Slashdot Mirror
Microsoft Research Showcases New Browser Prototype, "Gazelle"
Ars Technica reports that Microsoft has opened up about "Gazelle," a new browser prototype of theirs that is modeled after the underlying concepts of operating system design. "A research team led by Microsoft's Helen Wang recently published a report about an experimental browser prototype called 'Gazelle' that uses processes to isolate page content elements originating from different domains. It builds on the concept of multiprocess browsing but uses more fine-grained isolation to expand on the security advantages that are already delivered by existing multiprocess browsing models. But is it an operating system, Microsoft Research's analogue to Google's Chrome OS? Not quite."
Oh boy! A more secure browser from the pros at secure browsing, Microsoft.
Microsoft focusing on developing a browser-based OS is directly opposed to their current business model, which involves forcing users to purchase an operating system. Microsoft's focus has always been on for-pay, offline applications. Taking a precautionary foray into Google's future business model seems to show that they are at the very least wary of Google's future plans.
"Going to war without the French is like going deer hunting without your accordion." ~General Norman Schwarzkopf
MS's idea is nice, but it's not going to help a lot of things very much. It'll help when plug-ins and helper apps go runaway, being in a separate process they won't be able to block the browser itself. But from a security standpoint the problem isn't that those embedded objects are in the same process, it's that they have access to the same page and the DOM elements in it and the data structures of the browser itself. And that won't be solved just by putting them in their own process, not without isolating them from the rest of the page and browser to a degree that'll break a lot of Microsoft's technologies.
After reading that article, I'm much less excited than I was. I had assumed it was something similar to Google Chrome OS, but it's not even something that seems like it turned out very well for Microsoft, or something that can have yet undiscovered major issues on the horizon. The idea seems to have turned out overly complex to work around the limitations with the approach, and all that in a resource hungry .NET application. It says they're hopeful to get the per-tab RAM usage down from 16 MB, but I have to wonder by how much? This approach doesn't seem much better than running a process-separated browser written in Java. Ugh.
I have a hard time understanding the decision to use .NET, but perhaps it was a security decision? Anyway, it doesn't sound like the optimal choice, when the project all revolves around low-level features like isolating the tabs even further.
Beware: In C++, your friends can see your privates!
I am far from an expert on browsers so I am genuinely curious to know if this will keep the browser from occasionally "stalling". Will it allow the browser to keep downloading/processing the parts of the web page that it can even when certain elements are unavailable? If so, sounds like a good advance!
Just FYI, Bing is a search engine, not a browser. And as for "Bing is not Google" (cf to Gnu's not Unix) I'm sorry to tell you this was largely utilized around /. a while ago...
Slashdot, fix the reply notifications... You won't get away with it...
IE doesn't support web standards, but people still use it because it has Microsoft's name. Maybe this will get people to switch to a (hopefully) standards-compliant browser.
It builds on the concept of multiprocess browsing but uses more fine-grained isolation to expand on the security advantages that are already delivered by existing multiprocess browsing models.
That's a new definition of security of which I was previously unaware. Just about anyone who's spent five minutes trying to do multi-process, multi-thread, unsyncronized accesses, cloud, spin-locks, etc., will tell you that no, there are no inherent security advantages. It'll be less secure unless you make a dedicated effort from project start just to keep it on par with single-threaded. The only "advantage" it has is that when it fails it'll crash more slowly, with a wider variety of obscure error messages, hammering the operating system as it tanks with the extra overhead as it does so. Yes, it might be slightly harder to develop an exploit because it's not using a generic flaw, but some complicated and obscure flaw -- but that's not more secure; Only badly designed.
#fuckbeta #iamslashdot #dicemustdie
Some of Microsoft's technologies - like data files that can execute code - need to be broken. It is sometimes necessary to sacrifice convenience for a degree of security. The personal computer industry has been slowly coming to terms with this for the last 10 years or so, it would be nice if we don't have to wait another 10 before it all works properly.
From scarped cliff or quarried stone she cries "A thousand types are gone, I care for nothing, no not one."
It's largely a .NET application that uses Internet Explorer's "Trident" rendering engine.
Granted, it has made significant improvements but I still haven't been that impressed by the Trident engine. Sometimes I wish they'd use someone else's engine so that they'd be kept up-to-date on standards AND you'd have the same browsing experience on multiple browsers.
I guess I can understand why they don't though... they'd be up a creek without a paddle if they used Webkit and people stopped developing for it or licensed Gecko from Firefox and they went under or yanked Microsoft's license.
Ummm... Isn't a Gazelle kind of a fast animal?
Since this browser runs at half the speed of the not exactly quick IE 7, shouldn't it be given a code name more in keeping with it's actual speed? I've always thought Ubuntu had a cute naming scheme going. I hereby dub this software Turgid Tortoise
Unless if by new you mean:
From february at least, seems older to me: http://research.microsoft.com/apps/pubs/default.aspx?id=79655
Has already appeared on slashdot and a hundred other tech sites.
http://tech.slashdot.org/article.pl?sid=09/02/22/1724244
Its hard to google before you run to try and get a story submitted isn't it?
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
What they don't tell you is that the part of the gazelle it most closely emulates is the stomach; which, in ruminants, implements four-chambered process isolation in order to safely digest large quantities of low-quality input. This seemed like a valuable feature for a web browser.
Still faster than Firefox 3.5 - http://www.youtube.com/watch?v=6cWzWil_h8s
Sounds neat. I shall get it immediately.
Well, right after I get Windows 7, which will be after I get Vista, which will be after i get XP which will be after I decide microsoft have done anything worthwhile after Windows 2000.
They whose government reduces their essential liberties for temporary security, receive neither liberty nor security.
Ruminants have multiple chambers, period.
There is no set number and it depends on species.
There is nothing to do with safety in ruminants, and more to do with the fact that they eat foods that require far more processing to be broken down into useful components. Basically the food ferments in their 'stomachs' as other bacteria and such break the food down as the bacteria eat it, then as it makes its way along the process it becomes something useful to the animal itself.
Cows can't eat grasses. They can how absorb the byproducts of the grass that ferments in their stomach thanks to the symbiotic relationship with the organisms in their stomachs.
Yes yes, its off topic, but I've just been the boyfriend to 4 years of vet school. err, I mean a girl in vet school.
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
hey it is not slow but is DIFFERENTLY ABLED.
Have some respect please.
Moving away from the DOM is ultimately going to confound searching engines and the namespaces they index. It would be nice to see Javascript running inside a VM - CLR or JVM, followed by other languages with the same access that Javascript has. Making Javascript a language under .NET in IE, perhaps using the Java VM for Javascript in Firefox etc. This may lend itself more readily to an indexable semantic web in the future.
MS Research
All in all, i think it is a great idea for them to be researching things like this.
But the fact they are still with Trident hurts me and the web greatly.
Please Microsoft, switch to Webkit or anything else.
Or even scrap it and make a new one and don't force it to replace IE-whatever if you update, just move away from Trident!
Trident was a horrible idea and always will be. The quicker it is killed off, the better for them and us. (especially since Microsoft have now realized it is a futile attempt to build their sites around IE since the numbers of users are dwindling)
Also, i lol'd at the URL
http://research.microsoft.com/en-us/um/people/helenw/papers/gazelleSecurity09.pdf
"um" indeed, Microsoft.
Well, we were so eager to get rid of segments that by the time 80386 more or less perfected them, we dumped them for flat mode. Now they are gone in x86-64, likely never to return. What a terrible mistake! If we had different segments, we could have a lightweight browser process with user space threads assigning segments to different domains on the page. Instead of trying to get protection by wrapping software sandboxes around everything like Java, C# or something else does, we could have the CPU actually doing it. If only I could go back in time and say to myself, as I fumed over the likes of ES:CX... and say, no no, this will actually turn about to be a good thing in the future!
This is my sig.
They might have better luck reducing the "resource overhead" if they programmed the kernel in something other than C#.
Floating in the black seas of infinity without a paddle.
Well, "Fronkensteen" (stitched together from discarded rotting corpses) was already in use, and "Staggering Fat Man" was voted down by the focus groups.
No folly is more costly than the folly of intolerant idealism. - Winston Churchill
How long have we had browsers? How obvious is all of this? This reads like an article from 1997.
We are still debating the best way to multi-thread a browser!
One might have thought that we would be a little further along with this kind of stuff.
The UNIX designers were adamant about process-based isolation, to the degree that UNIX for a long time did not have kernel threads (early versions of Java had to emulate threads even in the mid-90's). Macintosh and Windows were much quicker to adopt threads.
It's kind of ironic that Microsoft now is pushing for process-based isolation. Their window system, of course, has also moved to a client/server architecture and asynchronous calls now, like X11 already did 20 years ago. Why don't they just go all the way and adopt UNIX or Linux? And if they really want to be cutting edge, they might switch to Plan 9. :-)
I guess thats an advanced concept for application programing in the world of Windows where fork() is still an alien concept.
Excuse me while I remain unimpressed. I'll wait a while longer while MS familiarise themselves with common programming techniques developed in the 1970s.
What I want in a new browser is one that, if I tell it to go to http://www.domain_1.com/ then that's where it goes, and it makes no attempts to download anything from any other domains. No cookies sent to doubleclick.net, nothing to googleanalytics.com, etc etc. Does the new MS browser do that? If so, great. If not, then I have no incentive to look at it because firefox is adequate.
Clearly they named it Gazelle because ultimately they expect it to be killed off by safari.
If we start buying CDs then the terrorists have already won.
Actually, the PP has a point, why don't they rename themselves "Bing"? After all, "Microsoft" is not only a stupid-sounding name (wow, a portmanteau of "microcomputer software", how clever. They must have found someone with a lot of imagination to come up with that. Probably the same genius that came up with the totally non-obvious name "Internet Explorer".), but it's pretty obsolete-sounding too since no one uses the term microcomputer any more.
However, Bing Crosby's spirit might take offense, if he hasn't already, to them stealing his name.
A research team led by Microsoft's Helen Wang discovered how to rebrand and skin a theme for the widely used Firefox. "Since most people already think we stole Firefox code to render webpages correctly with IE 8, we got to thinking..." Helen Wang stated in a call yesterday. "Our next IE release will be simply to rebrand and change the default skin of the latest Firefox web browser! So we can then say, finally, that Internet Explorer correctly renders web pages according to W3C published standards." This move seems to secure Firefox as the dominate web browser with a huge influx of new users. "Most people use Firefox because they have realized Internet Explorer was never able to render HTML correctly. This is in part because we have habitually hired software engineers that have never heard of www.w3c.org." This last fact is found to be true, on a job application for the Internet Explorer Development Team, which looks a bit like a Mc Donalds application, the first question is . "1. Do you know of www.w3c.org?" followed immediately by "2. Do you know what the word 'standards' mean?" Helen Wang affirmed that answering any of these two questions with 'yes' will disqualify you for any prospective position on the Internet Explorer Development Team.
We can only suspect that Microsoft will soon shift back to their own broken browser after people stop switching over to a Firefox branded Firefox.
If MS ever ships a browser that passes ACID 3, let me know. Until and unless that happens, MS's offerings in this area are a waste of space.
-jcr
The only title of honor that a tyrant can grant is "Enemy of the State."
Now Google came out with their free OS with browser MS is striking back. They will now retaliate with their own free OS and browser system. MS is so competitive, they can not loose, they will dominate the free market, if necessary by bribing their way in. You may have vacuum on your head, but we have more vacuum in our heads.
This is business at usual for the Microsoft people - but the real world has changed while they weren't looking. That "internet" thing that Bill mis-predicted has allowed news and information to be disseminated at lightning speed. Those who deal in lies and deception no longer have the cloak of secrecy to hide behind.
If Microsoft wants to actually invent something new, we'll be right here to cheer them on. But they need to realize that the days where "innovation" meant stealing from others or stupid (Microsoft Bob) useless (talking paperclip) junk were marketable are over.
I'm not expecting much from them, though. That "I'm God" feeling that comes with great success will be their downfall - they are yet to realize that they're not anything special in the real world and their attempts to force new standards will no longer be a "fait accompli".
They lost sight of who their customers really were and created Vista - and it was a sales flop. If they didn't have those restrictive contracts with hardware vendors to force it onto new machines their sales figures could be counted on their fingers and toes.
But now they're coming out with Windows 7 and there's a huge marketing push going on - and the nice folks at Microsoft are being very careful not to reveal that Windows 7 is really just Vista with some (but not all) serious bugs fixed and just enough changes to the user interface to make it appear to be something different. Even the IT savvy people here on Slashdot are hailing Windows 7 as being something special.
Hey, guys - the DRM is still baked in and everything that was bad about Vista is bad about Windows 7 too. And for those who believe otherwise, here's a challenge: name one single thing in Windows 7 that provides more value to the customer than XP. Just because they can hang more bells and whistles on the same old pig doesn't make it a better pig.
It has been a while since I took the operating systems course in my undergraduate CS curriculum, but I seem to recall that there is a balance to be struck between too many and too few processes with regard to other related attributes such as security and stability. In some cases, notably in Sun Solaris, an attempt was made to capture more of the benefits of process isolation without the attendant overhead of full processes by introducing so called "lightweight processes" which provide more isolation benefits than threads but are not as resource heavy as full processes. I would venture a guess that this Microsoft Research project will reach the same or similar conclusions of early web server developers (CGI, for example); namely that more is not always better when it comes to separate threads and processes.
great idea , now how about renameing linux next , seriously , how conceded do you have to be to name a os after your self??
It's not conceited; when Linus named it, he just thought it was going to be a little hobby project that he and maybe a handful of other students might work on for a bit. He didn't know it was going to become as big as it did. By the time its global popularity became apparent, it was a little too late to change the name.
Bing is a really bad name for the chinese market. If you read it as pinyin, the most common romanization system, it can mean ice, military or even illness. Not that attractive a name. Considering the importance given by Chinese to this kind of homophonous association, it won't help the marketing campaign.
Wow, that's interesting. First Coca-cola's "bite the wax tadpole", and then Pepsi's "Pepsi will bring your dead ancestors back to life", you'd think someone at MS would have thought of checking into this before settling on the name "Bing".
Oh well, it's not like MS has a track record of well-chosen names.
Beware of urban legends : http://www.snopes.com/cokelore/tadpole.asp
Coca-Cola's translation in Chinese is especially good and very successful. As it is composed of very simple characters, it is also one of the first words I learned :)
Another classic urban legend is the Chevrolet Nova : http://www.snopes.com/business/misxlate/nova.asp
Bing is translated with biying in Chinese (meaning roughly : "must answer", sorry I didn't manage to use sinogramms to add that little scholarly touch). Microsoft of course did not choose the character of "illness" or "ice". It still must be a little confusing for a Chinese user because he has to type "bing" on the address bar, while he sees another name on the page.
The post I was replying to was (seemingly) deleted (!). So mine doesn't make sense anymore...
Slashdot, fix the reply notifications... You won't get away with it...
It wasn't deleted; it was modded down as "Troll", so it's below your visibility threshold. There should be a link saying "x posts below your threshold" or similar, that you can click on to see the hidden post.
Posts are never deleted on Slashdot unless there's a problem with the system, or the Scientology lawyers threaten a lawsuit.
So it's got the plumbing of a Gazelle? That's not exactly appealing.
There's an interesting interview on Microsoft's Channel 9 with Dr. Wang and the grad student who wrote some of the prototype code here: http://channel9.msdn.com/shows/Going+Deep/Expert-to-Expert-Gazelle-Operating-System-Architecture-and-Web-Browser-Security/
Language designer Erik Meijer conducts the interview along with C9's usual suspect behind the camera...
H Spencer long ago coined the razor "Those who don't understand UNIX are forced to re-invent it, badly".
the underlying concepts of operating system design...
What does that mean? Is the default home page is a blue screen?
I'm happy to slag microsofts sloppy lazy monopolistic crapware with the best of them; but microsoft research have produced some remarkable works. What is this crap? Research = repackaging with provocative, if meaningless, buzzwords? Was this from microsoft market research?
http://xkcd.com/250/
Just sayin'...
By "increased security", they seem to mean that its less likely the whole browser with all your tabs and data is going to suddenly crash. Which can be useful, for example you might be in the middle of filling out an intense job application form on one tab and suddenly the youtube video you were loading in the background takes down your whole session.
But I think calling it "security" just makes everyone assume they mean it will be harder for people to hack their system.
Surely if it takes 16MB of RAM just to load up the Google website (one of the simplest websites there is!) it's going to bring lots of new ways to crash or hack the system!!
Checkmate!
> great idea , now how about renameing linux next , seriously...
Idea! Let's call it GNU/Linux.
> how conceded do you have to be to name a os after your self??
Dunno but it seems to work well
What about Project Gazelle? Now that's something truly revolutionary. http://www.projectgazelle.org/
The Hound
Think of how stupid the average person is, and realize half of them are stupider than that.
Microsoft Research Showcases New Browser Prototype, "Gazelle"
Like how, they 'published a report', without actually producing anything like a prototype, in a Ars Technica article, the day after Google announces Chrome OS. If I didn't know any better I would suspect the whole excercise was designed to steal Google thunder.
Of course, I wasn't the one who got $200k in UEO grants for the damned thing.
I *had* to think of the "safari" in Jurassic Park, when you mentioned this.
Didn't go so well, when that Mozilla arrived. ^^
Any sufficiently advanced intelligence is indistinguishable from stupidity.
It'll be called Internet Operator. It'll tap into the full potential of the internet quite like how Windows 95 tapped into the full 32-bit performance of your 486, only better.
Copyright != Trademark
Modding me down won't make your products worth using.
-jcr
The only title of honor that a tyrant can grant is "Enemy of the State."
unless you're talking about Safari on OSX, and not on Windows, then I have to laugh heartily at that comment.
Undoing a mod-mistake.
Stop trolling.