The Window That Acts

On the morning of 9 August 1995, shares in Netscape Communications began trading in New York. The company was sixteen months old. It had never made a profit, and its main product was given away free to most of the people who used it. The shares had been priced at $28 the night before. They opened at $71, and by the end of the day the company was valued at more than $2 billion.¹ Investors were not buying a business so much as a doorway. Netscape Navigator was how most people then saw the World Wide Web, and the web looked as if it might become the way people did almost everything.

Three decades later the doorway matters more than ever, and almost nobody thinks about it. The browser is the most used application in the world. In October 2026, according to StatCounter, Google’s Chrome accounted for about 69 percent of web browsing worldwide, Apple’s Safari for about 17 percent, and Microsoft’s Edge and Mozilla’s Firefox for most of the rest.² Two antitrust cases a generation apart have turned on browsers: the first against Microsoft for how it took the browser market, the second against Google, in which a federal judge found in 2024 that it had maintained its search monopoly partly by paying billions of dollars a year to be the default search engine in browsers, and in 2025 declined to order it to sell Chrome.³ And in 2025 artificial intelligence companies began building browsers that act on pages as well as showing them, booking, buying and filling in forms for their users.

This essay follows how a program written at a physics laboratory became the window through which most of humanity sees the internet. It follows the decisions that shaped it: the web given away, the browser made visual, the browser given away, the browser tied to an operating system, the browser left to stagnate, the browser rebuilt, the browser locked to one engine, and the browser turned into a battleground over tracking and an agent that acts. Its deeper subject is agency. A browser’s technical name is the “user agent”: a program that acts on behalf of a person. Who it really works for, and what it does to the people looking through it, has been contested from the start.

Before the browser: documents that pointed to each other

The idea that documents could point to other documents is older than computers. In 1945 Vannevar Bush imagined a desk-sized machine, the memex, in which a reader could tie any two items together with a trail; in the 1960s Ted Nelson coined the word “hypertext” for writing that branches and links, and spent decades on a system, Xanadu, that would have made every link two-way and every quotation traceable. Both are discussed on this site, in As We May Think and The Links That Would Never Break. By the late 1980s hypertext existed in programs such as Apple’s HyperCard, but only inside a single computer. The internet, meanwhile, connected computers at universities and laboratories, and people used it to send mail and copy files, but there was no easy way to move from a document on one machine to a document on another.

At CERN, the European physics laboratory near Geneva, Tim Berners-Lee saw the problem as one of lost knowledge. Thousands of researchers came and went, their documentation scattered across incompatible computers. In 1989 he proposed a system of linked documents spread across the network, and in 1990 he built it: a way of naming any document anywhere (the URL), a simple protocol for fetching it (HTTP), a simple language for marking it up (HTML), and a program for reading it.

The first browser could write

Berners-Lee’s program, called WorldWideWeb, ran on a NeXT computer and was finished at the end of 1990. It was a browser and an editor at once: a user could read a page, change it and save it, and create links as easily as follow them.⁴ Berners-Lee imagined the web as a shared space in which people would write as well as read, and he described this vision later in Weaving the Web (1999). The NeXT was a rare and expensive machine, though, and the editing features could not easily be carried to other systems. To let people on ordinary terminals see the web, a CERN student, Nicola Pellow, wrote the Line Mode Browser, released in 1991, which displayed pages as plain text and could only read them.⁵ The first browser most people could use was a reader.

The decision that made the web possible came in 1993. The University of Minnesota had built a rival system, Gopher, which was popular and easier to set up, and early that year it said it might charge some users of its server software. On 30 April 1993 CERN released the web’s software into the public domain, so anyone could use and build on it without permission or payment.⁶ Developers who had hesitated over Gopher’s terms had no such doubt about the web.

Mosaic makes the web a picture

At the National Center for Supercomputing Applications at the University of Illinois, a student programmer, Marc Andreessen, and a staff engineer, Eric Bina, wrote a browser called Mosaic. Its first version appeared in January 1993, and versions for Windows and Macintosh followed.⁷ Mosaic was not the first graphical browser, but it was the first that was easy to install on the computers ordinary people owned, and it showed images within the text of a page rather than in separate windows. In early 1993 Andreessen proposed an HTML tag for inline images, and Mosaic implemented it, so pictures could sit inside the text.

The effect was immediate. The web became something to look at. Pages could have logos, photographs and layout, and people who had never cared about the internet saw a reason to go online. Mosaic also settled what a browser was. It was for viewing. Editing pages remained a specialist activity done with other tools, and the read-write web that Berners-Lee had built receded. The trade-off was rarely discussed at the time. A tool that made reading effortless and writing separate helped make the web a medium most people consume and a minority produce.

Netscape: a browser as a business

Andreessen graduated, moved to California and in 1994 founded a company with Jim Clark, the founder of Silicon Graphics. After a dispute with the University of Illinois over the name, it became Netscape Communications, and late in 1994 it released Netscape Navigator, written largely by former members of the Mosaic team.⁸ Navigator was faster and more polished than Mosaic and soon dominated the market.

Netscape’s business decision shaped the industry. It gave the browser away to individuals, at first nominally for evaluation and in practice free, and charged businesses for licences and for the server software that delivered web pages. It also added the features that turned the web into a place for commerce. In 1994 Netscape engineer Lou Montulli devised the cookie, a small piece of data a website could store in the browser to recognise a returning visitor, originally so that a shopping basket would remember its contents.⁹ Netscape developed SSL, the encryption that let people send card numbers safely and that put a padlock in the corner of the window. And in May 1995 Brendan Eich, newly hired, wrote in about ten days the first version of a scripting language for web pages, later named JavaScript, which let pages respond to users without fetching a new page from the server.¹⁰ Each of these was a small decision taken quickly. Cookies would later become the basis of tracking across the web, and JavaScript the language in which most of the world’s applications run.

Microsoft turns around

On 26 May 1995 Bill Gates sent his senior executives a memo titled “The Internet Tidal Wave.” He ranked the internet above every other priority and named Netscape as a threat, because a browser that ran on every operating system could make Windows matter less: if applications ran on the web, it would not matter which computer they ran on. The memo is discussed on this site in The Internet Tidal Wave. Microsoft licensed browser code from Spyglass, a company that had licensed Mosaic from the University of Illinois, and in August 1995 released Internet Explorer 1.0.¹¹ It was weak at first, but it improved quickly with each version, and Microsoft gave it away and built it into Windows.

Giving it away removed Netscape’s revenue from consumers. Building it into Windows put it on every new computer, whatever the buyer wanted. Microsoft also used its leverage: contracts with computer makers restricted their ability to promote other browsers, and deals with online services, including America Online, made Internet Explorer their default. Navigator’s share fell steeply. In November 1998 Netscape agreed to be acquired by AOL for about $4.2 billion, and early that year it had released its browser’s source code, the decision that gave rise to Mozilla and is discussed in The Gift That Runs the World.¹²

The case

On 18 May 1998 the US Department of Justice and twenty states sued Microsoft. Judge Thomas Penfield Jackson found that Microsoft held a monopoly in operating systems for personal computers and had used anticompetitive means, including its treatment of the browser, to protect it. In June 2000 he ordered the company split in two. On 28 June 2001 the federal appeals court in Washington unanimously upheld the core finding that Microsoft had illegally maintained its monopoly, but overturned the breakup, criticised the judge’s conduct and sent the question of remedies to another judge.¹³ A settlement that restricted Microsoft’s conduct, without breaking it up, was approved in 2002.

The case did not restore Netscape, which had already lost. Its effects were indirect. Microsoft spent years under court supervision, and its executives became more cautious about using Windows to crush rivals, which some have argued left room for the next generation of web companies, including Google. In Europe the browser returned as an issue later. In December 2009 the European Commission accepted Microsoft’s commitment to show Windows users in Europe a screen offering a choice of browsers. Microsoft failed to show the screen for about fourteen months, affecting about fifteen million users, and in March 2013 the Commission fined it €561 million, the first time it had fined a company for breaking such a commitment.¹⁴

The browser that stood still

Internet Explorer 6, released in 2001, gave Microsoft more than 90 percent of the browser market.¹⁵ Then development slowed sharply. With no strong rival, Microsoft treated the browser as finished, and an argument made in the trial, that web applications threatened Windows, gave it little reason to make the web a better platform. No major new version appeared until Internet Explorer 7 in 2006. Meanwhile Internet Explorer 6’s quirks and gaps in supporting web standards became the constraints within which every web developer worked, and its security flaws became a favourite route for attackers.

The stagnation also drove the people who made browsers to take control of the web’s standards. The World Wide Web Consortium, the body Berners-Lee founded in 1994 to guide the web, was working on a stricter successor to HTML that browsers showed little interest in. In 2004 Apple, Mozilla and Opera began developing HTML themselves, in a group called the Web Hypertext Application Technology Working Group, or WHATWG, focusing on what browsers actually did. Its work became HTML5, and in 2019 the W3C agreed that the WHATWG’s continuously updated “living standard” would be the authoritative version of HTML.¹⁶ The rules of the web had moved, in practice, to the companies that built browsers.

Firefox and Safari reopen the field

Mozilla’s first years were slow, and its full suite of software was heavy. A small group of its developers built a lean browser alone, and on 9 November 2004 released Firefox 1.0. It blocked pop-up advertisements, offered tabs, which let users keep several pages open in one window, and was safer than Internet Explorer. It was downloaded 25 million times in its first 99 days, and by 2009 had more than a quarter of the market by some measures.¹⁷ Mozilla funded itself largely through payments from Google for making Google the default search engine in Firefox, which by the 2020s were reported at around $400 million to $450 million a year.

Apple, meanwhile, needed a browser for its own computers that did not depend on Microsoft. In January 2003 it released Safari, built on WebKit, Apple’s adaptation of KHTML, an open-source engine written by volunteers for the Linux desktop. WebKit was small, fast and released as open source, and it would become the engine that mattered most in the next decade, because when Apple launched the iPhone in 2007, Safari came with it, and a full web browser on a phone was one of its strongest selling points.

Chrome

On 2 September 2008 Google released Chrome. It took WebKit for layout and added two things that changed what browsers could do. Each tab ran as a separate process, so a crashing page could not bring down the whole browser, and pages were isolated from each other for security. And a new JavaScript engine, V8, ran web applications many times faster than before. Google explained the design in an illustrated comic by Scott McCloud. Google released most of the code as an open-source project, Chromium, and later forked WebKit into its own engine, Blink.

Google’s reasons were partly technical and partly strategic. Its business depended on web applications, such as Gmail and Google Maps, that existing browsers ran poorly, and on searches, most of which began in a browser’s address bar or search box. A browser of its own guaranteed that the starting point of the web would send queries to Google. Chrome was also promoted on Google’s own pages, the most visited on the web. In May 2012, according to StatCounter, Chrome overtook Internet Explorer worldwide for the first full month.¹⁸ By the 2020s it held about two-thirds of the market.

Its open-source engine spread further. Opera adopted Chromium in 2013, Brave was built on it, and on 6 December 2018 Microsoft announced that Edge, which it had launched in 2015 to replace Internet Explorer, would be rebuilt on Chromium too.¹⁹ Internet Explorer itself was retired on 15 June 2022. By then almost every major browser except Safari and Firefox ran on an engine whose development Google led. The web’s practical standard was increasingly whatever Chromium did.

One engine on the iPhone

On Apple’s devices the opposite rule applied. From the first App Store, Apple required every browser on iPhone and iPad to use WebKit. Chrome, Firefox and Edge on an iPhone were Safari’s engine in different clothes. Apple cited security and battery life; critics argued that the rule let Apple decide what web applications could do on its devices, and so limit competition with apps sold through its own store, from which it took a commission. In the EU, the Digital Markets Act forced a change: from iOS 17.4 in March 2024, browser makers could use their own engines in the EU, subject to Apple’s approval and conditions, including keeping separate versions for the EU and the rest of the world.²⁰ Few have done so. The broader dispute over Apple’s control of its platform is discussed in The Walled Garden.

The cookie war

The cookie, invented to remember a shopping basket, became the main instrument of tracking. A cookie set by an advertising company whose code appeared on thousands of sites, a third-party cookie, let that company recognise the same browser everywhere it went and build a profile of its interests. Browsers decided whether to accept such cookies, and for two decades most accepted them by default.

Apple moved first. In 2017 Safari introduced Intelligent Tracking Prevention, which used machine learning to identify trackers and limit their cookies, over the objections of advertising groups. In 2019 Firefox turned on Enhanced Tracking Protection by default, blocking known third-party tracking cookies.²¹ Google faced a harder choice, because it was both the largest browser maker and the largest advertising company. In 2019 it announced the Privacy Sandbox, a set of technologies meant to allow targeted advertising without third-party cookies, and in 2020 committed to phase the cookies out. Britain’s Competition and Markets Authority, worried that Google would favour its own advertising, extracted commitments to oversee the change. The deadline slipped repeatedly. In July 2024 Google said it would keep third-party cookies and offer users a choice instead; in April 2025 it dropped even the choice prompt, and in October 2025 it retired the Privacy Sandbox.²² The most used browser in the world still lets advertisers follow people across sites by default.

Warnings and padlocks

The browser also became the place where people decide whether to trust what they see. It shows a padlock for an encrypted connection, warns when a certificate is invalid and blocks sites known for phishing or malware. These signals were designed by engineers and read by everyone else. In a large field study published in 2013, Devdatta Akhawe and Adrienne Porter Felt measured how people responded to real warnings in Chrome and Firefox. Users continued past 70 percent of Chrome’s warnings about invalid certificates, against about a third of Firefox’s, and the authors argued that the design of the warning, including how many clicks it took to proceed, accounted for much of the difference.²³ Browser makers redesigned their warnings in response. In 2023 Chrome removed the padlock from its address bar, because many people took it to mean that a site was trustworthy, when it meant only that the connection was encrypted.

The default and the court

The browser’s most valuable property turned out to be its default search engine. Google paid Apple, Mozilla, Samsung and others to make Google the default in their browsers, and in August 2024 Judge Amit Mehta ruled that Google had illegally maintained its monopoly in search, in part through these exclusive agreements, as discussed in The Auction Behind the Answer. The government asked the court to order Google to sell Chrome. On 2 September 2025 Mehta declined. He barred Google from exclusive default contracts and ordered it to share some search data with rivals, but allowed it to keep paying for default placement and to keep Chrome and Android, noting that artificial intelligence had changed the course of the case.³ In February 2026 the government said it would appeal.

The browser that acts

The AI companies saw the browser as the place where work happens. In 2025 the search start-up Perplexity launched Comet, a browser built around an AI assistant that could read pages and carry out tasks, and offered $34.5 billion for Chrome, in case a court forced a sale. On 21 October 2025 OpenAI launched ChatGPT Atlas for Mac computers, with an agent mode that could navigate sites and act on them for paying users.²⁴ Google added its Gemini assistant to Chrome.

An agent that reads the web on a user’s behalf has a weakness that ordinary browsers do not. Web pages can contain text addressed to the agent rather than the person, instructions hidden in a comment or an image telling the agent to do something its user never asked for. In August 2025 researchers at Brave, a rival browser company, showed that a hidden instruction in a Reddit comment could lead Comet’s assistant to retrieve a user’s email address and a one-time login code and send them to an attacker; Perplexity said it had fixed the flaw, while Brave said the fix was incomplete.²⁵ In December 2025 OpenAI wrote that prompt injection, “much like scams and social engineering on the web, is unlikely to ever be fully ‘solved’,” and described the automated attacker it had built to find such flaws.²⁶

On 9 July 2026 OpenAI announced that it would shut Atlas down on 9 August, folding its agent into its desktop app, a Chrome extension and other products. It said that persuading people to switch browsers was much harder than bringing features to the browsers they already used.²⁴ The most capable AI company in the world had found that the window people look through is one of the hardest things in computing to change.

What the browser is today

Today the browser is the operating environment for most of what people do on computers: mail, documents, banking, shopping, meetings and work software all run inside it. One engine, Chromium, underlies most browsers in use, with Apple’s WebKit and Mozilla’s Gecko as the only independent alternatives of any size. The browser decides which search engine answers, which trackers are blocked, which sites are flagged as dangerous and how warnings look, and these decisions are made by a few companies, most of which earn money from what happens inside the window. Regulators in Europe and the United States now treat the browser as a point of control. And AI assistants are being built into browsers, so that the window is starting to read, summarise and act on what it shows.

How the browser changed how people meet the web

From a tool for writing to a window for reading

The first browser edited pages as easily as it displayed them. Mosaic and its successors made the web a medium for viewing, and writing moved into separate tools and later into platforms that hold what people write.

From a product to a giveaway

Browsers became free, which spread the web to everyone and meant that browser makers earned money elsewhere, from operating systems, search payments or advertising. The interests of the browser’s maker and its user were no longer simply aligned by a price.

From documents to applications

JavaScript, faster engines and process isolation turned the browser from a document viewer into a platform for software, and made the browser itself one of the most complex programs most people run.

From many engines to one

The engines that render the web consolidated from many to effectively three, one of them dominant, and the standards that define the web moved from a consortium to the companies whose browsers implement them.

From a window to an agent

The browser began as something that shows. With AI it is becoming something that acts, which raises the question that its technical name always implied: on whose behalf?

What the history suggests

The history repeats patterns seen across this site. Open outreached closed, as a web given away by CERN beat a rival that hinted at fees. Who pays decided what got built, as free browsers came to be funded by search deals and advertising, and the largest browser maker’s revenue came from tracking that rivals blocked. An incumbent absorbed a challenger’s idea, as Microsoft built the browser into Windows. A strength became a trap, as Internet Explorer’s dominance led Microsoft to let it stand still. Distribution beat design, as Chrome spread through Google’s pages and OpenAI found it could not make people switch. And permissive defaults were borrowed time, as third-party cookies stayed on in the world’s most used browser long after rivals turned them off.

The browser also shows something more particular. It is the one piece of software whose job is to stand between a person and everything else on the network, and so it is always being asked to choose a side: between the user and the website, the user and the advertiser, the user and the platform that makes it, and now the user and instructions hidden in the page. Its technical name, the user agent, states a promise. Whether that promise can be kept, and what it does to the people looking through the window, is where the philosophy begins.

Understanding the philosophy

The rest of this essay examines eight ideas beneath the web browser, one at a time. Each is explained in plain terms, placed in the tradition of thought that has examined it, traced in the history above, tested against its strongest objection and related to how people and organisations decide today. Three of them are psychological. The connections to philosophers, psychologists, economists, lawyers and engineers are interpretations offered to make the ideas clearer. The people who built browsers were solving practical problems, and did not, as a rule, set out to answer these thinkers.

1. A window onto a world

The idea in plain terms

The browser is called a window, and it is shaped like one: a frame through which a world appears, with the viewer on one side and the view on the other. A window is a particular way of relating to things. It lets you see without touching, and it places you outside what you see. The first browser was also a pen; the browsers that spread were windows. That shift changed what most people think the web is for.

The tradition

In On Painting, written in 1435, the Italian humanist Leon Battista Alberti described how a painter should begin: by drawing a rectangle that he treated as an open window, through which the subject would be seen. Alberti’s window organised the new art of linear perspective, in which everything in a picture is arranged around a single viewer standing at a fixed point outside it. Historians of art have treated the image as a founding metaphor of modern representation: the world as something laid out for an observer.

In a lecture of 1938, published as “The Age of the World Picture,” Martin Heidegger turned the metaphor into a diagnosis. The modern age, he argued, is not simply one that has pictures of the world. It is one in which the world itself is grasped as a picture, something set before a subject who represents it, measures it and disposes of it. The human being becomes the viewer at the centre, and everything else becomes what is viewed. Heidegger meant this as a description of how modern science and technology frame reality, and he worried that it hid other ways of being in the world, in which people dwell among things rather than survey them.

Where it shows up

Tim Berners-Lee’s first browser was not a window in this sense. It was a shared workspace in which reading and writing were the same act. The browsers that reached the public, from the Line Mode Browser to Mosaic and Netscape, were windows: they made the web a picture to be looked at, with the user outside it, scrolling and clicking. When ordinary people later wrote on the web in large numbers, they did so through platforms, blogs, social networks and wikis, that provided the writing tools the browser itself had dropped, and that owned the space in which the writing appeared. The browser’s architecture of a frame, a viewport and a page set the user in Alberti’s position. AI browsers move further along the same line: the page is no longer even looked at; it is summarised for the viewer, who sees a picture of a picture.

The strongest objection

It can be argued that this reads too much into a word. People wanted to read far more than to write, and the browser gave them what they wanted. Writing for the web did not disappear; it moved to tools better suited to it, and billions of people now publish every day. The window metaphor also describes every screen, of which the browser is only one. This is fair, and the read-write web did return in other forms. But the form in which it returned matters. Writing that lives on a platform is subject to the platform’s rules and incentives, while Berners-Lee’s design put the pen in the reader’s own tool. The default stance a technology offers shapes what most people do with it, even when other stances remain possible.

What it means today

Product builders should notice which stance their interface offers: viewer, participant or author. A tool that only lets people look will be used for looking, however many separate tools exist for making. For leaders, the lesson is that the frame through which customers and employees meet an organisation shapes what they think they can do there. And for users, it is worth asking, from time to time, which of the things they see they could also change.

2. The user’s agent

The idea in plain terms

In the technical standards of the web, a browser is called a user agent, and every request it sends to a website carries a line identifying itself as one. An agent is someone who acts on behalf of someone else. The word states a promise: the browser works for its user. But an agent can have interests of its own, and the people who pay for it may not be the people it acts for.

The tradition

Economists call this the principal–agent problem. In a 1976 paper, Michael Jensen and William Meckling described the relationship in which one party, the principal, engages another, the agent, to act for it, and showed that whenever the agent’s interests differ from the principal’s and the principal cannot watch everything the agent does, the agent will to some degree serve itself. The resulting losses, and the cost of monitoring and incentives to reduce them, they called agency costs. Law has an older answer to the same problem: fiduciary duty. Trustees, doctors and lawyers, who act for others with power those others cannot easily check, owe duties of loyalty and care, and may not put their own interests first. In 2016 the legal scholar Jack Balkin proposed that companies that collect and use people’s personal information should be treated as information fiduciaries, with similar duties not to use that information against the people who entrust it to them.

Where it shows up

The browser’s history is a long series of agency problems. Browsers were free, so they were paid for by others: by operating system sales, by search companies paying for the default, by advertising. Each payer had its own interest in what the browser did. Microsoft tied its browser to Windows to protect Windows. Google pays to be the default in other companies’ browsers, and Firefox has depended on those payments for most of its income. Google’s own browser, built by an advertising company, kept the third-party cookies that let advertisers follow its users, after rivals had blocked them. AI browsers add a new kind of agency problem. When an agent reads a web page and acts on it, the page can contain instructions that turn the agent against its principal, as Brave’s researchers showed with Comet. An agent that obeys whatever it reads cannot be loyal to anyone.

The strongest objection

A harder point is that users are well served, whatever the browser maker’s interests. Browsers are free and excellent, competition among several makers keeps them honest, switching takes a minute, and search payments fund products such as Firefox that would not otherwise exist. Fiduciary duties would raise costs and slow innovation, and no one has shown that people would pay for a browser that owed them loyalty. This argument has real force: the browser has served users remarkably well. Its weakness is the gap between what competition can discipline and what users can see. Defaults, tracking settings and the instructions an agent follows are mostly invisible, and the agency problem is sharpest where the principal cannot watch.

What it means today

Anyone building software that acts for people should ask Jensen and Meckling’s question: where do our interests diverge from our users’, and could they tell if we chose our side? For AI agents the question is urgent. An agent that books, buys and replies on someone’s behalf should be designed as a fiduciary would be, refusing instructions from anyone but its principal, telling the principal what it did and why, and treating the principal’s data as held in trust. Leaders choosing tools for their organisations should ask the same of the vendors whose software stands between their staff and the world.

3. The power of the default

The idea in plain terms

Most people never change the settings they are given. They keep the browser that came with the computer, the search engine that came with the browser and the privacy settings that came with both. This is not laziness in any simple sense. It follows from how people make choices, and it makes whoever sets the default one of the most powerful decision-makers in technology.

The tradition

In 1988 the economists William Samuelson and Richard Zeckhauser showed in a series of experiments that people disproportionately stick with whatever option is framed as the status quo. In 2003 Eric Johnson and Daniel Goldstein compared organ donation across European countries and found that countries where people were donors unless they opted out had consent rates far higher than countries where people had to opt in, though attitudes to donation were similar. Psychologists have offered several explanations that work together: switching takes effort, the default is taken as an implicit recommendation from whoever set it, and giving up the default feels like a loss. Richard Thaler and Cass Sunstein’s Nudge (2008) made the idea famous, and this site discusses it as The Architecture of Choice. Default effects have held up well under replication, though a 2019 meta-analysis by Jon Jachimowicz and colleagues found that their size varies widely between settings.

Where it shows up

The browser’s history is a history of defaults. Internet Explorer won because it was already on the computer. The European Commission’s remedy was a choice screen, an attempt to replace a default with a decision. Google’s payments to be the default search engine were worth tens of billions of dollars a year, because companies that know their users understood how few would change it, and the court that found those payments helped maintain a monopoly also declined to ban them. Safari’s and Firefox’s decisions to block trackers by default protected hundreds of millions of people who never opened a settings page; Chrome’s decision to keep third-party cookies on did the opposite for billions. And OpenAI’s withdrawal of Atlas was an admission that even a better product struggles against the browser people already have.

The strongest objection

Others point out that defaults persist because they are good. Google became the default because it was the best search engine, Chrome spread because it was faster, and people who want something else can switch in seconds. Treating every default as a manipulation insults users’ judgement, and choice screens have shifted market shares only modestly, suggesting that people mostly prefer what they have. There is truth here: defaults that are bad tend to be abandoned eventually, as Internet Explorer was. But the speed matters. The value of a default lies in the years before people notice, and the fact that companies pay so much for defaults shows that they do not believe quality alone would keep users.

What it means today

Anyone who designs a product sets defaults, and so decides for most of its users. The honest question is the one the idea page asks: would we be comfortable explaining this default to the people it steers? For leaders, the lesson cuts both ways. A default is the most effective way to help people, and the most tempting way to profit from their inattention. Regulators, for their part, have learned that remedies relying on people actively choosing will be weaker than remedies that change what happens when they do not.

4. Warnings that cry wolf

The idea in plain terms

The browser is the place where people are told, many times a week, that something might be dangerous: an invalid certificate, a suspicious download, a site that might be phishing. Most of these warnings turn out to be harmless. People learn that, and they learn to click through. The result is that warnings meant to protect people train them to ignore warnings.

The tradition

Signal detection theory, developed in the 1950s and set out by David Green and John Swets in Signal Detection Theory and Psychophysics (1966), describes any decision about whether a signal is present in noise. Every detector, human or machine, faces a trade-off between missing real signals and raising false alarms, and moving the threshold to catch more real dangers produces more false alarms. Psychology adds the effect of repetition. Habituation, described systematically by Richard Thompson and William Spencer in 1966, is the decline of a response to a stimulus that is repeated without consequence; it is one of the simplest and most universal forms of learning. Together they predict what Aesop’s fable predicts: a warning that is usually false will stop being heeded, and the cost falls on the occasion when it is true.

Where it shows up

Akhawe and Felt’s study of real warnings found that Chrome users clicked through 70 percent of certificate warnings, and that the design of the warning, including how easy it was to proceed, made a large difference. Many certificate warnings were false alarms caused by misconfigured but harmless sites, which taught users that the warning meant little. Browser makers responded by reducing false alarms, making real warnings harder to bypass and changing their appearance. The padlock is a related case. It signalled an encrypted connection, but users read it as a sign that the site was safe, and once nearly all sites, including fraudulent ones, used encryption, the padlock became a false reassurance; Chrome removed it in 2023. The same dynamic now faces AI browsers, whose agents may ask users to confirm actions so often that confirmation becomes reflex.

The strongest objection

Then again, warnings work. The same study found that warnings for malware and phishing were heeded most of the time, and later redesigns by Google’s researchers raised adherence to certificate warnings substantially. Users are not hopelessly habituated; they respond to warnings that are rare, clear and credible. This is right, and it is the lesson rather than a refutation. Warnings fail when they are frequent and often false; they succeed when they are rare and usually true. The design problem is the threshold, and every product that warns its users is setting one, whether it knows it or not.

What it means today

Count your false alarms. Every alert, confirmation dialog and warning a product shows should be judged by how often it is right, because each false one teaches users to ignore the next. Make dangerous actions hard to take, rather than relying on people to read a warning. And where possible, remove the decision from the user altogether, as browsers did by blocking known malicious sites outright. Organisations that drown their staff in security alerts are training them in the same way.

5. Attention in tabs

The idea in plain terms

Tabs let people keep many pages open at once, and most people do. A row of tabs is a row of intentions: things to read, reply to, buy or finish. The browser made it effortless to start things and easy never to finish them. What this does to attention is one of the most debated questions about how people use computers.

The tradition

William James, in The Principles of Psychology (1890), described attention as “the taking possession by the mind, in clear and vivid form, of one out of what seem several simultaneously possible objects or trains of thought,” and observed that it implies withdrawal from some things in order to deal effectively with others. Attention, on his account, is selection, and selection is costly. A century later, research on task-switching showed that moving between tasks takes time and introduces errors, even when each task is simple.

In 2009 Eyal Ophir, Clifford Nass and Anthony Wagner published a study in the Proceedings of the National Academy of Sciences reporting that heavy media multitaskers were more easily distracted by irrelevant information and slower at switching tasks than light multitaskers. The study was widely reported, but its findings have proved hard to reproduce: in 2017 Wisnu Wiradhany and Mark Nieuwenstein reported that most of the original tests did not replicate in their studies, and other attempts have also failed, so the claim that multitasking damages attention remains uncertain. A different line of research is more consistent. Gloria Mark and her colleagues, observing people at work, found that interruptions were frequent and that people often took a long time to return to an interrupted task; in a 2008 experiment, people interrupted during a task finished it faster but reported more stress and frustration.

Where it shows up

Firefox popularised tabs, and every browser adopted them. Chrome’s design, with each tab running as its own process, made it practical to keep dozens open. The browser became the main workplace of knowledge workers, so that mail, chat, documents and shopping sat side by side, each a click away from the others. Browser makers then built features to manage the problem they had helped create: tab groups, sleeping tabs that release memory, reading lists. AI assistants promise to summarise all the open tabs at once, which would relieve the burden of reading them and also remove the experience of reading them.

The strongest objection

Some argue that tabs help attention rather than harm it. A tab is a way of putting something aside without losing it, which frees the mind to focus on the current task; the alternative, remembering to come back, is worse. The research on multitasking is weak and contested, as the failed replications show, and people have always worked amid interruptions. This is a good argument, and it fits the view that tools can extend memory, discussed on this site as The Mind Beyond the Head. The difficulty is that a tab is both a memory aid and a standing invitation. The same design that lets something wait also keeps it visible, one click away, competing for the attention James described as a selection.

What it means today

For individuals, the practical lesson is to treat tabs as a list of commitments and to close the ones that will never be kept. For product builders, it is to notice that making things easy to open is not the same as helping people finish them. For leaders, it is to remember that a workforce working inside browsers full of mail, chat and alerts is working amid constant interruption, and that some work needs a window with only one thing in it.

6. Monoculture

The idea in plain terms

When nearly everyone uses the same browser engine, the web becomes a monoculture. A single bug can affect billions of people at once, and a single company’s decisions about how the web works become, in practice, the web’s rules. Diversity among browsers is inefficient, and it is also a form of protection.

The tradition

In agriculture, a monoculture is a large area planted with a single variety. It is efficient, and it is fragile, because a disease that can attack one plant can attack all of them. The Irish famine of the 1840s, in which much of the population depended on a narrow range of potato varieties that blight destroyed, became the standard example. In 2003 seven computer security specialists, among them Dan Geer and Bruce Schneier, applied the idea to software in a report titled “CyberInsecurity: The Cost of Monopoly.” They argued that the dominance of Microsoft’s software, including Internet Explorer, had created a monoculture in which a single vulnerability could be exploited across most of the world’s computers, and that this was a risk to national security, not only to Microsoft’s customers.

Where it shows up

Internet Explorer 6, used by more than nine in ten people and barely updated for five years, was the monoculture the report described: its flaws were exploited on a vast scale. The web’s subsequent recovery depended on diversity, as Firefox, Safari and Chrome competed and pushed each other forward. Then the market concentrated again, around Chromium. By the 2020s Chrome, Edge, Opera, Brave, Samsung Internet and many others shared one engine, so a serious flaw in Chromium affects most of the world’s browsers at once, and Google’s engineering decisions shape what websites can do. Apple’s rule requiring WebKit on iPhones, whatever its motives, kept one large alternative engine alive; Mozilla’s Gecko, funded largely by Google’s search payments, is the other.

The strongest objection

There is a reply: a shared engine is a strength. Chromium is open source, so many companies contribute to it and examine it; vulnerabilities are found and fixed faster because so many people depend on them; and websites work the same everywhere, which saves developers from the incompatibilities of the Internet Explorer years. Diversity has costs, as anyone who built websites in 2005 remembers. This is persuasive, and Chromium is not Internet Explorer 6: it is actively developed and quickly patched. But the risks of monoculture go beyond the technical. When one company’s engine defines the web in practice, that company’s interests, in advertising, in its own services, in what it chooses to support, become the web’s constraints, and there is no alternative to switch to that would escape them.

What it means today

Organisations should test their websites and services on more than one engine, both to reach all users and to avoid writing for one company’s interpretation of the web. Anyone responsible for critical systems should ask where they depend on a single supplier whose failure or decisions would affect everything at once. And regulators and funders should recognise that independent engines are a public good, now sustained largely by the payments of the company whose dominance they balance.

7. Privacy as control

The idea in plain terms

Most people say they care about privacy and then accept tracking cookies, click past consent banners and use the browser that tracks them most. This gap, called the privacy paradox, is often taken to show that people do not really care. It may instead show that they have little real control, and that the browser is where that control is decided.

The tradition

In 1890 Samuel Warren and Louis Brandeis argued in the Harvard Law Review for a right “to be let alone,” prompted by newspaper photography and gossip. In Privacy and Freedom (1967), the political scientist Alan Westin defined privacy differently, as the claim of individuals to determine for themselves when, how and to what extent information about them is communicated to others. On Westin’s view, privacy is not secrecy but control. Researchers later studied why people’s behaviour seems to contradict their stated concern. Alessandro Acquisti and Jens Grossklags argued in 2005 that people’s privacy decisions are shaped by incomplete information, bounded rationality and biases such as valuing immediate convenience over distant risks. A 2017 review by Susanne Barth and Menno de Jong found many competing explanations for the paradox. The legal scholar Daniel Solove argued in 2021 that the paradox is a myth: people’s choices about particular services cannot reveal how much they value privacy in general, especially when the choices offered are illusory.

Where it shows up

The cookie was invented to remember a shopping basket and became a means of following people across the web, without most of them knowing. For two decades browsers accepted third-party cookies by default, so the choice was made before users could make it. Safari and Firefox then made a different default and blocked trackers for everyone, which gave users the control Westin described without asking them to exercise it. Google’s six-year attempt to replace third-party cookies ended with the cookies kept and a planned choice prompt dropped, leaving the default unchanged. Europe’s consent banners, meanwhile, asked people to make the same decision on every site, which many experienced as a nuisance rather than control.

The strongest objection

A sceptic would say that people’s behaviour reveals their true preferences. The web is free because advertising pays for it, and advertising pays more when it is targeted. People who wanted privacy could install a blocker or switch to Safari or Firefox; most do not, which suggests that they value free services and convenience more than they say. Paternalistic defaults deprive publishers of revenue and users of free content. This argument has weight, and the economics of the free web are real. But revealed preference requires a real choice, made with understanding of what is being chosen. When the tracking is invisible, the consequences delayed and the alternative a settings page few people find, behaviour reveals more about the design of the choice than about what people value.

What it means today

Treat privacy as a question of who controls information as well as of what is hidden. Product builders should set defaults that a reasonable user would choose if they understood them, and make the choices that matter visible, few and lasting rather than repeated on every page. Leaders whose businesses depend on data collected by default should ask what would happen if the default changed, because for many users of Safari and Firefox it already has.

8. Whose rules?

The idea in plain terms

The web has no owner and no government. Its rules, what a page can do, how a link works, what a browser must support, are written in standards. Who writes those standards, and why anyone obeys them, is a question of authority. For most of the web’s history the answer has shifted from a consortium of members to the companies whose browsers people use.

The tradition

The sociologist Max Weber distinguished three sources of legitimate authority in Economy and Society, published in 1922: traditional authority, resting on custom; charismatic authority, resting on devotion to an exceptional person; and legal-rational authority, resting on rules made by recognised procedures. Internet standards developed a fourth kind, based on what works. In 1992 the computer scientist David Clark summed up the culture of the Internet Engineering Task Force in a phrase that became its motto: “We reject: kings, presidents and voting. We believe in: rough consensus and running code.” A standard was legitimate if people broadly agreed on it and if it had been implemented and shown to work.

Where it shows up

Berners-Lee founded the World Wide Web Consortium in 1994 to give the web a home with legal-rational authority, where members could agree standards by procedure. When the consortium pursued a stricter successor to HTML that browser makers did not want, Apple, Mozilla and Opera formed the WHATWG and wrote the standard browsers actually implemented. Running code won: in 2019 the W3C agreed that the WHATWG’s living standard would define HTML. The arrangement works well technically, because a standard that browsers do not implement is useless. But it means that authority over the web lies with the few companies that make browser engines, and above all with the company whose engine most browsers use. The EU’s Digital Markets Act and the American courts represent a different kind of authority, public law, reaching into decisions that standards bodies and companies had made among themselves.

The strongest objection

Defenders reply that implementers are the right authority. They understand the technical constraints, they bear the cost of building features, and the web has improved faster since the WHATWG took over than it did under the consortium’s procedures. Formal processes stalled and produced specifications no one used. Governments are slower still and understand less. This is a strong argument, and the record supports it. Its limit is that running code reflects the interests of those who run it. When the implementers are few and one of them dominates, rough consensus becomes the consensus of a small group, and the people who use the web, who are not at the table, have no procedure for being heard.

What it means today

Organisations that depend on the web should take part in its standards, or at least follow them, because decisions made in standards groups shape what their products can do. Leaders should notice where authority in their own fields rests on running code rather than rules, and who that leaves out. And anyone building platforms should remember that legitimacy that comes from working well lasts only as long as users believe the platform works for them.

Bringing the threads together

The browser is a window, and a window places its user outside what it shows. It is a user agent, and an agent paid by others may serve them. Its defaults decide for most people, its warnings teach people to ignore warnings when they are usually false, and its tabs make it easy to start things and hard to finish them. Its engines have concentrated into a monoculture, its defaults on tracking determine how much control people have over information about themselves, and its rules are written by those who build it. Running through all of these is the same question: who the browser works for. The history shows browsers serving their users remarkably well when their makers’ interests and their users’ interests coincided, and serving their makers when they did not.

The window that acts

When Netscape’s shares opened at $71, investors were paying for a window onto the future. They were right about the future and wrong about who would profit from the window: the browser became free, and the money moved to operating systems, search and advertising, which meant that the companies making browsers came to depend on what happened inside them. The engineers at CERN who gave the web away, the students who made it visual, the volunteers who rebuilt Netscape’s code into Firefox and the teams at Apple and Google who made browsers fast and safe gave the world a tool of astonishing reach and quality. Others, by tying the browser to a monopoly, by letting it stand still, or by keeping tracking on by default, made decisions in which the user was not the first concern.

The history suggests some working principles. Ask of any software that acts for people whose interests it serves when those interests diverge. Set defaults you would be willing to explain to the people they steer. Warn rarely and truthfully. Make finishing as easy as starting. Keep more than one engine alive. Give people control over information about them without asking them to exercise it on every page. And as the window learns to act, build agents that take instructions only from the person they serve. The browser was named an agent before it could act. Now that it can, the promise in its name will have to be kept by design.

Selected bibliography

• Alberti, Leon Battista. On Painting. 1435; English translation by John R. Spencer, Yale University Press, 1956.
• Warren, Samuel D., and Louis D. Brandeis. “The Right to Privacy.” Harvard Law Review 4, no. 5 (1890): 193–220.
• James, William. The Principles of Psychology. Henry Holt, 1890.
• Weber, Max. Economy and Society. 1922; English translation, University of California Press, 1978.
• Heidegger, Martin. “The Age of the World Picture.” Lecture, 1938; in The Question Concerning Technology and Other Essays, Harper & Row, 1977.
• Bush, Vannevar. “As We May Think.” The Atlantic Monthly, July 1945.
• Green, David M., and John A. Swets. Signal Detection Theory and Psychophysics. Wiley, 1966.
• Thompson, Richard F., and William A. Spencer. “Habituation: A Model Phenomenon for the Study of Neuronal Substrates of Behavior.” Psychological Review 73, no. 1 (1966): 16–43.
• Westin, Alan F. Privacy and Freedom. Atheneum, 1967.
• Jensen, Michael C., and William H. Meckling. “Theory of the Firm: Managerial Behavior, Agency Costs and Ownership Structure.” Journal of Financial Economics 3, no. 4 (1976): 305–360.
• Samuelson, William, and Richard Zeckhauser. “Status Quo Bias in Decision Making.” Journal of Risk and Uncertainty 1, no. 1 (1988): 7–59.
• Clark, David D. “A Cloudy Crystal Ball: Visions of the Future.” Presentation to the Internet Engineering Task Force, July 1992.
• Berners-Lee, Tim, with Mark Fischetti. Weaving the Web. HarperSanFrancisco, 1999.
• United States v. Microsoft Corp., 253 F.3d 34 (D.C. Cir. 2001).
• Geer, Dan, and others. CyberInsecurity: The Cost of Monopoly. Computer and Communications Industry Association, 2003.
• Johnson, Eric J., and Daniel Goldstein. “Do Defaults Save Lives?” Science 302, no. 5649 (2003): 1338–1339.
• Acquisti, Alessandro, and Jens Grossklags. “Privacy and Rationality in Individual Decision Making.” IEEE Security & Privacy 3, no. 1 (2005): 26–33.
• Mark, Gloria, Daniela Gudith and Ulrich Klocke. “The Cost of Interrupted Work: More Speed and Stress.” Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (2008): 107–110.
• Thaler, Richard H., and Cass R. Sunstein. Nudge. Yale University Press, 2008.
• Ophir, Eyal, Clifford Nass and Anthony D. Wagner. “Cognitive Control in Media Multitaskers.” Proceedings of the National Academy of Sciences 106, no. 37 (2009): 15583–15587.
• Akhawe, Devdatta, and Adrienne Porter Felt. “Alice in Warningland: A Large-Scale Field Study of Browser Security Warning Effectiveness.” Proceedings of the 22nd USENIX Security Symposium (2013).
• Balkin, Jack M. “Information Fiduciaries and the First Amendment.” UC Davis Law Review 49, no. 4 (2016): 1183–1234.
• Barth, Susanne, and Menno D. T. de Jong. “The Privacy Paradox: Investigating Discrepancies between Expressed Privacy Concerns and Actual Online Behavior.” Telematics and Informatics 34, no. 7 (2017): 1038–1058.
• Wiradhany, Wisnu, and Mark R. Nieuwenstein. “Cognitive Control in Media Multitaskers: Two Replication Studies and a Meta-Analysis.” Attention, Perception, & Psychophysics 79 (2017): 2620–2641.
• Jachimowicz, Jon M., Shannon Duncan, Elke U. Weber and Eric J. Johnson. “When and Why Defaults Influence Decisions: A Meta-Analysis of Default Effects.” Behavioural Public Policy 3, no. 2 (2019): 159–186.
• Solove, Daniel J. “The Myth of the Privacy Paradox.” George Washington Law Review 89, no. 1 (2021): 1–51.
• United States v. Google LLC, No. 20-cv-3010 (D.D.C.), memorandum opinion on remedies, 2 September 2025.

Research limitations

The early history of the web rests partly on participants’ recollections, including Berners-Lee’s own account in Weaving the Web; release dates for the first browsers differ slightly between sources. The date of Netscape Navigator’s first release is given variously as October and December 1994. Brendan Eich’s ten days and Lou Montulli’s invention of the cookie are their own accounts as widely reported. Market share figures come from StatCounter and other analytics firms, whose methods differ and which sometimes disagree substantially; the peak share of Internet Explorer is given as “more than 90 percent” because sources differ on the exact figure. Mozilla’s search income is described from press reports, not audited accounts. Descriptions of Microsoft’s contracts follow the findings of the courts. The account of the Comet vulnerability rests on Brave’s research, a rival’s account, and Perplexity disputed that it remained unfixed. The government’s appeal of the 2025 remedies ruling was pending at the time of writing. The research on media multitasking has a poor replication record, and the essay reports it as contested. The connections to Alberti, Heidegger, Jensen, Meckling, Balkin, Samuelson, Zeckhauser, Johnson, Goldstein, Thaler, Sunstein, Jachimowicz, Green, Swets, Thompson, Spencer, James, Ophir, Nass, Wagner, Wiradhany, Nieuwenstein, Mark, Geer, Warren, Brandeis, Westin, Acquisti, Grossklags, Barth, de Jong, Solove, Weber and Clark are the author’s interpretation; their works are paraphrased apart from short, attributed phrases. The decisions in the decisions box are judged by the author, separating what could be known at the time (process) from what happened (call).

Footnotes

1. “Netscape Communications Corporation,” Encyclopedia.com; “Netscape Navigator won, then lost,” Yahoo News. ↩

2. StatCounter, “Browser Market Share Worldwide,” October 2026. ↩

3. “In a major antitrust ruling, a judge lets Google keep Chrome but levies other penalties,” NPR, 2 September 2025; “Appraising the Google search antitrust remedies,” Stanford Law School, September 2025; on the appeal, “Google Chrome’s internet supremacy faces major threats,” Newsweek, 2026. ↩ ↩²

4. Wikipedia, “WorldWideWeb”. ↩

5. Wikipedia, “Line Mode Browser”. ↩

6. Wikipedia, “WorldWideWeb”, on the release of 30 April 1993; Wikipedia, “Line Mode Browser”. ↩

7. Wikipedia, “NCSA Mosaic”; University of Illinois, “Mosaic,” Distributed Museum. ↩

8. Britannica, “Netscape Communications Corp.”; Internet Pioneers, “Marc Andreessen”. ↩

9. Wikipedia, “Lou Montulli”; “Lou Montulli: building browsers, cookies and more,” Paleo Ad Tech, December 2023. ↩

10. Wikipedia, “Brendan Eich”; “How JavaScript helped transform the web,” TechRadar. ↩

11. “IE turns 15: the birth and life of Internet Explorer,” Redmond Magazine, August 2010; Wikipedia, “History of Internet Explorer”. ↩

12. “AOL acquires Netscape for $4.2 billion,” InternetNews, November 1998. ↩

13. “Microsoft case in brief,” CNN Money, 28 June 2001; “Appeals court unanimously reverses Microsoft breakup,” TidBITS, 28 June 2001. ↩

14. European Commission, “Antitrust: Commission fines Microsoft for non-compliance with browser choice commitments,” IP/13/196, 6 March 2013. ↩

15. “Microsoft Internet Explorer 6 support continues,” eWeek; “Internet Explorer below 70% market share,” Linux Magazine. ↩

16. Wikipedia, “WHATWG”; “W3C and WHATWG to collaborate on single HTML and DOM specifications,” SD Times, May 2019. ↩

17. “The deal that built the cathedral,” Faster Than Normal; on market share in 2009–2010, The Register, 3 February 2010. ↩

18. StatCounter, “Chrome overtakes IE globally for first calendar month,” 1 June 2012; Engadget, 1 June 2012. ↩

19. “Microsoft officially acknowledges Chromium-based browser development,” Gigazine, 7 December 2018; “Microsoft announces retirement of Internet Explorer,” Gulf News, May 2021. ↩

20. “Apple will allow alternative browsers and browser engines in the EU,” Cult of Mac; “Apple browser engines in the EU,” The Register, 17 May 2024. ↩

21. “Apple WWDC 2017: block videos, tracking,” Fortune, 5 June 2017; “Firefox blocks third-party tracking cookies and cryptominers by default,” The Hacker News, June 2019. ↩

22. “Google’s Privacy Sandbox: what you needed to know, before its demise,” MarTech; “Google pulls plug on Privacy Sandbox, leaving cookies in place,” TechSpot, October 2025. ↩

23. Devdatta Akhawe and Adrienne Porter Felt, “Alice in Warningland,” USENIX Security 2013; “Warning fatigue means browser users ignore up to 70% of security alerts,” WeLiveSecurity, July 2013. ↩

24. Wikipedia, “ChatGPT Atlas”; “OpenAI is discontinuing ChatGPT Atlas,” 9to5Mac, 9 July 2026; on Perplexity’s bid for Chrome, Fortune, 12 August 2025. ↩ ↩²

25. “Perplexity’s Comet browser naively processed pages with evil instructions,” The Register, 20 August 2025. ↩

26. “OpenAI admits prompt injection may never be fully solved,” The Decoder, December 2025; Fortune, 23 December 2025. ↩