A Blog From Behind the Trenches

According to Computerworld, security firm Cenzic has released a report showing that Firefox and Safari were the least secure browsers in the first half of 2009. That's the impression you get by simply skimming the article anyway. The actual report from Cenzic only counts the number of security flaws, and concludes that Firefox had 44% of all vulnerabilities, Safari had 35%, IE had 15%, and Opera a mere 6%.

Does that really mean that IE is more secure than Firefox and Safari?

I'm not sure a conclusion like that can be drawn at all. There are other aspects to security vulnerabilities that were not covered, such as the severity, and how long the vendor takes to fix them. Furthermore, security reports sometimes elevate standard crash bugs into security bugs, for example referring to them as "Denial of Service Vulnerabilities".

It's great to see that Opera has a low number of vulnerabilities, and I am confident that we would look good if severity and "time to fix" were taken into account as well. But until the report actually includes those relevant details, it isn't really that useful.

Statistics are great, though. You can make them show just about anything.

In an article triggered by RIM's acquisition of Torch Mobile and their WebKit based browser, CNET's Matt Asay argues that Apple has too much control over WebKit. Other companies relying on WebKit for their browser will basically be slaves to Apple's release cycles, and Apple will always control where WebKit is heading and optimize it for their own products.

So what is his solution to this suggested problem?

it would be nice to see a truly open-source project--open in source, and open to outside involvement--standardize the mobile browsing experience, too

In other words, he is echoing Symbian's call for a standardized browser for all mobile phones.

Read more...

Netscape founder Marc Andreessen is apparently backing a new browser called "RockMelt". Details are sketchy at the moment, but rumours have it that it's a browser tailored for Facebook.

I hope the rumours are untrue.

What I am hoping for is that RockMelt will be a Web browser which is not tied to any specific sites, and that it will introduce a completely new browser engine. Writing a browser engine is a huge undertaking, but we need more of them on the market.

The larger the number of widely used browser engines is, the lower the impact of security holes in any single browser, the more expensive and time-consuming it will be for virus and malware authors to infect computers, and the higher the benefits are for writing standards-compliant Web pages.

One of the comments on the antitrust complaint against Microsoft I see a lot is: "So what if most people are using IE and aren't aware that there are choices? I'm using Opera/Firefox/Chrome just fine."

Sometimes we may feel that something doesn't really affect us. But does IE's dominance on the Web affect us even though it might not feel that way?

The answer is: Yes, definitely. But the problems with a monoculture on the Web extends beyond browsers! A single point of failure is a bad thing no matter what.

Browser monoculture

The recent ActiveX security flaws in IE once again show us that a browser monoculture is a bad thing because those looking to infect people's computers will have a single target with a very nice return of investment. And those millions of compromised computers can be used for things like sending spam to the rest of us.

But it goes much further than just IE. One could argue that just about any kind of dominance of the Web is a bad thing.

Read more...

We are all used to all the artificial JavaScript benchmarks out there by now. What they have in common is that they all test small parts of JavaScript, and none of them are testing real-life performance.

Read more...

Performance benchmarks are all the rage these days, but everyone seems to be focusing narrowly on artificial benchmarks that basically tell you how certain browsers perform at the particular JavaScript functions chosen for those particular benchmarks.

It's surprising that there is little or no focus on other, perhaps more relevant performance aspects of modern pages. For example, how do browsers perform when it comes to dynamically changing the style of a page (CSS)?

Read more...

Microsoft's new Get the facts has a strange smell to it. It's almost like it smells... old and stale.

Read more...

It's old news by now, but do we really need yet another one? Peacekeeper "simulates the load placed on the browser by common JavaScript functions as used by popular, modern websites", but weren't all the other ones supposed to be doing that as well?

Read more...

CNET UK's Nate Lanxon tries to makes the case that Opera should give up on desktop browsers. I'll respond to his claims point by point below, but the quick reply is: No way!

Read more...

Microsoft is finally going to get their mobile browser offering up to speed... by porting the old Internet Explorer 6 (released in 2001, a few months after Opera 5) to Windows Mobile.

In a world where everyone, including the rest of Microsoft, is busy moving away from IE6 and all of its problems, Microsoft's Windows Mobile unit thought it was a good idea to wipe the dust off IE6 and give it new life.

At least it supposedly supports Flash.