"> Firefoxs Archives - Engr Kabir Saleh

Posts Tagged


Top web browsers 2019: No end in sight for Firefox’s losses

If Firefox were a ship, it would be becalmed on a flat sea, loosened seams leaking faster than the hand-worked pumps can empty the bilge, passengers springing overboard and swimming toward other vessels – those with sails bearing rivals’ logos.

According to data published Sunday by analytics company Net Applications, Firefox’s share for November slumped to 8.2%, down half a percentage point. It was the seventh month in the last 12 in which Firefox spilled share, the fifth where the loss amounted to a half point or more.

From 2005, when Firefox was scratching its way out of the single digits in an insurrection against Microsoft’s Internet Explorer (IE), the browser has posted lower shares only three times, all in a short stretch of 2016 when Firefox bottomed out at 7.7%. That time, the browser clawed back to 13% (in October 2017) before again shrinking.

Unless something suddenly stems Firefox’s current free-fall, the browser will return to that low point of 7.7% by June, according to Computerworld‘s forecast, which relies on Firefox’s 12-month average. That same forecast predicts the open-source browser will dip under 8% as early as January.

Mozilla’s efforts to make Firefox more attractive as a browser choice have failed to move the share needle. From its November 2017 “Quantum” relaunch to its recent emphasis on the hottest browser topic – privacy in general, blocking ad and site trackers more specifically – the improvements and enhancements have been accompanied by collective shrug. Or worse, a step toward the exit.

Historically, Firefox has been the counterweight to the then-current leader, first IE, then Google’s Chrome. Firefox’s flirtation with irrelevancy as exhibited by its smaller user share may see that counterweight go weightless. Microsoft’s decision to adopt Google’s browser technology for its reborn Edge strengthened the monoculture. Sans Firefox, the browser choice becomes Chrome or near-Chrome.

Chrome: Settling into its spot?

During November, Chrome lost a quarter of a percentage point, dipping to 67.2%, the browser’s lowest mark since June.

While the loss was little more than a rounding error and could not be considered a threat to Chrome’s dominance by any stretch, Google’s browser may be close to its upper-end limit.

Last month’s share was identical to Chrome’s number at the start of the year, for one, so for all the wild swings — up 2.3 points one month, down 1.7 points the next — it ended where it began. And although Chrome shed three-quarters of a percentage point in the past six months, in the last three the movements were a wash, hinting that changes to share have slowed.

The forecast based on the 12-month average foretold some gains — Chrome should make the 68% mark by June — but the prophesied increase was significantly less than a month ago, when the prediction contended Chrome would hit 70% by mid-2020.

IE edges Edge

Microsoft’s browsers recovered three-tenths of a percentage point in November, the second straight month of share gains (and only the fourth time that’s happened in the last five years). IE+Edge ended November at 12.8%.

That total was tallied of two browsers, IE and Edge, with the increase credited entirely to the ancient and obsolete IE, not the at-least-newer Edge: IE climbed four-tenths of a point to 6.8% while Edge fell a tenth to 6%.

Because Windows 10’s share of all operating systems also declined, Edge remained with an 11.2% share of all Windows 10 browser activity, the level it’s been stuck at for a full quarter.

Measuring Edge against Windows 10 will soon be impossible, as the revamped browser — Microsoft tossed its own technologies and built a new Edge from Google’s Chromium – will reach release status Jan. 15, launching for Windows 7 and 8.1 as well as 10, not to mention macOS.

Whether Edge’s remodel will result in a jolt to its user share is unknown. Microsoft is, if not counting on Edge’s phoenix-rising, eager to put a thumb on the scale to boost the chances; it will automatically replace the original homegrown Edge with the Chromium-based version rather than wait as users do what they do best, stick with the status quo.

Edge may never gain much ground in Net Applications’ measurements. The California metrics vendor best quantifies individuals’ browsing activity, and while Microsoft wouldn’t object if that group dumped Chrome for a Chrome clone, there’s good evidence that the retuned Edge is a corporate play.

Elsewhere in Net Applications’ numbers, Apple’s Safari gained half a percentage point for the fourth consecutive month, climbing to 5.3%, and Opera Software’s browser remained flat at 1.3%. Safari’s increase came as macOS climbed six-tenths of a percentage point to 11.6%, a record for Apple’s operating system. For November, Safari’s share of macOS rose to 45.6%, the highest mark since December 2017, showing that it is possible for a browser to convince customers to ditch Chrome for a browser they’d used before.

Net Applications calculates user share by detecting the agent strings of the browsers that render the websites of Net Applications’ clients. The firm tallies visitor sessions to measure browser user activity.

Source link

Mozilla blames ‘interlocking complex systems’ and confusion for Firefox’s May add-on outage

Mozilla has issued multiple after-action reports analyzing the major mix-up in May that crippled most Firefox add-ons. The reports also made recommendations for preventing similar incidents in the future.

The fiasco started just after 8 p.m. ET on Friday, May 3, when a certificate used to digitally sign Firefox extensions expired. Because Mozilla had neglected to renew the certificate, Firefox assumed add-ons could not be trusted – that they were potentially malicious – and disabled any already installed. Add-ons could not be added to the browser for the same reason.

Mozilla rushed a stop-gap fix to the browser via its Studies system, infrastructure normally responsible for pushing test code to small groups or collecting data on reactions to sponsored content. Because the Studies approach did not reach everyone, on May 5 and May 7 Mozilla shipped two Firefox updates – 66.0.4 and 66.0.5 – that addressed the certificate mess.

“The first question that everyone asks is, “How did you let this happen?'” wrote Firefox’s CTO Eric Rescorla in a post to a company blog. “At a high level, the story seems simple: we let the certificate expire. This seems like a simple failure of planning.”

Rescorla disputed that characterization, however. Saying that the situation was “more complicated” than that, he said the responsible team knew the certificate was expiring but assumed that the browser would ignore the expiration date because in an earlier incident certificate checking had been disabled. “This led to confusion about the status of intermediate certificate checking. Moreover, the Firefox QA plan didn’t incorporate testing for certificate expiration and therefore the problem wasn’t detected. This seems to have been a fundamental oversight in our test plan.”

Others covered the crisis from different angles in separate postmortems, including an incident report and a technical report.

The latter, written by Peter Saint-Andre and Matthew Miller, a principal software engineer and senior staff engineer, respectively, came to a similar conclusion. “This incident was not the fault of any individual or team but was the result of having an interlocking set of complex systems that were not well understood across all the relevant teams,” the two wrote.

Among the details in the Saint-Andre and Miller report was that Mozilla outsources its QA (quality assurance) testing to Cognizant Softvision, a multi-national firm with offices scattered from India and Ukraine to Romania and the U.S. “The lack of in-house or on-call QA resources caused delays in testing proposed fixes across various platforms because our external teams at Softvision were not immediately available through normal channels,” Saint-Andre and Miller said. “In fact, engaging with individual Softvision team members could have introduced legal complications and the potential for data leakage.”

While Rescorla had spelled out some of Mozilla’s failings in a blog post shortly after the add-on outage, he had promised a list of recommended changes for a later missive. His July 12 post and the July 2 report by Saint-Andre and Miller made good on that promise.

Among the recommendations: a rapid-response hotfix-delivery mechanism that could push emergency updates to Firefox users.

In May, Mozilla quickly created a temporary fix for the desktop versions of Firefox and pushed the patch to the browser using the Studies system. Mozilla turned to Studies to deploy the hotfix as soon as possible, rather than make users wait for a full browser update. Yet some reported that they didn’t receive the hotfix or that it had not enabled Firefox’s add-ons. If the user had disabled Studies, perhaps for privacy reasons (the mechanism is turned on by default), they would not have gotten the patch, for instance.

“The lesson here is that we need a mechanism that allows fast updates that isn’t coupled to Telemetry and Studies,” contended Rescorla. “The property we want is the ability to quickly deploy updates to any user who has automatic updates enabled. This is something our engineers are already working on.”

Saint-Andre and Miller echoed Rescorla, but also went into detail discussing the cryptographic signing of Firefox add-ons.

“Most fundamentally, the full Firefox team does not have a common understanding of the role, function and operation of cryptographic signatures for Firefox add-ons,” they wrote. “Although there are several good reasons for signing add-ons (monitoring add-ons not hosted on AMO, blocklisting malicious add-ons, providing cryptographic assurance by chaining add-ons to the Mozilla root), there is no shared consensus on the fundamental rationale for doing so. In addition, maintaining a full public key infrastructure (PKI) is a complex task and we do not necessarily have a firm grasp of the engineering and business tradeoffs involved.”

They recommended that more complete documentation be produced so everyone knows how add-on signing works, and assuming that Mozilla is committed to the current add-on signing approach, that improvements be made “to our certificate management processes, especially our key rollover strategies.”

armagaddon timeline Mozilla

Mozilla’s incident report included a detailed timeline of the add-on meltdown, from the certificate expiring to the final fix pushed to Firefox users 21 days later. Some clever wag at Mozilla named the graphic Armagaddon-timeline.prg!

Source link