Internet Explorer Sucks
This study is from August, but I missed it. The researchers tracked three browsers (MSIE, Firefox, Opera) in 2004 and counted which days they were "known unsafe." Their definition of "known unsafe": a remotely exploitable security vulnerability had been publicly announced and no patch was yet available.
Context & Ripple Effects
Bruce Schneier is resurfacing an August researcher study covering all of 2004 that measured browsers by 'known unsafe' days — any window where a remotely exploitable vulnerability was publicly announced but unpatched — and Internet Explorer came out worst of the three browsers tracked (MSIE, Firefox, Opera). The framing matters because it measures exposure time, not raw bug counts: a vendor's patch cadence becomes the security metric.
First-order effects
- Users already moving off IE — a shift confirmed in coverage just over a week before this post — now have a quantified security argument for switching to Firefox or Opera rather than a purely ideological one.
Second-order effects
- Microsoft's dominance strategy of shipping the browser with Windows comes under pressure: every announced-but-unpatched IE vulnerability is now public evidence rivals can use in the migration pitch to consumers and IT departments.
Third-order effects
- If 'days known unsafe' becomes a standard comparison, browser competition shifts toward patch responsiveness and disclosure handling, making security posture a durable differentiator instead of an afterthought for whoever holds the default position.
The trend: Browser market share is being contested on measurable security exposure, with the patch gap between disclosure and fix becoming the yardstick users and enterprises judge defaults by.