Java also lets you re-throw a typed exception as untyped and then you don't have to every worry about handling it (which may confuse people using your code). catch(Exception e) { throw new RuntimeException(e); } etc.
Saying that it's good that java forces you to handle typed exceptions is not always a good thing. Typed exceptions are nice for small programs but on large scale they are a pain.
This way if 'i' changes from short to something a bit more complex you don't create a duplicate object when you do a post increment (thanks for Scott Mayers for that one).
I can't agree with you more, I said basically same thing on digg and got -20 diggs for my comment. People do not realize how important early optimization is given deadline creep (notorious in game industry). You never have time at the end to optimize because you are fighting with sales/marketing on what features to cut and what date to meet for optimal sales.
Many people also mistake optimization for well written code (as in efficient algorithms) and honestly compilers can't optimize a poorly designed algorithm most of the time.
#define should only be used for constants, macros can make the code very unreadable (especially to novices that this article targets) and thus it should have suggested using a 'static const' instead.
It should have also mentioned following Doxygen like formatting for comments so that when all is done you can run Doxygen (or any tool that generates comments) and get some API like documentation done. Doxygen style of using/*! */ or//! is supported by many other doc generating packages.
Few friends moved from Bay area to R-D and Charlotte, all 3 got salaries about 5%-10% lower than the valley and with cost of living about 40% lower and reasonable real estate prices, they are all happy so far. The toughest part is job hunting (implied move) and physically deciding to pickup your family and moving (much easier if you are single of course). The one in Charlotte actually told the company he will move himself knowing that they would almost match his salary and that housing costs are about half, so it required a small investment into the actual move but I think it was worth it for him.
Then this is what you should do. There are plenty of tech friendly cities with affordable housing and relatively low cost of living. Portland, OR; Austin, TX; Vancouver, BC; Raleigh-Durham, NC; Heck even Boston, Seattle and New York City are a steal compared to SV (if you live in one of the suburbs nearby). I lived in SV for 5 years and could not reasonably afford a house and family with developer salary (pure interest loans never sounded good to me); so I moved to Austin and managed to buy a house without much trouble and enjoy it a lot and glad I moved away from the valley (not to mention all the fun life outside of work which the valley sorely lacks unless you want to drive to SF every night).
Any language in the hands of bad developers can cause problems. While C++ heap corruptions can be easily detected by number of tools (including MSDEV), good programming is not something a compiler can always help with. Java suffers from many other problems like resource leaks, circular refernces that prevent GC from cleaning up correctly, object bloat (objects for everything under the sun, I suppose pun intended), and oevrall code bloat. WebSpehere that I worked with would take 1.2 GB just to start up and we often hit the 2GB barrier, there is way too much stuff with java that you just don't need but it's there taking up resources and space.
I have been writing CGIs since 1994 and often used the CGI as a test or proof of concept. The thing I do not like about them is to make them work you have to write additional "services" that manage things like persistence, database connection pooling, static content caching, XSLT processing (caching parsed stylesheets), etc.
I can see when you have a highly changing environment, a CGI offers enough simplicity to make the needed changes without having a framework to rely on (heck, my CGI library was designed to let people write C++ objects that would inherit common functionality accross CGI calls to make life easy, and that was in 1995). Since mid 90s I have run across way too many complex problems that CGIs were not always ideal in solving (most revolve around database connectivity and session management), so I have been drifting more and more toward app servers (and not java kind, I have what happened to java, too many corporations with their pointless JSRs have made it into a bloated sack of lard).
Your point for CGIs is valid, they offer great isolation, but I tend to lean to speed and efficiency when I can, so I have been drifting away from CGIs.
What does java have anything to do with this? My CGI and app server are both in C++. Yeah you can look at websphere with a 2GB footprint running HelloWorld and wonder wtf is going on, but a C++ app server will take maybe 20MB to do the same, java app servers are a bloated mess (this includes tomcat, jboss, websphere and weblogic; use/used them all and very very disappointed, but maybe when 32GB is considered a low number for server memory will it not matter anymore).
Anyhow, CGI is so 1995, it has its place. Every point you made above, can be made about pretty much anything, so it's not saying that CGI is a benefit, just says that you did your due diligence and wrote maintainable/structured code; I am sure you would do the same if you were working with an app server. The only benefit inherent to CGI is process/thread isolation; which is a trade off since process creation is a bit heavy but affords you the isolation. Well written applications running on an app server can do the same. If you expect your code to do horrible things to the process space, then yes, CGI is the way to go, otherwise I would pick efficiency over it any day. Personal choice maybe.
This was relative test on a very slow outdated machine, so the absolute numbers are not relevant, the relative ratio is. While I am not saying that CGI is bad, I am saying that there are ways to do better.
As a CGI library (freeCGI++) and an app server (AsynchObjectServer) developer, I can tell you that CGIs are extremely inefficent (but rather a quick and dirty way to build server side apps); there is so much you cannot do well with CGIs, like caching the executable/library (although FastCGI fixes this a bit), caching of static/global/app data, database connection pooling, HTTP pipelining (for all except IE), pre-parsing of data, templating, etc. I can write two simple apps (and I have actually) that do nothing but send back to the browser a simple XML doc . Both CGI and app server is in C++ and with CGI the execution takes 70-80ms and with an app server 5-8ms (on the same machine, albeit an old slow one but it's a relative test). There is a lot that needs to be built up with CGI execution (environment hooks, loading on executable, capturing of stdin/stdout, unloading), meanwhile the app servers (frameworks) can have it all pre-built and cached and only connection/request specific info needs to be built up.
The reason I wrote the app server and framework was to overcome the shortcoming of CGI (yet I still support the CGI library the same, it's great for quick app development as a proof of concept or prototype). I would never use CGI for any large scale development (maybe that's just me).
We have run into a lot of problems with WebStart (haven't tried NET yet so don't know). But versions are a big problem with java, something that works on jre 1.4 may not work on jre 1.5 and to code for jre 1.3.1 just to be compatible is often limiting. This doesn't even address the issues of a problems in 1.4.6 (for example) that do not occur in 1.4.7 and you may need to avoid or write your own way to doing it to avoid this..NET got the version handling down much better, so I would be interested in seeing it work.
You missed a critical part: production should be 2 identical environments. One is currently running and the other is the fallback/deployment.
Lets say you have 1 machine in production (not likely but makes it easy). Machine A is serving all the traffic. Machine B is out of the "loop" via load balancer. You deploy your staging code to machine B and run some smoke tests. Once all is go with Machine B, the load balancer flips or slowly migrates traffic from A to B (can do all or stage it by percentage of users, this depends on the volume of your site, very big sites usually do 25/50/100% or 10/25/100% or 25/50/75/100% whatever fits your size). Now A is offline and contains the last release and ready for fallback until your next deployment, which buys you enough time to flip to A if there is something critical in B that affects business. I worked at a place where there were multiple fallback just in case (and when billions of dollars are on the line, you need that kind of fallback).
In real world, Machine A is a cluster of machines maybe 100 maybe a 1000, depends on your business demands and if you are running 1000 machines, having another 1000 as a backup is not am issue since you can borrow from the fallback pool if anything fails in production and things fail (drives, memory, network cards, power supplies, whatever).
SVN is nice from teams Staging -> Prod is dead on.
The only thing I would add is keeping a machine for each older release (up to maybe 5) so that you can do regression to see when a certain bug was introduced. At one place I worked we had 10 machines that worked like a circular queue of all past releases and if you get a bug in the current staging build, you can go back a in releases to see when something was introduced. This depends on the business you are in and frequency of the releases, you may only need a few regression machines.
Another point is to deploy things to a VM image (like VMWare) and allow developers to make copies of it (assuming you have the licensing for the OS) and test things in that environment. VMWare is a useful way to keep older releases around without devoting hardware to it. If you are on linux then you have no licensing issues and can make VM copies as needed (you can download an image from VMWare site they have links to a bunch of linux distros).
Email me if you have more questions, I have done this stuff with shops running on 10 machines and ones with over 5000 machines and 1000 developers, so I may have some useful hints.
There are too many things you give up when writing portable GUI code, Qt is ok, wxWidgets is ok, Swing is ok, AWT sucks; using native GUI elements is by far superior. For example, to write a windows app that uses dockable floating toolbars that are easily customizable and contain custom controls within them is relatively trivial with windows and extremely painful if not impossible with ohers because such behavior is not native on other OSs. While you can get portable GUI apps to be very functional, it requires more work to extend the lowest-common-denominator tools.
In the end it is not a question whether it can be done but rather how much work will it take to make it very usable and portable at the same time. I did it for a small app that ran on Windows, OSX and KDE as expected, looked a bit off on Gnome, then after getting Gnome right, OSX controls would not align, and so on. Eventually I just gave up with having to maintain 4 different VMs just to validate things work and now I just stick to WinXP/200x and work more on developing and less on making things portable. It's a matter of preference.
DVD is dying, torrents to portable/mass storage and On-Demand are the new direction. I estimate current DVDs will die in 3 years, replaced with HD-DVD or better. Eventually we will be buying hash ids that will be saved on our portable devices to allow us to view on demand anything we want via streaming.
One can always create reverse honey-pot servers that connect to the chat channel and when given a command, reply with "I am sorry Dave, I cannot do that..." and then recite some multi-gigabyte random poem into the channel:)
The key here is "unpatched server" and of course it happens to be a windows box... hmmm...
The Stern broadcasts were being ripped to MP3s the day they started, people just converted incoming audio and converted to MP3 on the fly. I thought the reason for not going via internet initially was that they were owrrie dthey could not provide adequate bandwidth and once people thought it was crappy quality, they would never come back. Bad publicity/impression at start is devastating, so I can see why they held off.
I listen to Sirius radio on the web daily (because I work in a valley between 2 mountains and no reception is possible). Honestly, the quality is great, better than FM radio. I also have a Sirius unit that unfortunately broadcasts via FM (since my car doesn't have a direct input and I am too lazy to rewire it) and the internet stream sounds better than FM I get in my car.
As far as Howard, his show is quite amusing for the guests he has and the non-standard questions he asks them. Even though on satellite he is not censored, the language is not overused. Bubba is also quite interesting in a dirty sexist sort of way.
Howard is a good reason to get Sirius, but I presonally like Hard Attack channel where I can listen to new death metal and interview for which I would have no access over coventional radio.
I don't care about CD quaity, I grew up in the tape-swap 80s and scrambled premium channel over airwaves decade, so I think my brain is trained to smooth out and unscramble stuff I hear and see:)
I also listened to XM with the dish I had and their channels are not very diverse, XM feels like their channels are part of some genre-based market study (and very generic feeling); but that's just me. All Sirius needs is a 24/7 Pink Floyd channel and I will be happy.
I think over time the bitrates will improve and I am hoping 3rd party software will allow me to record shows so I could listen to them when I have time.
Amiga at the time was very well designed (aside from an unshielded parallel port that could burn out the computer if IBM printers were used). Amiga had great graphics, very clean architecture (way better than Atari ST or IBM PC/XT) and it had great sound digitizer on-board; along with many other features. Games for the Amiga in the 80s were breath-taking.
And I too knew a guy named Justin that claimed Amiga was going to take over the computer world...:)
First came Jave applets and they were lacking and not supported correcty on all browsers.
Next came ActiveX and it was windows only and had huge security holes (we still feel today).
Next came Flash and it was simple enough that it started to catch on, but what kept it from really getting huge was that the developer kits are expensive and you really need to be in a company that can afford the kit (this keeps all the home grown web developers out of the mix).
Now there is AJAX which promises goodness but there is a huge issue with number of calls to the originating server and latency. Also a lot of server software is written in not so fast languages like perl, ruby, python and even java, while fine with standard web apps, are far from optimal for a complex AJAX app (this will only improve in time).
And here we have yet another clone to Flash and the only way it can wedge itself into the web world is to offer developer kits for free and charge for license to use it in production or commercial gain. If they are smart they will have a back end sever that can be quickly queried for data and charge for the OS/server software. In the early 90s microsoft offered free OS SDK for Windows 3.0 while OS/2 SDK was not, since I learned a lot of the early SDK stuff while in school I couldn't afford the OS/2 dev kit even though they had a better OS, so I learned Win16 SDK and when apps needed to be developed I used what I knew (by then it was Win32, MFC, ATL, etc). Free SDK and developer support is the key to winning over Flash, I think.
And text only browser on my atari 130XE would also be safe.
But come on, the study is obviously going after the huge market share of windows machines that run either IE or Firefox. If Kubuntu was as prevalent as Windoze then yes you would see a lot more hackers working on breaking them, it's a game of numbers; it doesn't help that for most novices windows is the first OS they get to use (and struggle with).
Then again, Symantec has always been in bed with IE and for them to claim that Firefox is insecure only means that IT people will insist on NOT having Firefox installed thus giving Symantec something to defend. It's a matter of survival and if a browser is secure they can't sell you thheir protection tools. I have had IT tell me that I had to uninstall my Firefox due to a risk factor and that I had to have a new version of Symantec tools installed, I flat out refused until they showed me concrete proof... I am still waiting.
I have not too many mathematicians who were into self promotion, especially is such a silly way. Most just want to be left alone to work in seclusion, but he is a complete unknown so maybe he's trying to make a name for himself. I heard he is in talk with Paris Hilton about a duet on her next techo-bland upcoming CD.
Slashdot Mirror
Java also lets you re-throw a typed exception as untyped and then you don't have to every worry about handling it (which may confuse people using your code). catch(Exception e) { throw new RuntimeException(e); } etc.
Saying that it's good that java forces you to handle typed exceptions is not always a good thing. Typed exceptions are nice for small programs but on large scale they are a pain.
should also be:
...
for (short i; i < MAX_NUM_ALIENS; ++i)
This way if 'i' changes from short to something a bit more complex you don't create a duplicate object when you do a post increment (thanks for Scott Mayers for that one).
I can't agree with you more, I said basically same thing on digg and got -20 diggs for my comment. People do not realize how important early optimization is given deadline creep (notorious in game industry). You never have time at the end to optimize because you are fighting with sales/marketing on what features to cut and what date to meet for optimal sales.
/*! */ or //! is supported by many other doc generating packages.
Many people also mistake optimization for well written code (as in efficient algorithms) and honestly compilers can't optimize a poorly designed algorithm most of the time.
#define should only be used for constants, macros can make the code very unreadable (especially to novices that this article targets) and thus it should have suggested using a 'static const' instead.
It should have also mentioned following Doxygen like formatting for comments so that when all is done you can run Doxygen (or any tool that generates comments) and get some API like documentation done. Doxygen style of using
Few friends moved from Bay area to R-D and Charlotte, all 3 got salaries about 5%-10% lower than the valley and with cost of living about 40% lower and reasonable real estate prices, they are all happy so far. The toughest part is job hunting (implied move) and physically deciding to pickup your family and moving (much easier if you are single of course). The one in Charlotte actually told the company he will move himself knowing that they would almost match his salary and that housing costs are about half, so it required a small investment into the actual move but I think it was worth it for him.
Then this is what you should do. There are plenty of tech friendly cities with affordable housing and relatively low cost of living. Portland, OR; Austin, TX; Vancouver, BC; Raleigh-Durham, NC; Heck even Boston, Seattle and New York City are a steal compared to SV (if you live in one of the suburbs nearby). I lived in SV for 5 years and could not reasonably afford a house and family with developer salary (pure interest loans never sounded good to me); so I moved to Austin and managed to buy a house without much trouble and enjoy it a lot and glad I moved away from the valley (not to mention all the fun life outside of work which the valley sorely lacks unless you want to drive to SF every night).
Any language in the hands of bad developers can cause problems. While C++ heap corruptions can be easily detected by number of tools (including MSDEV), good programming is not something a compiler can always help with. Java suffers from many other problems like resource leaks, circular refernces that prevent GC from cleaning up correctly, object bloat (objects for everything under the sun, I suppose pun intended), and oevrall code bloat. WebSpehere that I worked with would take 1.2 GB just to start up and we often hit the 2GB barrier, there is way too much stuff with java that you just don't need but it's there taking up resources and space.
I have been writing CGIs since 1994 and often used the CGI as a test or proof of concept. The thing I do not like about them is to make them work you have to write additional "services" that manage things like persistence, database connection pooling, static content caching, XSLT processing (caching parsed stylesheets), etc.
I can see when you have a highly changing environment, a CGI offers enough simplicity to make the needed changes without having a framework to rely on (heck, my CGI library was designed to let people write C++ objects that would inherit common functionality accross CGI calls to make life easy, and that was in 1995). Since mid 90s I have run across way too many complex problems that CGIs were not always ideal in solving (most revolve around database connectivity and session management), so I have been drifting more and more toward app servers (and not java kind, I have what happened to java, too many corporations with their pointless JSRs have made it into a bloated sack of lard).
Your point for CGIs is valid, they offer great isolation, but I tend to lean to speed and efficiency when I can, so I have been drifting away from CGIs.
What does java have anything to do with this? My CGI and app server are both in C++. Yeah you can look at websphere with a 2GB footprint running HelloWorld and wonder wtf is going on, but a C++ app server will take maybe 20MB to do the same, java app servers are a bloated mess (this includes tomcat, jboss, websphere and weblogic; use/used them all and very very disappointed, but maybe when 32GB is considered a low number for server memory will it not matter anymore).
Anyhow, CGI is so 1995, it has its place. Every point you made above, can be made about pretty much anything, so it's not saying that CGI is a benefit, just says that you did your due diligence and wrote maintainable/structured code; I am sure you would do the same if you were working with an app server. The only benefit inherent to CGI is process/thread isolation; which is a trade off since process creation is a bit heavy but affords you the isolation. Well written applications running on an app server can do the same. If you expect your code to do horrible things to the process space, then yes, CGI is the way to go, otherwise I would pick efficiency over it any day. Personal choice maybe.
This was relative test on a very slow outdated machine, so the absolute numbers are not relevant, the relative ratio is. While I am not saying that CGI is bad, I am saying that there are ways to do better.
As a CGI library (freeCGI++) and an app server (AsynchObjectServer) developer, I can tell you that CGIs are extremely inefficent (but rather a quick and dirty way to build server side apps); there is so much you cannot do well with CGIs, like caching the executable/library (although FastCGI fixes this a bit), caching of static/global/app data, database connection pooling, HTTP pipelining (for all except IE), pre-parsing of data, templating, etc. I can write two simple apps (and I have actually) that do nothing but send back to the browser a simple XML doc . Both CGI and app server is in C++ and with CGI the execution takes 70-80ms and with an app server 5-8ms (on the same machine, albeit an old slow one but it's a relative test). There is a lot that needs to be built up with CGI execution (environment hooks, loading on executable, capturing of stdin/stdout, unloading), meanwhile the app servers (frameworks) can have it all pre-built and cached and only connection/request specific info needs to be built up.
The reason I wrote the app server and framework was to overcome the shortcoming of CGI (yet I still support the CGI library the same, it's great for quick app development as a proof of concept or prototype). I would never use CGI for any large scale development (maybe that's just me).
We have run into a lot of problems with WebStart (haven't tried NET yet so don't know). But versions are a big problem with java, something that works on jre 1.4 may not work on jre 1.5 and to code for jre 1.3.1 just to be compatible is often limiting. This doesn't even address the issues of a problems in 1.4.6 (for example) that do not occur in 1.4.7 and you may need to avoid or write your own way to doing it to avoid this. .NET got the version handling down much better, so I would be interested in seeing it work.
So how do I get a job as a "penetration tester"?
You missed a critical part: production should be 2 identical environments. One is currently running and the other is the fallback/deployment.
Lets say you have 1 machine in production (not likely but makes it easy). Machine A is serving all the traffic. Machine B is out of the "loop" via load balancer. You deploy your staging code to machine B and run some smoke tests. Once all is go with Machine B, the load balancer flips or slowly migrates traffic from A to B (can do all or stage it by percentage of users, this depends on the volume of your site, very big sites usually do 25/50/100% or 10/25/100% or 25/50/75/100% whatever fits your size). Now A is offline and contains the last release and ready for fallback until your next deployment, which buys you enough time to flip to A if there is something critical in B that affects business. I worked at a place where there were multiple fallback just in case (and when billions of dollars are on the line, you need that kind of fallback).
In real world, Machine A is a cluster of machines maybe 100 maybe a 1000, depends on your business demands and if you are running 1000 machines, having another 1000 as a backup is not am issue since you can borrow from the fallback pool if anything fails in production and things fail (drives, memory, network cards, power supplies, whatever).
SVN is nice from teams Staging -> Prod is dead on.
The only thing I would add is keeping a machine for each older release (up to maybe 5) so that you can do regression to see when a certain bug was introduced. At one place I worked we had 10 machines that worked like a circular queue of all past releases and if you get a bug in the current staging build, you can go back a in releases to see when something was introduced. This depends on the business you are in and frequency of the releases, you may only need a few regression machines.
Another point is to deploy things to a VM image (like VMWare) and allow developers to make copies of it (assuming you have the licensing for the OS) and test things in that environment. VMWare is a useful way to keep older releases around without devoting hardware to it. If you are on linux then you have no licensing issues and can make VM copies as needed (you can download an image from VMWare site they have links to a bunch of linux distros).
Email me if you have more questions, I have done this stuff with shops running on 10 machines and ones with over 5000 machines and 1000 developers, so I may have some useful hints.
Current DVD is the 4.6GB format, next gen is HD-DVD whichever standard they settle on.
There are too many things you give up when writing portable GUI code, Qt is ok, wxWidgets is ok, Swing is ok, AWT sucks; using native GUI elements is by far superior. For example, to write a windows app that uses dockable floating toolbars that are easily customizable and contain custom controls within them is relatively trivial with windows and extremely painful if not impossible with ohers because such behavior is not native on other OSs. While you can get portable GUI apps to be very functional, it requires more work to extend the lowest-common-denominator tools.
In the end it is not a question whether it can be done but rather how much work will it take to make it very usable and portable at the same time. I did it for a small app that ran on Windows, OSX and KDE as expected, looked a bit off on Gnome, then after getting Gnome right, OSX controls would not align, and so on. Eventually I just gave up with having to maintain 4 different VMs just to validate things work and now I just stick to WinXP/200x and work more on developing and less on making things portable. It's a matter of preference.
DVD is dying, torrents to portable/mass storage and On-Demand are the new direction. I estimate current DVDs will die in 3 years, replaced with HD-DVD or better. Eventually we will be buying hash ids that will be saved on our portable devices to allow us to view on demand anything we want via streaming.
One can always create reverse honey-pot servers that connect to the chat channel and when given a command, reply with "I am sorry Dave, I cannot do that..." and then recite some multi-gigabyte random poem into the channel :)
The key here is "unpatched server" and of course it happens to be a windows box... hmmm...
The Stern broadcasts were being ripped to MP3s the day they started, people just converted incoming audio and converted to MP3 on the fly. I thought the reason for not going via internet initially was that they were owrrie dthey could not provide adequate bandwidth and once people thought it was crappy quality, they would never come back. Bad publicity/impression at start is devastating, so I can see why they held off.
I listen to Sirius radio on the web daily (because I work in a valley between 2 mountains and no reception is possible). Honestly, the quality is great, better than FM radio. I also have a Sirius unit that unfortunately broadcasts via FM (since my car doesn't have a direct input and I am too lazy to rewire it) and the internet stream sounds better than FM I get in my car.
:)
As far as Howard, his show is quite amusing for the guests he has and the non-standard questions he asks them. Even though on satellite he is not censored, the language is not overused. Bubba is also quite interesting in a dirty sexist sort of way.
Howard is a good reason to get Sirius, but I presonally like Hard Attack channel where I can listen to new death metal and interview for which I would have no access over coventional radio.
I don't care about CD quaity, I grew up in the tape-swap 80s and scrambled premium channel over airwaves decade, so I think my brain is trained to smooth out and unscramble stuff I hear and see
I also listened to XM with the dish I had and their channels are not very diverse, XM feels like their channels are part of some genre-based market study (and very generic feeling); but that's just me. All Sirius needs is a 24/7 Pink Floyd channel and I will be happy.
I think over time the bitrates will improve and I am hoping 3rd party software will allow me to record shows so I could listen to them when I have time.
Amiga at the time was very well designed (aside from an unshielded parallel port that could burn out the computer if IBM printers were used). Amiga had great graphics, very clean architecture (way better than Atari ST or IBM PC/XT) and it had great sound digitizer on-board; along with many other features. Games for the Amiga in the 80s were breath-taking.
:)
And I too knew a guy named Justin that claimed Amiga was going to take over the computer world...
int i=0;
while (i200)
std::cout "I did RTFA, but flash memory is as exciting as concrete pouring." std::endl;
I know this is off topic, but there is never anything interesting about how annoying Flash SDK costs are.
First came Jave applets and they were lacking and not supported correcty on all browsers.
Next came ActiveX and it was windows only and had huge security holes (we still feel today).
Next came Flash and it was simple enough that it started to catch on, but what kept it from really getting huge was that the developer kits are expensive and you really need to be in a company that can afford the kit (this keeps all the home grown web developers out of the mix).
Now there is AJAX which promises goodness but there is a huge issue with number of calls to the originating server and latency. Also a lot of server software is written in not so fast languages like perl, ruby, python and even java, while fine with standard web apps, are far from optimal for a complex AJAX app (this will only improve in time).
And here we have yet another clone to Flash and the only way it can wedge itself into the web world is to offer developer kits for free and charge for license to use it in production or commercial gain. If they are smart they will have a back end sever that can be quickly queried for data and charge for the OS/server software. In the early 90s microsoft offered free OS SDK for Windows 3.0 while OS/2 SDK was not, since I learned a lot of the early SDK stuff while in school I couldn't afford the OS/2 dev kit even though they had a better OS, so I learned Win16 SDK and when apps needed to be developed I used what I knew (by then it was Win32, MFC, ATL, etc). Free SDK and developer support is the key to winning over Flash, I think.
And text only browser on my atari 130XE would also be safe.
But come on, the study is obviously going after the huge market share of windows machines that run either IE or Firefox. If Kubuntu was as prevalent as Windoze then yes you would see a lot more hackers working on breaking them, it's a game of numbers; it doesn't help that for most novices windows is the first OS they get to use (and struggle with).
Then again, Symantec has always been in bed with IE and for them to claim that Firefox is insecure only means that IT people will insist on NOT having Firefox installed thus giving Symantec something to defend. It's a matter of survival and if a browser is secure they can't sell you thheir protection tools. I have had IT tell me that I had to uninstall my Firefox due to a risk factor and that I had to have a new version of Symantec tools installed, I flat out refused until they showed me concrete proof... I am still waiting.
I have not too many mathematicians who were into self promotion, especially is such a silly way. Most just want to be left alone to work in seclusion, but he is a complete unknown so maybe he's trying to make a name for himself. I heard he is in talk with Paris Hilton about a duet on her next techo-bland upcoming CD.
Math power!
Barbara Streisand in Full Effect!
When will people learn that this sort of thing only draws more publicity and if they wanted it to go away they would just ignore it.