When clients ask me, "Sam, honestly, how do I get started with open source?" it's usually clear that the first step is to install Mozilla Firefox on their Windows machines. The next step is to install the OpenOffice.org suite and help them plan a migration strategy away from MS Office.

Firefox and OpenOffice are tactical assets in the battle for the wider use of open software standards. These two important commodity applications - installed on Windows - are the start of a beautiful new relationship for organizations with their computer systems based on lower total cost of ownership (TCO) and higher productivity. As users exert control by demanding better desktop security and open formats, we must continue to rigorously ask, "What can we still do to accelerate their open source epiphanies?"

In 2010, when the desktop standards war is winding down, we'll look back and say what a very, very good year 2002 was for open source software applications. It was in 2002 that both the Mozilla and the OpenOffice.org development projects delivered their 1.0 releases to the public. Having a Free (and free) and open source browser and office suite running on both the Windows and GNU/Linux operating systems is a milestone worth rejoicing at any time. Its significance in 2002 can be measured by the emergence the following year (2003) of viable desktop Linux solutions. In hindsight, that impact seems even greater today, when the mature enterprise GNU/Linux desktop system is something that's taken for granted.

While the desktop Linux market share last year came in at a slight 3%, according to IDC estimates year-on-year growth is currently well into double digits and may in 2005 or 2006 reach into triple-digit percentages for a time while the absolute base is still small. That this phenomenon is due to the improving quality and maturation of the Linux kernel and leading user interfaces, GNOME and KDE, is not questioned. What really makes the market-share advance for desktop Linux possible is that the two most important commodity user applications that provide Web-page access and document creation services on GNU/Linux also run on practically all versions of Windows, today's dominant operating system.

The New Standard Browser for Windows

Mozilla has made many advances in the technology and user experience of its software since its 1.0 release in 2002. In particular, the project has split the e-mail, calendar, address book, and HTML editor features from the browser to form two separate applications called Thunderbird and Firefox. The latest version of the browser is Firefox 0.9.3. It's available as a free download under the open source Mozilla Public License (www.mozilla.org/products/firefox/releases/#download).

Users of Firefox on both Windows and GNU/Linux have reported to me that they are impressed by Firefox's quick speed at rendering Web pages. And Windows users report they are startled to find a non-Microsoft application that has new and useful functionality compared to their experience with Internet Explorer.

Figure 1 shows Mozilla Firefox 0.9.3, which boasts strong features like pop-up blocking, strong Web-site password management, and tabbed browsing. You can see that 19 different Web sites are open in tabs, visible just below the Personal Toolbar (the Personal Toolbar is the row of folders located below the Main Menu and Object Bar). With Firefox, you can open a folder full of bookmarks within multiple tabs in a single instance of your browser with a single right-click of the mouse. Figure 1 illustrates this action, having been executed on the folder called "OSS News Blogs" that's second from the left on the Personal Toolbar.

Firefox received a blast of attention this past July when US-CERT (United States Computer Emergency Readiness Team), a division of the Department of Homeland Security, issued a security warning (www.kb.cert.org/vuls/id/713878) to users of Microsoft's Internet Explorer ("IE"), stating the following:

Microsoft Internet Explorer (IE) does not adequately validate the security context of a frame that has been redirected by a Web server. An attacker could exploit this vulnerability to evaluate script in different security domains. By causing script to be evaluated in the Local Machine Zone, the attacker could execute arbitrary code with the privileges of the user running IE.

Functional exploit code is publicly available, and there are reports of incidents involving this vulnerability (Scob, Download.Ject, Toofeer, Berbew).

Any program that hosts the WebBrowser ActiveX control or uses the IE HTML rendering engine (MSHTML) may be affected by this vulnerability.

By convincing a victim to view an HTML document (Web page, HTML e-mail), an attacker could execute script in a different security domain than the one containing the attacker's document. By causing script to be run in the Local Machine Zone, the attacker could execute arbitrary code with the privileges of the user running IE.

The solution proposed by US-CERT is a whole gamut of patches and security updates that Windows users need to apply to their systems - some of which don't work, even if common users had the ability to install them - and behavioral changes that are not likely to be in the cards for free-clicking, freedom-loving Microsoft customers.

My favorite solution recommendation in the US-CERT warning is "Use a different Web browser" (see sidebar).

US-CERT Warning's Impact on the Mozilla Project

The warning had the predictable effect of driving millions of Microsoft users to Mozilla's Web site. Bart Decrem, a member of the Mozilla Foundation and a senior contributor to its development project, had this to say about the warning's impact:

We've seen our daily downloads double after the CERT warnings. During the month of July, we logged a whopping 5.5 million product downloads. Firefox usage has been doubling every month for the last six months or so, and the CERT warning added more fuel to the fire, so to speak.

If this as well as our own experience with the OpenOffice.org development and marketing project is any reference, the lion's share of Firefox downloads are for Windows (see Table 1).

The New Standard Office Suite for Windows

Having recently passed its 30-millionth download, OpenOffice has done much better than pundits even still reckon.

The Meaning of an Open File Format

Above all, one thing you can say about an open source office suite that you can download for free is that your software application upgrade cycle and your software application budget are no longer controlled by Microsoft and its respective food chain.

Apart from OpenOffice's decent useability (always improving); its solid look and feel on your desktop; and its complete selection of features for creating and editing text documents, spreadsheets, presentations, graphics, Web pages, mathematical formulas, and accessing databases, OpenOffice has a generous array of file formats it can import, export, save as, and otherwise ingest, digest, and express.

This is a revolutionary toolset that is silently taking over the world's desktop. Table 1 shows that the ratio of operating systems beneath installations of OpenOffice has drifted to the mean in the past year. My own interpretation is that we're seeing more installations of OpenOffice by pure Windows users. Earlier response data reveals more installations by users who are dual-booters of GNU/Linux and Windows or are administering multiple systems. The data trends you see today would be consistent with an increasing frequency of OpenOffice installations by single-system Windows-only users. If that's the case, we may conclude that OpenOffice is moving further mainstream - where it surely needs to go.

Now only the press and the technology analysts need to catch up. Rather than the gimmick or fad that's described in the media and among technology analysts (along with their anemic projection estimates), OpenOffice and StarOffice together have taken about 20% of the global office suite market, by Sun's last public estimate. This, therefore, is possibly the quietest extinction in the history of a species. OpenOffice, along with Firefox, is on a tactical beachhead, making way for further migration if and when individuals and organizations decide it's appropriate.

Conclusion

A high-quality open source browser and office suite running cross-platform on Windows and GNU/Linux first made it possible for GNU/Linux users to access the open Web as well as access their own data in the old and then work unencumbered in the new environment. Now, placing Firefox and OpenOffice on Windows gives companies, schools, and government agencies literally a "new lease" on the life of their IT infrastructure, permitting them to standardize on their two most important commodity applications while ramping out whichever underlying operating system solution for the server and desktop their budget and technical requirements dictate.

What is the value of this new flexibility ushered in by the open software standards associated with a very good cross-platform browser and office suite? Certainly there is substantial financial value (in terms of total cost of ownership) for each individual or enterprise adoption case as well as on aggregate. What should interest us most is the value of new opportunities created in personal and workgroup productivity (imagine always being able to open documents), business model innovation (think Google, think eBay, think Amazon), and homeland security by the ever-widening adoption of commodity software based on open standards.

Firefox and OpenOffice are the beginning of a global enabling process.

SIDEBAR

Use a different Web browser

There are a number of significant vulnerabilities in technologies relating to the IE domain/zone security model, the DHTML object model, MIME type determination, the graphical user interface (GUI), and ActiveX. It is possible to reduce exposure to these vulnerabilities by using a different Web browser, especially when browsing untrusted sites. Such a decision may, however, reduce the functionality of sites that require IE-specific features such as DHTML, VBScript, and ActiveX. Note that using a different Web browser will not remove IE from a Windows system, and other programs may invoke IE, the WebBrowser ActiveX control, or the HTML rendering engine (MSHTML).

-From the US-CERT warning against Microsoft Internet Explorer's vulnerability www.kb.cert.org/vuls/id/713878

• Figure 1
• Table 1