Firefox's 'retreat' ensures Microsoft excels

Contractor UK ^ | Aug 22, 2005 | Contractor UK

[Bush2000]

Firefox's 'retreat' ensures Microsoft excels

Open source web browser Firefox has lost the momentum it has steadily gained since it was unleashed last year, according to Web analysts at Net Applications.

The online portal’s unique Hit List service reveals a slump in the Mozilla browser’s market share, falling from 8.7% to 8.1 % in July.

Coinciding with its demise, was the advance of Microsoft's IE that has gained some of the ground surrendered in June, climbing back from 86.6 % to 87.2% last month.

The revival for the dominant browser comes on the back of average monthly losses of between .5 to 1% for Redmond, as Firefox started to gain acceptance among a wider audience than just tech-savvy users.

When asked by Contractor UK whether Microsoft’s sudden gains were from the unveiling of a new IE, Net Applications said a re-launch tends revive industry interest, and could have bolstered Microsoft’s market share of the browser market.

When a company launches a new product, there is always renewed interest in what the company has produced and it would also be fair to say that this may have had an effect, said a member of the Hit List team.

Although, there have been browser issues with Windows 2000 in the news, so it is possible that again you may see a dip [in Microsoft’s market share]. Right now, people are looking for security and whenever there are issues with the security of one's system, they will use what they feel will be the most secure.”

Besides Net Applications, web developer site W3 Schools, confirms that adoption of Firefox is falling, just as IE is reaching its highest share of the market in 2005.

According to W3's data on specialist users, Microsoft IE (6) enjoyed a 67.9% share in July, improving to 68.1% in August matched against Firefox’s top share of 21% in May, which has now dropped to 19.8% for the last two months.

Observers noted that both sets of analysis concur that Microsoft’s loss, up until now, has been Firefox’s gain, but over the last month roles have reversed.

Security fears concerning Mozilla and its browser product have recently emerged, coinciding with Microsoft’s high-profile trumpeting of its new safer browser product (IE 7), complete with glossy logo.

Experts at Net Applications said they were surprised at Firefox’s sudden retreat, saying they expected a slow down before any decline.

Yet they told CUK: “Whenever there may be problems with security, there always is a decline with users changing browsers.”

Data from the Web analytics company is based on 40,000 users, gleaned from their global internet operations, prompting some commentators to question the so-called ‘global decline’ in the Firefox market share.

The Counter.com reportedly finds that between June and July, Firefox actually increased its share by two points, and overtook IE5 for the first time ever.

The Web Standard Project suggests webmasters should treat data from web analysis providers with caution, before rushing to make service changes.

So what can we conclude?” asks the WSP, a grass roots project fighting for open access to web technologies.

“Not much: Mozilla-based browsers are probably used by just under 10% of the web audience and their share is growing slowly. IE5.x is probably used by somewhat less than that and its share is declining slowly. IE6 is roughly holding steady.”

Meanwhile, Spread Firefox, which measures actual download rates of the browser, reports that it took just one month for the Mozilla Foundation’s showpiece to reach 80 million downloads in August – from its July total of 70 million.

At the time of writing, Firefox had been downloaded 80701444 times, meaning adoption rates of over 10m occurred one month after Net Applications says Firefox bolted in light of the dominant IE.

[antiRepublicrat]

You can do the same thing with Windows, to be fair.

I'm interested for my Windows boxes. To see if they're the same, check out what I was talking about, WaveSEC

[antiRepublicrat]

Not sure, but weren't you once touting Novell?

Novell for what, and what does that have to do with how much experience an OS has with the Internet?

[adam_az]

Windows has a built in VPN client and can use a pre-shared key as well.

[antiRepublicrat]

Wow, so Apple was the lowest bidder? Interesting. I wonder if anyone put a windows bid in?

You'd be surprised how cheap Apples can be, especially for the servers. I don't know if an actual Windows bid went in, but the x86 architecture was definitely looked at. OTOH, there are very few Windows clusters on the Top 500, and those are low-placed and overly expensive. For some reason, this cluster isn't on the Top 500, but if it were it would be in the Top 10, for only $5.8 million.

[antiRepublicrat]

I did provide a link to the technology. You did? Where?

I never said product X.

You seemed to imply that I could just drop it in. In any case, now your solution is on the same theoretical level as my solution for strengthening Linux passwords that already can't be cracked by any existing lookup tables.

Remember the OSS mantra of being able to do what you need to with code?

The difference is that in your case to get Windows passwords up to UNIX standards you have to write a complete replacement of the Windows password management system (don't forget, you have to store the individual salts next to the passwords), while I would just have to put a few for loops into Linux's current password management system. No hard work, no large fee, just a tiny bit of editing and a recompile. You don't have that option with Windows.

Sorry, your solution doesn't fly in this disussion. It isn't available to the general public even as a paid-for add-on (which I would normally discount anyway), and therefore isn't applicable to a discussion of practical Windows password security.

Just admit it, Windows password handling is inferior.

[antiRepublicrat]

Windows has a built in VPN client and can use a pre-shared key as well.

I think that's a little different from WaveSEC. It does reverse DNS and shared keys just to get to the gateway the WAP is attached to. They're also working to cram it into 16MB so it will fit on a Linksys router (since they run Linux) so you can have it with just a firmware update.

[for-q-clinton]

The difference is that in your case to get Windows passwords up to UNIX standards you have to write a complete replacement of the Windows password management system (don't forget, you have to store the individual salts next to the passwords), while I would just have to put a few for loops into Linux's current password management system. No hard work, no large fee, just a tiny bit of editing and a recompile. You don't have that option with Windows.

But someone had to write the linux part. No? Or did it magically write itself?

Face it, you didn't know it was available and now you're trying to fit a square peg into a round hole. Often when windows has an advantage Linux types will say I can customize linux to do that. Or there's an OSS project right now underway to do that, it should be ready for beta in x months.

You're a joke.

[for-q-clinton]

while I would just have to put a few for loops into Linux's current password management system. No hard work, no large fee, just a tiny bit of editing and a recompile. You don't have that option with Windows.

Hmmm...I don't remember that mantra amongst the linux crowds. Let's see how much sense it makes.

"In order to do anything you want with linux all you have to do is just change a few lines of code."

Interesting and amazing, but not true.

The point of the Linux mantra of being able to customize the code to do what you want was so that one could customize whatever they wanted/needed. Even replacing whole parts.

[antiRepublicrat]

But someone had to write the linux part. No?

You seem to be missing something. My thing doesn't even need to exist in order for Linux passwords to be too hard to break by today's lookup tables. They already are. Your thing does need to exist for Windows to get up to the quality of current Linux passwords. And you haven't even proven it does exist.

Often when windows has an advantage Linux types will say I can customize linux to do that. Or there's an OSS project right now underway to do that, it should be ready for beta in x months.

We're talking about how it's shipped from Microsoft, or in Linux how it's shipped in common distros. Or, in this case, just to be nice, I will accept an add-on if it's available and widely used, as that would still have an impact on general Windows security.

Face it, Windows is inferior in this aspect. Is that so hard to accept, or do you love Microsoft so much?

[antiRepublicrat]

"In order to do anything you want with linux all you have to do is just change a few lines of code."

Did you read what I wrote or are you just making stuff up? I think the latter, because all I said was that to do what I was talking about would only require minor modifications -- modifications you can't do in Windows due to the closed nature of the source code.

[for-q-clinton]

I will accept an add-on if it's available and widely used

So are you trying to be obtuse? Or are you really that slow?

That's like me saying I accept the fact that with OSS you can change the code to do what you want, but only if it's widely available and won't affect anything else.

Now how silly is that statement?

[for-q-clinton]

Did you read what I wrote or are you just making stuff up? I think the latter, because all I said was that to do what I was talking about would only require minor modifications -- modifications you can't do in Windows due to the closed nature of the source code.

Did you read what I wrote? With Windows the crypto stuff is extensible and replaceable. That means you you can change it to do what you need. If you don't like MD5 and no salt, you can make one that has exactly what you need. Not just what the guy in his basement writing linux thought you needed (with some minor modifications). You can change everything.

[for-q-clinton]

My point is Linux's strength is that you can customize it to meet your needs. That means you can replace the crypto stuff if you want to.

All I'm saying is with Windows you can replace it as well. All you need to do is register the signed DLL with Windows. If you need a DLL you can write it yourself, but I'm beginning to think you don't know anything about code, so even the fact that Linux is customizable to you is a waste.

[antiRepublicrat]

All I'm saying is with Windows you can replace it as well.

I see, you're going on the subject of what's customizable, avoiding the core of the subject, that Windows' password mechanism is inferior.

True, you can plug-in with both OSs, with Windows you can do it to the extent that Microsoft will allow you to. The big difference is that with Linux you don't need any permission and can actually modify what's already there.

[antiRepublicrat]

Now how silly is that statement?

We are talking about the inferiority of the Windows password system. No matter how many theoretical (your case) or actual add-ons there are, the capabilities of Windows' password system as shipped and as used by all (or almost all if you can produce your plug-in) Windows users are inferior to those of Linux systems as shipped by all major distros.

It's a simple fact. Admit it.

[Bush2000]

A lot of people had one.

Name some others that IBM contacted, then.

IBM had a previous relationship with Gates, buying his language product, so they asked him who they should use for their new OS. Gates suggested Kildall's CP/M, Kildall wasn't home...

Nah. Not true. Read the Kildall wiki.

"In 1980, IBM approached Digital Research for a version of CP/M for its upcoming IBM PC. Legend has it that Kildall snubbed the IBM representatives by going flying in his Pitts Special (an aerobatic biplane) for several hours. Although widespread, the story is generally not accepted to be true because it was Kildall's wife, Dorothy, who handled business negotiations, not Kildall himself. Another story has it that IBM representatives wanted Dorothy to sign their standard non-disclosure agreement, which Dorothy considered overly burdensome. Kildall associate Gordon Eubanks has said that the non-disclosure was signed, but that Kildall was not enthusiastic about porting CP/M to the IBM PC's 8088 processor."

In that era, NO ONE negotiated with IBM from a position of power. It would be like a small software maker negotiating with Microsoft today from a position of power.

Anyone who has a commodity that you need and can't obtain elsewhere is negotiating from a position of power. I'm surprised that you can't admit this simple truth. But, I suppose, it flies in the face of your argument that Gates & Co. only attained their success through blind luck. I believe that most people reading this thread will agree with me that you're full of crap, though. Clearly, Gates realized that a non-exclusive agreement was an important thing and, clearly, IBM's attorneys were smart enough to understand that the agreement allowed Gates to sell his OS to other parties. You can argue that, but it's just not credible.

Nope, faster on the SAME hardware. You could boot directly into OS 9 or use OS 9 under OS X on the same machine. Using it under OS X was faster.

Let's see the data.

I'll start with one: uptime. As for OS X, just use it. It's brain-dead easy to administer the server and network. Nobody does usability like Apple.

Let's see the data.

Or for the military, which has quite a few, including in a supercomputer cluster. And what's this "platic furniture" thing about?

So what. The military spends $800 on ashtrays. They're good at blowing things up, but these guys aren't known for their intelligence.

[Bush2000]

We are talking about the inferiority of the Windows password system. No matter how many theoretical (your case) or actual add-ons there are, the capabilities of Windows' password system as shipped and as used by all (or almost all if you can produce your plug-in) Windows users are inferior to those of Linux systems as shipped by all major distros. It's a simple fact. Admit it.

Neither the Linux nor the Windows password systems need to be invulnerable to all possible attacks in order to be sufficient and useful for the vast number of uses. Not everybody needs to harden their machines in the same manner. Your suggestion that this makes Windows "inferior" to Linux systems is a pile of crap. In order to do hash lookups, you're going to need access to the password hashes. Barring access to the hashes, it doesn't matter how theoretically better one system is over another. You still won't be able to exploit them.

Need to replace Windows authentication? No problem. See pGina. The source code is readily available.

[antiRepublicrat]

Name some others that IBM contacted, then.

They contacted only those two. Bill said he could get them an OS, and he did. IBM could have just as easily bought QDOS themselves if they'd been bothered to look around, but they didn't think the OS was important.

Anyone who has a commodity that you need and can't obtain elsewhere is negotiating from a position of power. I'm surprised that you can't admit this simple truth.

The commodity was obtainable from other sources, so that point is moot.

Let's see the data.

I had a link with some informal benchmarks, but I can't find it now. As you may know, OS 9's virtual memory management was absolutely horrible. Classic mode (OS 9 under OS X) disables OS 9's virtual memory management and makes OS 9 see essentially unlimited physical memory, which unknown to OS 9 will be a combination of physical memory and OS X's highly efficient virtual memory system. Thus, any applications in situations that would normally cause OS 9 to use virutal memory will have higher performance under Classic than under straight OS 9.

OS X usability has to be experienced.

They're good at blowing things up, but these guys aren't known for their intelligence.

Shall I give your address to my Special Forces friends, especially the one who also happens to be an excellent DBA?

[antiRepublicrat]

Neither the Linux nor the Windows password systems need to be invulnerable to all possible attacks in order to be sufficient and useful for the vast number of uses.

Of course not, that's why I said hardening Linux's passwords would just be for the really paranoid.

Your suggestion that this makes Windows "inferior" to Linux systems is a pile of crap. In order to do hash lookups, you're going to need access to the password hashes.

Yes, in both the Windows and Linux cases you need access to the machine. Now that we've gained access to both systems, I am stumped by the Linux box and can get all of the passwords off the Windows box in a few minutes. Now I can access all of those users' files (even encrypted) on that machine and throughout the network, wherever those users have permission.

Which one's more secure? We both know security isn't a matter of stopping crackers, but in making it too difficult for them to bother. Unfortunately, Windows passwords are no longer difficult to crack.

Need to replace Windows authentication? No problem. See pGina. The source code is readily available.

Congratulations, you found one. I wonder why the earlier proponent of this hadn't been able to produce it. In any case, it shows that security can be increased (definitely a good thing), but as you know we usually stick to what's in the box, not something I've never seen used, not even in a Top Secret environment.

[Bush2000]

They contacted only those two. Bill said he could get them an OS, and he did. IBM could have just as easily bought QDOS themselves if they'd been bothered to look around, but they didn't think the OS was important.

Nope. Nice try, but you're wrong. The fact of the matter is that IBM didn't know who to get an 8088 operating system from. That's why it went to Gates. QDOS was the same pile of code that Bill bought from Seattle Computer Products and turned into MS-DOS. There's no evidence that IBM even know it existed, since SCP was a tiny, insignificant company located in Bellevue, near Microsoft.

The commodity was obtainable from other sources, so that point is moot.

The only ones that you can cite are CP/M and the one provided by Gates. As I showed earlier, Kildall didn't want to do a CP/M port to 8088. So Gate's code was the only OS available. You said there were others. Name them.

I had a link with some informal benchmarks, but I can't find it now.

Of course you can't -- because it's a fantasy.

OS X usability has to be experienced.

I have. OS X has ripped-off numerous UI elements from Windows (Start menu, Quick Launch, System Tray, Task Bar, etc).

Shall I give your address to my Special Forces friends, especially the one who also happens to be an excellent DBA?

Be my guest. I've been in the military. I know what I'm talking about. A great number of those guys (like their counterparts in the private sector) are mind-numbed bureaucrats with absolutely zero clue about what they're buying -- and with very little accountability with taxpayer money. They spend it like it's water.