The Future of Firefox

sebFlyte writes "As Firefox moves swiftly towards 1.1 and Internet Explorer keeps trundling towards IE7, ZDNet UK has an interesting set of articles about Mozilla. Among other things, they look at the history of Firefox all the way from the pre-phoenix days, and have an interview with chief evangelist Asa Dotzler looking at what has driven the browsers success and why he thinks the release of IE7 will cause a massive boost in the uptake of Firefox."

Comments

boost leads to more exploits

[rockytriton]

It's quite possible that this boost will lead to more exploits which will lead to a decline...

http://www.dreamsyssoft.com

Re:boost leads to more exploits

[Rosco P. Coltrane]

It's quite possible that this boost will lead to more exploits which will lead to a decline...

More likely, the open-source approach, meaning the pride developers take in making good (or at least decent) code, the peer review of said code, and quick fixing when a bug is found, will prevent a decline.

Microsoft bought Spyglass and started flinging shit at Mosaic until they got a working browser in a short time to kill Netscape. Then they flung more shit at it to corner the browser market, then they kept on flinging shit at random, to add this and that feature and eye candy. Since nobody really checks the code outside of Microsoft, and since they don't (didn't?) really care about security as long as nobody finds the flaws, there you have it: IE pisses people off and people switch to the first decent alternative.

That's why I think IE will keep on declining, and Firefox won't.

Re:boost leads to more exploits

[Leroy_Brown242]

(Score:0, Informative)

Of course, negative feedback from the mods because you spoke ill of FIREFOX even though it was a valid point. Same happens with Linux and Google. Oh well.

Your point is valid though.

The larger Firefox's market share become, the larger a target they become.

Right now, exploiters hit IE because it's the most efficient way to screw over a lot of people with a browser. Exploiting Firefox would effect a whole lot less people, possibly with more effort.

The true strength of Firefox is that the community stands behind it, and can change it to fill hole. So the open source community can put their geek where their mouth is, and make a browser as good as the community can. If it sucks, then it's nobody's fault but our own.

Re:boost leads to more exploits

[frodo from middle ea]

Let's not forget, Firefox is not embeded in the OS, that itself makes is much secure (by design) than IE. e.g. In future it may be possible to discover a way to gain administrative previledges thru IE, even when running with a non previledged a/c, chances of that happening with firefox, atleast by design look slim.

Re:boost leads to more exploits

[Leroy_Brown242]

I'm not sure what you're tlaking about. Mine updates all automated style just fine.

Re:boost leads to more exploits

[Quevar]

More options in browsers will be better for everyone.

If more people use Firefox, it's possible that more people will try to hack it, but that means less people hacking IE. So, any hack that does come out will probably not affect everyone. Software diversity is very important to preventing systems from going down. I can't believe people rely solely on one OS to do their stuff - a virus comes out and everything is messed up. I would rather have a backup running a different OS that could be swapped in or better yet, a mix of multiple OSes. Same with browsers - have multiple ones and everyone ends up more secure.

Re:boost leads to more exploits

[friedmud]

"And for every OSS trophy project you'll find a thousand half-assed weekend hacks that never make it past Alpha stage because, to the developer, posting it on sourceforge or whatever is more important that making a program usable to more than just himself."

As a _very_ part time open source developer I think this is fine.

I personally have published a couple of my own weekend hacks in Alpha stage... never to touch them again. I still recieved a lot of feedback... most of which was "Thanks!". Why? Because it gave people something to start from, or an example to use for a different implementation. I'm sure no one used anything in a "production" environment but that was never the purpose.

Publishing an open-source project is _never_ a bad idea. The more code and collaboration out there the stronger the community is. I never wanted to be the best at making program X... I just wanted to be helpful.

I think people have a hard time understanding that you don't always have to "win" at everything. Sometimes just being nice, or helpful can be its own reward (both to you and the community).

Friedmud

Re:boost leads to more exploits

[Rosco P. Coltrane]

are you implying that for-profit developers don't take pride in their code?

All developers in closed-source companies that I've known would *like* to take pride in their code, but they always have to respect tight schedules, and end up writing "good enough" code (good enough meaning, sure, there are bugs, but no show-stoppers).

I'm quite sure Microsoft developers aren't told to take the time to do things right. They're told to hurry the hell up and make it work. I'm also quite sure most of them would prefer taking the time to do things right, but their employer doesn't pay them to do that.

i'd advise you state your views on your resume. employers will probably want to know about that.

You misunderstood my views. My view is simply that not release the source code makes it easy to hide bad code, and even the best engineers can't go against their management's wishes and constraints.

As for me, I was a developer, so I should know what I'm talking about. Not anymore though: in my new line of job, I can tell the customer to get lost until I'm sure everything's done just right, and he's usually happy with that, because my products cost well over $10k a pop and he prefers waiting than having a botched-up result :-)

Re:boost leads to more exploits

[Captain Scurvy]

More likely, the open-source approach, meaning the pride developers take in making good (or at least decent) code, the peer review of said code, and quick fixing when a bug is found, will prevent a decline.

Or so one would hope. However, one must also take into consideration the fact that open source has a way of uncovering a lot more vulnerabilities. Granted, many of them as of late, at least with Firefox, haven't been very serious, were nit-picky, and were fixed rather quickly.

I have noticed, however, that a lot of people will just look at the number of vulnerabilities and make ill-formed opinions about open source products. They won't look at the severity or how quickly it was fixed, but they'll definitely look down on the product if they have to update it a "lot."

More than one of my clients has said something along the lines of, "Firefox/Linux/OSS? Isn't that really just as vulnerable as Microsoft stuff, but the community downplays the problem?"

So, in this way, the open source model can be a two-edged sword when it comes to persuading other people to go that route. The FUD seems to be working, at least from what I've seen.

Re:boost leads to more exploits

[Linus Torvaalds]

Microsoft bought Spyglass

No, they royally fucked over Spyglass. They made a deal with Spyglass so that Spyglass would get a cut of all the profits made from Internet Explorer as it was based upon Spyglass Mosaic. Remember, this was back when web browsers were something you could buy in a box. Getting a cut of all sales for a flagship application sold by Microsoft? Spyglass must have thought they really lucked out!

Then Microsoft illegally dumped Internet Explorer on the market for no cost in order to kill Netscape. 5% of zero profits isn't a lot of money, is it? Spyglass no longer exists.

Re:boost leads to more exploits

[Rosco P. Coltrane]

okay, you have an opinion, but please don't attempt to make blanket stmts about working software developers because you have run ins with a few crappy engineers and poorly managed projects, companies.

I was in this industry long enough to make such statements. Apparently, you seem to be working for a sensible company where engineers are listened to, and I'm glad that you do. However, I can assure you you're in a minority.

i know you're looking for mod points, but don't you think you've speculated enough for today?

Do you really think I'm looking for mod points, after having posted on this here board for 6 or 7 years and gotten all my karma on the first two days? ;-)

Besides, you don't have to be hostile...

Re:boost leads to more exploits

[Anonymous Coward]

> Microsoft bought Spyglass and

No, they did not, quite the opposite, they tricked them into doing the work for free.

MS contracted Spyglass to write IE from Mosaic but the payment was to be $5.00 for every copy of IE _sold_. When they 'gave it away' they did not need to pay Spyglass anything.

Spyglass sued and lost. MS insisted that it was never 'sold' even when it was an unremovable part of Windows that was sold.

Re:boost leads to more exploits

[syousef]

Publishing an open-source project is _never_ a bad idea. The more code and collaboration out there the stronger the community is. I never wanted to be the best at making program X... I just wanted to be helpful.

A lot of people operate under this assumption. Sadly they're just plain wrong, and here's why: If you have 1000 pieces of software that all claim to do roughly the same sort of thing, and 999 are hacks, finding that 1 good program is going to be an excercise in frustration.

End users are likely to come across one or more of the hacks, curse about open source rubbish and go back to using close rubbish that at least works a little better. More sophisticated users will go and find out what other people are happy with, but it still makes the process much more complex.

It's the same reason having thousands of distros,f ew of which work well, is a bad bad thing. Some diversity is a good thing, but too much diversity is almost as bad as none.

If open source wants to survive, we need more focus on a narrower range of products as well as solid lobbying of politicians to keep open source legal.

To be fair the sorts of software you're talking about writing yourself sound more like code snippets than fully functional programs. That's not so bad since your target audience is generally other developers, and they can be expected to sort through software.

Re:boost leads to more exploits

[Smidge204]

That's pretty much what I was getting at, thank you.

With all the "unusable by most people" stuff out there, someone just coming into the OSS scene is going to be very turned off trying to find something usable. This is especially important when it comes to businesses looking into possible OSS solutions.

Unfortunately the "bazaar" method leaves no room to separate the wheat from the chaff, as it were.
=Smidge=

Re:boost leads to more exploits

[friedmud]

I do see your point but I think that it is just from a different point of view.

What I was trying to get at is that a lot of open source developers don't have end users in mind at all when they create the software they do. I certainly don't have any goals of winning anyone over to OSS. I use it because it fits my needs and I don't mind all the diversity.

For people that "Just want stuff to work" there are other options out there (Windows, Mac). For people who like to hack around and find new things and collaborate/cooperate to build better environments _for themselves_ we have OSS.

What I'm trying to say is don't corrupt my open and collaborative environment just because it doesn't suit your needs. If people don't like the diversity then they can look elsewhere.

OSS has ALWAYS had diversity and it ALWAYS will. I personally see this as a strength (OSS becomes a melting pot of ideas, where everyone learns from eachother). Again, the goal is not to conquer the world, but instead to make ourselves happy.

When you say "having thousands of distros,f ew of which work well, is a bad bad thing"... who is it a "bad bad thing" for? The people making the distros are (for the most part) doing it because it is interesting _for them_. If people use it then that is great... if they don't then that person still had the experience of creating something... something which appeals to all scientific and engineering types.

This type of argument reminds me of when people criticise other people for having odd hobbies. "What an idiot! I can't believe he spent 2 months designing and building that case mod!" In general humans are very diverse and have lots of different interests. Some like to collect beanie babies, some like to code up pet projects on the weekend (regardless of whether or not something already exists that does the same job).

In essence I'm saying that for most OSS developers it is a hobby. As such let us do what we like. If you don't like the way it turns out then use the other alternatives.... no skin off our back.

Friedmud

Re:boost leads to more exploits

[friedmud]

Sorry to reply again...

You state: "If open source wants to survive we need more focus on a narrower range of products"

Again I ask.. Survive what? Hobbies don't die. You can't kill my ability to collaborate with people across the web and create a good environment for myself.

No amount of people claiming "OSS Sucks" can do anything... it's like telling a coin collector that "Coins are dumb!".... if the person enjoys what they are doing they will continue regardless of outside criticism.

Friedmud

Re:boost leads to more exploits

[mr.hawk]

Since MS is arguing that IE is an integral part of the OS, couldn't the Spyglass owners argue for a 5% share of a percentage of the Windows profits? That'd be a nice pile of cash to collect for being "royally fucked over"!

Re:boost leads to more exploits

[kwoff]

Then Microsoft illegally dumped Internet Explorer on the market for no cost in order to kill Netscape.

What if Microsoft had released IE as a free open-source project? Would that still have been considered "illegally dumping"?

firefox

[msh104]

firefox is a nice browser... but technology's like .net sure seem like a trouble to me in new windows versions. I've head some sites depend on .net being pressent in order to be displayed. I sure hope they can handle it.

Re:firefox

[ninjaadmin]

Unless of course, the site is publishing an application using "one-click deployment". In that case, the code executes on the client, and the client would need the framework. (I know, doesn't really apply here... just a technicality)

Re:firefox

[hal9000(jr)]

The parent is not a troll. It's a fact of browser life. Like it or not, there are many, many enterprise web applications that depend on features found within IE (or at least claim to--Opera usually works OK when impersonating IE). BTW, I am a staunch FF user, and Netscape before that all the way back to the 1.0 days.

Re:firefox

[Lumpy]

typically because those enterprise web applications are written by no talent hacks that can not code themselves out of a paper bag. And yes this is true, I have looked at the code for many apps that cost the company I work for $50,000+ and the code is absolutely HORRIBLE.

php asp asp.net perl or java, your web app has no excuse to not support all compliant browsers.

code to real standards and spend another 10 minutes testing, anything less is plain lazy.

Re:firefox

[lukewarmfusion]

Some web applications require ActiveX to do things you can't do using standards-compliant code. You have to rely on ActiveX, Java, etc. to do things like drop-and-drop file uploading. As it stands, using a file browse interface to access individual files when you really want to click and drag thirty files at once is a pain.

(I bring up this example because it's a problem I'm dealing with now.)

So while there are plenty such web apps written by no-talent hacks, there are also apps that push the limits of web standards and require something more powerful.

Ironic

[deaddrunk]

That the page doesn't render properly in the browser they're biggin' up.

Main advantage

[mfloy]

The main reason I like Firefox is that it pushes innovation. Back when IE was the clearly dominant browser, with no real competition, there were very few sensible inovations for browsers. Sure, a few little things here and there, but for the most part it was monopolized. Firefox's popularity will ultimately lead to a better browser market all around.

Re:Main advantage

[dsginter]

Speaking of innovation, someone should innovate an ActiveX IE plugin that simply changes the IE rendering engine to Gecko.

Then we could all use CSS the way it was meant to be. The drone consumers will never know the difference.

Re:Main advantage

[superpulpsicle]

I'd be happy if firefox can just fix the CPU hammering/memory leak with Flash by 2.0.

Re:Main advantage

[Zathrus]

q[ I'd be happy if firefox can just fix the CPU hammering/memory leak with Flash by 2.0.]q

Given that the issue in question also occurs in IE, Safari, and any other browser with a flash plugin regardless of OS I'd guess that this is not a browser bug.

My guess is that it's a race condition inside the Flash code itself. It doesn't appear on all systems, even if they are running the same OS/browser/flash revision (and viewing the same content).

At least with Firefox you can install Flashblock and not be annoyed by CPU gobbling flash unless you really want it.

Re:Main advantage

[dpilot]

You underestimate your argument.

When competition disappears from ANY market, that market stagnates. For the moment, I'll follow your example and continue to pick on Microsoft, but it's by no means limited to them. Way back in the early PC days, DOS advanced fairly rapidly to DOS 3.3, driven by hardware introductions. There was also a not widely used or known multitasking version of DOS (4?) as well as IBM's much-maligned DOS4. But basically, DOS stagnated after V3.3.

That is, until DRDOS 5.0 came out, offering much better value. (More features, not sure if it cost less.) Then Microsoft followed, and brought out their own DOS 5.0, and the stakes were upped again with DRDOS 6.0, etc. Somewhere in there, Microsoft slipped the legendary AARD code into Windows 3.1 to chill the DRDOS uptake, and also around that timeframe they "incorporated" disk compression, courtesy of Stac Electronics. (lawsuits followed, on both counts.)

But IMHO, if DRDOS 5 hadn't appeared, it would have stayed DOS 3.3 under Windows until the whole Windows vs OS/2 battle started. Also IMHO, lacking competitive pressure in a given market, a company will invest its development dollars elsewhere, and milk the stagnant market for all it can.

Re:Main advantage

[jlarocco]

Firefox hasn't innovated anything yet.

Innovating is coming up with something new based on something else. Firefox copied almost everything it's popular for from Opera, then zipped past it in userbase, and claimed Opera's innovations for its own. No matter what the fanboys try to tell you, it's still just copying.

Re:Main advantage

[Tumbleweed]

I've read that the upcoming new version of the Flash player solves the CPU usage problem quite nicely, but, of course, time will tell.

Re:Main advantage

[Will2k_is_here]

I have seen Firefox users highlight the same features Opera had before Firefox, but I have never seen anyone claim Firefox developers invented them.

and...

[cryptoz]

an article to go nicely with the story http://netscape.com.com/Opera,+Firefox+squabble+ov er+best-browser+claim/2100-1032_3-5740879.html shows another side to the whole FF thing.

Re:and...

[hkmwbz]

"Wait, Opera claimed on the front page of their website that they had won an award that didn't exist, and Asa called them on it in his blog... but Asa was the one who lied and got caught with his pants down?"

Yes, absolutely correct. Asa knew that there was some room for misinterpretation (as demonstrated by plenty of people when this was going on), yet he went straight for the throat in an all-out attack. Asa knew that Opera wasn't lying, so he was actually lying himself. This is not the first time he's done something like this either.

Opera made a simple mistake, but Asa couldn't resist the chance to attack Opera yet again.

"The logical hoops some people will jump through to make the facts fit their worldview (instead of the other way around) never ceases to astound me."

People who comment on something they know nothing about never cease to astound me.

Wow!!

[ShaniaTwain]

ZDnet can tell the future now!? Do they have any good stock tips or winning lottery numbers?

Security

[ad0gg]

I want to know how firefox devs plan to address security concerns with the browsers. It seems as firefox gets more popular, the number of exploits keeps rising.

Firefox security information

Re:Security

[DrEldarion]

For the longest time, people have been saying that linux/firefox is more secure than windows/IE. One of the response to that is that it's likely that the reason windows/IE has more exploits for it is because it's the most targetted since it's the most popular.

Now that we're seeing firefox gain foothold, we're starting to see more exploits for it. I wonder if they will be proven right?

Re:Security

[Apreche]

Hm, that is true. However, compared to IE the number and severity of concerns is a drop in the bucket. If firefox really has 10% then for ever 1 firefox there are 9 IEs about. there are more than 9 IE holes for every firefox hole.

But more importantly than that, firefox holes have always been fixed within days, if not the day of. With MS you have to wait for the second tuesday to get your windows update. What will you do when an exploit is discovered the day after that?

Re:Security

[man_of_mr_e]

Wow, you are so completely wrong on a number of counts.

First, It takes the mozilla team an average of 2 MONTHS to fix security issues, not the "same day". Further, The vast majority of IE vulnerabilities happened before Firefox even reached release candidate stage.

For example, FF 1.05 patches 12 vulnerabilities. The oldest from April, the newest from late May based on the creation date of the referenced bugzilla reports.

http://www.mozilla.org/projects/security/known-vul nerabilities.html#Firefox

Firefox has had 56 publicly announced vulnerabilities this year. 24 of them of High or Critical severity.

Re:Security

[rolfwind]

I doubt Linux will wilt under pressure.

Many of Microsoft's security problems comes from initial poor design decisions AND that those design decisions are not easily revoked once put forth because of backward's compatibility.

ActiveX is an example of this. It was made before internet security was much of a concern but to this day MS cannot easily revoke it without breaking apps left and right and pissing off Developers.

They would have to keep the API and rewrite it under the surface while having it react the same. Not an easy task nor guaranteed possible.

On the other hand, Open Source has several advatanges - one of which people complain about - their are redundant APIs and programs galore in several areas. The strength of this is that sometimes overlying programs are programmed to be use a more generic interchangeable API.

*nix has lack of integration. This is IE's and outlook's greatest strength but fatale flaw in some regards. Other OSes, the mail client and webbrowser and filebrowser can be ripped out and exchanged much more easily or not have one at all. Microsoft's Windows tends to be hardcoded to IE/outlook and the otherway around. This non-modular design is a nightmare.

General politics. While I'm sure Linux programming groups have this too, it's a much larger degree where Microsoft's design decisions are often political with their business in mind while OSS tends to be more engineering minded.

Re:Security

[div_2n]

Uhh, show me any news stories about "exploits" in the wild. What you hear are security flaws that have been found due to the source being open and then promptly being fixed.

Using the word exploits seems to indicate that there are malicious websites out there taking advantage of a security hole. There may very well be, I just don't remember hearing about it.

Continuing diversion of standards by MS

[jurt1235]

MS will try to keep integrating non web standards into its browser IE, resulting in people acutally using these new features (cool or usefull?), resulting in people using IE whether they like the browser or not, flawed like hell or not. They use it because it works on all sites. The good news I saw today (previous /. post) is that somebody made an extension which works well in firefox, but not good in IE. More of that is needed to fight on equal terms.
Maybe one innovation which MS wants to use, but which is patented by the mozilla foundation, effectively blocking MS from using it, just to get some negotation leverage to force MS to stop adding nonsense & bad implementations of standards to IE.

Re:Name one platform Firefox doesn't suck on.

[Anonymous Coward]

Your well-reasoned and insightful arguments have convinced me to uninstall Firefox.

Too bad ZDNet sucks

[Gothmolly]

I mean, they were alright and cool back in 93-94, when WfWG was out, and worked pretty well, and Novell was cool, and PC Magazine could review 8 or 10 word processors in a shootout article. But now they're just pundits, like Dvorak, who respin company press releases as insight. Sort of like a glorified, corporate, Roland Piquipaille.

Anyway, nice to see FF get some press, but I wouldn't take it too seriously - PHB doesn't trust it anyway, and Joe 4Pack doesn't read ZDNet.

Dicey logic?

[DrEldarion]

If you look at all of statistics they average out to us being about 10 percent of the Web. There are estimated to be about 1 billion Web users, which means there are about 100 million Firefox users out there. It has only been downloaded about 65 million times, so the other users are people who got it some other way. The most likely place they are likely to have got it from is corporate deployments.

Now, I haven't seen these statistics myself, but they seem a bit off to me - that 10% figure is probably skewed somewhat. Considering that the people with firefox installed on their computer are the people most likely to be on the internet a lot in the first place, usage statistics for it can be misread easily.

Also, they say 65 million downloads of Firefox have been made... how many of those were repeats? I've downloaded the program quite a few times, and considering that each upgrade just requires you to download the full install again, there's no way that 65 million downloads translates into 65 million users.

This just reeks of using statistics in a misleading manner.

Re:Dicey logic?

[tsetem]

Also, they say 65 million downloads of Firefox have been made... how many of those were repeats? I've downloaded the program quite a few times, and considering that each upgrade just requires you to download the full install again, there's no way that 65 million downloads translates into 65 million users.

Well, the follow on question to this, is how many installs aren't documented? ie: The NT Admin downloads it once, and pushes out the changes to 500 desktops.

Re:Dicey logic?

[QuantumRiff]

Actually, the downloads are only for new installs. The upgrade servers are not counted. There was an article here on slashdot talking about that, but I'm too lazy to look it up. It was when firefox released version 1.0.

Re:Dicey logic?

[rpdillon]

There are a lot of related questions, but going in the opposite direction, like:

Linux that use central repository package management use Firefox versions which were never downloaded from the Firefox site, and were never counted.

Anyone who uses The Open CD, or Knoppix, uses Firefox but hasn't "downloaded" it.

OEM CDs, as well as ISP's CDs contain Firefox, and are not counted.

And lastly, as the post above mentioned, corporate rollout of the browser will never have a number of downloads equal to the number of computer upon which the program is installed.

In others words, your point is perfectly valid, but only serves to show that the whole "counting the number of users" idea is actually quite a challenge.

Re:Dicey logic?

[nedder]

It's ok when the perceived good-guys do it.

Women in OSS

[BigZaphod]

This is part of one of the questions in the interview: "The open source community generally has problems encouraging women to participate."

Why is this seen as a problem? The open source community doesn't really try that hard to encourage *anyone* to participate regardless of gender or race or nationality. It just is what it is. Those who participate decide to do so on their own and there's virtually no barriers to doing so. The way that question is phrased it is almost as if there should be some kind of OSS organized effort to specifically attract women to the community. What would be gained by such a movement and why is it even implied to be necessary?

Re:Women in OSS

[jimbolauski]

"What would be gained by such a movement"

You need to think outside the box yong grasshopper! Wet oss t-shirt contests, home cooked meals instead of vending machine meals, the benifits are limitless.

Re:Women in OSS

[Phroggy]

Why is this seen as a problem? The open source community doesn't really try that hard to encourage *anyone* to participate regardless of gender or race or nationality.

The more people involved in open source development, the better. Slightly over half the population are women. It would be nice to have more women involved in open source development, simply because it would be nice to have more people involved in open source development.

It just is what it is. Those who participate decide to do so on their own and there's virtually no barriers to doing so.

Are you sure about that? Perhaps girls are being pressured by their peers, parents, the media, etc. that doing geeky computer things isn't cool, and they should look down on geeks with disdain instead of aspiring to become one themselves. Perhaps boys aren't being pushed away from it as much. Or perhaps because girls just naturally learn differently, the things that get boys interested in programming don't work for girls, and we need to figure out a different way to welcome girls into the fold. Or perhaps girls just aren't interested and we should forget about it. I think it's an issue worth looking at.

The way that question is phrased it is almost as if there should be some kind of OSS organized effort to specifically attract women to the community. What would be gained by such a movement and why is it even implied to be necessary?

Same reason there should be an organized effort to attract men to the community. The more skilled coders with itches to scratch, the better software we all get.

Re:Women in OSS

[westlake]

"The open source community generally has problems encouraging women to participate."
Why is this seen as a problem.

You might begin by asking how many women use open source software, make purchasing decisions or have shown the slightest interest in Linux. If you don't know the answers to these questions, or if 50% of the market is indifferent to your product and alienated from its developers, I'd say you have a problem.

Extension security

[gpinzone]

Firefox has been praised for being more secure than IE, but some say that the extension model introduces security risks. Do you agree with this? Why have you chosen this model?

I'm not terribly concerned about extension security or performance. Most extension developers host their code at Mozdev and the bad ones get weeded out quite quickly. It's unlikely that a malicious extension will get popular as you can view the source of extensions. You can't view IE's source.

Was this interview before or after the GreaseMonkey debacle?

Re:Extension security

[SonicRED]

The GreaseMonkey vulnerability was discovered by a good guy and is already fixed. This totally backs up his statement where he argues that being able to view the source of the extension makes things more secure.

Also, it isn't installed by default you know. I consider myself to be a power user and I've been running Firefox since version .5. Today was the first time I've heard of GreaseMonkey. An average user first of all has to know what an extension is, then they have to choose to install it, and then explicitly give a site permission to do so. This vulnerability has no active malicious exploit in the wild and even if it did it would still be a fringe issue.

Stick to standards

[giorgiofr]

somebody made an extension which works well in firefox, but not good in IE. More of that is needed to fight on equal terms

No, please, do not wish for this. It would only lead back to the way it was a couple of years ago. We should just stick to standards and in the long run this will win by itself. Developers are the ones driving this market, they will enjoy the standards, standard-compliant browsers will be more appreciated, we will win. But if we start playing like MS does, we won't. And in the process the web will suffer greatly.

Component Model

[agsharad]

While IE is obviously going to learn a lot from Firefox and improve their browser, there is one thing they are unlikely to provide. And that is the component model that Firefox offers. The basic browser is very small (and fast). Then there are hundreds of add-ons to choose from. Users get to decide what they want and install it. The browser morphs to serve the user rather than the other way around.

Re:Trundling?

[CdBee]

A lot of ZDNet content is written in the UK, where "to trundle" is everyday usage, applied to anything on wheels that moves slowly (buses, trams, wheelbarrows)

Sad, but true

[ehaggis]

I like Firefox, I have deployed Firefox as the defacto browser in my company and it is my primary browser.

That being said, it is sad when only (a questionable) 10% usage rate is viewed as any type of challenge to IE. Have we lowered our standards for what real competition should be?

I'm glad I switched!!

[Anonymous Coward]

One of the biggest reasons why I'm glad I switched to Firefox is all of the customisations you can do to it - I get a seven day weather forcast sitting down on the status bar - because I want it there, if I decide I no longer want it there, well I can take it away just as easy.

Support for multiple proxy servers - the ability to right click and see who's site I am looking at and the interigate cookies. All good things that help people use the internet safely and effectively - simply plugged in to a mixture of customisations that suit me.

RSS feeds, tabbed browsing and pop up blockers are all fantastic additions by themselves.

If I really need to look at the page in IE - I can right click and view the site in IE, but it thats a last resort now - I don't mind the odd formating issues. Perhaps all of these features are not new but it's free and it works as I want it and well.

The reason he thinks IE 7 will spur more FF growth

[Infonaut]

Dotzler figures that fifty percent of Windows users are still on Win 2k, and in order to get all the spiffy new IE 7 features, they'll need to upgrade to XP. His calculation seems to be that people will become annoyed at having to upgrade their OS just to get a new browser, and will therefore jump to Firefox instead.

I'm not sure about that logic. When MS puts their mind to it, they can make a fine browser. They jump from IE 3 to 4 and then to 5 was impressive. My guess is that IE 7 will not be as bad as expected, and they may sneak in a few features that the Firefox team hadn't anticipated. Microsoft wants to push users to upgrade, so if they can create even one little "must have" feature in IE 7 that Firefox doesn't already use, they may succeed in enticing more than a few Win 2k users to buy XP.

Even if Microsoft doesn't roll out a blockbuster with IE 7, I doubt that the release of a *competing* browser is going to somehow push people to switch to Firefox. With all the press Firefox has been getting, if you haven't at least tried out Firefox by now, you're not likely to so unless IE leaps out of your browser and stabs you in the forehead.

I'm so glad they fixed the %£$@! space bar

[mooncaine]

I tried Firefox now & then for OS X, but one thing always made me turn back to Safari: I couldn't stand how the spacebar in Firefox didn't adhere to standard practice: scroll the web page down. I saw this /. story and decided to give Firefox another try. Hurray! The spacebar works as it should!

The Future of Firefox is another 5 MB download...

[Steve_Jobs_HNIC]

Coding misstep forces new Firefox release

http://news.com.com/Coding+misstep+forces+new+Fire fox+release/2100-1002_3-5792635.html?tag=nefd.top


well....at least we have extensions.... here's my list:

TextZoom - because I'm blind as a bat
Adblock - use with Filterset.G from http://www.pierceive.com
Session Saver - saves tab sessions _when_ firefox crashes
Web Developer - lot of web dev options
IE View - click to view in IE
Target Alert - let's me know what I'm clicking on
ForecastFox - show forecast
FindBar Switch - makes the find bar toogle hide/un-hide with CTRL+F
Download Statusbar - much better than the download window/popup
SpellBound - because my spelling sux

We are spreading firefox...

[B11]

I'm the "guru" to my friends and family, and when I'm asked to "fix" the internet, that is, get rid of pop-ups and such, I install or recommend Firefox. I show what it can do, how those annoying pop-ups, active-x download prompts, noisy flash ads, etc., can disappear and they are amazed.

My sister installed it on her computer at work after bieng so frustrated with IE problems. Now her boss has it on his computer, at work, at home, and on his laptop. Her co-workers are using it.

I'm sure other "gurus" are spreading the word.

IE bundled with Windows

[Hamstij]

As long as IE remains bundled with the windows OS, Firefox will *never* take off and reach a significant install base.

I work as a consultant for many IT firms, and even though they are perfectly aware of IE's limitations and security problems, they do not make the change to an alternate browser simply because it is far easier to stay with the one already installed on the system.

Inertia means that Firefox will always remain a fringe browser until some anti-monopoly law makes MS remove IE. And that will never happen. No matter how awful IE becomes now or in the future, sheer laziness means it will always be the predominant browser.

Wrong!

[shoemaker251]

I'm sorry, but that is completely incorrect. The .NET Framework only needs to be installed on the web server, NOT the user's client machine. There is no requirement that users have the .NET Framework installed to render ASP.NET pages.

Firefox better than IE? Not saying much...

[Kazoo the Clown]

The Firefox team is pretty full of themselves-- it will take the attention to detail to make Firefox better, but I don't get the sense they are aware of that. Things like the annoying way it incessantly steals your input focus while you're typing, the fact that the Open New Window feature is virtually useless due to the Home Page feature which is itself useless (two areas where IE is actually better). Features that should have been worked out before the "sexy" features like popup blockers which can be done externally (and better, too). But users can always be retrained anyway, because We Know Better(TM).

Firefox should remember that they don't have to add sexy features every release like Microsoft does, and in fact that is Microsoft's biggest problem-- they have to add new features because they need you to update. Unfortunately, the Firefox team apparently also needs you to update in order to sustain the overinflation of their egos.

Both teams need a draconian Steve Jobs to force them to improve the usability first (and I don't even use a Mac). Someone who will take them to task over the little things. Otherwise creeping featurism and bloat will kill them off. The problem is, the little things just aren't as exciting to work on or talk about, which is a big reason why Microsoft's products are so lousy. Here's hoping it isn't becoming Firefox's reason too...

Re:unhappy with Firefox 1.x

[kihjin]

Part of the Open Source process is that the users have the ability to participate. Don't expect your problem to automagickly fix itself. There's code available, and a long process known as DEBUGING that you could be experimenting with right now.

Firefox 1.x branch has only crashed on me once since I downloaded 1.0.0, however many months ago that was. Your issue doesn't translate onto me, hence it sounds like an isolated problem.

Another plus for Firefox is that since you are so unhappy with it, you have the option to uninstall it... unlike a particular browser bundled with the OS.

He said...

[Kjella]

It's unlikely that a malicious extension will get popular as you can view the source of extensions.

GreaseMonkey is not malicious. It is insecure. Yes, a third-party GreaseMonkey script could be malicious, but that is like saying Firefox is malicious because it has a security bug. Personally I prefer extensions that do nothing but passively manipulate my pages. We've finally gotten rid of most JS/Java bugs, and I sure as hell don't want to add another script language *cough* vbs *cough* activex. But I guess people want that kind of stuff...

Kjella

Asa's blowing smoke

[museumpeace]

saying an improved IE is goint to INCREASE the number of people abandoning IE is something only PR people can say with a straight face. For that to actually happen, IE 7 would have to fall flat on its face for for reasons such as this.

how IE7 will help firefox

[phantomfive]

From the article:
We have high hopes that we'll do better and better in that space with Windows 2000 users. If users don't upgrade to Windows XP they won't get IE 7, but 50 percent of businesses are still using Windows 2000.

If a site looks broken in IE6, win2000 users will be annoyed with Microsoft (no IE7 for win2000).

Market segmentation is a good thing: it will keep people from designing to a single browser. The more different browsers have a significant market share, the more likely the internet will look good for me in Lynx.

Firefox in the enterprise world

[bsquizzato]

I still think Firefox won't be used widely throughout the corporate enterprises until the team develops a good update system. It's enough of a pain for me to install over my old version when an update comes out, let alone hundreds of computers.

Re:unhappy with Firefox 1.x

[kashani]

Try removing all your extentions. I had a number that weren't exactly compatible from version to version that were causing a number of problems.

kashani

Re:1.0.5 Still Not Auto-updating!

[Lukey Boy]

I think it's missing from the auto-update server because 1.0.5 breaks a lot of extensions. They're working on a 1.0.6 (there's already candidate builds out) that don't have that side effect.

How does that differ from commercial or in-house?

[SuperKendall]

...And for every OSS trophy project you'll find a thousand half-assed weekend hacks that never make it past Alpha stage...

Yes you will. Just as for every succesful commercial or in-house app you'll see a thousand failures. But at least OSS failures are ones generally based on technical merits, and not so much based on a company running out of money or a project being killed for political reasons eeven though it's quite good.

Not to mention that each of those thousand failures is a learning experience for the next one. Remember Edison saying he didn't mind thousand unsucessful attemps to make a light buld because he now knew a thousand things that didn't work? It can be (not saying it always is) the same with OSS. You can actually see what people pick up and use, and try to understand why.

You do see some simialr bugs cropping up across a lot of different forums, because programmers make simialr mistakes and a lot of software is being written and re-written for a huge range of platforms - like Java or PHP or Ruby. So sharing cannot happen quite as much as would be ideal, but at least sharing can happen in the form of UI sharing - if you like the way a user interacts with some piece of software you can replicate that.

Many eyes, but not all of them friendly

[jfengel]

Open source is a two-edged sword for security. Or more precisely, a two sided curve:

1. Open source means that finding holes is a lot easier
2. Open source means more eyes spotting and fixing them

So there's a curve: a small open-source product has as many holes as a small commercial product, but those holes are wide open in public. I'd be reluctant to run something from Sourceforge from a tiny community of programmers, because it doesn't actually have many eyes on it.

Your only saving grace is that no hackers are out there targeting you. You survive on security by obscurity.

The ratio of evil eyes to good ones is probably constant, but it takes only one malicious coder to spot an error in open source. So Firefox may be safe, but that doesn't mean that open source in general is safe.

And that's without even bringing up the nightmare that malicious contributors can do.

false

[diegocgteleline.es]

"In future it may be possible to discover a way to gain administrative previledges thru IE, even when running with a non previledged a/c"

Huh, what the fuck? IE is a process and it runs with users' permissions. It's just not possible to gain administrative privileges through IE just because there's no part of IE running with administrator privileges

I'm tired of all that "IE is integrated with the OS" bullshit. Microsoft said that because otherwise they'd have to remove IE from windows and they've enought money to make the judgue believe that. IE is integrated in the "active desktop", the explorer or the help reader or msn messenger, but that does NOT mean it's integrated in the "os" in the real sense. It's integrated in the OS if you call "OS" to explorer.exe, but it is certainly not integrated in ej: the kernel or the libraries implementing the win32 API. And the programs which use it (explorer, etc) use it as a com object, ie: it's not really "tightly integrated"

Re:false

[frodo from middle ea]

ever heard of local exploits ? What I am saying is , chances of finding a local exploit to gain admin previledges in IE are much higher than in firefox

Re:The reason he thinks IE 7 will spur more FF gro

[thetoastman]

I have been avoiding the Windows/2000 Professional to Windows/XP Professional upgrade on one of my home systems for a long time.

I use Windows/XP Professional as one of my systems at work and I loathe the environment. About the only reason I would consider upgrading the home system is to investigate IE 7.

And the only reason I plan to investigate IE 7 is to make sure web sites I build will work in that environment.

The method is: Build the web to standards, and hack on it until IE can render it correctly. I don't imagine IE 7 will change this method. It just means that I will have to use different hacks for a new set of standards embelishments that Microsoft decides to make.

Re:I'm all for MS bashing, but...

[whitehatlurker]

What's the difference? 24 February 2005 Update to Firefox Now Available
23 March 2005 Security Update to Firefox Released (One month) 15 April 2005 Updates to Firefox and Mozilla Suite Available (One month) 11 May 2005 Security Update to Firefox Now Available (One month) 12 July 2005 Update to Firefox Available for Download (Two months) (From [mozilla.org].)

Now, there are rumours of an imminent update to fix coding problems.

When was the last release of MS IE?

There does appear to be a speed difference.

Firefox update BROKEN

[Frank T. Lofaro Jr.]

Firefox's update feature is broken both automatic and when you press the "Check Now" button.

I just (3:45 PM USA Pacific Time, GMT-7) tried it with Firefox 1.0.4 and it said "Firefox was not able to find any available updates".

Even though 1.0.5 is out with critical security fixes and has been for at least 2 days!

Good work Firefox! :(

Migration to Firefox

[ShimmyShimmy]

from article "we rarely hear of companies doing wide-scale migrations from IE." Actually, I disagree with that. A lot of places use firefox, and have specific settings/features specifically for netscape-based browsers. I go to Lehigh University, where firefox is standard on every computer.
Somehow, I just don't feel like "migrate" is quite the right word. Obvoiusly, if a company put Linux on every one of it's computers, it'd be pretty damn migrated. However, since you obviously can't have a Windows box that doesn't run IE, it's still hanging on every computer. But the IT guys push it and tell all the professors/staff to use it for security issues, and all the Mail is Thunderbird.

I really feel like Firefox and Thunderbird are a lot more "migrated" than it seems like, but it's just not a complete move away from IE becuase you could still use it if you absolutely wanted to.

Long live Firefox!

XulRunner

[bahwi]

XulRunner is what I've been waiting for! We've got our fully functional CRM app, but having people download Firefox and run it through that just doesn't look as professional as it could.

Of course, firefox --chrome http://blahblahblah.../ works, but is still more difficult, and people begin to wonder where this Firefox thing came from. Yeah, spreading the browser is a great cause and good crusade, BUT, business is business. In fact, when people call tech support complaining IE won't work(why are they calling us? No idea, we're just too nice sometimes), we tell them to install FF, and they're good to go.

Hopefully with the Gecko Runtime Enviroment(GRE) coming along, it will make smaller downloads for the other apps once you've got one installed. (Installed FF, great, Tbird and Xulrunner are miniscule downloads). Perhaps not, but maybe...