In the frenzied world of software development, five years is a long time to wait for an upgrade. But that's how long it has been since Microsoft upgraded Internet Explorer. In the interval, other browsers, including Opera and Apple's Safari, and the open source Mozilla Firefox and Linux/Unix-based Konqueror, seized the opportunity and pushed the state of the browser art forward. And so when Microsoft finally released Internet Explorer 7 last October, expectations were high, perhaps unrealistically so given Microsoft's history.

IE 7 is a clear advance over IE 6, but the browser's new features show little innovation over its rivals. From a user standpoint, the two most notable advances are tabs and RSS support: both are new to IE but otherwise, old news. Other less obvious innovations, including anti-phishing measures, better CSS support, and support for international URLs, are equally welcome, but have not quickened the pulse of reviewers. For Microsoft, the industry's rules of evaluation are pretty straightforward: a tie goes to the competition. After waiting five years, critics expected a new standard of excellence. And when that didn't happen, they surveyed the field of browsers and praised IE's competition. Mozilla has been especially favored, because of a lingering sense that without Firefox, Microsoft might still be sitting on IE 6.

The influential website CNET, for example, called Firefox 2.0 "much better" than IE 7, giving the former its Editors' Choice award for best Internet browser. The one place the review criticized Firefox was for its incomplete uninstall facility, which left behind folders and register entries. That could be a problem both for people who want a complete uninstall, or want to load Firefox 2.0 cleanly, without previous bookmarks, extensions and preferences.

Another influential reviewer, The Wall Street Journal's Walt Mossburg, said that while IE 7 was much improved, the browser offers nothing that compelling to make Firefox users switch back. He noted that Firefox offered a few things that IE has so far omitted, including a spell checker that works for online entries and a facility for resuming where you left off in the event of a crash. And while praising IE 7's anti-phishing measures, he wrote that "the most important new security feature in IE 7 will only work on the Vista version of the browser, not under XP. That feature, called Protected Mode, blocks websites from altering computer settings and files. (Microsoft says Protected Mode is only available on Vista because it relies on Vista security features.) "The new Internet Explorer is a solid upgrade, but it's disappointing that after five years, the best Microsoft could do was to mostly catch up to smaller competitors," Mossburg wrote.

Not everyone has given the edge to Firefox. Jonathan Marsh, who spent 10 years at Microsoft working on XML and Web services technologies before joining the startup WS02, preferred IE 7 on three counts out of four. WSO2 will provide support services to Apache Axis tools customers, and so Marsh might have been expected to switch to an open source browser. But he's staying put. "One would think these two products would be pretty similar, especially given the anti-IE campaign waged by some Firefox users," Marsh wrote on his blog "Design by Committee." "I was prepared to abandon IE for a better alternative if that's what Firefox proved to be. But I found substantial differences in the user experience between the two products.

Marsh gives IE the edge in three areas: antialiasing, XML browsing support, and in how pages are bookmarked. Antialiasing is via Microsoft's Cleartype feature, which Marsh contends, makes text much clearer than on Firefox. (Flipping back and forth between identical pages, I couldn't see much of a difference on my Cleartype-enabled version of XP displayed on a Princeton monitor. But different equipment and sensibilities might produce different results.)

Marsh argues that while Microsoft and Firefox have not kept up with the state of the art for XML support, Firefox is even further behind. He called the Mozilla browser's XSLT (Extensible Stylesheet Language Transformations) implementation "sluggish" and faulted it for not supporting namespace nodes. "Imagine my surprise that Microsoft's "proprietary" product supports open standards better than the 'open' product! This makes Firefox completely unusable as an XML development tool. IE wins round 3 handily." Marsh is also wedded to an IE feature in which bookmarked pages appear as typeahead suggestions when entering a URL in the address bar. (The feature only works for top-level favorites, not sub-folders). He does prefer Firefox's find feature, which he calls "snappy" and "unobtrusive." Unlike with IE, Firefox begins searching on partial entries, often locating the desired text "before you even finish typing the phrase - like it's mind-reading!"

In all these reviews, the score is close, not decisive, judged on minor features, preferences, and in Mozilla's case, the good will garnered by a successful open source application. But that raises a question: have browsers gotten about as good as they are going to get? Like most software categories, the principal advances have come much earlier. Indeed, it is hard to remember, but Microsoft beat out Netscape not just because IE was free, but also because it had fewer bugs and offered better features. At least that's how I viewed the two browsers after running them side-by-side years ago. It wasn't until Opera came along, gaining a foothold in 1997 as a more nimble, smarter alternative, that IE got some competition on Windows machines. In 2003, Apple's Safari filled in the gap for Mac users left behind by Internet Explorer for Mac, which hadn't been upgraded in three years-and would not be upgraded again. Safari's design strongly influenced Mozilla Firefox, which in turn lit the fire under Microsoft.

Where IE 7 does matter is in its overwhelming market share: the Microsoft browser continues to be the iPod of the industry, and as such becomes the benchmark for the industry. Tabbing isn't new. RSS feeds have been around for years. But as IE features, they are now mainstream features that should see broad adoption.

Filling in the feature gaps

IE 7's overall look is somewhat different than IE 6, but not dramatically so. In keeping with a theme that will permeate the new version of Microsoft Office, Microsoft has tried to de-clutter the desktop by eliminating less frequently used options. For example, two icons handle the favorites screen-one listing bookmarks, the other for adding a single bookmark or a collected group of tabs, importing and exporting bookmarks, and an organization screen. Users can zoom in on Web pages and preview a page before it is printed.

The biggest change in the interface is tabbing. When Opera introduced the feature on its browser years ago, the company had to explain the concept: multiple URLs all open at once, each accessed by an onscreen tab. Yet in retrospect, the old method of opening up a new instance of the browser is so cumbersome and counter-intuitive-especially if you are doing serious research-that it's a wonder tabbing wasn't there from the beginning. For at least the past five years, tabbing has been pretty much mandatory for every browser except Internet Explorer. Now, at last, IE has joined the 21st century. The tabs are nicely sized. You can drag and drop them to change them from left to right. Clicking on a small tab to the far right opens a new tab with a blank screen. You can establish "tab groups," which can be saved as a single bookmark and opened with a single click-or opened automatically when the browser is launched. A "Quick Tabs" option shows small snapshots of each tabbed screen-a feature available on Firefox only through an extension.

Another missing feature now added to IE 7 is a built-in search box. Mozilla developers perfected this idea by giving users the ability to select from a menu which search engine they are searching from. Indeed, Firefox can search all kinds of places that aren't strictly speaking, search engines at all. Amazon, Wikipedia, BBC news are only the beginning. At this writing, the Mycroft project (http://mycroft.mozdev.org/), a search engine of search engine plugins, is approaching 10,000. The project is sponsored by Mozilla, and plug-ins work with both Firefox and IE 7, although that fact is far less obvious to IE 7 users. One Firefox search feature entirely missing in IE 7: a suggested list of search results that appears just below the search box. Enter Yahoo when the search box itself is set to Yahoo, and "Yahoo Messenger," Yahoo Mobile," "Yahoo Mail," and other possible matches, are all suggested. As with Firefox, users can also make what is essentially their own search engine plug-in, though the feature does not consistently work.

The built-in search bar would seem to eliminate the need to install a separate search bar from Yahoo or Google. But these companies and others are instead offering customized versions of the browser, created with the Internet Explorer Administration Kit, which Microsoft released for corporations, ISPs, content providers and ISVs. The kit's wizard allows customization of the toolbar, privacy settings, tabbing behavior, pre-set RSS feeds and search providers, and default home pages via tabs.

The ability to track RSS feeds is the other big feature in IE 7. Well, maybe RSS isn't quite as big: it helps to be something of a browser geek who wants to track dozens, if not hundreds, of sites, particularly blogs and other websites that are not updated daily. The good news about RSS is how much easier it has gotten. In the early days of RSS, you had to download a separate reader that worked apart, or somewhat in conjunction with your browser. Then some websites, most notably Yahoo!, offered RSS feed tracking as an online service. But built-in RSS support makes the most intuitive sense, just as do built-in bookmarks. Because of Internet Explorer's dominant market share, IE 7's support is an important step for RSS, putting it in the hands of more people, which, in turn, should encourage more websites to offer RSS feeds.

The feature on IE 7 is easy to use. When you view a page with an RSS feed, an RSS icon on the main navigation bar turns from gray to its native reddish-orange. Click on the icon and you get the usual content summary, options for sorting by date, author or title, and an option to subscribe. Unlike Firefox, which treats RSS feeds as a type of bookmark-called a "Live Bookmark-IE 7 separates subscribed feeds into a separate list, viewable by clicking an icon in the "Favorites Center." This side panel also shows conventional bookmarks, tab groups, and browsing history. RSS feeds can be stored and accessed at the operating system level under both Vista and XP-making subscriptions available beyond the browser to other applications.

Better security

IE 7's security features include an opt-in Phishing Filter that analyzes sites, comparing them against a list of confirmed phishing sites, which is updated several times an hour.

IE 7 comes with ActiveX controls switched off-users must turn it on, and can do so as needed through the Information Bar. (Firefox's approach is more conservative: you must add an ActiveX plug-in.) IE 7 also notifies users when security settings may be set too low. Users working on shared and public PCs can with a single click erase cached pages, passwords, form data and cookies, and their browsing history. And Web page scripts are now prevented from interacting with content from other domains or Windows.

Microsoft has joined the other browser vendors in promoting stricter Extended Validation Certificates Web transactions that help prevent spoofing. The advance is at two levels-stricter, or at least more uniform standards to be certified, and clearer user notification. The guidelines, still in draft form, are being defined by the CA/Browser Forum. They include confirmation of a company's identity, including the name it is doing business under, its registration number, the requesting agent, its right to use the domain name, and that it has an authorized EV certificate.

Users are unlikely to know about any of this, except that when they log onto a certified site, the address bar will turn from white to green, indicating approval. But as the Wall Street Journal pointed out, many smaller U.S. companies "won't be eligible for the new, stricter security certificates that Microsoft requires to display the color." Will shoppers hesitate to enter a site if they don't "see green?" Writing on the Microsoft Internet Explorer Weblog, IE product manager Markellos Diorinos responded that the green bar would be seen only during checkout and other points when personal user information was to be disclosed-so the indicator won't necessarily serve as a "red light" for smaller websites. And many retailers, including the one profiled by the Journal, will be able to use EV Certificates anyway, because their checkout process is hosted by a larger partner, such as eBay or Amazon. That argument makes sense: given the security vulnerabilities still common on the Internet, the days of small retailers handling their own transactions may be numbered.

Another security hole being filled has to do with international characters in URLs. These are of special interest, because of the drive to support internationalized domain names (IDNs), which contain non-ASCII characters. "Internet engineers and policy makers have been working for years to come up with a standard way of supporting foreign language characters without disrupting how the Internet's domain name system works," wrote Carolyn Duffy Marsan in a Network World report. She noted that while Firefox and Opera have supported international characters, IE 7's support might represent the needed push. According to VeriSign, the most popular IDNs are in the country code domains for Germany, Taiwan, China, Japan and Korea.

The domain name register Afilias launched the German script in 2004. Last October, it added Polish, Swedish, Danish, Hungarian, Icelandic, Latvian, Lithuanian and Korean (KO). Both VeriSign (which registers Japanese IDNs through PSI-Japan) and Afilias IDN registrations are based on the Punycode standard, which was approved in 2003. According to Network World, there has been high demand for IDNs in Korea and Japan, where the .jp domain rose from 80,000 to 122,000 since the last beta version of IE 7 was released. IDNs now represent 30% of all registrations-representing about 1 million domain names-in the Korean country code top-level domain. "Korea has been a bellwether in terms of the adoption of new domain-name technologies,"

All of these changes are for the good. But there are still no panaceas. IE 7 was no sooner out than reports of potential security holes came pouring through. An early one came from the Dutch security firm Secunia, which reported a "less critical" potential exploit in which a popup window could be displayed with a "somewhat spoofed" address bar that contains special characters in the URL. In a demo, clicking on the link may bring up a pop-up that users believe is from a legitimate source-asking for confidential information. (Microsoft argued that the bug may have emanated from IE 7, but actually resided in Outlook Express. Secunia replied that no matter where the bug resided technically, IE 7 remained the "vector.") Another vulnerability-potentially more dangerous-involved XML as a vehicle for "driveby downloads" of malware on both IE 6 and IE 7.

Web Design features

A few improvements in IE 7 will make Web designers happier-though not completely satisfied. A good case in point is the long-standing complaint that different browsers will render the same page differently, mostly because cascading style sheet (CSS) specifications have not been implemented uniformly across browsers. IE 7's CSS support has been upgraded to include additional support for CSS 2.1, includes selectors and fixed positioning. A benchmark for standards compliance is the Acid2 test, developed by the Web Standards Project, which developed it in April 2005 in response to the IE7 announcement.

The test image (which, ironically, contains some bugs of its own)-is deceptively simple: a yellow smiley face rendered within a 14x 14 grid of squares, each square 12 pixels by 12 pixels, along with the text "Hello World's Running a cursor over the black nose turns it blue. But the source page employs HTML4, CSS1, PNG and Data URLs, which, while less used, are described in HTML4. Elements tested include object elements, positioning, margins, generated content, CSS parsing, line heights and hovering effects. Opera version 9 and Safari RSS under Mac OS X 10.4.3 have passed. At this writing, neither Firefox 2 nor IE 7 do-though the image rendered on Firefox appears to come closer.

IE Next wish list

As for the next version of Internet Explorer, Microsoft is not waiting another five years. "IE Next," as IE 7's successor is being called, has no release date and, not surprisingly, rumors are few. In terms of a "feature war," Firefox has an advantage here in the form of its extensions, which give users wide ability to extend the capabilities of the browser. (There is even, perversely, an extension that makes Firefox look like IE.) Microsoft has given developers the ability to extend IE since version 4, but they are much harder to locate because, unlike Mozilla, Microsoft doesn't collect them in one place.

The Web Standards Project, with its interest in browser cross-compatibility, asked participants for a wish list of features, which it promised to compile, prioritize and pass along to Microsoft. "We're not guaranteed to get everything we ask for, but they are listening," the site said.

On her blog (www.molly.com), author Molly E. Holzschlag, who has a lead role in the project, recounted a meeting between Bill Gates and 14 bloggers and industry leaders, held on a rainy day last December in building 20 of the Microsoft campus. She took the opportunity to ask Gates about "committing to the implementation of standards for the browser and other development tools" and suggested that many "that Microsoft wants to own the Web."

Gates denied that accusation, but admitted the company had let IE lapse. "We've done the Mea Culpa . . . that yes, we should have kept the browser innovation curve to be a more continuous curve. Believe me, we wish that we'd done that differently. [Lead IE developer Dean Hachamovitch's] group is getting more resources," he said.

Gates told the group that the company would accelerate the pace of innovation, including implementing standards and adding ever more features to the interface-all in pursuit of a browser that is ever more "cool."

But Holzschlag didn't think her question was answered. What about Microsoft's commitment to browser standards.

Gates replied that for three years, 1995-1997, the company did nothing to promote standards, but didn't do anything proprietary, either. "That's criticizing not our intent, our strategy, that's criticizing our execution and we fully accept that." But in the years following, the company has "not just followed and implemented standards," but contributed more standards than anyone else." That's especially notable, he said, in Microsoft's widespread XML implementation, which he said was now at the core of all its products.

Judging from Holzschlag's background, I would guess she was concerned more about CSS support than XML.

But no matter. Long term, it's a pretty good guess that Microsoft is at least listening-and won't wait another five years for the next rev.