, young, adventurous member of the species "homo sapiens" (Netscape) gets gored by a bunch of dumb, overweight beasts with sharp horns (Microsoft).

A lot more applications should have moved to the web over the last decade. Microsoft prevented that because they were not ready for it yet, even though the industry was. Instead, we got nearly another decade of poorly written VB, Office, and Access applications.

Re:apt metaphor

[dedazo]

an intelligent, young, adventurous member of the species

I suggest you go back and review your history. The people who founded Netscape were as much hardasses as Gates and everyone else at Microsoft. These are the people who claimed they had "invented" the Internet (even before Gore) and took all the glory away from Berners-Lee and his team. It's just that they were not as good at the game as Microsoft were. They released a buggy unstable 3-4.x product that couldn't possibly compete with IE4 and then when they got reamed (Navigator was free, just like IE, remember?) they went to court to claim that Netscape engineers were not "weenies".

poorly written VB, Office, and Access applications

Yes, because I'm sure that the same people who wrote those applications would have done wonders with C, Python and Perl. After all, we all know it's the language, not the developer.

The usual ...

[orangeguru]

Netscape was supposed to be a new platform ...
Java was supposed to be a new platform ...
Even Flash was supposed to be a new platform ...
Now Firefox is supposed to be a new platform ...

Did they kill MS? Nope.

XUL is cool, but so far I haven't seen MANY great applications done with it.

Re:The usual ...

[Anonymous Coward]

: XUL is cool, but so far I haven't seen MANY
: great applications done with it.

Apparently there are still quite a few restrictions on web applications that use XUL. That's a good thing (security wise), but hopefully beyond Mozilla/XUL2.0 the moz developers will implement something that will ease development as well, without re-inventing ActiveX hell. It _is_ possible to write working web applications if you invest a lot of time and can live with a somewhat disjointed documentation. xulplanet.com is a good start. The Amazon Browser is pretty impressive (but not that useful in real life, I admit that). Don't miss The games at mozdev, they're tiny XUL applications running over HTTP as well. And Nextls XUL is a somewhat weird frontend for a client/server mp3/ogg jukebox, also in XUL over HTTP. So what other XUL webapps are out there, anyone?

Why is this news? Anyone remeber....

[MetalliQaZ]

Mozilla (seamonkey)? Its been around a lot longer than firefox, and it is just as much of a platform as firefox can be. I guess people just like the cool name...

The download has DECREASED in size

[Ars-Fartsica]

And sharing the gecko engine will mean more and more software will be able to ship smaller binaries once gecko already resides on your system.

What can the platform do?

[johannesg]

People are talking about Mozilla/Firefox as a platform, but I don't entirely understand what to expect from it. Does it give me the ability to have processing in a webpage on the desktop? The ability to open windows with controls that look like "normal" (read: non-HTML) Windows-windows? The ability to create my own controls and use those on any desktop?

Re:What can the platform do?

[Coryoth]

Does it give me the ability to have processing in a webpage on the desktop? The ability to open windows with controls that look like "normal" (read: non-HTML) Windows-windows? The ability to create my own controls and use those on any desktop?

Um, pretty much, yeah. Open this in Firefox or Mozilla, or better yet, go here and click on the "launch in its own window" link.

Jedidiah.

Re:What can the platform do?

[marcosdumay]

Actualy, the firefox interface itself is written in XUL, just like any other application you can run on it. That means, you can display almost anything in a "normal" window. The only interface limitation (I think) is the absence of a "canvas" object, but this is very litte restritive, due tho the large amount of available objects to use.
Processing stuf on the machine, however, is a bit more complicated. Fireforx, nowadays, accept any kind of javascript that doesn't access the local discs (for security reasons). Anything different must be installed locally with a XPI script. Javascript is not very powerfull, and installing a XPI script from the web needs a big amount of trust, but, with this, you can run any program you want.

Re:A few really good Apps could make the differenc

[CosmicDreams]

Does anyone know if someone is writing a webmail client in XUL?

Yes, http://xulwebmail.mozdev.org/

IE7

[LordMyren]

Why hasnt IE been updated in so long?

Because IE7 was the biggest threat to microsoft. They nearly built open standards which would have let their users to everything as webapps. The only problem is they didnt have any lock-in.

Thats why IE7 team was stomped into the ground and we havent seen or heard a major release since Win2000.

Someone dig up some of those random facts i once had on this subject please? IE7 was a strong active dev team doing neat stuff. Then they were axed.

Re:IE7

[rmpotter]

I've wondered about this also. Check out Dean Edward's stuff. He's created a nice Javascript library that "modifies" IE behaviour so that most of its CSS rendering bugs and incompatibilities disappear. Very cool work. Why can't Microsoft do it?

Re:IE7

[bergeron76]

Microsoft decided not to release a stand-alone IE application so they could circumvent the US Department of Justice ruling against them. They were found to be in violation of anti-trust laws because they were using their monopoly power to promote their product (IE) beyond their competitor (Netscape). Their best arguement in this situation was to eliminate the competing product, and [actually] integrate that code into the Operating System itself (the forthcoming Longwhorne).

By doing so, they get the added benefit[sic] of pre-empting future DOJ inquiries because it's a "different" product entirely.

Re:Worries me..

[jsebrech]

Problem with this 'We can do more' attitude is that you could end up with serious bloat for simple software.. like your web-browser being a 20mb download and supporting everything under the sun.

Firefox is not a 20 meg download, it is a 6 meg download, which is lean enough for my tastes. And for all intents and purposes, it already is the platform they want it to be, with the browser merely yet another app running on top of the platform, written in javascript, xul and css. So it is not going to bloat. In fact, it has been steadily shrinking/speeding up, and will continue to do so.

On a wider level though, the paradigm shift is inevitable. Historically the market has always demanded richer web apps in waves, and the browser maker which responded best won out marketsharewise. Now we see again the market complaining browsers are too dumb, asking for the ability to deliver desktop-quality apps to the browser. To not become a broader platform at this point is suicide marketsharewise. Even microsoft, who has tried desperately to avoid having the browser become a generic app design platform because it would make the OS less relevant, recognizes this and is launching their XAML initiative partly to focus attention away from the platforms that already exist, and partly to have something in the fray they can push at those wanting richer web apps.

FF front end on Mozilla platform

[shubert1966]

It's a great browser. We can get into the security, but alot of what makes a killer app killer is the GUI. I don't know the legal specs, but I'm blown away no one else got famous using "tabbed browsing". Til now it's been the webdevelopers who've brought that to the average consumer through frames(sic) - who owns the rights to the concept? I sure hope M$ doesn't. The recent cross-tab vulnerability notwithstanding.

Anyway, Firefox is more user-friendly than MSIE, without becoming a lecturing tedious drone(clippy). It's installation size (1.7.3) is roughly 9MB, compared to my MSIE at 14MB. It blocks most popups and allows me to configure/repeal this and other user-level-tweaks with intuitive ease.

The open source aspect DOES have a positive impact on it's development as well. As another poster accurately stated - the more eyes on the code, the more better. Microsoft can't compete in that way. I think they should continue extending the platform - do they do firewalls as and end-product? (ok, I'll go find out later)

We're discussing a free product that most of us feel is superior to the market leader. That itself is reason to celebrate. Way to go F^2!

Re:A few really good Apps could make the differenc

[neil.pearce]

That does look quite interesting, would people care to share links to informative XUL documentation?

Re:A few really good Apps could make the differenc

[Fnkmaster]

XUL is cool. Javascript is nicht so cool. I can't really imagine having to build or debug a complicated GUI application with Javascript as your primarily language for doing everything.

I realize that part of the problem with Javascript has been different browsers with slightly different interpretations of DHTML and DOM stuff, and that has given Javascript a worse rap than it deserves.

But that rap isn't completely undeserved. And trying to convince programmers that they should be building the key functional blocks of their applications in Javascript just isn't going to fly any time soon. At least call it something else. Like "XULscript", fix the marketing problem that Javascript has.

One thiing that needs pointing out....

[ltwally]

One thing that needs pointing out: Firefox (and other mozilla based products, as well) does, in fact, have "zones." The only difference is that there is only one zone by default: the insecure/internet zone.

But the mere fact that Firefox has "zones" is a pretty solid indicator that at some future point in time, the Mozilla team intends to make use of "zones" in the base products.

If you wish to enable the zones, all you need is this plugin. The plugin does not provide this zones itself, all it does is provide an interface for the builtin zone capabilities that Firefox and Mozilla have.

Re:A few really good Apps could make the differenc

[Coryoth]

Yes, that's a great demo and it shows that there is a lot of functionality in Firefox. But look at what it took to write that code: a dozen JavaScript files and a lot of XML. JavaScript and XML just aren't very nice to use for engineering large, complex interactive software systems.

Sure. I don't think web applications are ever going to take over as many people claim. I don't expect to see web based word processors of any note, nor web versions of any terribly complicated program - but XUL for webmail, for apps like the demo, for online tax calculation apps, for simple bespoke database frontend apps at companies etc. there is plenty of room (and value) in a fully cross platform web application. The utility of having the whole thing be cross platform and remote can be sufficient to justify any extra coding complexity if we're talking about relatively simple applications here.

Jedidiah.

this was thought of long ago

[Robocoastie]

>>Firefox's open platform gives it enormous potential to hatch a new class of applications that live on the desktop but do business on the Web.'" old news. This is the same thing that was said back when Netscape made the first "Communicator" suite and it didn't come to pass.

XUL as an Application Platform

[SendBot]

This is shamelessly ripped from http://xulplanet.com/tutorials/whyxul.html
I think it presents a concise overview of firefox as a development platform.

XUL and Gecko make an excellent choice for building sophisticated Web applications. It provides a rich user interface toolkit, an HTML and CSS renderer with excellent standards-compliance and support for web services, all completely cross platform.

Work is ongoing with the Gecko Runtime Environment (GRE), which aims to make Gecko a snap to drop into a standalone application, complete with your own executable, if you desire. The idea is to allow the right version of the GRE to be installed automatically with the application if necessary. If the GRE is already installed, there is no need to install it again, or even download it. For those that are interested, the GRE is about 5 to 10 MB, depending on your platform, which is quite small compared to other application platforms. It's also possible to have Gecko run directly from a network drive or CD.

Since XUL may be used on Web sites, it can be used with server-side architectures such as PHP and JSP to build dynamic content. This allows Gecko to be both a two-tier or a three-tier application model depending on your needs. There are projects in development now which aim to integrate Java, Python and other languages into Gecko directly.

Re:Not firefox. Try google

[toddestan]

A web browser is not an operating system. I repeat a web browser is not an operating styem!

It is if you ask Microsoft!

Re:bloat is a non problem

[eyepeepackets]

"becasue of bloat !!! Yes !!!"

Because of bloat my Pentium II 366 Celeron laptop running a tweaked Slackware 8.0 (!) install seems to run faster that the Pentium IV Dell with Windows XP I have to use at work. The perceived speed (what the user sees as speed) difference between the two is nil. That is the downside of excessive bloat.

Axiomatic: Bloat attracts bloat! My bet is that after 30 days of running MS XP on the net your son's new emachine will have the perceived speed of a Commodore 64.

Have fun and be happy!

Re:bloat is a non problem

[damiam]

there is a small problem: ff does not work as well as IE ... All it takes is ONE failed bank transaction

Firefox works far better than IE in most cases. If banks want to ignore standards and test only under IE, that's not Firefox's problem.

Uh oh, "Platform" again

[Animats]

We've done this already. Three times. Once with Netscape. Once with IE. And once with Mozilla.

Browsers, as a "platform", suck.

You really don't want browsers downloading and executing code. It's just too insecure. That way lies the hell of Active-X. The great thing about HTML is that it's basically descriptive, not executable. Downloading code in some interpretive language is only slightly less insecure, and much slower. (Or, when there's a page with a dumb ad on screen, CPU usage goes to 100%)

Asking the user for permission to run code doesn't work. Not only will users answer "yes" for hostile code, they'll implicitly agree to EULAs your business's lawyers would never agree to.

Most free "plugins" are in some sense hostile code. They phone home. They look around the host machine. They burn CPU time when not doing anything for the user. Even the "good ones", like Google's toolbar, overreach. Others are much worse.

What we really need are good extensions to HTML for forms. Better validation and help are all things that can be done descriptively, rather than by running executable code on the user's machine. HTML forms are lame; they can't even set up a field that must, say, have five numeric digits and must be filled in. You could do that on IBM green-screen terminals thirty years ago.

Re:Uh oh, "Platform" again

[omicronish]

You really don't want browsers downloading and executing code. It's just too insecure. That way lies the hell of Active-X. The great thing about HTML is that it's basically descriptive, not executable. Downloading code in some interpretive language is only slightly less insecure, and much slower. (Or, when there's a page with a dumb ad on screen, CPU usage goes to 100%)

One alternative is to go with VMs and enforce security that way. For example, it's possible to run a .NET application with restricted permissions that say it can't read/write files and the registry, but it can only display UI. I'm sure something similar is possible with Java. You might wonder how security like this could possibly work, but you simply prevent applications from using System.IO.*, for example, and since .NET code is verified so that buffer overflows and "unsafe" code is impossible, it becomes highly unlikely that .NET code will be able to break out of the security boundaries it runs in.

Sure, you might get security holes that might allow a program to call System.IO.* stuff after all, but that can be patched, unlike ActiveX, which as a whole is simply a flawed concept.

I'm guessing in the future we'll be executing code from the web once more on our machines, but this time within the confines of a VM. Now that I think about it, why hasn't Java taken off more on web pages? The general slowness of applets loading is what bothered me before; is UI and applet performance still annoying? Or maybe it needs a XAML/XUL-like language?

Re:Not firefox. Try google

[Billly Gates]

So is Microsoft right?

If you dont like google dont use it. Or better yet write your own alternative in teh spirit of free software.

Google makes their money from ads and from businesses. So far its free as in beer and the api's are not proprietary with restrictions the last time I looked.

Re:Worries me..

[Talez]

Yeah. The tarball is 30 megs.

Expand it.

SlashHack

[graveyhead]

(see my sig)

SlashHack is a cool example of an app written on top of the Mozilla platform.

The article is correct Firefox (really Moz as others pointed out) is a fantastic development platform.

The technology is especially cool for me: I wrote a system in 2000 for a client that positions Java Swing widgets using XML, in order that the app could support pluggable skins. I view XUL as the ultimate application of that architecture. A fantastic decoupling of logic and presentation.

Re:A few really good Apps could make the differenc

[IGnatius T Foobar]

That's a great demo. But the first thing I thought when I saw it was, "Damn, when Microsoft inevitably steals this and puts out their own version in the form of XAML, we in the non-Microsoft world are going to have a really hard time keeping our platform software relevant and viable."

We've got to get this stuff out there and widely used before Microsoft does. The very future of computing is probably at stake.

Same Threat - Different Date

[Nom du Keyboard]

But FF is not just a problem as a browser; its potential as a platform is significant.

This was the Netscape threat of 5 years ago. That Java enabled apps running under Netscape would destroy Microsoft/Windows because any platform that that could support Netscape would run everything else as well.

Didn't happen then. Don't hold your breath yet now.

works for us

[Gunark]

I work for a company that develops intranet-type applications for big mega corporations here in Canada. We've been developing and deploying apps written in XUL/JavaScript + PHP or Python for almost a year now... so far so good. Surprisingly (or maybe not surprisingly) no one has complained about the forced switch to Firefox. In fact we tend to get thank you emails gushing with compliments about Firefox :)

XUL is here, and it works. Having all of the advantages of web-based deployment, while being able to use proper user interface elements is a godsend.

Re:works for us

[Glabrezu]

well, not exactly our experience here. We have been trying to develop a system using XUL and JavaScript but we ran in multiple problems, that required almost always some kind of work around.

Don't get me wrong, I do think there's a LOT of potential in XUL. Specially, XBL has been wonderful to develop some data binded components that saved us a lot of time in the long run, and they were quite easy to develop.

However, theres a lack of maturity in some of it features that make them look as it they were an after thought, or just not really well designed. Templates have a lot of limitations, remote XUL just doesnt work right (or at least the docs that explain how to sign components are just too outdated), many errors result in segfaults (agree, the problem was in how we were using some components, but you shouldn't segfault in any case!!), theres no clear separation between components and services (I really don't understand why they don't share a common interface!), XBL lacks of obvious things (like a script tag, please). And honestly, javascript sucks to structure your code... we had to implement an include () directive to import other .js, there should be a way to do that in the language. And, there should be support for other datasources besides RDF.

And the worst part is that there are not many apps developed in XUL, so documentation (specially about XPCOM components) is really scarce. The reference is OK (most of the time), but you dont have a single example for most of the XPCOM components. A search in google usually returns C/IDL headers from the mozilla implementation or the reference at xulplanet ;).

I really hope XUL development speeds up. Its really a good platform, and the separation between presentation/data/logic really shows up. But as it is, its darn difficult, and slow, to develop for it (at least till you know most of the work arounds).

By the way, has anyone developed both in Luxor and mozilla XUL and have some insights in their pros and cons? (besides what the luxor page says, which of course I wont believe until I try it :P).

Loads faster then IE?

[sstidman]

Firefox, a free open-source browser that loads twice as fast as Internet Explorer

I keep reading comments like this from time to time. I like FireFox and I find that it is pretty fast once it is loaded, but on every box I have tried it typically takes 8 to 10 seconds to load the first time I use it. IE always loads in under 2 seconds, usually less than 1 second. Is there some trick I am unaware of? Does anyone know why folks keep claiming that it loads faster than IE?

Re:Loads faster then IE?

[sstidman]

Wrong on both counts. I am neither new to Slashdot or computers. I guess you are a troll, but I'll adress your ignorant assumptions anyway.

Did you read my post? Did you read the article? I know that IE is faster and I fully understand why. And it makes sense that FF would be slower since it has to load everything the first time. But I have read many times by various Firefox advocates (including this article ... did you read the article?) that despite these facts Firefox still loads faster than IE. It doesn't make sense to me and it does not jive with what I have observed which is why I asked the question. Contrary to what you seem to think, I did not ask why Firefox is slower to load. I asked why Firefox advocates think that it is faster to load than IE.

Re:Loads faster then IE?

[cranos]

They may actually be refering to page load times not start up.

Re:Loads faster then IE?

[MikeBabcock]

It loads pages faster than IE. IE doesn't load faster than Firefox incidentally -- it loads when your system boots and never unloads from memory to my knowledge.

You wouldn't know how long IE takes to load because it doesn't unload.

Not unti l XUL is beyond just mozilla

[Ambassador Kosh]

Overall I can't see how doing stuff with XUL is a good idea until other systems support XUL also. The point of web based apps isa freedom to change at any time. If you write to XUL you have locked yourself in to one rendering engine essentially. If xul worked with khtml and opera then I would not have this problem.

I want to have the freedom that web based apps give me and my customers not remove that freedom. Tieing myself to one browser engine does remove that freedom. Right now if I do regular html, css etcthe stuff works pretty much everywhere under almost any kind of device. With XUL I would lose that freedom and it is important.

True 'nuff

[stealth.c]

The features it has now are just FINE. Stop adding them. We could probably even do with fewer. I am curious though. What makes you say it "isn't that great?" It's far and away better than IE (imho), and it doesn't feel as clunky as the Mozilla Suite. It does everything I want it to and for me it's been a pleasure to use. In fact I use it exclusively. What flaw am I overlooking? Is it something that only anal-retentive coders notice?

But of course--security problems or not--almost anything is better than IE, eh? eh? ;)

Re:True 'nuff

[ahdeoz]

All I know is that Mozilla works fine and Firefox is slow as hell and has a tendency to turn into unresponsive sludge on my PIII 500. It behaves suspiciously like it has some serious memory leaks and a near fatal flaw about emerging from swap. And Firefox is ugly compared to Mozilla. And a lot of plugins are iffy on Firefox (like flash and java) and when it comes down to it, Firefox just doesn't have the features needed to be a full use browser, and to top it off, it's default behavior sucks in a lot of ways.

LOTR. Be ent-ertained.

[tepples]

The Entlösung? As in "solution involving ducks"? Or "the Duck solution"?

No, it's a solution involving walking, talking trees :-)

AcitveX XUL?

[CaptainPinko]

just thinking but wouldn't it really help to get the ball rolling if someone developed an ActiveX plug-in to support XUL in IE? That way even IE only shops can write XUL where there might have written it in AcitveX instead. This could prevent the construction of another barrier to switch over to Mozilla/Firefox at a latter date. This would be a great way for OSS to get a foot in the door at some major organisation.

Work on security issues

[jeti]

It has the potential to be great, but we need to get past all this "add more features" and fix security programs.

Maybe Firefox is not yet as secure as it should be. But people are intensely at work tightening things up.
According to The Burning Edge no less then 10 security related bugs have been fixed in the last week.
The developers are obviously using the random HTML script, and the security bug hunting program seems to pay off.

I'm under the impression that Firefox developers are working very hard to provide a secure version 1.0 of Firefox.

Has Microsoft ever faced this kind of competition?

[jbn-o]

Hey...it's not like MS has never utterly crushed a rival browser before, huh?

A free software and open source web browser with an audience (increasing numbers of people getting the browser, the press talking about it, and lots of third-party add-ons)? I don't think Microsoft has ever faced that kind of web browser before.

Not until...

[seguso]

IMHO, as long as Microsoft is allowed to offer Internet Explorer as a default, Firefox will never reach a sufficient market share to have vendors use it as a platform.

The law has to realize that a (monopolist) operating system must not be allowed to bundle a file browser, a web browser, a multimedia player, a firewall, an instant messenger, and any other kind of software which someone else may want to sell. Otherwise that dominant position of that monopolist will be self-reinforcing.

We are spectators to the same phenomenon that happened on the earth, where a completely unregulated natural selection took place: humans have come to such a dominant position that other animals simply cannot compete with them anymore and have no way to invert the dominance. They are only free to adapt to niches that are of no interest to humans. (like MacOSX and Linux are doing)

There is a degree X of dominance that, when crossed by a species S, allows S to stay dominant, if no regulation happens. This has happened on the planet earth but must not happen in the market.

So we can only prevent monopolists to include products by default. Of course some users like to buy a product that does all those things out of the box, but 1. that desire is not necessarily to be fulfilled, because there may be more pressing matters, 2. the installation of products could be made embarassingly easy if you really want to. One click.

Modularity is the key.

Some maybe Most are getting confused...

[vivehosting]

Alot of people are confused about the facts and the potential of Firefox, even the ones that use it. First, let me just say to those who claim IE is faster... IE loads up faster initially, but Firefox renders faster. Unless you are the type to go to a website, close the window, open ie, go to a website, and so on. Firefox is going to be a much faster solution.

I've been noticing more here than anywhere else that some are confusing Firefox with the Mozilla Suite(Someone even mentioned being a user of FireFox 1.7.3). Firefox is not bloated and will never be bloated. Extensions are optional and if you are like me, you would only be installing about 5 small features to the default installation. The option is there to bloat to your wishes though ;).

Now the potential as a platform isn't really going to be Firefox. It's starting with firefox, and will become popular because of firefox, but the platform is under development as the XUL Runtime Environment (XRE). This is where the magic starts.

One will be able to develop executable applications seperate from Firefox that automatically run on Windows/Linux/Mac. Right now, noone wants to tie their developments to a browser although a few like to tinker with it on their own. When the XRE is released, people will then actively develop XUL/Javascript applications with an optional backend of their choice. You will be able to create .exe applications. You can make those one-click installations someone mentioned somewhere here. No need for the browser although the browser can be used if you want to. Bad news is the XRE isn't being actively developed as Firefox is. So, who knows when they'll release it. But when they do, Firefox, Thunderbird, etc will be complete XUL/Javascript Applications that run using the XRE and GRE. I don't know much about GRE, but that's most likely going to stay browser-specific, although I'm probably wrong.

I'm one of the people who has starting learning XUL and such, and although I have big plans for it. I do not plan on coding for a browser ;) XRE all the way!

a quick trip down OS theory lane

[Moraelin]

A native program running in a well designed OS is just as secure as Java.

That's why, for example, we used to let 20+ students at terminals at a mainframe or mini, in universities for example. They could run whatever programs they wanted on that machine, including their own code and including stuff they found on a hacker BBS. And in fact in all CS universities they're _supposed_ to program on those machines. Yet none of them came anywhere _near_ owning the machine.

The concept that a program once running on a machine automatically can retrieve or overwrite _all_ data, format the drive, or generally even blow an alien mothership up, is (A) Hollywood idiocy, and (B) never true except for the simplest single-user OS's like Win'95.

Or to put it otherwise: what do you tell Unix users? "Don't run as root except to install programs or other admin tasks. Especially don't go online as roo." Then they ask: why? "Because if someone takes control of the program via an exploit, they can't do as much harm if it doesn't run as root."

For all practical purposes, a modern OS is (or could be) just as virtualized as any Java sandbox. Programs no longer run directly on the bare metal, like in the days of DOS. (Which was barely a program loader.) They have to go through the OS to do _anything_. Including, but not limited to, reading or writing files, opening TCP/IP sockets, installing stuff.

Heck, even directly accessing RAM from other apps or directly poking machine ports can be blocked when running on a 386 or above (and _is_ blocked when you don't have kernel access).

Basically when running an app on a 32 bit CPU it can be as sandboxed as you want it to be.

E.g. don't want them accessing files? That's trivial. Just run them as a different user that can only access its temporary directory.

So ActiveX _could_ work, and it _could_ be extremely secure. Maybe not on Windows, and maybe not implemented by MS. I'll concede that point. But at least theoretically it can be at least as safe as Java, and without needing users to download 100 MB plugins that get wantonly changed by Sun.

Re:a quick trip down OS theory lane

[Ba3r]

There are legions of security holes that can be present in any system, unix, windows,whatever. To think that just because something is a Sun its safe is ludicrous. For example, at the RIT cs department a couple years back when i was a student, they had a series of break ins, to the point where for one hour, the password file had been deleted and everyone could have logged in as root. And we were running Solaris!

Computer security only starts with a well designed OS. Every OS is vulnerable, at the very minimum, to a co-opted high level user.

Re:Has Microsoft ever faced this kind of competiti

[Gigantic1]

A free software and open source web browser with an audience (increasing numbers of people getting the browser, the press talking about it, and lots of third-party add-ons)? I don't think Microsoft has ever faced that kind of web browser before.

No, MS has never faced such a dynamic browser before, and by dynamic, I mean "...responds to user's wants". Compared to IE, Firefox does very a good job at closing up security holes in a timely manner and providing a platform where a user can select a rich variety of add-ons (like "Bug-me-not", "Dictionary Search", "Zoom", "Cookie Manager" etc..). Also, Firefox blocks the snot out of Pop-ups, and I am eternally gratetful to it's developers for that! Also, the tabbed browsing is a god-send, too. Really...ever since I've been using Firefox, my web-surfing experience has become significantly more enjoyable and, I'll say it again, I am forever grateful to it's developers.

Now, given Firefox's superiority, it would seem that things should easily go thier way and IE would soon be history, but...unfortunately, those guys in Redmond still have a desktop monopoly and a lot of money - and it all begins and ends with that fact. At one time, Netscape's Navigator was everything - THE browser - and Microsoft's IE was nowhere, and then it all changed: Microsoft rolled over Netscape in a few short years despite the fact that politicians, courts and many of the computing public cried "foul" at MS's tactics; nevertheless, MS won. See, as long as IE was packaged with Windows as the default browser and was "Good enough, it put Netscape in a losing position from which it could never recover.

Anyways, we shall see. In the meanime, I will continue to use Firefox.

There is a difference

[Moraelin]

The difference is basically that:

1. First and foremost, GCC's bytecode isn't Sun's or MS's proprietary stuff.

2. It _is_ more efficient. Java on the desktop is still by and large a fscking disaster. It uses more RAM, its GC doesn't play nice with the swapping, and it _still_ runs at about half the speed of native C++ code in real apps. (As opposed to Sun's cleverly crafted micro-benchmarketting.)

(Virtualizing everything and emulating fictional machines instead of dealing with the _real_ machine, is every Computer Scientist's wet dream. When you live in a theoretical world, it's easy to forget about the concerns of the _real_ world. Such as performance. Or memory footprint. Or the fact that computers have finite memory and a swap file, so an idiotic GC will cause thrashing when the machine is overloaded.)

3. A Swing app tends to look-and-feel nothing like a native app.

(And it's not just about the "look", but about users being able to just use their existing skills on a new app. E.g., not having to learn yet another file chooser dialog. What's wrong with the existing Windows one? Coding yet another set of personalized widgets is every geek's wet dream, which is why every idiot just has to do that. Using yet another new widget set is, however, something every non-geek would rather avoid if he/she had half a choice.)

Now the last two points _are_ slowly getting better. JIT compiling has come a long way, for example. We're no longer in the days of Java 1.0 running 20 times slower than even the worst written C++ program. And IBM's SWT sure is what Swing and AWT _could_ have been, if Sun's engineers didn't have their heads firmly up their arse.

Still, you know... can't help wondering why we keep waiting for Sun's proprietary thing to eventually get fixed, instead of using the open alternative that already exists and which already works better. Are we _that_ addicted to Sun's marketting and lies, or?

Re:There is a difference

[Darren Winsper]

"First and foremost, GCC's bytecode isn't Sun's or MS's proprietary stuff."
The Mono folk seem pretty sure they can implement the .Net CLR without being sued out of existence. Also, the CLR is an ECMA standard. GCC's intermediate language is also intended for use in GCC only and is subject to change on a whim.

"It _is_ more efficient."
Do you have any evidence of that? When working on an assessment several months back, I wrote a Java implementation of an algorythm whereas my mate wrote his in C. My implementation was at least as fast as his despite using lots of high-level concepts and never marking my methods as final, whereas my housemate used things like small structs and memcpy.

"A Swing app tends to look-and-feel nothing like a native app."
So? That has nothing to do with bytecode.

"Still, you know... can't help wondering why we keep waiting for Sun's proprietary thing to eventually get fixed, instead of using the open alternative that already exists and which already works better. Are we _that_ addicted to Sun's marketting and lies, or?"
Yes, we're so addicted to Java that virtually nobody in the open source world uses it for desktop applications. Look, do you have *any* evidence that GCC's IL would be useful in the general case, or are you just blowing hot air?

Please don't go there Firefox

[Master_Ruthless]

Internet Explorer is what it is because Microsoft stopped thinking of it as a web browser and started thinking of it as a development platform. Many of the most abused, insecure features of IE (the infamous Browser Helper Objects being the best known example) were bloated on after a few versions in an attempt to make IE a more viable development platform.

It is precisely because Firefox lacks those "features" that I use it.

How does it compare to other platforms?

[kohsuke]

A new platform is always interesting, but is it really good when compared to other platforms?

Take Java, for example. You can write a Java Web Start application that launches like a locally-installed application. It's got a reasonable set of GUI components. It runs on most of the platforms I care, it has probably got a bigger installation base than Firefox is.

And then there's a difference in productivity. Java is way more productive than Firefox as a platform. Go to a book store, you see a whole bunch of books on Java. There are countless FAQs, articles, mailing list archives, communities, and local user groups that covers every aspect of Java. A whole range of IDEs and debuggers to make you even more productive. Hundreds of commercial/free libraries you can use.

All of these things help you get the job done quickly.

So what does the Firefox platform bring to the table? Why a developer like me should be intereste in it?