◄ Part 1 Tab isolation and Security, and Privacy
There's still a fairly widespread perception among Web users that IE has security problems, and we do occasionally hear about exploits that need to be plugged. But a report by the NSS Labs showed that IE8's SmartScreen filtering did the best job at thwarting socially engineered malware and phishing attacks (okay, the study was commissioned by Microsoft, but it is an independent lab). On the other hand, at the annual, pwn2own hacking contest, only Chrome wasn't penetrated, thanks to its total sandboxing. IE9 does run plugins in a sandbox, and adds ActiveX filtering for more safety.
Internet 8 started a trend of browsers running tabs in more than one process, to prevent a total browser crash if one bad site acted up. But IE8 bunched 3 or 4 tabs per process, while Chrome actually ran each tab—and each plugin—in its own process. IE9 now gets closer to this extreme: When I had 12 tabs open, there were 9 running processes, so figure two tabs per process and three for plugins.
Microsoft has done more than separate processes for tabs, though. They've added "hang recovery," for when a website script runs on forever, and crash recovery can either restore a bad-acting tab or reload a group of tabs to the last good point if the browser closes. In addition to the download manager's scanning for malware, IE's SmartScreen has been updated to block malicious content even when it's on a good page, such as an externally served malicious advertisement on a legitimate news page.
When it comes to private browsing, Internet Explorer's InPrivate mode is still the only one among popular browsers that by default hides site's activities from other third-party sites. This has been around since IE8, so I'm surprised other browser makers haven't included it (there is a Firefox add-on that allows control over third-party snooping).
Tracking Protection
Microsoft goes even farther towards protecting users from third-party site tracking. The browser's innovative Tracking Protection feature is the company's response to the FCC's call for such a feature. This allows users to block tracking sites (such as DoubleClick) from following your Web surfing history and tracking you. The tracking it protects you from is mostly a technique for Web advertisers to profile you, and this IE9 feature is akin to the "Do Not Call" list aimed at telemarketers.
You can enable the feature explicitly in settings and choose a list provider of sites to block, or have it automatically create a list based on how often a third-party site phones home from different sites you visit. For example, if you go to ten different sites, all of which contain DoubleClick elements, DoubleClick gets added to your personal list. You also have the option to allow these tracking sites, if the idea of targeted advertising appeals to you. This technique requires less buy-in from all sites than Mozilla and Google's anti-tracking initiatives, so I consider it more flexible and comprehensive.
Performance and Compatibility
Speed was the reason so many turned away from Internet Explorer (and Firefox) to Google's Chrome. IE8 trailed Chrome on JavaScript benchmarks by orders of magnitude. IE9 rights that, with top performance among all current browsers on some tests. It also adds speed through its innovative hardware acceleration, which works for more than just 3D graphics. By precompiling JavaScript on a second CPU core, the browser can take performance up a notch.
In one measure of performance that's important to everyone—the time it takes to start up the browser—IE9 has nothing to worry about: I tested the big three browsers on a weak netbook with a 1.66GHz Atom CPU and 1GB RAM running 32-bit Windows 7. After a reboot, IE9 took 3.5 seconds to start up, Chrome's 2.6 took seconds, and Firefox 4 took 6 seconds. Closing and restarting the browser without a reboot took IE9 1.1 seconds, Firefox 2.2 seconds, and Chrome .9 seconds.
IE9 now wins the SunSpider JavaScript Benchmark, with 246ms on my 2.6GHz dual core laptop, compared with 283 for Google Chrome. Microsoft has been accused of optimizing for this benchmark, but, as we'll see, the browser does well on other JavaScript measures, too (though this is the only one it wins). It would be naïve to think that browser makers don't optimize their engines to do well on these widely cited tests, too. To get the following results, I shut down any unessential processes for three averaged test runs on a Core 2 Duo 2.6GHz Windows 7 (32-bit) laptop with 3GB of DDR2 memory:
On Firefox maker Mozilla's Kraken, another JavaScript benchmark, IE9's final release makes big improvements over its beta, but Chrome 10 improved even more. Mozilla contends that this benchmark reflects more realistic workloads than the other two JavaScript benchmarks, and it takes quite a bit longer to run.
IE9 also shows a huge improvement over IE8 in its performance on Google's V8 benchmark, though it still significantly trails the benchmark maker's browser, and Firefox 4 RC. Google's Chromium blog claims that the benchmark is designed to "capture the areas in which a JavaScript engine has to perform well to support the well-structured, maintainable, and high-performance Web applications of tomorrow." Here are my results on the same machine:
These script speed tests measure just a small piece of performance, though, and in normal browsing, I was hard pressed to see a difference between Chrome, IE, and Firefox 4 RC.
To measure a different kind of performance, Microsoft engineers have authored tests on the
IETestdrive site. These demonstrate IE9's graphics hardware acceleration. One I like to use is Psychedelic Browsing, which displays a spinning color wheel while playing spacy sounds and reports a result in RPM. While no one touches IE9, thanks to its DirectX hardware acceleration, Firefox 4 beta does thump Chrome 9, though Firefox doesn't play the sound as the test requires and Chrome does. Here were my results for this test:
One final test of hardware acceleration comes from Mozilla, its
Hardware Acceleration Stress test, which spins a spiral of photos in the browser window and reports a score in frames per second. This test showed the two browsers furthest along in implementing hardware acceleration to good advantage (note the benchmark no longer reports frame rates over 60FPS, as that's the limit of standard LCDs):
Compatibility
When it comes to supporting new Web standards, IE9 is on the right track. Microsoft has moved more deliberately than other browser makers, often submitting cases to the World Wide Web Consortium before implementing a feature. Support for HTML5, CSS3, Canvas, location services, and SVG has made its way into Microsoft's browser, but IE9 still trails Chrome in sheer number of supported emerging Web features.
On the widely cited Acid3 test of adherence to Web standards, IE9 is up to 95 out of a possible 100—remarkable for a browser stuck in the 20s for years—but unchanged from the beta. Microsoft has stated that implementing some Acid3 features would constitute a security risk. It's also worth noting that the Web Standards Project that puts out the test isn't an official standards body, and many have claimed it's an arbitrary set of requirements. Still, it's an interesting metric.
More granular is the HTML5Test, which shows how many HTML5 elements and features a browser supports out of 400. It also notes "bonus" points for features that aren't required parts of HTML5, but are good to have, such as extra video codecs. On this test, Chrome leads all other released browsers, with a score of 288 and 13 bonus points. IE9 ups its game from 96 and 3 bonus points in the beta to 130 and 5, but it still trails most other new browsers.
A truly valid test will be available when the W3C finishes its
HTML5 Test Suite, but as of this writing, the organization cautions against quoting that. IE9, so far, is among the top in the test's results, and the site gives an eye-opening look at how much is involved in implementing the new standard.
In real-world site compatibility testing, I found that IE9 worked perfectly in far more sites than the beta did—you have to look high and low to find one that doesn't display correctly. I had no trouble signing into my Citibank, Fidelity, and Omniture accounts. Even our Vignette CMA, which has trouble in just about every browser except IE7, again works perfectly in IE9. But in the new Yahoo Mail site, the built-in slideshow viewer didn't display. There will always be some sites that choke any browser, and this was likely a result of IE9 still being new.
It's Trim, It's Fast, and It's Secured, But Is It For You?
Microsoft reps told me that this browser had been the fastest adopted beta in the company's history and benefited from the most tester feedback by far. This should translate into fewer site-compatibility issues going forward. The browser also offers great speed, security and privacy tools, and support for much of HTML5's glories.
Though this is called version 9 of IE, in some ways it feels more like a version 1: it's a complete rebuild of Microsoft's browser. It still lacks some conveniences and frills found in other browsers, like themes and bookmark syncing. Some of these may come, but Microsoft may consider those features to be "the browser getting in the way."
IE9 is the result of a massive effort by a large team of super smart people, and huge number of beta testers. And it's an impressive, innovative app that I'm sure will come to benefit millions of Web users, especially once graphics-heavy sites are common. It's a no-brainer for those using IE8 on Windows 7 or Vista. Google Chrome 10 is my Editors' Choice among Web browsers, because it adds nifty tricks like Instant page display and syncing to already blazing speed and minimalist design—and brings that stuff to every currently popular operating system, including Windows XP.
