[shaki-dora]

A/B testing is pretty much the gold standard. It took medicine a thousand years of bloodletting to get there.

Of course its’s not always possible, which is what economists and nutritionists and a few other sciences struggle with. But measuring security incidents and correlating them with browser use seems sensible.

There is still plenty of room for theory, such as coming up with what to test.