The Future of Firefox

sebFlyte writes "As Firefox moves swiftly towards 1.1 and Internet Explorer keeps trundling towards IE7, ZDNet UK has an interesting set of articles about Mozilla. Among other things, they look at the history of Firefox all the way from the pre-phoenix days, and have an interview with chief evangelist Asa Dotzler looking at what has driven the browsers success and why he thinks the release of IE7 will cause a massive boost in the uptake of Firefox."

Comments

boost leads to more exploits

[rockytriton]

It's quite possible that this boost will lead to more exploits which will lead to a decline...

http://www.dreamsyssoft.com

Re:boost leads to more exploits

[Rosco P. Coltrane]

It's quite possible that this boost will lead to more exploits which will lead to a decline...

More likely, the open-source approach, meaning the pride developers take in making good (or at least decent) code, the peer review of said code, and quick fixing when a bug is found, will prevent a decline.

Microsoft bought Spyglass and started flinging shit at Mosaic until they got a working browser in a short time to kill Netscape. Then they flung more shit at it to corner the browser market, then they kept on flinging shit at random, to add this and that feature and eye candy. Since nobody really checks the code outside of Microsoft, and since they don't (didn't?) really care about security as long as nobody finds the flaws, there you have it: IE pisses people off and people switch to the first decent alternative.

That's why I think IE will keep on declining, and Firefox won't.

Re:boost leads to more exploits

[Leroy_Brown242]

(Score:0, Informative)

Of course, negative feedback from the mods because you spoke ill of FIREFOX even though it was a valid point. Same happens with Linux and Google. Oh well.

Your point is valid though.

The larger Firefox's market share become, the larger a target they become.

Right now, exploiters hit IE because it's the most efficient way to screw over a lot of people with a browser. Exploiting Firefox would effect a whole lot less people, possibly with more effort.

The true strength of Firefox is that the community stands behind it, and can change it to fill hole. So the open source community can put their geek where their mouth is, and make a browser as good as the community can. If it sucks, then it's nobody's fault but our own.

Re:boost leads to more exploits

[friedmud]

"And for every OSS trophy project you'll find a thousand half-assed weekend hacks that never make it past Alpha stage because, to the developer, posting it on sourceforge or whatever is more important that making a program usable to more than just himself."

As a _very_ part time open source developer I think this is fine.

I personally have published a couple of my own weekend hacks in Alpha stage... never to touch them again. I still recieved a lot of feedback... most of which was "Thanks!". Why? Because it gave people something to start from, or an example to use for a different implementation. I'm sure no one used anything in a "production" environment but that was never the purpose.

Publishing an open-source project is _never_ a bad idea. The more code and collaboration out there the stronger the community is. I never wanted to be the best at making program X... I just wanted to be helpful.

I think people have a hard time understanding that you don't always have to "win" at everything. Sometimes just being nice, or helpful can be its own reward (both to you and the community).

Friedmud

Re:boost leads to more exploits

[Rosco P. Coltrane]

are you implying that for-profit developers don't take pride in their code?

All developers in closed-source companies that I've known would *like* to take pride in their code, but they always have to respect tight schedules, and end up writing "good enough" code (good enough meaning, sure, there are bugs, but no show-stoppers).

I'm quite sure Microsoft developers aren't told to take the time to do things right. They're told to hurry the hell up and make it work. I'm also quite sure most of them would prefer taking the time to do things right, but their employer doesn't pay them to do that.

i'd advise you state your views on your resume. employers will probably want to know about that.

You misunderstood my views. My view is simply that not release the source code makes it easy to hide bad code, and even the best engineers can't go against their management's wishes and constraints.

As for me, I was a developer, so I should know what I'm talking about. Not anymore though: in my new line of job, I can tell the customer to get lost until I'm sure everything's done just right, and he's usually happy with that, because my products cost well over $10k a pop and he prefers waiting than having a botched-up result :-)

Re:boost leads to more exploits

[Linus Torvaalds]

Microsoft bought Spyglass

No, they royally fucked over Spyglass. They made a deal with Spyglass so that Spyglass would get a cut of all the profits made from Internet Explorer as it was based upon Spyglass Mosaic. Remember, this was back when web browsers were something you could buy in a box. Getting a cut of all sales for a flagship application sold by Microsoft? Spyglass must have thought they really lucked out!

Then Microsoft illegally dumped Internet Explorer on the market for no cost in order to kill Netscape. 5% of zero profits isn't a lot of money, is it? Spyglass no longer exists.

Re:boost leads to more exploits

[Rosco P. Coltrane]

okay, you have an opinion, but please don't attempt to make blanket stmts about working software developers because you have run ins with a few crappy engineers and poorly managed projects, companies.

I was in this industry long enough to make such statements. Apparently, you seem to be working for a sensible company where engineers are listened to, and I'm glad that you do. However, I can assure you you're in a minority.

i know you're looking for mod points, but don't you think you've speculated enough for today?

Do you really think I'm looking for mod points, after having posted on this here board for 6 or 7 years and gotten all my karma on the first two days? ;-)

Besides, you don't have to be hostile...

Re:boost leads to more exploits

[Anonymous Coward]

> Microsoft bought Spyglass and

No, they did not, quite the opposite, they tricked them into doing the work for free.

MS contracted Spyglass to write IE from Mosaic but the payment was to be $5.00 for every copy of IE _sold_. When they 'gave it away' they did not need to pay Spyglass anything.

Spyglass sued and lost. MS insisted that it was never 'sold' even when it was an unremovable part of Windows that was sold.

Re:boost leads to more exploits

[syousef]

Publishing an open-source project is _never_ a bad idea. The more code and collaboration out there the stronger the community is. I never wanted to be the best at making program X... I just wanted to be helpful.

A lot of people operate under this assumption. Sadly they're just plain wrong, and here's why: If you have 1000 pieces of software that all claim to do roughly the same sort of thing, and 999 are hacks, finding that 1 good program is going to be an excercise in frustration.

End users are likely to come across one or more of the hacks, curse about open source rubbish and go back to using close rubbish that at least works a little better. More sophisticated users will go and find out what other people are happy with, but it still makes the process much more complex.

It's the same reason having thousands of distros,f ew of which work well, is a bad bad thing. Some diversity is a good thing, but too much diversity is almost as bad as none.

If open source wants to survive, we need more focus on a narrower range of products as well as solid lobbying of politicians to keep open source legal.

To be fair the sorts of software you're talking about writing yourself sound more like code snippets than fully functional programs. That's not so bad since your target audience is generally other developers, and they can be expected to sort through software.

Re:boost leads to more exploits

[friedmud]

I do see your point but I think that it is just from a different point of view.

What I was trying to get at is that a lot of open source developers don't have end users in mind at all when they create the software they do. I certainly don't have any goals of winning anyone over to OSS. I use it because it fits my needs and I don't mind all the diversity.

For people that "Just want stuff to work" there are other options out there (Windows, Mac). For people who like to hack around and find new things and collaborate/cooperate to build better environments _for themselves_ we have OSS.

What I'm trying to say is don't corrupt my open and collaborative environment just because it doesn't suit your needs. If people don't like the diversity then they can look elsewhere.

OSS has ALWAYS had diversity and it ALWAYS will. I personally see this as a strength (OSS becomes a melting pot of ideas, where everyone learns from eachother). Again, the goal is not to conquer the world, but instead to make ourselves happy.

When you say "having thousands of distros,f ew of which work well, is a bad bad thing"... who is it a "bad bad thing" for? The people making the distros are (for the most part) doing it because it is interesting _for them_. If people use it then that is great... if they don't then that person still had the experience of creating something... something which appeals to all scientific and engineering types.

This type of argument reminds me of when people criticise other people for having odd hobbies. "What an idiot! I can't believe he spent 2 months designing and building that case mod!" In general humans are very diverse and have lots of different interests. Some like to collect beanie babies, some like to code up pet projects on the weekend (regardless of whether or not something already exists that does the same job).

In essence I'm saying that for most OSS developers it is a hobby. As such let us do what we like. If you don't like the way it turns out then use the other alternatives.... no skin off our back.

Friedmud

Ironic

[deaddrunk]

That the page doesn't render properly in the browser they're biggin' up.

Main advantage

[mfloy]

The main reason I like Firefox is that it pushes innovation. Back when IE was the clearly dominant browser, with no real competition, there were very few sensible inovations for browsers. Sure, a few little things here and there, but for the most part it was monopolized. Firefox's popularity will ultimately lead to a better browser market all around.

Re:Main advantage

[dsginter]

Speaking of innovation, someone should innovate an ActiveX IE plugin that simply changes the IE rendering engine to Gecko.

Then we could all use CSS the way it was meant to be. The drone consumers will never know the difference.

Re:Main advantage

[Zathrus]

q[ I'd be happy if firefox can just fix the CPU hammering/memory leak with Flash by 2.0.]q

Given that the issue in question also occurs in IE, Safari, and any other browser with a flash plugin regardless of OS I'd guess that this is not a browser bug.

My guess is that it's a race condition inside the Flash code itself. It doesn't appear on all systems, even if they are running the same OS/browser/flash revision (and viewing the same content).

At least with Firefox you can install Flashblock and not be annoyed by CPU gobbling flash unless you really want it.

Re:Main advantage

[dpilot]

You underestimate your argument.

When competition disappears from ANY market, that market stagnates. For the moment, I'll follow your example and continue to pick on Microsoft, but it's by no means limited to them. Way back in the early PC days, DOS advanced fairly rapidly to DOS 3.3, driven by hardware introductions. There was also a not widely used or known multitasking version of DOS (4?) as well as IBM's much-maligned DOS4. But basically, DOS stagnated after V3.3.

That is, until DRDOS 5.0 came out, offering much better value. (More features, not sure if it cost less.) Then Microsoft followed, and brought out their own DOS 5.0, and the stakes were upped again with DRDOS 6.0, etc. Somewhere in there, Microsoft slipped the legendary AARD code into Windows 3.1 to chill the DRDOS uptake, and also around that timeframe they "incorporated" disk compression, courtesy of Stac Electronics. (lawsuits followed, on both counts.)

But IMHO, if DRDOS 5 hadn't appeared, it would have stayed DOS 3.3 under Windows until the whole Windows vs OS/2 battle started. Also IMHO, lacking competitive pressure in a given market, a company will invest its development dollars elsewhere, and milk the stagnant market for all it can.

Re:Main advantage

[jlarocco]

Firefox hasn't innovated anything yet.

Innovating is coming up with something new based on something else. Firefox copied almost everything it's popular for from Opera, then zipped past it in userbase, and claimed Opera's innovations for its own. No matter what the fanboys try to tell you, it's still just copying.

Re:Main advantage

[Tumbleweed]

I've read that the upcoming new version of the Flash player solves the CPU usage problem quite nicely, but, of course, time will tell.

and...

[cryptoz]

an article to go nicely with the story http://netscape.com.com/Opera,+Firefox+squabble+ov er+best-browser+claim/2100-1032_3-5740879.html shows another side to the whole FF thing.

Security

[ad0gg]

I want to know how firefox devs plan to address security concerns with the browsers. It seems as firefox gets more popular, the number of exploits keeps rising.

Firefox security information

Re:Security

[DrEldarion]

For the longest time, people have been saying that linux/firefox is more secure than windows/IE. One of the response to that is that it's likely that the reason windows/IE has more exploits for it is because it's the most targetted since it's the most popular.

Now that we're seeing firefox gain foothold, we're starting to see more exploits for it. I wonder if they will be proven right?

Re:Security

[man_of_mr_e]

Wow, you are so completely wrong on a number of counts.

First, It takes the mozilla team an average of 2 MONTHS to fix security issues, not the "same day". Further, The vast majority of IE vulnerabilities happened before Firefox even reached release candidate stage.

For example, FF 1.05 patches 12 vulnerabilities. The oldest from April, the newest from late May based on the creation date of the referenced bugzilla reports.

http://www.mozilla.org/projects/security/known-vul nerabilities.html#Firefox

Firefox has had 56 publicly announced vulnerabilities this year. 24 of them of High or Critical severity.

Re:Security

[div_2n]

Uhh, show me any news stories about "exploits" in the wild. What you hear are security flaws that have been found due to the source being open and then promptly being fixed.

Using the word exploits seems to indicate that there are malicious websites out there taking advantage of a security hole. There may very well be, I just don't remember hearing about it.

Re:firefox

[ninjaadmin]

Unless of course, the site is publishing an application using "one-click deployment". In that case, the code executes on the client, and the client would need the framework. (I know, doesn't really apply here... just a technicality)

Re:Name one platform Firefox doesn't suck on.

[Anonymous Coward]

Your well-reasoned and insightful arguments have convinced me to uninstall Firefox.

Too bad ZDNet sucks

[Gothmolly]

I mean, they were alright and cool back in 93-94, when WfWG was out, and worked pretty well, and Novell was cool, and PC Magazine could review 8 or 10 word processors in a shootout article. But now they're just pundits, like Dvorak, who respin company press releases as insight. Sort of like a glorified, corporate, Roland Piquipaille.

Anyway, nice to see FF get some press, but I wouldn't take it too seriously - PHB doesn't trust it anyway, and Joe 4Pack doesn't read ZDNet.

Dicey logic?

[DrEldarion]

If you look at all of statistics they average out to us being about 10 percent of the Web. There are estimated to be about 1 billion Web users, which means there are about 100 million Firefox users out there. It has only been downloaded about 65 million times, so the other users are people who got it some other way. The most likely place they are likely to have got it from is corporate deployments.

Now, I haven't seen these statistics myself, but they seem a bit off to me - that 10% figure is probably skewed somewhat. Considering that the people with firefox installed on their computer are the people most likely to be on the internet a lot in the first place, usage statistics for it can be misread easily.

Also, they say 65 million downloads of Firefox have been made... how many of those were repeats? I've downloaded the program quite a few times, and considering that each upgrade just requires you to download the full install again, there's no way that 65 million downloads translates into 65 million users.

This just reeks of using statistics in a misleading manner.

Re:Dicey logic?

[QuantumRiff]

Actually, the downloads are only for new installs. The upgrade servers are not counted. There was an article here on slashdot talking about that, but I'm too lazy to look it up. It was when firefox released version 1.0.

Re:Dicey logic?

[rpdillon]

There are a lot of related questions, but going in the opposite direction, like:

Linux that use central repository package management use Firefox versions which were never downloaded from the Firefox site, and were never counted.

Anyone who uses The Open CD, or Knoppix, uses Firefox but hasn't "downloaded" it.

OEM CDs, as well as ISP's CDs contain Firefox, and are not counted.

And lastly, as the post above mentioned, corporate rollout of the browser will never have a number of downloads equal to the number of computer upon which the program is installed.

In others words, your point is perfectly valid, but only serves to show that the whole "counting the number of users" idea is actually quite a challenge.

Women in OSS

[BigZaphod]

This is part of one of the questions in the interview: "The open source community generally has problems encouraging women to participate."

Why is this seen as a problem? The open source community doesn't really try that hard to encourage *anyone* to participate regardless of gender or race or nationality. It just is what it is. Those who participate decide to do so on their own and there's virtually no barriers to doing so. The way that question is phrased it is almost as if there should be some kind of OSS organized effort to specifically attract women to the community. What would be gained by such a movement and why is it even implied to be necessary?

Re:Women in OSS

[jimbolauski]

"What would be gained by such a movement"

You need to think outside the box yong grasshopper! Wet oss t-shirt contests, home cooked meals instead of vending machine meals, the benifits are limitless.

Re:Women in OSS

[Phroggy]

Why is this seen as a problem? The open source community doesn't really try that hard to encourage *anyone* to participate regardless of gender or race or nationality.

The more people involved in open source development, the better. Slightly over half the population are women. It would be nice to have more women involved in open source development, simply because it would be nice to have more people involved in open source development.

It just is what it is. Those who participate decide to do so on their own and there's virtually no barriers to doing so.

Are you sure about that? Perhaps girls are being pressured by their peers, parents, the media, etc. that doing geeky computer things isn't cool, and they should look down on geeks with disdain instead of aspiring to become one themselves. Perhaps boys aren't being pushed away from it as much. Or perhaps because girls just naturally learn differently, the things that get boys interested in programming don't work for girls, and we need to figure out a different way to welcome girls into the fold. Or perhaps girls just aren't interested and we should forget about it. I think it's an issue worth looking at.

The way that question is phrased it is almost as if there should be some kind of OSS organized effort to specifically attract women to the community. What would be gained by such a movement and why is it even implied to be necessary?

Same reason there should be an organized effort to attract men to the community. The more skilled coders with itches to scratch, the better software we all get.

Extension security

[gpinzone]

Firefox has been praised for being more secure than IE, but some say that the extension model introduces security risks. Do you agree with this? Why have you chosen this model?

I'm not terribly concerned about extension security or performance. Most extension developers host their code at Mozdev and the bad ones get weeded out quite quickly. It's unlikely that a malicious extension will get popular as you can view the source of extensions. You can't view IE's source.

Was this interview before or after the GreaseMonkey debacle?

Stick to standards

[giorgiofr]

somebody made an extension which works well in firefox, but not good in IE. More of that is needed to fight on equal terms

No, please, do not wish for this. It would only lead back to the way it was a couple of years ago. We should just stick to standards and in the long run this will win by itself. Developers are the ones driving this market, they will enjoy the standards, standard-compliant browsers will be more appreciated, we will win. But if we start playing like MS does, we won't. And in the process the web will suffer greatly.

Component Model

[agsharad]

While IE is obviously going to learn a lot from Firefox and improve their browser, there is one thing they are unlikely to provide. And that is the component model that Firefox offers. The basic browser is very small (and fast). Then there are hundreds of add-ons to choose from. Users get to decide what they want and install it. The browser morphs to serve the user rather than the other way around.

Sad, but true

[ehaggis]

I like Firefox, I have deployed Firefox as the defacto browser in my company and it is my primary browser.

That being said, it is sad when only (a questionable) 10% usage rate is viewed as any type of challenge to IE. Have we lowered our standards for what real competition should be?

The reason he thinks IE 7 will spur more FF growth

[Infonaut]

Dotzler figures that fifty percent of Windows users are still on Win 2k, and in order to get all the spiffy new IE 7 features, they'll need to upgrade to XP. His calculation seems to be that people will become annoyed at having to upgrade their OS just to get a new browser, and will therefore jump to Firefox instead.

I'm not sure about that logic. When MS puts their mind to it, they can make a fine browser. They jump from IE 3 to 4 and then to 5 was impressive. My guess is that IE 7 will not be as bad as expected, and they may sneak in a few features that the Firefox team hadn't anticipated. Microsoft wants to push users to upgrade, so if they can create even one little "must have" feature in IE 7 that Firefox doesn't already use, they may succeed in enticing more than a few Win 2k users to buy XP.

Even if Microsoft doesn't roll out a blockbuster with IE 7, I doubt that the release of a *competing* browser is going to somehow push people to switch to Firefox. With all the press Firefox has been getting, if you haven't at least tried out Firefox by now, you're not likely to so unless IE leaps out of your browser and stabs you in the forehead.

The Future of Firefox is another 5 MB download...

[Steve_Jobs_HNIC]

Coding misstep forces new Firefox release

http://news.com.com/Coding+misstep+forces+new+Fire fox+release/2100-1002_3-5792635.html?tag=nefd.top


well....at least we have extensions.... here's my list:

TextZoom - because I'm blind as a bat
Adblock - use with Filterset.G from http://www.pierceive.com
Session Saver - saves tab sessions _when_ firefox crashes
Web Developer - lot of web dev options
IE View - click to view in IE
Target Alert - let's me know what I'm clicking on
ForecastFox - show forecast
FindBar Switch - makes the find bar toogle hide/un-hide with CTRL+F
Download Statusbar - much better than the download window/popup
SpellBound - because my spelling sux

IE bundled with Windows

[Hamstij]

As long as IE remains bundled with the windows OS, Firefox will *never* take off and reach a significant install base.

I work as a consultant for many IT firms, and even though they are perfectly aware of IE's limitations and security problems, they do not make the change to an alternate browser simply because it is far easier to stay with the one already installed on the system.

Inertia means that Firefox will always remain a fringe browser until some anti-monopoly law makes MS remove IE. And that will never happen. No matter how awful IE becomes now or in the future, sheer laziness means it will always be the predominant browser.

He said...

[Kjella]

It's unlikely that a malicious extension will get popular as you can view the source of extensions.

GreaseMonkey is not malicious. It is insecure. Yes, a third-party GreaseMonkey script could be malicious, but that is like saying Firefox is malicious because it has a security bug. Personally I prefer extensions that do nothing but passively manipulate my pages. We've finally gotten rid of most JS/Java bugs, and I sure as hell don't want to add another script language *cough* vbs *cough* activex. But I guess people want that kind of stuff...

Kjella

Re:unhappy with Firefox 1.x

[kashani]

Try removing all your extentions. I had a number that weren't exactly compatible from version to version that were causing a number of problems.

kashani

How does that differ from commercial or in-house?

[SuperKendall]

...And for every OSS trophy project you'll find a thousand half-assed weekend hacks that never make it past Alpha stage...

Yes you will. Just as for every succesful commercial or in-house app you'll see a thousand failures. But at least OSS failures are ones generally based on technical merits, and not so much based on a company running out of money or a project being killed for political reasons eeven though it's quite good.

Not to mention that each of those thousand failures is a learning experience for the next one. Remember Edison saying he didn't mind thousand unsucessful attemps to make a light buld because he now knew a thousand things that didn't work? It can be (not saying it always is) the same with OSS. You can actually see what people pick up and use, and try to understand why.

You do see some simialr bugs cropping up across a lot of different forums, because programmers make simialr mistakes and a lot of software is being written and re-written for a huge range of platforms - like Java or PHP or Ruby. So sharing cannot happen quite as much as would be ideal, but at least sharing can happen in the form of UI sharing - if you like the way a user interacts with some piece of software you can replicate that.