4 ms·

Doesn’t Microsoft advise against using IE11 because of security reasons, except for critical internal applications that only support IE11? [0] It’s mind blowing

Doesn’t Microsoft advise against using IE11 because of security reasons, except for critical internal applications that only support IE11? [0] It’s mind blowing to me that companies continue to use an insecure browser, to the point of insisting on it. Why can’t vendors refuse to support IE11 on the grounds that it’s a security risk? If you reframe the problem to “IE11 is insecure,” surely customers will adapt? [0] https://www.zdnet.com/article/microsoft-security-chief-ie-is-not-a-browser-so-stop-using-it-as-your-default/ https://www.zdnet.com/article/microsoft-security-chief-ie-is...

Kye 7y ago
COBOL is still in use 61 years later. Institutional inertia is very much in style. Vendors can't dictate terms to the people paying the bills.
- chatmasta 7y ago
  They can if the software is good enough and the customer really wants it.
  - deleted 7y ago
    [deleted]
  - _ZeD_ 7y ago
    not if the ones using the software are not the ones that pay
    - Dangeranger 7y ago
      If you are big enough, and people want to use your software enough, you can dictate what you will support no matter who is paying.[0] [0] https://www.theguardian.com/technology/2015/jan/30/flash-youtube-nostalgia https://www.theguardian.com/technology/2015/jan/30/flash-you...
    - chatmasta 7y ago
      If you’re losing a sale because your software doesn’t work in IE11, maybe your software isn’t actually all that good. I understand some companies insist on IE11, but companies insist on a lot of “requirements” that aren’t actually necessary if you push back on them. When the rubber hits the road, if your software is truly the best/only option, they can find a way to use a secure browser to access it.
  - reaperducer 7y ago
    They can if the software is good enough and the customer really wants it. "Killer app" only works in the consumer and small business spaces these days.
    - wolco 7y ago
      Not really. Slack pushed into enterprise quickly.
      - reaperducer 7y ago
        Nobody bought new computers to run Slack. "Killer app" came from Visicalc, which caused millions of accountants and businesspeople to buy Apple II machines.
        wolco 7y ago
        I'm about to buy a new phone. The slack app stopped working on my phone, won't install on my tablet.
- _bxg1 7y ago
  That's different. A web browser is an interface to the outside world which executes arbitrary foreign code as a regular course of operation. Any IT department that forcibly limits people to use the world's least-secure browser in an effort to keep things secure is utterly failing in its job.
- Finnucane 7y ago
  Until they can't find vendors who will do the thing, I suppose. If every vendor says, I can't do that, they've got a problem.
jabroni_salad 7y ago
Developing for Chrome is not an unreasonable ask and many vendors are asking for it these days. Any new service should get minimal resistance. At my org we use Chrome or Edge as the default and define ie11-only sites in group policy. When you navigate, IE11 pops up automatically. As an aside a company I used to work for was so underwater on tech debt that instead of modernizing their site they repackaged IE9 as a citrix app that business partners had to run. People are willing to overlook a lot when the commissions are good and that was not the worst thing I have seen in the insurance space.
- mrkstu 7y ago
  We recently transitioned to Chrome and use IE Tab on predefined sites. It’s a good compromise of standardizing on a modern browser and still being able to access a couple straggler apps.
  - gsnedders 7y ago
    What's the motivation to use Chrome and IE Tab v. MS Edge (where the Chromium-based product supports IE Tab-like functionality natively)? Or just long enough ago before the Chromium-based Edge shipped?
    - mrkstu 7y ago
      Prior to Microsoft’s change of engines, or at least around the same time. Plus it isn’t like anyone wanted to use IE or Edge, so we would of likely gone the same path regardless.
      - gsnedders 7y ago
        It's not clear to be Chromium-based Edge is an any worse product than Chrome (and in many ways is going further down the anti-ad-tracking route than Chrome, unsurprisingly), but I expect the Trident integration in their IE Mode is better than IE Tab?
        7y ago
kube-system 7y ago
This stuff happens over time. It is a result of cascading dependencies. Companies have lots of pieces of software that they support for extended periods of time. Also, they typically avoid requiring users to use different browsers for different applications. The number of support calls goes up dramatically if you need users to use different browsers, and it causes usability headaches when linking from one system to another, because you can only have one default browser. If you bring a piece of enterprise software into any organization, they will want you to target the browser they're using.... so, targeting IE was written into the requirements well after it was a good idea, because legacy compatibility was required. That, of course, works until MS throws a wrench in the works and discontinues the browser. SaaS will change this somewhat, because the software is continually updated by the vendor. It's mainly on-prem and/or custom applications that cause this issue, because they don't get upgraded until big bucks are dished out.
- gsnedders 7y ago
  > The number of support calls goes up dramatically if you need users to use different browsers, and it causes usability headaches when linking from one system to another, because you can only have one default browser. Which is precisely why Chromium-based Edge has an IE Mode that uses Trident for given sites so that those legacy systems can be filtered to use a different browser engine from within the same browser UX.
  - kube-system 7y ago
    Good to know -- I personally haven't dealt with this issue in the past few months (or years), but hopefully this will give some organizations a path forward. Between ~2010 and the January release of Edge this year, a lot of organizations were dealing with the scenario I outlined. Although as recently as this month, I've run into scenarios where Chromium-based Edge acts a bit differently than Chrome... so it's not a solid solution in all cases.
    - gsnedders 7y ago
      > Although as recently as this month, I've run into scenarios where Chromium-based Edge acts a bit differently than Chrome... so it's not a solid solution in all cases. I mean the Edge team will treat any such case as a bug if you report it.
drngdds 7y ago
Because unfortunately, competition exists. I work in fintech and we have two options: - Convince bajillion dollar investment banks to switch web browsers just to use our service - Accept a mild decrease in developer experience
- bromuro 7y ago
  Does that mean your company doesn’t care about security? Looks crazy for being a “fintech”!
sebazzz 7y ago
I had clients reject .NET Framework 4.8 due to security concerns.

Kye 7y ago

COBOL is still in use 61 years later. Institutional inertia is very much in style. Vendors can't dictate terms to the people paying the bills.

chatmasta 7y ago
They can if the software is good enough and the customer really wants it.
- deleted 7y ago
  [deleted]
- _ZeD_ 7y ago
  not if the ones using the software are not the ones that pay
  - Dangeranger 7y ago
    If you are big enough, and people want to use your software enough, you can dictate what you will support no matter who is paying.[0] [0] https://www.theguardian.com/technology/2015/jan/30/flash-youtube-nostalgia https://www.theguardian.com/technology/2015/jan/30/flash-you...
  - chatmasta 7y ago
    If you’re losing a sale because your software doesn’t work in IE11, maybe your software isn’t actually all that good. I understand some companies insist on IE11, but companies insist on a lot of “requirements” that aren’t actually necessary if you push back on them. When the rubber hits the road, if your software is truly the best/only option, they can find a way to use a secure browser to access it.
- reaperducer 7y ago
  They can if the software is good enough and the customer really wants it. "Killer app" only works in the consumer and small business spaces these days.
  - wolco 7y ago
    Not really. Slack pushed into enterprise quickly.
    - reaperducer 7y ago
      Nobody bought new computers to run Slack. "Killer app" came from Visicalc, which caused millions of accountants and businesspeople to buy Apple II machines.
      - wolco 7y ago
        I'm about to buy a new phone. The slack app stopped working on my phone, won't install on my tablet.
_bxg1 7y ago
That's different. A web browser is an interface to the outside world which executes arbitrary foreign code as a regular course of operation. Any IT department that forcibly limits people to use the world's least-secure browser in an effort to keep things secure is utterly failing in its job.
Finnucane 7y ago
Until they can't find vendors who will do the thing, I suppose. If every vendor says, I can't do that, they've got a problem.

jabroni_salad 7y ago

Developing for Chrome is not an unreasonable ask and many vendors are asking for it these days. Any new service should get minimal resistance. At my org we use Chrome or Edge as the default and define ie11-only sites in group policy. When you navigate, IE11 pops up automatically. As an aside a company I used to work for was so underwater on tech debt that instead of modernizing their site they repackaged IE9 as a citrix app that business partners had to run. People are willing to overlook a lot when the commissions are good and that was not the worst thing I have seen in the insurance space.

mrkstu 7y ago
We recently transitioned to Chrome and use IE Tab on predefined sites. It’s a good compromise of standardizing on a modern browser and still being able to access a couple straggler apps.
- gsnedders 7y ago
  What's the motivation to use Chrome and IE Tab v. MS Edge (where the Chromium-based product supports IE Tab-like functionality natively)? Or just long enough ago before the Chromium-based Edge shipped?
  - mrkstu 7y ago
    Prior to Microsoft’s change of engines, or at least around the same time. Plus it isn’t like anyone wanted to use IE or Edge, so we would of likely gone the same path regardless.
    - gsnedders 7y ago
      It's not clear to be Chromium-based Edge is an any worse product than Chrome (and in many ways is going further down the anti-ad-tracking route than Chrome, unsurprisingly), but I expect the Trident integration in their IE Mode is better than IE Tab?
      - 7y ago

kube-system 7y ago

This stuff happens over time. It is a result of cascading dependencies. Companies have lots of pieces of software that they support for extended periods of time. Also, they typically avoid requiring users to use different browsers for different applications. The number of support calls goes up dramatically if you need users to use different browsers, and it causes usability headaches when linking from one system to another, because you can only have one default browser. If you bring a piece of enterprise software into any organization, they will want you to target the browser they're using.... so, targeting IE was written into the requirements well after it was a good idea, because legacy compatibility was required. That, of course, works until MS throws a wrench in the works and discontinues the browser. SaaS will change this somewhat, because the software is continually updated by the vendor. It's mainly on-prem and/or custom applications that cause this issue, because they don't get upgraded until big bucks are dished out.

gsnedders 7y ago
> The number of support calls goes up dramatically if you need users to use different browsers, and it causes usability headaches when linking from one system to another, because you can only have one default browser. Which is precisely why Chromium-based Edge has an IE Mode that uses Trident for given sites so that those legacy systems can be filtered to use a different browser engine from within the same browser UX.
- kube-system 7y ago
  Good to know -- I personally haven't dealt with this issue in the past few months (or years), but hopefully this will give some organizations a path forward. Between ~2010 and the January release of Edge this year, a lot of organizations were dealing with the scenario I outlined. Although as recently as this month, I've run into scenarios where Chromium-based Edge acts a bit differently than Chrome... so it's not a solid solution in all cases.
  - gsnedders 7y ago
    > Although as recently as this month, I've run into scenarios where Chromium-based Edge acts a bit differently than Chrome... so it's not a solid solution in all cases. I mean the Edge team will treat any such case as a bug if you report it.

drngdds 7y ago

Because unfortunately, competition exists. I work in fintech and we have two options: - Convince bajillion dollar investment banks to switch web browsers just to use our service - Accept a mild decrease in developer experience

bromuro 7y ago
Does that mean your company doesn’t care about security? Looks crazy for being a “fintech”!

sebazzz 7y ago

I had clients reject .NET Framework 4.8 due to security concerns.