Schroepfer agrees: The weak link is trust. That puts more responsibility on the Web browser to know more of what's going on, to present information to users so they can make decisions, and to make them more aware of the consequences of their decisions. Much of this, he says, is a matter of education; while socially we may prefer to give users a choice, most of the time that's giving them enough rope to hang themselves—what Schroepfer calls the "yeah, whatever" click-through.

One way to address this under consideration uses peer-to-peer knowledge or collaborative history of a site—but that raises new problems. Browser vendors have to take a stronger stance with malware as a result. Schroepfer says, "It's an area where we need to be braver; for the vast majority of users, [these security features are] the right behavior. Out of the box we'll have it work that way, but you can turn it off."

One security challenge for browsers—for today and tomorrow—is the way developers learn new techniques and exchange ideas: Are they copying the right source code today, the right patterns? From the earliest days of the Web, programmers clicked on View Source to discover programming tips. "This enabled everybody to have a website with dancing hamsters," says Hachamovitch. Developers learn from and copy each other's source code. But warns Hachamovitch, "If that procedure had a security problem, or the developer didn't understand an information disclosure issue, that code infected a lot of websites."

Serving the Developer

Developers want to have an easy, straightforward experience writing great applications. Too much time is spent in Web developers optimizing applications to make them work right on a given browser—or even to make the app work at all. They want to spend their time adding value, not dealing with subtle technical differences between implementations. And they don't want to have to start over when a new technology becomes available. That means investments in the pipeline between development and production. "Compatibility is hard to demo," says Schroepfer. "It's not a sexy thing; it's a hygiene thing. But it's what permits the Web to be successful long term."

The browser creators are aware of developers' challenges, and that it's hard to do more using current technology. Schroepfer ticks off a few of the issues on his fingers: There's the deployment model, the need to decouple parts of the infrastructure, the choice of vendors. "We have to make sure the platform is ready for the app, and that the platform is amenable to the apps," Schroepfer says.