Firefox faces challenges as it matures

 When version 1.0 of Firefox was released in November 2004, it caused a sensation as a seemingly more secure and more feature-rich option to Microsoft Corp.'s ubiquitous Internet Explorer (IE) which for years had held a market share north of 90 percent and which Microsoft had barely bothered to improve.

Free IT resource Hear how top CIOs turn change into a competitive advantage. Sponsored by HP Free IT resource Attend the SOA Executive Forum: Breaking SOA Bottlenecks SOAExecForum.com/may2007 Sponsored by InfoWorld

Since Firefox 1.0 was released, it has achieved what no other browser had accomplished in years: attain a significant market share at IE's expense. Firefox now holds a market share of between 7 percent and 9 percent, according to various market research estimates.

But as Firefox nears its first birthday, its maker, The Mozilla Foundation, faces significant challenges, analysts say. These include quickly discovering and fixing security vulnerabilities, competing against an upcoming IE upgrade and broadening Firefox's user base beyond its core of technically savvy users.

The stream of Firefox security vulnerabilities uncovered in recent months is par for the course for a young software product. But it may disappoint users who switched to Firefox expecting it would be immune to security holes.

While the myth of Firefox as a totally secure browser evaporates, Microsoft is now upgrading IE to try and close the features gap that has attracted users to Firefox. IE 7 is now in a test, or beta, phase. Mozilla must keep Firefox one step ahead of IE in features and innovation, a bigger challenge now that Microsoft is for the first time in years paying attention to its browser's development.

Finally, although Firefox has anywhere between 40 million and 50 million active users, according to Mozilla, it needs to appeal to more mainstream individual users as well as to corporate IT departments, in order to give its usage growth a boost, analysts say.

Mozilla isn't keeping still. The first major Firefox upgrade, code-named Deer Park and also known as version 1.5, is now in beta testing and is slated for general availability by November or December of this year.

The new and improved features in Firefox 1.5 are adequate and convenient, but not earth-shattering, and the coming months will be critical for Firefox to hold on to its user base and remain a viable alternative to IE, analysts say.

"Firefox 1.5 features improvements that are necessary and valuable but not necessarily compelling. It will not re-energize the usage growth, which is going through a natural slowing down that happens with maturity," said Ray Valdes, a Gartner Inc. analyst.

Firefox 1.5 features enhancements in usability, performance, extensibility, security and privacy, including faster Web navigation, due to advanced capabilities for caching and pre-rendering content, Chris Beard, head of products and marketing at Mozilla Corp., told IDG News Service recently. Mozilla Corp. is the subsidiary of the nonprofit Mozilla Foundation that is charged with developing, marketing and distributing Mozilla products.

The product's tabbed browsing feature has also been improved by making it possible for users to rearrange pages by dragging and dropping them, Beard said.

In terms of security and privacy, the biggest improvement is an automated update feature to make it easy for users to keep their browser current with the latest improvements and patches available for it, Beard said. For example, with the current version users have to download the entire browser again to get updates, but with Firefox 1.5 users will be able to simply download the patches, making the process faster, he said.

The updates will be downloaded in the background in bits and pieces at a time, so as to not interfere with the browsing experience, and users will be prompted to install them once the patch has been completely downloaded, he said. Moreover, the automated update feature also will take into account the add-ins a user has installed on a browser, to ensure compatibility between the updates to the browser and the extensions, he said.

"We're delivering a software update capability that is holistic, that takes into account how people use Firefox," Beard said. "This feature is one of the most significant enhancements. It has been a pain point for Firefox users and we believe we've delivered a solution that will let people stay current."

Microsoft, however, is reacting to the challenge by improving IE, analysts say.

"The real question is how well will Firefox fare against a reinvigorated IE," said Michael Gartenberg, a Jupiter Research analyst. "For many users, IE 7 will address some of the key reasons why they may have looked at Firefox, such as security or new features [not in IE.]"

In the excitement that surrounded its launch last year, Firefox was unreasonably portrayed by some as having unbreakable security, but the vulnerabilities that have been detected in recent months are injecting a dose of reality into this myth, analysts say.

Users who adopted Firefox, hoping never having to patch it, are disappointed and this in turn is slowing down its growth, said analyst Rob Enderle of The Enderle Group. "Firefox has had some visible growing pains," Enderle said. "As the product grows up, you face reality … and the massive interest has dropped off."

In the face of unavoidable security holes, the important thing is for Mozilla to react quickly to the discoveries with fixes, analysts say. "What the market has learned is that there are going to be vulnerabilities on any platform and that switching from one browser to another is not going to be a panacea," Gartenberg said.

This is why the automated update feature in Firefox 1.5 is a particularly important one, said Eric Peterson, a Jupiter Research analyst. "It's the kind of functionality they should have. They need to be ready to quickly address any kind of hacker threat to the application," Peterson said. "If they're making it fairly transparent to the user, that's great news. In retrospect, it's probably something they should have built in with the 1.0 release."

On the question of how responsive Mozilla has been in patching the security holes, the opinions are mixed. Gartenberg and Valdes both give Mozilla high marks, but others are less impressed. "Putting in place an automated update mechanism doesn't really get you anything unless there are updates to feed through it. What we've seen with some of the first security problems in Firefox is that their speed of getting to market with an update is the bigger factor," said Nate Root, a Forrester Research Inc. analyst.

As Mozilla continues to improve Firefox, it needs to place more attention on quality assurance, because the browser is developed by a community of open source volunteers, Root said. Particular stringency needs to be applied to reviewing the hundreds of add-ins available for the browser, some of which have been sources of security vulnerabilities, Root said.

Then there's the issue of keeping the growth momentum going, which necessarily involves appealing to users outside of Firefox early adopters. These core users are mostly technically savvy people comfortable with open source software and eager to take advantage of Firefox's extensible architecture to customize the product, analysts say. Places to find new adopters are in the massive consumer market and in the corporate market, they say. "One could argue they're getting [close] to saturating that portion of the market of technically adept users," said Gartner's Valdes.

To appeal to mainstream individual users, Firefox needs to remain a step ahead of Microsoft in features and innovation, analysts say. However, some don't see anything close to a massive migration from IE to Firefox happening any time soon.

"IE works perfectly fine for the vast majority of consumer, mainstream users," Jupiter's Gartenberg said. "I don't think we'll see massive mainstream consumers opting to use Firefox."

Regarding the enterprise market, Mozilla officials acknowledge that, at least for now, their focus remains on individual users, not on making the browser attractive for IT departments that may in turn roll it out to their corporate users.

That needs to change, said Gartner's Valdes. "If they want to keep growing their usage base, they need to address the needs of different sectors of the user population, including corporate users," he said.