Illustration by The New York Times ARTICLE TOOLS E-Mail This Article Printer-Friendly Format Most E-Mailed Articles Reprints & Permissions TIMES NEWS TRACKER   Topics Alerts Microsoft Corporation Computers and the Internet Track news that interests you.

The Fox Is in Microsoft's Henhouse (and Salivating)

IREFOX is a classic overnight success, many years in the making.

Published by the Mozilla Foundation, a nonprofit group supporting open-source software that draws upon the skills of hundreds of volunteer programmers, Firefox is a Web browser that is fast and filled with features that Microsoft's stodgy Internet Explorer lacks. Firefox installs in a snap, and it's free.

Firefox 1.0 was released on Nov. 9. Just over a month later, the foundation celebrated a remarkable milestone: 10 million downloads. Donations from Firefox's appreciative fans paid for a two-page advertisement in The New York Times on Thursday.

Until now, the Linux operating system was the best-known success among the hundreds of open-source projects that challenge Microsoft with technically strong, free software that improves as the population of bug-reporting and bug-fixing users grows. But unless you oversee purchases for a corporate data center, it's unlikely that you've felt the need to try Linux yourself.

With Firefox, open-source software moves from back-office obscurity to your home, and to your parents', too. (Your children in college are already using it.) It is polished, as easy to use as Internet Explorer and, most compelling, much better defended against viruses, worms and snoops.

Microsoft has always viewed Internet Explorer's tight integration with Windows to be an attractive feature. That, however, was before security became the unmet need of the day. Firefox sits lightly on top of Windows, in a separation from the underlying operating system that the Mozilla Foundation's president, Mitchell Baker, calls a "natural defense."

For the first time, Internet Explorer has been losing market share. According to a worldwide survey conducted in late November by OneStat.com, a company in Amsterdam that analyzes the Web, Internet Explorer's share dropped to less than 89 percent, 5 percentage points less than in May. Firefox now has almost 5 percent of the market, and it is growing.

Gary Schare, Microsoft's director of product management for Windows, has been assigned the unenviable task of explaining how Microsoft plans to respond to the Firefox challenge with a product whose features were last updated three years ago. He has said that current users of Internet Explorer will stick with it once they take into account "all the factors that led them to choose I.E. in the first place." Beg your pardon. Choose? Doesn't I.E. come bundled with Windows?

Mr. Schare has said that Mozilla's Firefox must prove it can smoothly move from version 1.0 to 2.0, and has thus far enjoyed "a bit of a free ride." If I were the spokesman for the software company that included the company's browser free on every Windows PC, I'd be more careful about using the phrase "free ride."

Trying to strike a conciliatory note, Mr. Schare has also declared that he and his company were happy to have Firefox as "part of the large ecosystem" of software that runs on Windows. In fact, Firefox is ecumenically neutral, being available also for both the Mac and for Linux.

Mr. Schare may be the official spokesman, but he does not use Internet Explorer himself. Instead he uses Maxthon, published by a little company of the same name. It uses the Internet Explorer engine but provides loads of features that Internet Explorer does not. "Tabs are what hooked me," he told me, referring to the ability to open within a single window many different Web sites and move easily among them, rather than open separate windows for each one and tax the computer's memory. Firefox has tabs. Other browsers do, too. But fundamental design decisions for Internet Explorer prevent the addition of this and other desiderata without a thorough update of Windows, which will not be complete until 2006 at the earliest.

How fitting that Microsoft finds itself in this predicament. In late 1995, at a time when Netscape Navigator was synonymous with the Web and Internet Explorer had yet to attract many adopters, Microsoft made a risky but strategically wise decision to redesign the Internet Explorer code from the bottom up - re-architecting, in industry jargon. As Michael A. Cusumano of M.I.T. and David B. Yoffie of Harvard chronicled in their 1998 book, "Competing on Internet Time: Lessons From Netscape and Its Battle With Microsoft," that decision meant delaying the release of Internet Explorer 3.0, but the resulting product was technically far superior to Netscape's Navigator. In Browser Wars I, the better browser won.

Today, it's the Internet Explorer code that is long overdue for a top-to-bottom redesign, one that would treat security as integral, and Firefox is the challenger with new, clean code. Netscape bequeathed its software to the nonprofit Mozilla Foundation, which used an open-source approach to undertake a complete rewrite that took three years. Firefox is built upon the Mozilla base.

All Microsoft can offer Internet Explorer users are incremental security improvements, new patches to fix holes in the old patches. In Windows XP Service Pack 2, the company claimed as a major security advance a notice that is displayed if the user takes an action within Internet Explorer that sets off a download of a tiny application called an ActiveX control, which can take control of your PC and, in a worst-case instance, erase your hard drive. "Users still must make informed decisions," Mr. Schare added. (With Firefox, users do not have to make decisions about these miniprograms, which are blocked by design.)

Bruce Schneier, the chief technical officer of Counterpane Internet Security Inc. and an authority on security issues, did not hide his anger at Microsoft's claim of having improved Internet Explorer. "When my mother gets a prompt 'Do you want to download this?' she's going to say yes" he said. "It's disingenuous for Microsoft to give you all of these tools with which to hang yourself, and when you do, then say it's your fault." He lectures his clients (and his mother): "Don't use Microsoft Internet Explorer, period." He has been using the browser Opera, but having tried Firefox declares it "a great alternative."

THIS month, officials at Pennsylvania State University recommended that students and staff stop using Internet Explorer because of persistent security problems. The announcement said that "the threats are real, and alternatives exist."

Stuck with code from a bygone era when the need for protection against bad guys was little considered, Microsoft cannot do much. It does not offer a new stand-alone version of Internet Explorer. Instead, the loyal customer must download and install the newest version of Service Pack 2. That, in turn, requires Windows XP. Those who have an earlier version of Windows are out of luck if they wish to stick with Internet Explorer.

Mr. Schare of Microsoft does have one suggestion for those who cannot use the latest patches in Service Pack 2: buy a new personal computer. By the same reasoning, the security problems created by a car's broken door lock could be solved by buying an entirely new automobile. The analogy comes straight from Mr. Schare. "It's like buying a car," he said. "If you want to get the latest safety features, you have to buy the latest model."

In this case, the very latest model is not a 2001 Internet Explorer, but a 2004 Firefox.

Randall Stross is a historian and author based in Silicon Valley. E-mail:ddomain@nytimes.com.

Holiday Offer: Home Delivery of The Times for 50% off.