Microsoft Gazelle – Brand new browser from MS

On my last post about Microsoft, I explained why we should not hate microsoft. But today, let me come up with two reasons to love Microsoft. Later today, Microsoft is expected to announce two of their most impressive products. One is Gazelle, the new web browser with it’s own kernal. Another is, Microsoft office on clouds.

As per wikipedia.org gazelle is

"Gazelle is a research web browser which Microsoft Research announced in early 2009. The central notion of the project is to apply operating system principles to browser construction. In particular, the browser has a secure kernel, modeled after an operating system kernel, and various web sources run as separate "principals" above that, similar to user-space processes in an operating system. The goal of doing this is to prevent bad code from one web source to affect the rendering or processing of code from other web sources. Browser plugins are also managed as principals"

On 19 February 2009, Microsoft research blog announced Multi-Principal OS Construction of Gazelle Web Browser. By making it’s own kernal and new architecture, Gazelle is more focusing on cloud computing applications and security. Microsoft says that Gazelle will not have any relation ( neither look and feel nor architecture ) with browsers present at this moment.

Security model

Gazelle security model is completely different from background (security model in existing browsers) browsers. They are using Unified SOP (same-origin policy) across all resources. Mixed HTTPS and HTTP Content secures you from threats made by <ifrme> HTTP contents embeded in HTTPS pages. Present browsers ignores this when user allow HTTP contents inside HTTPS pages.

I think Sub domain treatment of Gazelle can be an issue because, in this security model, Gazelle wont allow scripts in the sub domain to access document:domain property to suffixes of its domain and assumes that identity. So cross domain javascript XMLHTTP request issue will be more complicated. Any ways, concerned of backward compatibility, many sites are using one sign in option by creating cookies which auto logins sub domains also. This will be possible because they have added an exception for cookies

Architecture

Different principals are placed into separate protection domains so that they are protected from one another. Just as in desktop applications where instances of an application are run in separate processes for failure containment, Gazelle run instances of principals in separate protection domains for the same purpose.(Almost similar to process in Chrome). But here, not just about tabs, but if a page is having embeded iframe pages from a different domain, that is managed as a different process. This will highly improve security.

Browser Kernel runs in a separate protection domain and interposes between browser principals and the traditional OS and mediates their access to system resources. Essentially, Browser Kernel functions as an operating system to browser principals and manages the protection and sharing of system resources for them.

The runtime of a principal instance is essentially an instance of today’s browser components including HTML and style sheet parser, JavaScript engine, layout renderer, and browser plugins. So there is less or more complication for developers to struggle as they do for other Microsoft products (Say IE ).

Simply, architecture of Gazelle is to run "everything as a separate process". Due to lack of time, I am not going deep in to specific features of Gazelle. You can read it here (pdf).

Conclusion

Even though Gazelle is expected to be exposed today, there are no clues about UI or alt east logo of the product. Microsoft has another blog post on Gazelle explaining how Gazelle is different from other existing browsers here. You may watch the live videos from Microsoft Partner network website. And don’t forget to follow me on twitter for get more updates on the same. Subscribe to RSS feed so that you can get my post on Office in cloud post also. BTW, there is option to subscribe via email on the right side if you have missed it.