It's important to understand which values evaluate to false in JavaScript. Falsy values are: undefined, null, NaN, 0 -0, "", and false. This means that everything else evaluates to true:
document.getElementById("firstbtn").disabled=true /* True */
document.getElementById("firstbtn").disabled="true" /* True */
document.getElementById("firstbtn").disabled="false" /* True */
document.getElementById("firstbtn").disabled="banana" /* True */
document.getElementById("firstbtn").disabled=1 /* True */
document.getElementById("firstbtn").disabled=4723598495 /* True */
document.getElementById("firstbtn").disabled=false /* False */
document.getElementById("firstbtn").disabled="" /* False */
document.getElementById("firstbtn").disabled=0 /* False */
document.getElementById("firstbtn").disabled=NaN /* False */
Because of this and as you can see above, "false" is evaluated to true as it is a string with length greater than 0.
On the subject of which is right, the answer would be that both are. Both get the job done. You may as well just use disabled=true, however, to avoid potential confusion at a later date.
disabledattribute in the HTML tag and thedisabledproperty of the DOM object, which is another great source of confusion.