shiny chromey new things

It's not every day a whole new browser comes out. It's even less common for that new browser to make lead story status in mainstream media outlets*. But today both happened as Google released their browser, Chrome.

Initial impressions are that its 'innovative features' are essentially an amalgam of other browsers; plus it uses bits of Safari, Firefox and IE (settings panel) so it's kind of Frankenstein's browser. But no matter what you think of its pedigree it does feel fast.

[*] Chrome's release was top story news at The Australian and news.com.au, for those of you playing at home. It might have been top story on other sites too, I didn't have time to look around. Standard disclaimer: I work for News Digital Media.

how fast is it?

Precisely how fast it is depends on who you ask. Naturally if you ask Google they'll tell you it's the fastest browser that has ever existed; although they tend to just talk about the Javascript engine rather than overall performance. Google's own Javascript benchmark yields the unsurprising result that Chrome is far quicker than the others.

Let's face facts, companies choose whichever benchmark makes their product look best. Other tests show different results:

So the only consistent result is that everything is faster than IE. I'm rather partial to Lifehacker: Speed Testing the Latest Web Browsers, where nobody won across the board :)

So, is Chrome fast? Forget the numbers, everyone says it feels fast and that's pretty much what counts at the end of the day. It's more of an emotional measurement. It's quick. Paint it red.

security and rendering flaws

Along with Webkit's benefits, Chrome also inherited its first security flaw: Serious Security Flaw in Google Chrome - ReadWriteWeb. It's not even listed as a product on Secunia yet..!

Interestingly there are also some rendering inconsistencies: Google Chrome vs Safari 3.1 on Flickr (some CSS properties not working, border-radius not anti-aliased...).

privacy controversy

It really was a big first day for Chrome, with the first privacy concerns blogged within hours: Does Google Have Rights to Everything You Send Through Chrome? - ReadWriteWeb. Matt Cutts responds that all is above board: Preventing paranoia: when does Google Chrome talk to Google.com?

Let's cut to the chase. Google can do whatever it wants with any information you enter or reveal while using their products. There is nothing to stop them. So the real question is not can they do it - yes, they can - but do you trust them not to?

Do you trust Google?

odd name

I have to say the name does seem like an odd choice to me. For anyone who didn't know, the interface elements of a browser are called the 'chrome'. So we could end up having to talk about Chrome's chrome at some point.

More to the point though, chrome is generally shiny but non-functional bling; and 'chroming' is another name for petrol or glue sniffing. Neither association seems like something you'd want with your new product. Interestingly, Wikipedia has already been updated to include a reference to 'chroming' meaning 'to browse with Google Chrome'. I didn't realise things like that became canonised in a day, but hey ;)

I guess it's not like Opera, Firefox or Mozilla are the most immediately obvious names anyway (compare that with Navigator, Explorer, Safari - all related to finding things and travelling around). So who's to judge? :)

Anyway, so far I haven't seen an explanation from Google for the name. No doubt it's out there somewhere. Maybe it was buried somewhere in that cartoon (I haven't been able to get through the whole thing, I have to admit).

a bit of fun

Google threw a lot of geeky fun into Chrome. Options are labelled with things like 'stats for nerds'; entering about:internets into the address bar reveals a fun easter egg; and some of the error messages are a bit... unconventional:

Oh you! Oh snap!

OK, so actually I could have lived without my browser saying 'Aw, snap' to me before I had my coffee ;) I do wonder if this sort of geekyness will put off mainstream users - time will tell I guess.

so why is google doing this?

There's heaps of speculation going around regarding Google's motivation for releasing a browser. After all they don't need to do it, since people are having no trouble finding Google as far as I can tell...

I think the explanation probably goes back to a message that was loud and clear at Google Developer Day (literally, they openly said this): Google wants to be synonymous with everything you do on the web.

They want all their services' names to become verbs, I guess ;) Google it. YouTube it.

Basically Google are in a position that's probably unique: the more people use the web, the more money they make (from their ads). Literally, that's as specific as it needs to get for Google. So long as we're online, they make money. I don't think there are any other companies that can say something quite so broad and still be serious.

the google gloss

We'd had the first 'do we support Chrome?' question before we'd had lunch; and it wasn't just the tech staff that were talking about Chrome. People certainly do notice Google products.

Personally, I don't think Chrome is about to sweep the world and take over the entire browser market (that said, anything's possible). There's a big novelty factor right now, but it's not so fundamentally different from any other browser that you simply can't live without it.

It's fast, it's multi-threaded, it has tabs. Umm, just like most other browsers. Even the Wikipedia entry for Chrome is littered with 'like Opera' and 'like Firefox' references. There's even a 'like IE8' in there.

So it's probably not going to cruel the other 'alternative' browsers from the market. I do think it's a legitimate danger to IE though. It's the only other browser from a company the average punter has actually heard of.

Think about that - a lot of alternative and open source products get smashed by FUD tactics. "They're too small", "how do you know it's made properly" and that sort of crap. But it's harder to get that sort of FUD going over a product from a company as widely recognised as Google.

last thoughts

Google might attract conspiracy theorists as fast as geeks, but nobody thinks they're a flash in the pan. People who wouldn't try an open source product like Firefox might just give Chrome a go (they probably won't even notice Chrome's open source). People who've never heard of Opera won't know where they can already get speed dial and top placement of tabs. Lots of things that geeks think about simply won't matter.

I can see a lot of people trying Chrome even though they've always used IE. Quite a few of them will probably like what they see, too. It's a pretty good browser and it'd certainly be new and shiny after years of IE. That, or people will just stick with whatever they're already using, since habits don't change easily.

One thing is for sure - it's going to be interesting to see what happens next.

...

Update 2008.09.07 - It has come to light that Chrome does not support even basic accessibility features in its first release: Google Chrome Accessibility - The Paciello Group Blog. Google has a terrible track record for accessibility, so it's discouraging to see Chrome start badly in this regard.

Obviously it remains to be seen whether accessibility features are incorporated as the browser progresses. A comment at the Paciello Group Blog post suggests that Google do plan to incorporate accessibility features, they just didn't put them into the initial release. Here's hoping that's true.

Labels: , , , , , ,

exposing microformat content in the browser

It has been noted, over at the relaunched Webmonkey, that Microformat support seems to have dropped out of Firefox 3.

What has actually happened is that FF3 has an API for microformatted content but no UI to display it. There was a concern about how to alert the user and then how to let them access the data.

The short story is that even with Firefox 3, you'll need to install an add-on like Operator to take advantage of microformats data on the web. The reason the user interface is missing is because, as Kaply says, "there was never any agreement as to how to expose (microformats)".

Mozilla and the Firefox developers variously considered a sidebar or a toolbar, but decided that both would take up too much screen real estate.

Is this really such a difficult question? Why not just display the microformats logo next to the RSS logo in the address bar?

It's extensible - after clicking you would get a list of available microformatted items, just like you get a list of available feeds. It follows an existing paradigm set up by the RSS logo, specifically that the data on screen is available in another format. It takes up a tiny amount of screen real estate.

Opera already adds a logo in this manner when the content is available as a widget:

Opera toolbar showing RSS and Widget icons

It's hardly a stretch to imagine a Microformats icon as well (ignoring the fact that I'm no icon designer :)):

Opera toolbar showing RSS and Widget icons, plus added microformat icon

It feels pretty natural and you're already used to the RSS icon appearing in that location. Obviously there's an upper limit on how many logos you'd want, but that issue applies to the RSS icon too.

The security and maintenance issues of how to process the data do remain, of course. How do you update the processing routines, for instance? But even that seems like a minor issue when you consider how often Firefox updates get pushed out.

Updates seem like even less of an issue when you consider the frequency of new microformats being released - ie. not very often. Seriously, plenty get discussed but the list of actual "specification" grade microformats has barely changed in the past 18 months. In fact, off the top of my head I don't think it actually has changed in the past 18 months.

So, my suggestion to browser makers could be summarised like this:

  • When microformat content is identified in the page, display a microformat icon in the same way the browser displays the RSS icon.
  • Only support those microformats designated "specifications". Or even just support hCard and hCalendar, which are the ones most likely to be useful to the user in a browsing context.
  • When the specs change, include the parsing changes in your next update.

It's just a thought. At any rate, the lack of UI to access the Microformat API in Firefox just means that nothing changes for the time being. People who want to use Microformats use something like the Operator extension. Sometime in future the UI issue will no doubt get resolved one way or another.

Labels: , , ,

X-UA-Compatible: let sleeping intranets lie?

The longer I think about X-UA-Compatible, the more I think it's not really about "not breaking the web". I think it's about "not breaking big bad web apps".

While it's possible that Microsoft wants to be friends with standardistas, or at least make us shut up, they really don't want to be enemies with a much larger group - large web application vendors and administrators.

Think of the children lemurs big vendors

The big application vendors could seriously kill innovation in IE. People like IBM, PeopleSoft/Oracle, BlackBoard and indeed Microsoft themselves... basically any company that sells web applications with lots of zeros in the figure. There are a lot of them out there and a lot of them dominate an entire industry.

Why can't MS afford to piss them off? Well their products drive a lot of really big sites and intranets that only work properly in IE6 or IE7, because they were built for a bad but stable platform. If IE8 comes out and renders like Firefox, Opera or Safari, those sites might break.

That's one reason IE7 is still blocked in many corporate environments - they have systems that only work in IE6. Remember it only takes one critical system to stop the new browser being rolled out. Admins have no choice but to lock down to old versions of the browser or switch their users to a competitor (if they have that option).

So Microsoft faces a scenario where their new products are not adopted; or they start losing thousands of users at a time as corporate clients switch to competitor products; or they have to keep releasing browsers that never update the rendering engine.

Otherwise they could have large vendors banging on the door with pitchforks, torches and lawyers, demanding to know why Microsoft has sabotaged their products after years of providing a stable platform.

stability?

IE6 sucked, but it didn't change for years. That's stability, to the corporate mind. So they just built for IE, or if you're really lucky they built for Netscape as well and eventually grudgingly added Firefox to the list. Safari? Opera? Konqueror? Not a chance. In fact "alternative" browsers may even be blocked entirely.

The big vendors don't want new browsers. New browsers are a pain because they require huge amounts of testing, bug fixing and patches. So they want their supported browser list to be as small as possible and they'd be quite happy if no new browser was ever released.

why are these apps so bad?

Based on my observations the bigger the company and the more expensive the product, the worse the product's frontend code will be. The bigger the application the harder it is to change any of it, too.

Why is that? My speculation is that the really big enterprise applications are mostly running on old code bases. They may have been through several releases, with an ever-expanding list of dependencies, patches and plugins. Some didn't even start life as a web app. Some began as desktop applications and at some point had a web interface tacked on.

I'd also guess that the web interfaces are often built by software engineers, who were never trained as web developers and really don't care about frontend code - much less standards compliance or accessibility.

So anyway, these applications are not agile. They are big, slow and heavy. They cannot change direction. They cannot seriously deviate from the way they work. They cannot be easily fixed if their environment changes.

...and that's the new version

Keep in mind that the systems in production out there might also be running and old version of the product. When it costs hundreds of thousands of dollars just to do a dot-point upgrade, staying current loses some of its gloss.

Clients might be holding on to an old install because they don't have the money, time or inclination to upgrade it. There are plenty of systems out there being kept alive well after their use-by date.

think of the large clients

At even greater risk than the vendors in all this is the people who bought the big applications. We're talking about big businesses, universities and government departments who've invested anything from hundreds of thousands to many millions of dollars implementing an off-the-shelf web application.

Why do I say they're at risk if they could afford the system? Well many of these clients cannot afford to do much more than maintain the application. They spent their money, they got a system and now they wait out the years on a support plan, until their next shot at a big capital expenditure.

what about roll-your-own?

Major operations tend not to roll their own web applications. I'll skip the rant about the wisdom of this approach; but the decision makers believe that big organisations have to buy big products. They believe that only a big vendor can provide proper support; they believe they need an ecosystem of consultants set up to help with your implementation; and they need to feel sure the vendor will still be releasing patches in five years time.

The applications are critical to ongoing operations. People need financial systems to get paid, students need to get enrolled, government departments need to publish information for the public. These are not systems that can be replaced by something hacked together over the weekend, no matter how much of a big, tough Rails Haxx0r you are.

even if they do roll their own...

In some cases, big organisations will actually get a system built specifically for them. But when they do that, they still tend to base it on some large vendor's technology. They also tend to hire really expensive companies to do the build; and those companies often convince them to set up "a controlled environment" since they have the same mentality as the big vendors anyway.

Which means they just build for IE, or if you're really lucky they build for Firefox as well.... and you know where that leads.

then there are the disinterested developers

It's true that even the big vendors probably aren't the only issue. Yes, there are a lot of developers out there who aren't packing a major web application, yet they have the same build habits as the vendors. IE's the most common browser, so that's what they build in. End of story.

No matter what standardistas think of them, we're outnumbered by the people who learned tables and font tags back in 1997 and haven't changed a thing since.

Yes, these people just might scream at Microsoft if IE8 suddenly "breaks" their sites. While I personally would be happy to see these hacks get a harsh lesson, I can understand why Microsoft might not want to stir up that trouble.

so where does this leave the IE team?

Let's assume that the IE team do want to build a standards-compliant browser, even if Microsoft the company doesn't give a shit. It's also rational to think they want to keep their market share; and we know they don't want 10,000 more screaming emails.

So the IE team can't release something which breaks all those intranets and web applications. Forget "breaking the web" - the web can heal itself (mob rules and all...).

But imagine what happens if you break a bank's intranet? Breaking a hospital's patient file records database? Breaking a government's welfare payment system? These are scenarios I think are entirely plausible and would cause serious trouble. Breaking an entire product line of some major vendor? That's unlikely to bode well for the IE team either.

So version targeting is a way out. They can build a better UI, a more secure browser and still keep the old rendering engine for those systems that won't render in standards mode.

If that same solution can be set up to keep the lazy developers happy and quiet, so much the better (for Microsoft).

where does that leave standards?

Standardistas get caught in the crossfire. We have to do more work because we build the "right way". But we're motivated enough to go and fix our sites, or set up a version target, or deal with it some other way. We'll live.

Being able to specify browser support probably means that a lot of existing sites and web applications will never progress. They'll freeze at IE7 either through choice or inaction.

Huge numbers of people will opt out of web standards and opt-in to IE, because it gives them the illusion of stability and control. Is this a big loss? Perhaps not - they probably weren't ever going to be willing or able to make the switch to standards anyway.

So essentially Microsoft is giving up on a huge number of developers. They're giving them a free pass to mediocrity - making it easier to just do nothing rather than build to standards. There is no way this won't lead to more crappy, non-compliant, non-accessible and inefficient web sites and applications. So it's bad for standards on that count.

But, the flip side is that all those crappy sites can sit and stagnate without stopping the rest of us building to standards. Plus I gather from some of the comments I've seen, the alternatives were all worse.

Maybe the whole issue will be a turning point. Perhaps standards-based development becomes a niche industry, like tailor-made suits compared with cheap off-the-rack suits from budget stores. People might recognise the quality, but they'll only pay for it on special occasions.

standards 0, business 1

While it's disturbing how well lemurs can illustrate the issue as it might play out for small companies (X-UA-Lemur-Compatible, if you haven't seen it), I don't think that's what ultimately drove Microsoft's decision. I think the most telling battles were probably fought on the major application front.

Standards lost. Business won. But IE8 may live to fight another day and with it, maybe standards will ultimately come out on top.

I still think X-UA-Compatible should have been an opt-in system, putting the burden onto the people who caused the problem in the first place. It would have been far better for web standards if all those lazy developers out there had to explain why they needed to roll out another patch. Maybe a few questions would have been asked.

But that's not how it's going to play out. Microsoft is making web standards an opt-in game. In some ways the game hasn't truly changed... we still have to convince people to opt-in to standards, it's just going to be a little harder now.

I hope the big bad web applications appreciate it.

Labels: , , , , , ,

browser configuration for better web development

The way you configure your primary browser effects the way you see the web. Using a suite of browsers during your test rounds is one thing, but it's not the same as using a particular browser and configuration on a daily basis.

To see what I mean, spend a day with Javascript and plugins disabled: it's amazing how many sites fail completely without them. While browsing with Javascript disabled all the time is a bit impractical, there are some things I do recommend to catch basic errors:

  1. Set your system/browser's default background to something other than white
  2. Disable plugins by default (enable them on demand)
  3. Disable meta refresh

These three tips will catch a huge number of sites which make assumptions about browsers. The errors you catch with these settings aren't necessarily the end of the world, but they are a sort of litmus test for site build quality. Plus, many sites do in fact fail completely under these simple-sounding conditions.

non-white background

On a Windows PC (not sure about Macs), a web page with no explicitly stated background colour will be rendered with the Windows default background colour. Since the default Windows background is white, many developers forget to actually set the background when they want it to be white. However to reduce eye strain I set the Windows background to a light grey or off white, so I get to see which sites haven't set a background colour.

It really is quite astonishing how many sites don't actually set their white backgrounds! There are some very popular sites (by large companies) and even a couple of A list bloggers who have forgotten this one.

While it's not the worst error out there, it can certainly be a problem if a user has a black system background and you've got black text. I know someone who has grey on black as their system default; and they regularly have to highlight websites just to read them.

I think Firefox has started overriding the system background and inserting white as a default, but that's not really a solution.

To change your Windows background: click Start → Settings → Control Panel → Display → Appearance → Advanced. Click on the diagram or select Window from the Item dropdown. Change that item's colour and apply the change.

[If someone knows the MacOS equivalent to change the default background in web browsers, feel free to comment or let me know :)]

disable plugins

You should regularly browse with plugins disabled. It's interesting to see how many sites use flash for critical content yet have no fallback at all. Many all-Flash sites don't even have a warning message telling you to install Flash - they just load as a blank screen.

I use Opera and go a bit further, disabling animated graphics and Java. It's trivially simple to switch them back on a for a site, so why not. With Opera's site preferences I can enable plugins for those few sites where I do want the plugins to work (eg. YouTube). To toggle these settings, use the Quick Preferences menu to disable plugins then use Edit Site Preferences to enable them for chosen sites.

I'm not sure if Firefox can disable plugins once they are installed, however there are various extensions (eg. Flashblock) which can disable Flash. It's buried in IE as well but to be honest I don't recommend using IE as your daily browser anyway - it encourages complacency, since you don't notice all the sites out there that don't work in anything other than IE.

disable meta refresh

Meta refresh is particularly problematic for users with screen readers, since the uncontrolled refreshes create confusing and unpredictable experiences. For this and many other reasons, browsers are now making it a lot easier to block meta refreshes.

The thing is, many sites use these to forward the user from one page to another - but they don't include a manual, clickable link. Many people assumed that browsers would never be able to switch off refreshes I guess!

To disable meta refresh:

  • Opera: browse to opera:config#UserPrefs|ClientRefresh, then deselect the option and restart Opera.
  • Firefox: you can wait for version three, or install the Web Developer's Toolbar and click Disable → Disable Meta Redirects.
  • In Internet Explorer: go to Tools → Internet options → Security tab → Custom Level button → Miscellaneous category → set "Allow META REFRESH" to Disable.

[Feel free to comment if you know instructions for other browsers.]

...and that's it

These tips should help remind you to provide fallback content if you're using plugins, scripts or modifying standard page load behaviour in any way. If nothing else, it should remind you that white backgrounds don't magically happen :)

Labels: , , , , , ,

meta refresh gets the popup treatment

It seems that Firefox 3 will include an option to treat meta refreshes much the same way as popups - blocking them and alerting the user what the page wants to do. It's another step forwards in letting the user take control.

Of course, Opera users already have this option; using opera:config#UserPrefs|ClientRefresh. Neat, although an alert would be good; as would site-specific settings. Hopefully the feature will be refined in future versions.

Really though, either way is good as it gives the user a little more control over their browser. Automatic refreshes and redirects break accessibility recommendations. They're one of those things which gets written up as "until browsers provide a way to control...".

As these features become more widespread, the importance of fallback options will become even more critical. Just like scripts need a <noscript>, meta refreshes need a link in the document. Many pages don't have them, though; so no accessibility or SEO juice for them!

It serves as a good reminder that we should provide alternatives any time we modify the behaviour of a page. I have had people say in the past that meta refresh was so simple nothing could go wrong. Well, that assumption will bite them on the arse...! :)

We should always assume that somehow, somewhere such features will be disabled. It's not hard to provide an alternative, so it should remain our habit to do so.

how to disable meta-refresh

  • In Opera 9 (Win/Mac): browse to opera:config#UserPrefs|ClientRefresh, then deselect the option and restart Opera.
  • Firefox 2 (Win/Mac): install the Web Developer's Toolbar and click Disable → Disable Meta Redirects.
  • In Internet Explorer 6 and 7: go to Tools → Internet options → Security tab → Custom Level button → Miscellaneous category → set "Allow META REFRESH" to Disable.
  • Safari 2: currently I don't know of a way to disable it in Safari.

Labels: , , , , , ,

browser security by fix rate

Back in 2005 I compared the patch rates of IE, Firefox and Opera. In the past few days the subject of browser security has come up a few times, so I thought I'd revisit the topic to see what (if anything) has changed.

data source

I'm using Secunia advisories again, to keep the data source consistent. The product pages are:

Note that Secunia's data starts from February 2003, regardless of each product's release date. You can investigate Secunia's methodologies if you will; there are some quirks. However I'm not after a perfect scientific investigation, so much as a broad strokes impression.

what am i comparing here?

Since each browser has a different release date and lifespan, comparing raw numbers of problems isn't really useful. However we can compare the percentage of patches/fixes from the vendor - it's not how many security issues were identified, rather it's about how many were fixed.

I would have added in "time to patch" and "days vulnerable" and so on, but Secunia doesn't currently graph that information (as far as I know).

I thought about sorting out standardised timeframes and so on, but the bottom line here is how secure can a user's browser be today? I say "can" since we can't assume that all browsers are up to date with the latest patch (or even close), but we can at least evaluate the potential for a conscientious user to keep up. After all, we can only apply the patches that are available.

Having discussed the user acceptance issue in the previous article (to patch or not to patch?) I won't rehash it here. However I will mention that according to Secunia Opera users really need to update their browsers.

patch rates - july 2005

First, let's remind ourselves of the data from 2005:

Browser patch success rate (Feb 2003 to July 2005)
Browser IE 6 Firefox 1 Opera 7/8**
Number of advisories since Feb 2003* 83 21 42
Vendor patch 55% 81% 100%
Vendor workaround 1% 0 0
Partial fix 13% 5% 0
Unpatched 30% 14% 0

* Firefox advisories start from August 2004.
** Opera 7 and 8 are combined to create a better comparison in terms of the number of advisories.

[Note - yes I know it didn't really make sense to combine Opera 7 and 8, but both had a 100% success rate so it didn't really change the outcome.]

patch rates - january 2007

First off, let's compare the patch rates of the same browsers (and we'll add Safari so people don't accuse me of forgetting Macs). Remember that these are all superceded versions now:

Browser patch success rate (Feb 2003 to Jan 2007)
Browser IE6 FF1 Op8 Saf1
Number of advisories since Feb 2003 110 39 15 15
Vendor patch 67% 87% 100% 93%
Vendor workaround 2% 0 0 0
Partial fix 11% 3% 0 0
Unpatched 20% 10% 0 7%

So, no change for the three browsers compared last time. Safari slots in at second, after Opera and before Firefox.

Now let's have a look at the latest versions of the four browsers:

Browser patch success rate (Feb 2003 to Jan 2007)
Browser IE7 FF2 Op9 Saf2
Number of advisories since Feb 2003 4 2 3 6
Vendor patch 25% 50% 100% 33%
Vendor workaround 0 0 0 0
Partial fix 0 0 0 0
Unpatched 75% 50% 0 67%

This produces very clear results, but the low number of advisories exaggerates the margins. The previous versions all have a higher number of advisories, but actually the only change in ranking is that Safari drops from second to third. The sharp drop in patch rate between Safari 1.x and 2.x makes it hard to get any useful conclusions - has Apple really dropped the ball?

For the other three browsers, the rankings remain:

  1. Opera (100% patched, no change)
  2. Firefox (50% patched, down from 87%)
  3. IE (25% patched, down from 67%)

It's worth noting that the patch rate for both Firefox 1.x and IE 6.x improved between 2005 and 2007. However both dropped noticeably between their previous and current versions (same as Safari). The proportion is exaggerated by the low number of advisories for the newest products.

conclusions?

Well, one clear thing is that Opera is the only vendor with a 100% patch record according to Secunia. Opera is also the only vendor that maintained its patch rate between versions - in fact you have to go back to Opera 6 to find an unpatched advisory (and there's only one).

It's also clear that IE has the worst patch rate of all the browsers compared. You could say that's a result of having a much bigger user base and a correspondingly higher incident rate. But then Microsoft has more resources than the other three vendors combined so it's a pretty weak excuse for leaving security issues unpatched.

Meanwhile Firefox does pretty well for an open-source product, consistently beating IE - even if not by much. Apple meanwhile needs to get Safari 2 sorted out; but we'll see what happens as more data becomes available (for all four browsers).

So at this time Opera wins the patch stakes. The argument can be made that Opera attracts fewer attacks due to small marketshare. That could be true - there's no way to truly know, since malicious hackers aren't polled - but when I'm doing my banking I don't care if it's true. I just care that my browser is secure; and Opera currently has the best record for fixing security issues.

Labels: , , , , , , ,

the current state of browsers

Browser School Daze - Yahoo! News sums it up in an amusing way:

So, it's time for teacher to hand out the grades, and some final words.

Opera 9.0: You're doing fantastic work—it's good to see you back in form. Grade: A+.

Firefox 2.0 Beta 1: You're not working up to your usual level. You're still looking good, but I would like to see you try harder. Grade: B+.

IE 7 Beta 3: Great job. It's good to see you applying yourself, finally. I knew you had it in you. Grade: B.

Labels: , , ,

in the blue corner, IE7...

Regular readers will know my feelings about the IE7 team's attitude, at least as published on their official blog. Generally I feel just a dash more sensitivity wouldn't have gone astray, given that Microsoft has come back to the browser game after a notable and extended absence.

So it's only fair for me to highlight this post: Albatross! : Microsoft, IE and the Web Standards Project. Now it's a personal blog and not an official line, but all the same it's an acknowledgement that they did disappear for a while there: I’m sorry Microsoft took an apparent vacation for a few years. Mea culpa. Mea maxima culpa. Go watch Bill Gates’ and Dean Hachamovitch’s keynote addresses from the MIX06 conference, maybe their apologies will mean more.

The post also shows the frustration from the IE side of the fence: I’m not asking that people forget that vacation – I don’t expect them to. I’ve moved on, and I’m trying to do the right thing now. There's a difference between stewing in the past, and figuring out where to go from here.

It's a fair call that we have to move on, although there's a difference between stewing and venting. After all IE7 still isn't actually released and we have years of screaming at IE6 to get out of our systems ;) But it's true that it takes leaders like Molly Holzschlag to cross the line between bitching and helping. The rest of us should probably be getting a handle on the idea that IE7 might be a good browser.

Meanwhile, Eric Meyer reminds us (and apparently the IE team) that neither side is an amorphous mass. Eric's Archived Thoughts: Praise IE, Go to Jail : While at Mix 06, I was talking with one of the senior IE team folks about improving standards and the browser market. He said to me, "So what is it the Web design community wants?"—as if there is a single such community, and it always speaks with a unified voice on all matters. Does that sound like the Web design community you know? ... So why do we assume that Microsoft, a company with tens of thousands of employees working in hundreds of teams and units, would be any more unified?

Occasionally we all have to have a reality check. There are humans on all sides here. All the usual issues of building trust and relationships still stand; and everyone needs to cut the other side a break once in a while.

Labels: ,

IE7: good signs?

I've been completely unimpressed by all the buzz about IE7, with its promises, dictates and preview-preview-alpha-betas. But when both Molly and Malarky get excited enough to post big things about the next beta*, maybe it's time for some cautious hope :)

I wouldn't say I'm excited, but this would have to be the first time I've not felt a sense of dread about IE7.

* See: Microsoft IE7 Progress: Sneak Preview of MIX06 Release and The IE7 MIX 06 release | And all that Malarkey.

Labels: ,

test driving opera 9 technology preview 2

So, right now browser preview/beta releases are the new black. IE7b2 is doing the rounds, so I won't bother getting back into that circus. Let's have a look at Opera 9 Technology Preview 2 (on PC, since that's what I use).

what's good

There's a lot of polish going into this version, but I won't bore you with every single little detail which I like. The bigger points:

  • I will mention that overall, a huge number of preference/options settings now have more flexibility.
  • Add any search to the search dropdown, just by right-clicking it. You can define a search keyword while you're at it. I've since discovered Firefox lets you define your own search keywords, but it's not as easy and you still can't add it to the dropdown without writing an extension.
  • opera:config ... the ability to deep link a preference setting is going to make life a lot easier when directing users to a particular setting.
  • Tab/window nomenclature now matches other browsers. I'm sure a certain standardista will feel vindicated.
  • BitTorrent. The cool kids tell me BitTorrent is a good thing. It wasn't included in previous versions since there were some bugs - gasp, I hear you say... a software company that didn't just slap the new feature in, bugs and all? That's right, they waited until it was good and ready for public consumption. That's a company that cares. Redmond this ain't.
  • The ability to change a stack of settings for specific sites. So now you can disable flash but have it automatically re-enabled for those three sites where you actually wanted the flash.
  • Content blocking - seems to be something similar to the popular "ad block" in Firefox, which is nice. I'm also thinking of blocking the boring photos posted by specific users in some photography groups...
  • Tab thumbnails, making it easier to find that particular tab.
  • "Insert personal"... it's form field autocomplete, but in a user-controlled manner. I really like this.

what's bad

Actually not a huge amount to complain about.

  • Still doesn't have a "home" button on the toolbar, out of the box. Seriously, what the hell? I really don't like the default toolbar and I always change it immediately. It is my opinion that this one single issue causes the most trouble for potential new users.
  • Tab selection order still bugs me, I'm sure a certain standardista would agree. It's that reading-through-the-blogroll thing.
  • Some settings still don't have quite enough flexibility for my liking, eg. I'd like to be able to allow the tab bar to extend to a second row but no more.

what's... not sure

  • Widgets. People who went nuts for Konfabulator (or whatever it was called) should get a kick out of widgets. Plus, they look the same as all the faux-plastic/glass widgets that I see plastered all over the Mac at work. People love those things. So anyway, I'll have to play with the widgets a bit more to see if they're useful for me.

conclusion

I'm looking forward to the final release. Although, actually the beta has been rock solid on my machine so far anyway.

link crazy

Labels: , ,

firefox: the new internet explorer

This feeling has been brewing for a while: Firefox is turning into Internet Explorer. The attitudes surrounding Firefox draw ever closer to those attitudes it was supposed to destroy. Things people hate about IE and Microsoft are appearing in Firefox and the Mozilla Project.

What am I talking about? It mostly boils down to these points:

  • Using one browser's popularity to justify not supporting other browsers
  • Treating users of other browsers as inferior - "just use the popular one"
  • Making up proprietary code which is only supported in one browser

People weren't happy to let IE get away with that crap, so why are they taking it from Firefox?

popularity contest - what is this, high school?

I thought we were supposed to be getting away from the days where users with a small marketshare were told "too bad". Sadly an increasing number of sites are appearing which work in IE and Firefox, but not Opera or Safari. Users of these browsers can rant and rave but they are inreasingly being met with blank stares - why won't you just use Firefox and shut up?

Major players lament having to support "niche browsers" and even people who should know better are starting to go live with sites that only work in IE and Firefox:

  • Flickr's "notes" feature only works in Firefox, despite being one of the key features they promote.
  • Blogger actively pushes users into using Firefox since their interface sucks in anything other than IE and Firefox: AOL users, as well as those unaccounted for here (Netscape, Opera, etc.), would be wise to use Mozilla Firefox in order to have the best possible experience using Blogger.
  • Technorati's method of increasing the size of popular tags only works in IE and Firefox (maybe Safari, but I don't have a Mac handy).
  • 37 Signals may be the darlings of the life hacking fraternity, but their products generally don't work in Opera so guess what? I don't use them.

What makes it even more interesting is the way many applications add support for other browsers later on. This indicates that it was entirely possible to support all browsers at go-live, but instead they ran early without bothering to finalise the product. Who cares about a few idiots who don't use IE or Firefox?

Most of this is based on the flawed assumption that browser stats are gospel. For all anybody really knows, Firefox's real marketshare could be a third of that reported in most log files (what with all the pre-fetching).

"quit complaining and just use Firefox"

People ranted at length about being told to "go use IE", yet don't seem to blink when directed to Firefox. Just because Firefox has some open source cool points doesn't mean people should be forced to use it.

What happened to letting the user choose? Did we decide that Microsoft was right after all - everyone should use the exact same software?

Worse still, many people seem to think Firefox is the only alternative browser. Firefox has been pushed so hard, people are treating it like "the other browser" instead of "another browser". Gratingly, articles are appearing with titles like Why You Should Consider Budgeting a Site Redesign for Firefox 1.5 Now (Yes Firefox). Argh! No! Redesign with standards, not "for Firefox"!

proprietary code

There's been quite a bit of noise surrounding the <a ping> feature being proposed for Firefox. Actually, it's not a feature for Firefox so much as a bit of proprietary code for developers to add to their pages. Wow, there's a thought - let's code our pages for just one browser. Let's stick "Best viewed in Firefox!" buttons on our sites and get in the popcorn to watch Browser Wars 2.0 unfold.

Does one feature really mark an entire project? Not really, but have you ever had the feeling you've just seen the thin end of the wedge? The ping attribute isn't even being proposed for a good reason - the justification is that some sites do stupid redirection monkey business in order to track hits. Why a browser maker should get involved is beyond me. Let those sites break if their redirections fail, for all I care. Don't make up new code!

firefox is not perfect

No matter what people say, Firefox is not perfect. It has bugs (table padding problems, anyone?), it has security flaws, it has a memory problem. It may have a larger marketshare than a few other browsers, but it's still a minnow compared with IE.

People should stop acting like it's perfect. Firefox is just another choice. Its marketshare could slip tomorrow - IE7 could take back everything Firefox gained; taking the "it's popular" argument back off Firefox. I'm sure Firefox users would still like to be supported even if that happened.

Unless we want to replace IE with Firefox, the industry needs to remember the original point of web standards: support standards, not browsers. Build once, publish anywhere, let the users choose the UA that's right for them.

Labels: , , , , ,

it's a slightly braver new world: no more ie for mac

We knew it was coming, now the time has officially arrived. IE5 for the Mac is no more. Internet Explorer 5 for Mac: Microsoft will end support for Internet Explorer for Mac on December 31st, 2005, and will provide no further security or performance updates. ... It is recommended that Macintosh users migrate to more recent web browsing technologies such as Apple's Safari.

Please listen, IE/Mac users: even Microsoft is recommending Safari. Please, stop using IE. It may have been a leader once, but those days are long gone. It's old and very, very busted. Let it rest now. OK?

Labels: , ,

google, microsoft and yahoo: still anti-standards

WSJ.com - The Men Who Came To Dinner, and What They Said About Email. The email (ie. webmail) project leaders for Google, Microsoft and Yahoo got together for a friendly dinner. What did they agree on? Well, Gmail is the clear leader of the beta-version pack; but also they just wish that everyone would use IE and stop hassling them: The men reported similar pressures: cranky users of Web browsers with tiny market shares demanding that their browsers be supported, while not appreciating how much work is involved.

Here's the thing - some of us do understand how much work is involved... and we still think they should get it right. Remember that we're talking about products and companies with massive budgets and massive userbases. All three companies consider email to be a key factor in obtaining and retaining customers - yet they're unwilling to let those users make a simple choice like which browser to use.

It's an odd aspect to the IT industry... major companies willing to cut out whole segments of their market, just because it's "Too Hard" to cater to them. Applied to another industry it'd look ridiculous - imagine a petrol station turning away anyone who isn't driving a Toyota Camry!

So anyway, it's clear even from a brief paraphrase that these three companies (or at least their email teams) are not keen on standards and resent expectations of cross-browser support. In fact, they look like classic Angry, Acceptance-Averse Application Administrators to me. Old school "it works in my browser so what's the problem" guys. No surprise, of course.

I think it's also about time we started calling companies about this "permanent beta" thing. It's too convenient an excuse - "hey, it's just a beta product, what do you expect?". Sure, but beta for years?

But hey, maybe I'm being too harsh and the final release of Gmail will actually work properly across the board. After all, it's just beta...

Labels: , , , , ,

about

Web development and standards, as seen by Ben Buchanan.

see me speak

subscribe