AWG - Browser Standards

Frequently Asked Questions

Fri, 09 Dec 2005 10:51:43 -0800

1. Why support two browsers on each platform?

Standards & Portfolio Approach

Though most of our research targets an objective comparison between browsers, it is also important to consider the strategic mix of supported browsers as a whole.

Embracing a mix of browsers which implement open standards, allows us a means to ensure access to the widest range of web sites and applications into the future. However, the practical truth is that many applications and web sites are currently written for specific browsers. Therefore our collective list of supported browsers strategically needs to consider our most important current applications.

Internet Explorer on Windows is essential for accessing some sites and applications. This means we need to inform users of such applications, and continue to work with application providers and web sites to move toward open standards ensuring that their applications will work on several browsers and with the Mac platform.

Some sites are not tested against Safari because of the relative market share or perhaps Mac platform availability in their organization. This makes the inclusion of Mozilla Firefox support on the Mac platform strategic, as it has now the second largest market share and runs on Windows the same way it does on the Mac platform.

By including Mozilla Firefox, we have a total supported browser count of 3, across both Mac and Windows platforms, and a fall back since we have no control over what is shipped with the platform operating system. If we were to adopt a non-cross platform alternate for the Windows or Mac platform, we would then need to support 4 different browsers, increasing the costs and knowledge needed to provide support.

2. What criteria did IMT use to perform the evaluation?

IMT's Architecture Working Group has established the following criteria deemed important going forward:

Adoption – support those browsers which are widely used, and those with a significantly increasing adoption rate
Application Future – application roadmap and health of the software company or developer community to achieve continued success
Security - browser security is a result of excellent design, quick response, and user communication
Standards Compliance - how well a web browser implements the World Wide Web Consortium (W3C) published standards and guidelines is directly related to its ability to access current and future web resources
Supportability – applications which score well in these categories are easier to support: ease of installation, ease of use, documentation availability, frequent bug fixes, support options, stability, performance, and extensibility

To see the full browser evaluation criteria visit:

http://groups.apu.edu/awg/node/148

To see the results of individual browser reviews visit:

http://groups.apu.edu/awg/node/194

3. What about major web-based applications which APU uses?

SunGard Bi-Tech IFAS Browser Support

By continuing to support Internet Explorer on Windows, and Safari on the Macintosh, we can maintain official supportability with IFAS IE-Based applications and Web-Based applications. We have tested Firefox to work with IFAS broad access true web-based solutions, such as campus online.

IFAS Applications	Windows XP SBI Official Support	Windows XP Also Works With	Mac OS X SBI Official Support	Mac OS X Also Works With
Web-Based Applications:
Campus Online (APU Online)	IE, Netscape	Firefox	Safari, Netscape	Firefox
Degree Works	IE, Netscape	Firefox	Safari, Netscape	Firefox
IE-Based Applications:*
7i Administrative	IE	*	*	*
EDI Link	IE	*	*	*

* IFAS Internet Explorer Based Applications - Because these web-delivered applications are based on Microsoft Windows proprietary technology, these will continue to only be usable with Internet Explorer on Windows. Mac users will continue to need to access these Windows applications using Citrix remote application display software.

Online APU (eCollege) - Learning Management System

IE, Netscape, Firefox, and Safari are supported. See http://online.apu.edu/index.real?action=Technical

Apolis2 Library System – III Millennium and related services

Innovative Information Systems is committed to supporting all browsers compliant with web standards. Our internally written “Offcampus Online Library Resources” service, may have one reported bug with Safari. This service will be transitioning to a new product from our vendor which should behave properly in all browsers.

Web Based Email

Outlook Web Access, is an example of an application which works with all proposed browsers included in this report, but which has greater functionality when used with Internet Explorer. When used with Internet Explorer, non w3c standard windows-based controls are used to provide richer functionality. It is hoped that future versions of Outlook Web Access will provide the same functionality in all standard browsers.

Recent advances in “Rich Internet Applications”[1], which use open standards to achieve similar results may be a target for Microsoft. AJAX (Asynchonous JavaScript and XML) behind google's mail and maps services, have caused many to reconsider the possibilities of lightweight applications that are still easy to use via a web browser. Microsoft has released a “Windows Live” service based on this technology, including a new email service with outlook type functionality.[2] Perhaps, they will do something similar for Outlook Web Access.

Other Applications

An informal survey of IMT Support Desk, Student Services, and other IMT staff was taken to determine whether there are any other broadly used web applications which are limited to a particular browser. We did not determine any major applications which would not support our proposed list of browsers. If there are any reported, IMT should produce a list to inform users of which browsers to use, as well as request that vendors adopt web standards.

1. http://en.wikipedia.org/wiki/Rich_Internet_Application

2. http://www.forbes.com/2005/11/04/microsoft-google-yahoo-mr_1104bow.xml.html

AWG Reviews Supported Web Browsers

Mon, 12 Dec 2005 14:49:12 -0800

IMT's list of supported browsers has not changed in several years. We have been supporting Netscape since its inception, and Internet Explorer since it rose to popularity. Much has changed in the operating system and web browser market, and its time to re-evaluate which browsers we should support.

IMT's Architecture Working Group (AWG) was asked to conduct a review and make a recommendation. In order to attempt a comprehensive and objective review, we developed standard Browser Evaluation Criteria which can be used for current and future evaluations. We then conducted reviews of all current and candidate browsers in Fall 2005, and produced a recommendation.

The recommendation is being reviewed by IMT Cabinet. If approved, it will then go to UIMC for review.

Executive Summary (pdf) | Read the Full Report online | Printable Version

Individual Browser Reviews

Fri, 07 Oct 2005 00:57:54 -0700

What follows is an evaluation of each currently supported and recommended browser based on the established Browser Evaluation Criteria. Referencing the criteria will help serve as a basis for understanding the analysis. Lastly, browser usage statistics were gathered from web servers on campus and from industry sources, and are available for reference.

Browser Usage Statistics (Summer 2005)

Fri, 07 Oct 2005 02:02:01 -0700

Browser usage statistics are just one part of considering Adoption as part of our browser evaluation criteria.

The following stastics are broken down by customer group as much as is possible:

APU Users - Cougars Den Browser Stats

By generating some statistics on http access logs on APU only services such as Cougars' Den we should get a great sample for which browsers our constituents are using.

APU Employees - Outlook Web Access Browser Stats

Access log statistics for Outlook Web Access to determine which browsers are most used by faculty/staff etc.

APU Extended Community - www.apu.edu Browser Stats

Statistics on our outward facing website demonstrates browser usage by the broader APU community.

General Internet Trends - General Browser Stats

This is good to determine the market share held by each browser in general, and trends over time.

Mac Platform Specific - Mac Platform Browser Breakdown

Narrowing down browser stats on this platform is significant.

Apple Safari

Fri, 07 Oct 2005 01:57:00 -0700

Analysis and Evaluation

Adoption

According to our Mac Platform Browser Usage statistics, Safari is the most used browser on the platform. Safari is the default browser shipped with Mac OS X (since v10.3), and the only browser bundled with Mac OS v10.4.

Application Future

Safari was released in 2003, presumably as a strategic maneuver by Apple, who had previously been shipping with a Mac version of Internet Explorer. Safari is based on the linux konqueror KHTML layout engine, and the rendering portions continue to be released by apple under open source licenses. The elements other than the rendering engine remain in a proprietary license.

The latest version, 2.0, released on April 29th, 2005, has a built in RSS and Atom reader, and reported speed improvements. It is clear that Apple is comitted to the continuing development of the browser.

Safari is currently competing with Firefox in popularity for Mac users. A poll done in February indicated that 65% of Mac users preferred Safari, but nearly a quarter used Firefox.[1]

Security

As with all other browsers, safari has had security exploits which require patching. As an apple product, security updates are released through the normal system update utility included with Mac OS X. Users with administrative priviledges on the host are notified on login when there are new updates to install. There aren't any apparent design decisions in safari that would cause it to be liable to exploit, such as direct links into the operating system or other non-standard extensions.

Safari has some privacy related features, such as "private browsing" which hides cookies and history from other users. Additionally, private browsing does not cache any of the information that is sent or received. This is especially useful for users of publicly accessible machines, or other shared-user environments. Pop up blocking is also built into safari.

Standards Compliance

Safari's layout engine Webcore, and its heritage KHTML, were designed with w3c standards compliance as a goal. The current development version of Safari at Apple is the first browser to pass the Acid2 test, which tests some of the CSS2 features, especially in the area of error handling.

However, because many web sites are not based strictly on w3c standards, users have had some trouble with certain web sites. Many sights implement javascript without testing on the safari browser. Some sites who don't test on all popular browsers, include code on their sites that prevent users from using their site if not using a short list of acceptable browsers. This recently became a problem for macintosh users attempting to access the FEMA Aid Site.[2] It is hoped that with the increase of the use of alternate browsers and platforms, that large sites would lead the way in understanding the importance of internet web standards for universal access to the information they publish.

Supportability

As safari is already installed in Mac OS X, and is updated via its general system update tool, it should be easy to support from an administrative perspective. As far as usability, it complies with the graphical interface conventions of the Mac platform and includes advanced features such a tabbed browsing. Performance was a primary design goal for safari, rendering even graphics heavy sites quickly.

Apple offers a FAQ site for safari for further support. Discussion boards are also available. Technical support via phone or email is not available at this time.

1. http://www.pcworld.com/news/article/0,aid,119832,00.asp

2. http://www.informationweek.com/story/showArticle.jhtml;?articleID=170701321

MS IE 5 on Mac OS X

Fri, 07 Oct 2005 01:46:21 -0700

Analysis and Evaluation

Adoption

Analysis of Mac Platform Browser Usage statistics

Safari is the most used browser on the Mac platform. However, many Mac users are still using MSIE as it was installed by default. Presumably, they would not know that Microsoft had dropped support, and that security updates and such are not available. Perhaps others are using MSIE because of familiarity after making the platform switch, or because early on many sites would not render well with Safari. As MSIE is no longer included in Mac OS X releases, we can presume that the trend away from IE will continue. Those seeking alternates from Safari, would probably tend toward Firefox in the future, with the availability of MSIE going away. If anything, these results should encourage us to communicate with our community about which browsers they should be using from a security standpoint.

Application Future

Microsoft is completely dropping support for Internet Explorer on the Macintosh on Dec 31, 2005. However, as you can see from the Microsoft lifecycle chart below, they haven't released a service pack in two years.

Product Name	General Availability Date	Service Pack Support Retired
Internet Explorer 5.1 for Macintosh 5.1.7	10-Jul-2003	31-Dec-2005 See Note 13
Internet Explorer 5.2 for Macintosh	17-Sep-2002	Not Applicable
Internet Explorer 5.2 for Macintosh 5.2.3	16-Jul-2003	31-Dec-2005 See Note 13

Note 13.  Hotfix support is not available.

Source: http://support.microsoft.com/gp/lifesupsps#Macintosh_Products

You can see that the browser never made it to the 5.5 release, let alone version 6 which many websites now require.

Security

As you can see above, there have not been any new releases of IE for the Mac in 2 years. Nor have their been any security updates, as no hot fixes are being released. This factor alone should be cause for us to abandon its use.

Standards Compliance

For its time, IE 5 on the Macintosh was compliant with most of the widely used standards at that time. In fact, its is said that IE was not simply a port of the Windows version but a complete re-write, contracted to an outside company. However, it now lags quite far behind because it was abandoned by Microsoft.

One other item of note is that IE for Macintosh did not support many of the Microsoft proprietary standards which are supported on the Windows platform. Users often expected to be able to make use Active X or other Visual Basic driven applications specified to work with Internet Explorer. However, as most of these features are tied into Windows itself, they were never available on the Mac platform. This greatly reduces any benefit of using Internet Explorer for "cross-platform" compatibility reasons. It may as well have been re-branded, as it did not meet the same standards as the Windows product.

Supportability

Areas of concern here are the results of the lifecycle concern above. With no bug fixes, or new releases, there is no guarantee it will even continue to run on newer versions of Mac OS. New advances in ease of use, or even the ability to render many modern web pages will be severely lacking, if that is not already the case. Extensibility will become a problem as well, perhaps with commonly used plugins no longer being available. Ultimately, supporting this browser will be completely outside of any help from Microsoft after Dec 31, 2005.

Ultimately, IE on the Macintosh is no longer supportable.

Mozilla Firefox

Fri, 07 Oct 2005 01:58:46 -0700

Analysis and Evaluation

Adoption

Our May 2005 snapshot of browser access logs for cougars' den and webmail, show that between 8-9% of our constituents use Firefox to access these services. Our extended community, accessing www.apu.edu with firefox was a bit lower at 5%.

The industry is showing a steady increase in marketshare from Firefox. WebSideStory's report through April shows firefox going from 4% to 7% in the last year, while IE, Netscape & original Mozilla decreased. [1] A report in June showed that Firefox increased its market share to 8.71%, up from 8% in May, while Internet Explorer's share shrank to 86.56% from 87.23%, according to NetApplications.com. Since the beginning of the year, Firefox has increased its market share every month between 0.5% and 1% [2]. It is expected to hit 10% marketshare soon. In certain segments such as computer professionals the usage rate is higher. A recent study published that Firefox Used By 1 Out 10 Business Professionals, and it was reported that IBM is pushing firefox in house.

Application Future

Firefox has been growing in popularity. Innovative features such as tabbed browsing, lean design, and the promise of increased security are perhaps the cause of those switching from Internet Explorer. Firefox represents a complete re-write of the historical mozilla/netscape browser, and comes 5 years after Netscape open sourced its Netscape Navigator product.

The Mozilla Foundation "exists to provide organizational, legal, and financial support for the Mozilla open-source software project. The Foundation has been incorporated as a California not-for-profit corporation to ensure that the Mozilla project continues to exist beyond the participation of individual volunteers, to enable contributions of intellectual property and funds and to provide a vehicle for limiting legal exposure while participating in open-source software projects."

Mozilla, maintains a roadmap for Firefox, with the goal of continuing to build a "best of breed" browser product for Windows, Linux and Mac OS X. Firefox's next major release, Firefox 1.5, is currently in beta, and scheduled for release in very soon. Significant improvements include: automated updates, faster browser navigation, drag and drop re-ordering of tabs, improved pop up blocking, the ability to easily clear private data, and most importantly new support for Web Standards.

Security

Firefox perhaps has not been a large target for hackers because of its low marketshare. This may be changing, since 21 vulnerabilities were noted on the last Symantic report. However, the mozilla community has been able to respond very quickly to issues as they are found, which according to our criteria, is the most important factor besides design. Architecturally, Firefox does not use VBScript, ActiveX controls or other extensions granting greater access to the host operating system.

From a user security perspective, Firefox was one of the first to have built in pop-up blocking. Another helpful awareness feature, is that when you visit a secure (SSL) site with Firefox, the URL is high-lighted in yellow to help prevent phishing attacks. Users are notified when updates are available, but the messages can easily be ignored. In the next release of Firefox (1.5), these will be much more prevalent, and allow for incremental patching. This will make it easier to release security patches without requiring full downloads of new releases.

Some security experts have noted that user-added firefox extensions could expose security problems if they are written poorly.

Standards Compliance

Firefox holds a high commitment to W3C standards, with a proven track record toward early adoption of emerging standards. It is arguably the most standards compliant browser available.[3] Firefox 1.5 will support an impressive list of open standards including SVG, CSS 2 and CSS 3(partial), and JavaScript 1.6.[4]

Also of note, are the tools available for firefox which assist with standards-based web development including: DOM Inspector, a tool which allows inspection and modification of document without having to edit the document directly; JavaScript console, a tool to write and test JavaScript code as well as view JavaScript and CSS errors on a page; View page source, with syntax highlighting and find features; Browser extensions including the Web Developer toolbar, Live HTTP Headers, HTML Validator and many more. These tools not only help with the development of web pages for rendering in firefox, but in any current or future standards compliant web browser. Perhaps this is partially why it has found such success among IT professionals.

Supportability

Firefox is easy to download and install (its under 5 Megabytes). A multitude of extensions (currently close to 700) are available, and the most commonly used plug-ins such as Macromedia Flash are available. Extensions are small add-ons that add new functionality to Firefox. They can add anything from a toolbar button to a completely new feature. The user is able to easily check for new versions of the browser and installed extensions.

In areas of performance, firefox renders pages faster than most browsers, and its load time is drastically increased from the mozilla suite and netscape products. The browser is stable, probably a result of bugs being fixed with frequent releases. In theory, some poorly written extensions not officially supported by mozilla could raise stability concerns.

Firefox is quite easy to use, and its simple uncluttered interface has caused other browsers to follow suit. Usability features such as tabbed browsing are often noted as one of the primary reasons to switch. With the 1.5 release, Firefox will have improved compliance to Human Interface Guidlines.[5] Firefox has built in illustrated help with topics such as: nagivation, searching, efficiency, preferences, controlling popups, keyboard & mouse shortcuts, a menu reference and help for Internet Explorer users.

Further support can be received from the mozilla.org community forums, knowledge base, or internet relay chat. The published frequently asked questions are geared for average users and are easy to understand. Convenient links are also available for plugins as well. Telephone support is available from a third party (InfoSpan), for $39.95 per incident. The wealth of information provided by the community, and opportunites to interact at the developer, administrator or user level, would provide more than adequate assistance should any problems arise.

It should also be noted, that because Firefox runs the same on both Windows and Mac OS X (and Linux), it is improves the supportability of the application. The support desk does not need to have a macintosh computer in front of them in order to walk someone through a step over the phone. This is a great advantage of any cross-platform application.

1. http://www.websidestory.com/products/web-analytics/datainsights/spotlight/05-10-2005.html

2. http://www.computerworld.com/softwaretopics/software/story/0,10801,103212,00.html

3. http://en.wikipedia.org/wiki/Comparison_of_web_browsers#Web_technology_support

4. http://developer.mozilla.org/en/docs/Firefox_1.5_Beta_for_Developers#Support_for_open_Web_standards

5. http://www.hcibib.org/hci-sites/GUIDELINES.html

Netscape on Mac OS X

Fri, 07 Oct 2005 01:09:25 -0700

Analysis and Evaluation

Adoption

Analysis of Mac Platform Browser Usage statistics

Netscape is used by 3.51% of Mac users to access our University Portal. This is higher than the 1.51% of combined users of both Windows and Mac platforms. This is most likely be due to the prevalence of Internet Explorer on the Windows platform. Before Apple shipped their own web browser, Safari, Netscape was a primary alternate to Internet Explorer. Many Mac users' first web browser was Netscape, as Internet Explorer was not available till later. Now the primary alternate to Safari and Internet Explorer is Mozilla Firefox, surpassing Netscape.

Application Future

The organizational strength of AOL/TimeWarner, which owns Netscape, puts Netscape in a better position than near the close of the browser wars with Microsoft Internet Explorer. However, recent product lifecycle changes are concerning, and greatly affect the future of Netscape on the Mac platform.

Between Netscape 4.x and 6.x, Netscape Inc. decided to open source Netscape Communicator (browser and mail suite). This began the lifecycle of the "Mozilla" browser suite, which coincided with the internal name of Netscape Communicator. The goal for Netscape Inc. was to encourage innovation and development through an open source community, but continue to re-distribute Mozilla advances with a Netscape branded browser.

Netscape 6.x was released based on the Mozilla codebase. Arguably, early versions of Netscape 6.x brought some maturity and stability to the newer parts of the Mozilla codebase. Much original Netscape code was still in the product at this time. Beyond branding Netscape would bundle plugins and software such as AOL Instant Messenger. Many loyal Netscape 4.x users transitioned to Netscape 6, especially those who liked the integrated mail component. But the marketshare was still miniscule compared to Internet Explorer.

From a support perspective, Netscape 6.x and later 7.x were the same product, whether running on Windows, Macintosh, or Linux platforms. AOL recently made a dramatic change with the release of Netscape 8.0. They incorporated the trident Internet Explorer rendering engine, along with the gecko engine from Mozilla Firefox. As a result, Netscape 8.0 is not available for the Macintosh or Linux platforms.

We did not find any specific information about how long AOL will continue to support Netscape 7.x on the Macintosh platform, but obviously this lifecycle change affects the products future on this platform.

Security

Response to security issues with Netscape 6.x and 7.x, while not as quickly released as their Mozilla cousin, were made available. The product made good use of user notification messages to encourage them to upgrade to the latest version.

Without knowing the future of the now "archived" Netscape 7.x for the Mac environment, security updates would be a concern.

Standards Compliance

Standards complaince for this browser would roughly follow the analysis of Mozilla Firefox. However, we would state that the gecko rendering engine used in the Netscape Browser, would often lag far behind the release schedule for Mozilla, thus delaying corrections to existing supported standards and implementation of newer standards.

Supportability

Areas of concern here are the results of the lifecycle concern above. With the likelihood of no bug fixes, or new releases, there is no guarantee Netscape 7.x will even continue to run on newer versions of Mac OS. New advances in ease of use, or even the ability to render many modern web pages will diminish. Extensibility will become a problem as well, perhaps with commonly used plugins no longer being available. Since Netscape had been releasing new versions of the product more recently than the stale Internet Explorer, it probably could continue to be supported in the short term. However, without commitment to security updates, it would be at risk.

Ultimately, Netscape on the Macintosh will no longer be supportable.

Netscape on Windows XP

Fri, 07 Oct 2005 01:14:47 -0700

Analysis and Evaluation

Adoption

Only 1.51% of our University Portal users, representing our constituents (students/fac/staff), use Netscape. The figure is marginally higher (2.73%) for Outlook Web Access, which currently only faculty and staff have access to. This could be because we are currently pre-loading Netscape on on faculty and staff workstations and notebooks. There may also be a greater familiarity with Netscape among faculty and staff, than the younger aged student population.

Netscape represents 1.3% of accesses to our university web site (www.apu.edu). This group would consist of the extended community and general Internet users. This might imply that on-campus use of Netscape is slightly higher than off-campus.

One of the problems with the statistics gathered from apu's own web sites, is that they were recent snapshots only. General Industry Browser statistics we found are more helpful in comparing trends between the most popular browsers.

Statistics from WebSideStory show a downward trend from 2.83% to 2.23% for the 5 month period of Dec 04 to April 05. This is for Mozilla based browsers, such as Netscape, other than Firefox. Perhaps this combining of other Mozilla based web browsers with Netscape is why the percentage is higher than our own stats for www.apu.edu (1.3%). During this same period, Firefox usage rose from 4.6% to 6.75%, and IE declined from 91.80% to 88.86%. Dramatic perhaps, is that IE had 95.48% browser share in June of 04.

Trend analysis then would present the following facts. Firefox and other web browsers (Safari included) have seen increased adoption, while Netscape and Internet Explorer have seen a decrease. Firefox has taken away market share from both the original Mozilla suite, as well as Internet Explorer.

Application Future

The organizational strength of AOL, which owns Netscape, puts Netscape in a better financial position than near the close of the browser wars with Microsoft Internet Explorer. However, AOL has cut back on Netscape's browser investment, drastically reducing the size of its development team. For a while now, it appears that their investment is based on providing a unique brandable browser for their AOL customers. Perhaps that is the reason for their most recent product change.

Netscape 8.0 was released on May 19th, 2005 (during our on campus web browser standards investigation). Here is a good product summary which describes the significant design changes:

America Online launched Netscape Browser 8.0, the first major update to its flagship browser since Netscape 7.0 was released in 2002. Based on Mozilla Firefox, this latest release can render pages using either the Gecko or Internet Explorer layout engines. Other new features include Site Controls (per-site security settings), the MultiBar (a toolbar for personalised content), a new way of automatically filling in forms and a quick way of clearing private data like the browsing history. Unlike previous releases, Netscape Browser 8.0 is just a Web browser (no email application, newsgroups client or Web page editor), though it does include an integrated AOL Instant Messenger and ICQ client. As AOL laid off the Netscape browser development team in 2003, most of the programming work for version 8.0 was outsourced to Canadian firm Mercurial Communications.

Source: http://www.mozillazine.org/talkback.html?article=6662

Netscape 8.0 represents a significant shift for AOL.

Integrates Mozilla (gecko) and Internet Explorer (trident) rendering engines

Switches layout engine for each website based on predefined trust ratings, which are downloaded every hour
Includes per-site security settings to mitigate spyware etc.

Based on Firefox instead of the original Mozilla suite
No longer includes a mail client
No longer supported on Mac or Linux
Significantly different user interface

It is not clear how these changes will affect the browser's future. Will users adopt a browser that combines firefox and IE? Can it be a better firefox than firefox and a better IE than IE? Will it be able to keep up with architectural changes in firefox and the upcoming IE7? What is AOL's commitment to the product? Will they continue investing in its development if it continues to decline in popularity?

The pattern has been that Netscape 6.x and 7.x, which were based on the Open Source Mozilla browser, were less popular than Mozilla itself. It may follow, that a combined Netscape browser based on IE and Firefox, would not supercede "the real thing" either.

In any case, there is some element of risk in this product's future.

Security

Netscape 7.x has only been as secure as it has kept up with mozilla security patches. It has a good user notification system, reminding users to upgrade as fixes become available. As it doesn't extend itself into the operating system with proprietary extensions, it shouldn't suffer from security by poor design.

Netscape 8.x is unique as far as security goes. It has added several new security features including per site Trust Rating System. This is a good feature for identifying secure sites, and known malicious sites. However, its only as good as its lists of known sites, which gets updated by Netscape's Trust Partners. There is a high level of site trust controls that can be manually set as well.

What's not clear, is whether including the IE rendering engine 1) causes the browser to be vulnerable to IE exploits, or 2) adds an additional layer of complexity that could be exploited in the bridging mechanism.

Standards Compliance

Netscape 7.x would be as compliant as the latest version of the mozilla gecko rendering engine on which its based.

Netscape 8.x arguably would have the aggregate compliance of mozilla firefox and internet explorer. They specifically support both so that the most number of web pages will render properly. Basically sites on the white list, according to the trust partners, will render with the IE layout engine (trident), and all others will render with the Firefox layout engine (gecko). However, this might cause some confusion due to inconsistancies, and has already caused one problem, which was fixed in 8.0.2.

Supportability

The user interface is a radically different design, and could present a learning curve for users and support staff. It is a weighty application, with several additional components which increase memory usage over both IE and Firefox. While there is one interface for both the IE and Mozilla rendering engine, they failed to take into account that there are "in page" user interface differences depending on which rendering engine is being used. If you have used both firefox and internet explorer, think about the differences in the way that they behave. For instance, a right click brings up a context sensitive menu the contents of which are different in each browser. You could imagine all the things that would behave differently depending on which engine was being used (finding text on a page, print preview, auto-complete, even the rate and smooth-ness of scrolling). This random change of behavior simply based on which site you were visiting, would be considerably confusing to users. Apparently, there are also a few design decisions that break the expected behavior of a Windows application, (e.g.The main menu is on the right hand side).

Supporting netscape 8 could be troublesome. The fact that it can act like IE or Netscape could cause confusion when dealing with known issues at the support desk.

MS IE on Windows XP

Fri, 07 Oct 2005 02:00:38 -0700

Analysis and Evaluation

Adoption

Internet Explorer (IE) has by far the largest marketshare both oncampus and off. IE makes up 80% of Cougars' Den usage, and 73% of APU Employees use IE to access Outlook Web Access. Statistics for browsers accessing www.apu.edu, show that 89.4% of of campus users use IE, and 95.5% off campus.

General browser statistics from Web Side Story, are the only marketshare stats for which we can perform a trend analysis. They show that from 6/4/04 to 4/29/05 Internet Explorer has dropped from 95.48% to 88.86%. During this same period, Mozilla Firefox has increased marketshare. However, IE will clearly remain the dominant browser for the forseable future.

Application Future

Internet Explorer is a Core of Microsoft platform strategy, and represents a significant investment. Recent changes in direction to release an update (version 7) sooner than bundled with the next version of the Windows operating system, demonstrate that Microsoft is responding to the changing market.

Internet Explorer 7 is currently available in a beta version for testing. Internet Explorer will be part of future updates for Windows XP as well as included with the release of Windows Vista (late 2006). The new version of IE promises protection against phishing, and includes an RSS feed reader. The other stress for IE7 is built in search bars, which will allow users to change their default search programs, and tabbed browsing, both features which have made Firefox popular with advanced users.

Security

Security has been problematic with IE since its inception, because its design exposes more direct access to the operating system. The number of known exploits have been greater than other browsers, however, as stated by our security criteria, the number of bugs is less important than the speed of which they are corrected. It takes Microsoft an average of 43 days to patch a security hole.[ 1] This long window unfortunately allows for malicious software authors to make available exploits. The severety of these security holes often allow for the installation of trojan horse viruses and back door or remote control software. IE security issues have lead to some unprecedented warnings for users to use other browsers, even from the CERT Coordination Center. In December 2004, Penn State told its 80K higher education users not to use Interenet Explorer. [2]

Extending beyond standards has been a problem for Microsoft Internet Explorer. Extensions like Active X, clearly outside of published W3C standards, were a convenience for application developers wanting to bring more native user interfaces to web applications. Maliciously written Visual Basic code could be written to execute malicious code on desktop systems. Microsoft has spent significant resources stepping backwards to close doors left open by this design. Windows XP Service Pack 2 is now considered essential to security on the Windows platform in general, and specifically when running Internet Explorer. Whenever a web browser is tied to the operating system, it is absolutely essential for users to keep their operating system up to date.

Microsoft already improved on earlier versions of IE with the latest service pack. Service Pack 2 stopped certain malicious scripts and pop-ups. Also, the Attachment Execution Service program shows the user file signature of any files being downloaded for greater security, and even allows you to block programs from specific publishers.

Standards Compliance

With IE 5.5 Microsoft was actually ahead of some other browsers regarding standards. Since then, however their have been complaints from web developers and users regarding the rate of adoption of W3C published standards. Since version 5, there have been no significant changes in IE's Trident rendering engine. As a result, as of 2005, IE lags behind in support for standards.

An example is the PNG graphic format, a superior replacement for GIF released in 1995, after Unisys announced that it would be enforcing software patents on the LZW data compression algorithm used in the GIF format. In all that time IE has never supported PNG's correctly, causing many web developers to be frustrated.

On the topic of APU developed web applications, it should be noted that IE requires significantly more time to debug. Javascript issues, image handling, and CSS present a resource drain, and the lack of an included javascript debugger interface (such as Mozilla browsers have) limit troubleshooting ability. For some reason, the IMT Support Desk often is required to step the user through the process of deleting cookies and clearing cache for web applications to work properly with IE. IMT web developers will continue to need to make it a priority to thoroughly test web pages in IE, especially because it is so widely used.

"Although each version of IE has improved standards support, including the introduction of a 'standards-compliant mode' in version 6, the core standards that are used to build web pages (HTML and CSS) are still implemented in an incomplete and incorrect fashion. For example, there is no support for the <abbr> element which is part of the HTML 4.01 standard, and there are bugs in the implementation of float-margins for the CSS1 standard. The Internet Explorer box model bug is one of the best-known bugs in Internet Explorer's implementation of CSS." [3]

Internet Explorer has introduced an array of proprietary extensions to many of the standards, including HTML, CSS and the DOM. This has resulted in a number of web pages that can only be viewed properly using Internet Explorer.

An updated beta 2 featuring improvements in HTML 4.01 and CSS 2.0 is expected to be released in the fourth quarter of 2005.

Supportability

From an installation and maintenance perpsective, IE is the easiest browser to support on Windows. It is installed with the operating system, and updates are handled via the Windows update utility (which actually uses IE itself). For our student population all critical updates for IE are automatically downloaded periodically via the Cisco Clean Access Agent, installed on all student machines connected to reznet.

Stability is related to the health of the operating system, which on Windows XP is much improved. Unless there is a problem with a 3rd party extension, or spyware etc., Internet Explorer is reliable. Performance of rendering pages perhaps lags a bit behind newer browsers.

Internet Explorer is easy to use, though many users are looking forward to usability enhancements that IE 7 will bring, such as a cleaner, more simple design and tabbed browsing. Common extensions and addons supporting multimedia and other formats are widely available. The only place where IE falls behind in supportability, is the rate at which problems are resolved. Bug fixes are infrequent, and additional features have been lacking for some time. Obviously, security issues play a factor in supportability as well.

Help is built into Windows, and community support forums and newsgroups are available for advanced users. Otherwise, email support is be $35 per incident.

1. http://www.computerworld.com/securitytopics/security/story/0,10801,100541,00.html

2. http://chronicle.com/free/2004/12/2004121001n.htm

3. http://en.wikipedia.org/wiki/Criticisms_of_Internet_Explorer

Supported Browser Evaluation (Fall 2005)

Tue, 20 Dec 2005 11:17:46 -0800

Introduction

APU’s strategy of web based education relies on using a web browser as the primary delivery mechanism to access information. IMT is responsible to support applications and services that rely on web technology for faculty, students, staff and computer labs. IMT’s current web browser standards do not reflect recent industry changes, especially concerning security and platform support.

Netscape - Netscape's market share continues to decline and previously supported features – built-in email and Mac platform support – are no longer part of Netscape’s strategy and product development.
Internet Explorer on the Mac platform – Microsoft is discontinuing support of this product as of December 31, 2005, thus placing Apple Mac users as risk concerning security and support. The software will no longer be available for download, and no updates will be made available.

Two newer browsers, not currently on our supported list, represent an opportunity:

Mozilla Firefox - has become one of the most innovative browsers; its speed, features, and security have allowed it to reach 14% US market share in a short amount of time. Running the same way on both Windows and Mac OS X, it provides an excellent replacement for Netscape on both platforms.
Apple Safari - the most used browser on the Mac platform ships with every computer. It is fast, behaves in a way mac users expect, and supports web standards. It will be quite natural to formalize our support for this product.

IMT's Architecture Working Group (AWG) was asked to conduct a review and make a recommendation. In order to attempt a comprehensive and objective review, we developed standard Browser Evaluation Criteria which can be used for current and future evaluations. We then conducted reviews and testing of all current and candidate browsers in Fall 2005, and produced the following recommendation.

Recommendation

Based on our evaluation, we have made the following recommendations:

Replace Netscape with Mozilla Firefox on the Windows and Mac Platforms

Netscape no longer carries the benefits which made it a good browser in the past. Since outsourcing the creation of Netscape 8, AOL has dropped support for the Mac platform, dropped the messenger e-mail component that many liked, and has turned the product into a hybrid between Mozilla and IE. The idea behind the latest version was novel, to have the browser automatically choose the layout engine from Mozilla or IE depending on which web site you were visiting. However, the implementation leaves the user with a very inconsistent and confusing experience, and worse performance than using IE or Mozilla independently.

Mozilla Firefox has become an innovative and efficient browser. Firefox is written by many of the same minds behind the original Netscape and those responsible for open standards on the Internet. Its simplicity, lightweight design, and security have caused its adoption among advanced users. The rate at which it is able to patch security concerns, fix bugs, and offer new features while maintaining stability is sign of a mature product built on a flexible base. While not expected to dominate the market any time soon, it has been the only browser to make a small dent in Internet Explorer's market share since replacing Netscape. We believe Firefox will make a fine secondary browser to the default on both Windows and Mac.

Replace Internet Explorer with Safari on the Mac Platform

Internet Explorer on the Macintosh. Microsoft is completely dropping support for this product on Dec 31, 2005, and hasn't released an upgrade in two years. IE on the Mac was a completely different product from the Windows version and uses a different layout engine. Due to the tight integration of IE with Windows, proprietary extensions such as Active X were not available on the Mac version, and therefore the benefits of cross-platform were not experienced. The brand compatibility decreased further when IE on the Mac never advanced beyond IE version 5. IE 5.5 was a significant release for Windows and of course many sites now require version 6. It is not feasible nor responsible for IMT to continue supporting this product beyond the life of Microsoft's support commitment.

Safari is the current default browser shipping with Mac OS X. Apple has produced a native browser with speed as a primary goal, and natural integration with the operating system. It has improved with each release and updates are available through the operating system update feature. It has been known to set an example for adopting web standards, which is important for pages to display properly on all compliant browsers. However, some web sites have been slow to adopt these standards and don't test their pages against Safari. Firefox will serve as a more up-to-date alternative to IE for Mac users in these cases. Safari is the most used browser on the Mac platform, and it will be quite natural to formalize our support for this product.

Table 1: If approved, this would change IMT's Tier 1
supported browser application list as follows:

Current	Proposed
Windows XP:	Windows XP:
Internet Explorer	Internet Explorer
Netscape	Mozilla Firefox
Mac OS X:	Mac OS X:
Internet Explorer*	Apple Safari
Netscape*	Mozilla Firefox

* Microsoft and AOL, which owns Netscape, have both
dropped support for their products on the Mac.

Application Future

Thu, 06 Oct 2005 12:35:58 -0700

Definition: Application roadmap and health of the software company or developer community to achieve success.

Measurable Evaluation Criteria: Relative strength of the application lifecycle, and the organization or community behind it.

Application Lifecycle - What is the application roadmap? Can the application continue to add innovative features without re-architecting it? If it needs to be re-architected, are there enough resources and interest to achieve the next leap in web standards?
Organizational Strength - While the other criteria cover current state and perhaps some trends, the overall direction and strength of the software development company or community should be a considerable factor when choosing a standard browser.
- Corporate Health - Software companies can be measured by their financial standing, and stated commitment to a product line. Their performance can also be measured by timely product releases, and the quality of their support channels.
- Open Source Health - For Open Source applications, health can be measured primariliy by its maturity. Areas of investigation include the amount of participants in the developer community, the ability of developers to organize effectively around the project, and clear leadership by the project "maintainer". Often, there is also a non-profit organization providing direction and resources. Clearly performance is best measured by the quality and timeliness of code releases, and the ability of the community to support both users and developers who would like to contribute. Some immature Open Source applications loose interest before they ever release solid, supportable code. It should be clearly noted that Open Source is not a panacea for great software applications, and each product needs to be evaluated on its own merits over time.

Supportability

Thu, 06 Oct 2005 12:37:31 -0700

Definition: Supportability is a broad category rooted in the following philosphy: the same qualities which cause a good user experience with using and maintaining an application themselves, enable IT to provide excellent support.

Measurable Evaluation Criteria: In light of our definition, these are perhaps the qualities of any great application.

Ease of Installation - How easy is the application to download and install?
Ease of Use - Is the application intuitive adopting computer human user interface best practices?
Documentation Availability - Is their meaningful built in documentation and extended documentation available?
Frequent Bug Fixes - How quickly are annoying bugs fixed?
Support - Can advanced users and or IT receive support from the vendor or community?
Stability - How frequent do browser crashes occur on properly maintained systems?
Performance - How fast can the browser render w3c standard content pages?
Extensibility - Are commonly used plugins or add-ons available and are they easy to install?

Security

Thu, 06 Oct 2005 12:36:12 -0700

Definition: Browser security is a result of excellent design, quick response, and user communication.

Measurable Evaluation Criteria: A browsers track record is not based on the number of exploitable bugs found, but really how quickly the vendor or support community responds with fixes. It is also important that users are informed of the need to update, and the ease of which they are able to do so. Certainly, secure design plays a part. Some browser vendors have decided to add functionality beyond published web standards for ease of use that violates secure design concepts.

Considerations:

There has been much confusion regarding browser security lately. The press seems to pounce on any announcement regarding a security flaw found in particular browsers, often blowing the risk way out of proportion. However, this is natural in a world where ecommerce flourishes. The key factor in browser security is in actually finding security flaws and then correcting them in a quick and proper manner. Excluding design considerations, each bug found and fixed, in theory, should make that browser more secure.

Obviously, if users don't actually apply security updates to their browsers, then their security is compromised. This is why its important that users are notified of security updates, and that the security updates are easy to install.

Design issues are a bit difficult to evaluate. However, there is an overriding security concept: Security will always be at odds with convenience. The key is to strike a balance between usability and lockdown. Clearly, the most dangerous browser security exploits have been caused by browsers with close ties to the operating system, because they have greater priviledges to execute code on the host.

Standards Compliance

Tue, 06 Dec 2005 14:47:36 -0800

Definition: How well a web browser implements the World Wide Web Consortium (W3C) published standards and guidelines is directly related to its ability to access current and future web resources.

Measurable Evaluation Criteria: The W3C publishes all recommendations (standards) on its web site. There are also test tools and conformance information available in a quality assurance matrix. It should also be noted that many Internet Standards published by the IETF also apply. Even with all of these validators and test suites available, it may be hard to produce overall summaries for each browser. Also a consideration is how quickly a browser is able to adopt standards as they are formalized.