10 ms·

Understanding the corporate impact (of upgrading Firefox)

68 points by Isofarro 15y ago

dlikhten 15y ago
So here's my take on the matter. This is a Damned if you do, damned if you don't problem. a) Firefox must release frequently to keep up with competition. A firefox by any other version is just the same set of changes, just labeled 4.1 vs 5. I don't know why they changed their numbering system (to keep up with chrome i guess) but it makes absolutely zero difference. b) Any corporation cares about stability vs progress. They want to test now, guarantee that it will work for say 10 years, and just stick with it. And now of course c) The web needs to progress. (ie6). IE6 is still being used. This has been beaten long and hard for years. The problem is not IE6, the problem is corporations. IE6 will die, it'll die soon (I hope) as I still have to support that heap of crap. HOWEVER tomorrow firefox 3.6 will be it. FF 3.6 will have some crap and work like shit 10 yrs from now and some corporation will want to use it and nothing else just like IE7 and IE8 and actually anything. -- Anyone who embraces chrome is embracing a mindset, it will always be up-to-date and our it must support the latest version, we'll force a restart of chrome at some point to update that version. Our sites MUST WORK WITH LATEST CHROME. Here we have examples of companies complaining, and I guarantee if Mozilla would state that 3.6 will be forever supported (7 yrs?) like IE6 was they would get the same shit MS got for IE6, sure not today, but in a few yrs "omg fucking ff 3.6 can't do shit like rounded corners right, it needs to die" followed by the FF3.6 eulogy website etc. The only way to win this is for companies to realize that the following will be true on the web: a) security vulnerabilities in browsers will be discovered/patched, and quickly. You must upgrade frequently to keep up. b) The web is moving forward, even if you dislike that. Due to this rendering engines must be updated constantly. Sorry. Adopt best practices and release frequently. Its an unfortunate cold hard truth and its costly but its the nature of dealing with the web. c) Mozilla can't support an old browser forever. Pay them and they will. However they are not Microsoft, and even MS can't do this effectively, so if you want something for "free" (IE included here) be prepared for paying for having to move in the direction they take. Otherwise contribute cash to them to support what you want. I'm sure Mozilla will happily create a special FF3.5 branch back-porting fixes for years as long as you pay them to.
- zaphar 15y ago
  I would argue that the Chrome mindset may actually be a more sustainable easier practice. Instead of a large "certification" process you just fix things as they break on an ongoing basis. Small changes over time seem easier to absorb than a Huge change once every few years.
  - icefox 15y ago
    Not to mention they would only have one version of chrome (the latest) to support and not multiple versions of Firefox that are still installed on various desktops around the office.
- thaumaturgy 15y ago
  Let me put my flame-suit on ... To further distill your points, there is fundamentally two problems: 1. Maintaining backwards compatibility while providing support for new features; 2. Providing security updates without breaking compatibility. I need my flame-suit because, if Mozilla can't solve those two problems, then they seem to be ignorant of some very basic strategies in software development. In web-based application development lately, you see a lot of "MVC" talk. MVC is far from a new concept, but more people are starting to see the wisdom of keeping your business logic separate from your UI logic. There's no reason why a web browser shouldn't be constructed the same way. Internally, it should be separated into distinct parts -- the network interface, the rendering engine, the user interface, etc. -- with those parts communicating only through a largely static API. Each of those parts should then endeavor to separate the security-related logic from the rest of the application logic. In other words, there is absolutely no reason why it should be impossible to apply and maintain security fixes to multiple versions of the code base, simultaneously. Once upon a time, programmers saw the wisdom of maintaining separate versions of their applications, and they helped their system administration brethren by signaling the impact of changes in the version numbering: major.minor.revision Sysadmins running a specific major.minor of an application could always feel comfortable blindly updating .revisions, which typically consisted of things like security updates. If a .revision ever broke anything at all, the developers were generally considered to have screwed up. Sysadmins could more leisurely apply major.minor updates, after double-checking that the .minor change didn't break any of the stuff that their network relied on. And, meanwhile, sysadmins could even more leisurely take their time in developing comprehensive testing periods and update roadmaps for major releases, so that nobody in the company would get caught with their pants down. So, not only is Mozilla committing an egregious error in not being able to apply just security updates without changing any other application functionality, but they're committing a whole other sin of long-standing software best practices by abandoning the most sensible version numbering system that was ever developed, and developed for damn good reason. I think it's clear that Mozilla simply doesn't give a shit about their users at this point. They are either accidentally or intentionally ignorant of why these practices were developed and what problems they were intended to solved, not only in corporate markets but in home users as well. Mozilla is also digging the graves of system administrators everywhere who pushed for deployment of Mozilla applications in corporate environments and are now going to be faced with nothing less than a huge fucking maintenance nightmare -- and I promise you that nearly every corporate IT department has an administrative overlord who is much less interested in why a particular software product is technically better than they are in what the cost will be or how many people are going to complain. I'm beyond furious, personally. Way, way beyond furious. I've been making similar comments in every single Mozilla-related thread since this was announced. My company was still switching our clients -- clients who work with us because they trust our judgement -- to Firefox as of last week. This new release strategy has just fucked us in the ass. As of now, we've completely halted Firefox conversions, and I have to figure out what to do next. As far as website compatibility goes, would it really be so hard to support a simple comment tag at the top of the page that listed the browser major versions that the site had been built for, and then -- because the application was designed well so as to be capable of such magic as this -- use the appropriate rendering engine, dynamically loaded?
ratsbane 15y ago
The corporate mindset is the problem. They've got to get away from the hubris of thinking their software testing process is so special or better than the community's. Although it's a pretty cushy assignment. I'm sure plenty of bigcorp PMs would rather do that than to manage something with more complicated deliverables.
- Nitramp 15y ago
  I agree. The assumption here is that the corporate IT mindset is the constant factor, and Mozilla, Chrome, or whatever, have to adapt to it. I don't agree with that assumption. Corporate IT has to get better and faster, or they will get marginalized by cloud hosted solutions that can move faster and deliver superior experiences at better cost. If your internal software is so crappy you can't upgrade your browser, maybe you should try and fix your internal software.
  - Silhouette 15y ago
    > Corporate IT has to get better and faster, or they will get marginalized by cloud hosted solutions that can move faster and deliver superior experiences at better cost. That's easy to say when you're not responsible for a system where an hour of downtime comes with a seven-figure number in brackets on this quarter's review. Corporate IT guys get a lot of grief about imposing picky rules and making life difficult, but the bottom line is that they are the guys who are going to take the flak if stuff breaks. Most of these policies are not there because someone at the head office wants to throw their weight around, they are there because a lot of people on the corporate network really could cause serious damage without even knowing how or why if left to do whatever they wanted. If you want to blame someone for this cultural problem, blame the big software and infrastructure providers, who haven't yet collectively invented a robust global IT architecture where risk can reliably be localised to the user at fault. Or step up and do something about it and get very rich, because it's a real problem facing literally billions of staff every day. Alternatively, you could take the view that cloud computing is the way forward, releasing a new browser every three months will make these sorts of problems go away, and everyone who develops in-house tools and operates a conservative IT policy is a moron with no idea how to run a successful business. Good luck with that. :-)
synnik 15y ago
The problem I see with this complaint is what "End of Life" means in corporate IT. What it boils down to in practical terms is that the vendor no longer is available for support calls. We continue to run many EOL apps because of these kinds of issues -- we know the apps are stable for our usage of them, and it is a low risk that we would have needed vendor support anyway. We make an explicit decision to accept that risk So this is technical impact, but really it is a risk management issue.
- bradleyland 15y ago
  The FF4 EOL announcement has a bit more impact than that. It has been announced that FF4 will not received security updates. This means that if you deploy FF4 in your enterprise, you'll not only be committing to software without support, you'll have internet-facing software that contains published vulnerabilities (as they appear). That's just unacceptable. Browser vendors would do well to adopt a release strategy that is similar to Ubuntu's model. You have a churn of releases with a periodic LTS release that will receive security patches for a longer term. The key here is understanding that there is some middle ground. The "release often, period" method of software development is attractive to a lot of us individually, but it's nearly impossible to plan for when you manage hundreds of PCs per tech support staff member. Providing a consistent LTS release schedule would at least give corporations the ability to plan.
  - dpark 15y ago
    Corporations don't want LTS. They want RidiculouslyLTS. Ubuntu's LTS releases are supported for 3 years. IE 6 is now almost 10 years old. This is what corporations want. They want to install software and forget about it for a decade. This is not a realistic model for a browser. Even 3 years is not very realistic. 3 years means running Firefox 3.0 now, in June 2011. Sure, some people do it, but it's not a great idea for many reasons. When you're looking at Microsoft Word, expecting long-term support makes sense. It's shrink-wrapped software and upgrading is a big ordeal. You have to upgrade everyone at once, or someone's going to (repeatedly and consistently) send out docx files to coworkers who cannot open them. It can take a lot of time and money to upgrade everyone. Browsers are (or should be) different. The web is continually evolving. New exploits pop up fairly often. Regular upgrades are necessity for security and functionality, so upgrading a browser should be a minor, easy thing, and it should happen frequently. The problem is not the lack of support from Mozilla, but the expectation from corporations that browsers should be treated like Word processors.
markokocic 15y ago
So? Let's all get stuck with FF 3.6 like IE6? Please no. Mozilla shouldn't slow down the release cycle just because big corporations can't keep up with it. Alternatively, what would help those big customers to keep up would be the opposite of what they require. Instead of having infrequent "big" releases every few months, having continuous updates ala Chrome where each increment in almost compatible with the next one could help to mitigate the problem. There will be no big breakages and everyone that wants will be able to keep up when time comes.
- Silhouette 15y ago
  > Mozilla shouldn't slow down the release cycle just because big corporations can't keep up with it. No-one can keep up with it. Not big corporations. Not people who make web sites and web apps. Not even people who make extensions for the browser itself. The only people who can keep up are users who ticked the "update me whenever you feel like it" box. They only benefit in practice if the people providing the content can take advantage of any new functionality. Otherwise, it's just a no-win/lose proposition, a significant risk of breaking stuff that used to work for no real benefit.
  - daleharvey 15y ago
    Its a vast improvement for web developers who have to develop for 1 version of chrome versus 4 versions of ie, Its a vast improvement for web developers who get to use new functionality to deliver better experiences to their users, Its a vast improvement for users who get a faster, smoother, more featureful web experience. The only people it sucks for is large corporations who for some reason have applications that are tied to 10 year old technology and for extension developers, its a shame but certainly not worth holding back the web for
    - Silhouette 15y ago
      > Its a vast improvement for web developers who have to develop for 1 version of chrome versus 4 versions of ie, Its a vast improvement for web developers who get to use new functionality to deliver better experiences to their users, Its a vast improvement for users who get a faster, smoother, more featureful web experience. It would be a vast improvement if any of those things were actually true, but unfortunately none of them is. Web developers aren't developing for one version of Chrome or Firefox now, they're developing for one version every three months. That is far worse than supporting, say, IE8 and IE9. (Please can we drop the IE6 nonsense now? The remaining market share is negligible and the arguments are academic outside of niche markets.) Web developers can't use the new features if they can't keep up with them, and in any case they are typically not portable, robust or future-proof enough for production work when first released. That means users don't get a more featureful experience. If anything, they get less, because trendy web sites use trendy CSS3 features and the like to save time, and those features don't work for a very substantial proportion of the web-surfing public where the older but tried-and-tested techniques did.
CWuestefeld 15y ago
Staying at FF3.6 wouldn't make them the most out-of-date by a longshot. A majority of our site's corporate users are on IE6! But it seems to me that part of this problem is that they're trying to accomplish two things with the browser, that for their needs might be better separated into two. For internal corporate apps, there's probably little reason to upgrade. In particular, the security risk posed by accessing internal systems on a backlevel browser is pretty minimal. They could retain FF3.6 for use in this context. For general web browsing (research, etc.), you really want to be as up-to-date as possible, but there shouldn't be any repercussions to doing so. If you're accessing the internal apps on your old FF3.6, then you can have a separate "external browser" that's kept current. So my suggestion is to stick where you are for the internal apps, and separately install Chrome or IE or something for external access. Set up configurations that restrict each browser to only be able to access its intended sphere.
- bluedanieru 15y ago
  If the reason behind the upgrade is to take advantage of a new and more performant JavaScript interpreter, you might want that used for internal apps first, if anything. It depends on whether the sticking point is security or backward compatibility.
- jrwoodruff 15y ago
  I can't imagine trying to get everyone in a large corporation to use the right browser for the right thing. Most normal people barely understand that IE is not the internet, let alone understanding the difference between websites, web apps and internal and external servers. In a very small company, maybe, but not in corpo-land.
  - CWuestefeld 15y ago
    There would certainly be a training issue, but I think people would get it if their system were configured so that each browser is only able to access its intended targets. Something as simple as giving the internal-only one a different, non-standard icon might help. Using policies in IE6, it should be easy enough to disable access to internal sites. And in FF3.6 (for the internal apps) it's probably trickier (and I don't know how to deploy the policy), but one might point it to a non-existent proxy, and tell it not to use that proxy for internal sites.
eli 15y ago
I think this is a challenge especially for open source projects. I'd rather write documentation then have to maintain an old, deprecated codebase.
billybob 15y ago
Merits of the argument aside, I was surprised to see the tone that Asa Dotzler took on that thread. To me, it sounded like "you enterprises are dumb and we don't care about you." If I were "Community Coordinator for Firefox marketing projects," I think I would have tried to be more tactful. I'm not trying to throw darts at him, but it may be instructional for those of us who are geeks to consider how our words can come across online.
- asadotzler 15y ago
  I didn't say anything that could be remotely construed as calling enterprises dumb. I said that they have not, and in my opinion, should not, be Firefox's target.
  - fierarul 15y ago
    Actually it's unclear by reading this blog post alone what are you trying to say. It becomes clear if people read the end of your previous post[1] where you say: "For corporate deployments, there has to be a stable branch. I bet someone is probably going to make a nice business out of creating and maintaining a stable branch…" 1. http://mike.kaply.com/2011/06/21/firefox-rapid-release-process/ http://mike.kaply.com/2011/06/21/firefox-rapid-release-proce...
  - mindcrime 15y ago
    Well, you believe what you believe, and nobody can fault you for your beliefs, in and of themselves. I happen to disagree with you, but that's not my issue with your comment... my issue is that - regardless of what you intended - your tone came off as very arrogant, dismissive and mean-spirited. And, like it or not, there is a PR aspect to consider anytime someone - who is as visible and well known as you are - says something that sparks controversy. I think this whole thing has done some damage to the Firefox brand, and that makes me sad, as I've been a Firefox (and before that, Mozilla... going back as far as Mozilla M2, IIRC) supporter for a long time.
  - jubalfh 15y ago
    Now what you actually said is: ‘if you want to provide standarised and stable non-Windows browsing environment, screw you, sucker’. Yes, yes, I heard that ‘someone go and make business of stabilising the crap out of firefox’ song. Well, there's one problem – there's no such product yet.
dsr_ 15y ago
If you don't learn from history, what are you planning on learning from? Debian solved this sort of problem by forking Firefox to produce Iceweasel, which is a stable FF version plus security patches. There's nothing to prevent someone from doing the same for a Windows build of Firefox. There might even be a plausible business plan in providing support and updates. The releases would be free, but you can charge a fee for integrating and writing new patches, plus .msi installer scripts, plus answering questions. Cygnus was doing this for a bunch of GNU projects up until their merger with Red Hat.
chrisjsmith 15y ago
Stuff changes. Corporates need to get used to that. Add to that the motivation for buying software is usually either a bonus for completing a project or cash backhand from the vendor rather than on the merits of a tool. Also, I know a certain large company that used paper envelopes for asset tracking. They bought in a fantastic electronic system to handle it and all the staff sabotaged it because: A) it made them accountable ... B) it made people visible of what they were doing. TBH I think most corps are deranged as are any groups of humans with N > 5.
biturd 15y ago
It appears to me that corporate wants to repeat mistakes of past. Is it really Microsofts fault that IE6 won't die? Why is IE8 still around? Microsoft, of all companies, has tried to support legacy software for as long as possible, and often longer than possible, by reversing EOL'd announcements. The fact you can still run most 10+ year old software on a modern OS from Microsoft illustrates this. Look where Microsoft is today, I certainly don't wonder why that is. Corporations define policies and procedures for software releases internally. They find what is stable, slap a stamp of infinity approval on it, and forget about it. If this is to continue, there will be an IE6 problem again in a few years, only this time it will be FireFox that is being blamed. Browsers need to be updated often, this is only going to become more important as the web advances. If this breaks your stuff, if your intranet falls apart as a result, more than likely, this is the fault of your intranet, not that of the vendor software. If it is the vendor software, in a few days, a patch will auto update. As a corporation, you can chose to fix your intranet, put in the time and money to repair your mistakes, or not. Doing so will benefit you moving forward, and eventually, your intranet will be modern enough that these issues will be no more than a small inconvenience. It is not the problem of a browser vendor to stagnate their software because you want to allow your own software to stagnate. The source is available, you have options. You can fork your own, keep the software where you want it, and patch it internally. If you don't like that option, contribute back to the current version, and help move things along. If you don't like that, write a check to someone to do this for you. I would bet that Firefox will be more than happy to backport for the right price. You don't get to have your cake and eat it too, especially at the expense of the rest of the internet using world. All the suggestions in the comments of the linked article lean on FireFox developing different versions and augmented policies to somehow continue to support an old version to aid in keeping crappy intranet's working. Why should FireFox spend a moments thought on making a Corporate Legacy Infinity Support Humping Along version just to appease the corporations inability to progress. Sure, it is a lot of work to roll out 500,000 updates to FireFox. Move to Chrome and that won't be an issue, you are always up to date. Or, maybe there is an auto-update mechanism to FireFox for that scale. But doing that, removes the need for a large staff to take months to years to plan a browser update. That sentence is so insane, having a team to plan and document the upgrade of a browser! People will find small portions of their jobs are irrelevant. Progress is like that. One day, many of our jobs will be replaced by robots. There must have been resistance to the copy machine, and all those secretaries no longer had to hand type a letter from the boss. Carbon copy paper may have had equal resistance. Progress happens, sometimes at the expense of jobs. Stay on top of your industry, and change with it, and your job should be secure. Don't get comfortable with the fact that your job is hanging on by a thin thread of aged policy in a corporate environment that changes slowly. That will be forced to change, as we are seeing now. Corporate IT workers are demanding to turn FireFox into the IE6 problem. This has come at the expense of the entire internet using public in the past. FireFox is not willing to allow that to happen. Version numbers are going to stop mattering. When you check the version number in the future, it will say "current" or "needs updating". Embrace this, and your intranet will be modern and more bulletproof. Don't, and I hope you are confident there are other aspects of your business that do not rely on technology so you will still be relevant in some other field. Someone will always need to put more paper in the copy machine, maybe you can create a procedure for making sure that all the copy machines waste a page per print. Your job is safe for at least your lifetime.
m0nty 15y ago
To counter a point that has been made several times here: it's not just corporations which operate a "conservative" IT policy: many SMEs do so as well. Innovations are great at home but at work, they confuse users, break things which have worked forever, and represent an unknown quantity in support terms. I've already decided not to put FF4 in front of my users because of the interface changes (I know I can restore the address bar, etc, but I don't want to spend my time doing that for each user). The Firefox team are solving problems most users don't know they have, i.e. I rarely hear complaints that "the address bar is confusing", or "the status-bar is in the way", but frequently "I went to Google Image search and it's trying to install something on my computer". Time spent solving the second problem is far more valuable to me than time spent on the first (non-) problem.
jarin 15y ago
I used to do IT in the Navy and participated in upgrade processes like this, and this is exactly why I didn't go work at a government software contractor like most of my shipmates did after we got out.
fleitz 15y ago
What makes the web great is its constant change and innovation. How is it that a 2 person startup can deal with it's users changing browsers whenever they want, but a giant corporation can't? When your browser is beholden to a corporate dev cycle what you get is Internet Explorer. What exactly would be wrong with a test system that included support for a variety of browsers? Perhaps they could automate this test suite. Any process that made your dev system more agile would be a step forward in this turbulent economy. The current rate of change in the world is going to be increasing exponentially for the foreseeable future. Those well adapted to this environment will prosper those who aren't will perish. Furthermore, "faced with deciding which is more important: security updates or the critical production web application needed to manufacture your product is not a happy place to be." if you're running the same browser to browse the web and do process control you're asking for XSS/CSRF attacks against your process control system, setup some special link on the desktop that launches a custom browser, then you can keep that browser stable and have an up to date browser for the rest of the internet. Personally, if I was charged with securing a process control system I would have it entirely disconnected from the rest of the corporate network. Only systems that need to access the process control should be connected to that network. We live in the world of stuxnet.
- vogonj 15y ago
  > What makes the web great is its constant change and innovation. How is it that a 2 person startup can deal with it's users changing browsers whenever they want, but a giant corporation can't? That two-person startup consists of two hackers who eat, sleep, and fucking breathe Web technologies. They have bookmarklets for six different sets of Web documentation, and they can quote chapter and verse from any of them. They work 18-hour days because they love their job. The giant corporation's line-of-business app team consists of an IT guy, an accountant who owns a couple of dogeared books on JavaScript, and maybe a couple of contractors. They work 8-hour days, only half of which is actually devoted to the application they're working on, and they don't care about standards as long as they can finish writing that Web app and get back to their actual job. I'm certainly exaggerating a bit, but the reason is because that giant corporation's business is almost certainly not writing Web apps for a living.
Tichy 15y ago
"Education programs, documentation updates, communications all are planned." Couldn't you just fire all employees who need education programs and documentation updates for a browser update? I know it sounds harsh and will get me downvotes, but think about it? Maybe there are legit employees who are unable to grasp a new browser. But maybe for them a full blown browser is the wrong solution anyway. Perhaps somebody should step in and create dummy browsers that only have a couple of buttons for the limited set of activities those users are capable of performing. Seriously: the point of apps with nice UI is to make documentation superfluous. So instead of creating documentation nobody wants to read, create apps that make the docs superfluous. It could be some kind of "browser generator".
- pnathan 15y ago
  One indeed might wonder at the people who need education programs for a browser. seriously, the only major ui innovation since netscape 2.x? 3.x? was the merging of url bar and search bar.
- MKaply 15y ago
  You're thinking about it wrong. There are support documents with screenshots, self-help videos and things like that. All these things have to be redone when there are major visual changes to the browser.

68 points by Isofarro 15y ago

So here's my take on the matter. This is a Damned if you do, damned if you don't problem. a) Firefox must release frequently to keep up with competition. A firefox by any other version is just the same set of changes, just labeled 4.1 vs 5. I don't know why they changed their numbering system (to keep up with chrome i guess) but it makes absolutely zero difference. b) Any corporation cares about stability vs progress. They want to test now, guarantee that it will work for say 10 years, and just stick with it. And now of course c) The web needs to progress. (ie6). IE6 is still being used. This has been beaten long and hard for years. The problem is not IE6, the problem is corporations. IE6 will die, it'll die soon (I hope) as I still have to support that heap of crap. HOWEVER tomorrow firefox 3.6 will be it. FF 3.6 will have some crap and work like shit 10 yrs from now and some corporation will want to use it and nothing else just like IE7 and IE8 and actually anything. -- Anyone who embraces chrome is embracing a mindset, it will always be up-to-date and our it must support the latest version, we'll force a restart of chrome at some point to update that version. Our sites MUST WORK WITH LATEST CHROME. Here we have examples of companies complaining, and I guarantee if Mozilla would state that 3.6 will be forever supported (7 yrs?) like IE6 was they would get the same shit MS got for IE6, sure not today, but in a few yrs "omg fucking ff 3.6 can't do shit like rounded corners right, it needs to die" followed by the FF3.6 eulogy website etc. The only way to win this is for companies to realize that the following will be true on the web: a) security vulnerabilities in browsers will be discovered/patched, and quickly. You must upgrade frequently to keep up. b) The web is moving forward, even if you dislike that. Due to this rendering engines must be updated constantly. Sorry. Adopt best practices and release frequently. Its an unfortunate cold hard truth and its costly but its the nature of dealing with the web. c) Mozilla can't support an old browser forever. Pay them and they will. However they are not Microsoft, and even MS can't do this effectively, so if you want something for "free" (IE included here) be prepared for paying for having to move in the direction they take. Otherwise contribute cash to them to support what you want. I'm sure Mozilla will happily create a special FF3.5 branch back-porting fixes for years as long as you pay them to.

zaphar 15y ago
I would argue that the Chrome mindset may actually be a more sustainable easier practice. Instead of a large "certification" process you just fix things as they break on an ongoing basis. Small changes over time seem easier to absorb than a Huge change once every few years.
- icefox 15y ago
  Not to mention they would only have one version of chrome (the latest) to support and not multiple versions of Firefox that are still installed on various desktops around the office.
thaumaturgy 15y ago
Let me put my flame-suit on ... To further distill your points, there is fundamentally two problems: 1. Maintaining backwards compatibility while providing support for new features; 2. Providing security updates without breaking compatibility. I need my flame-suit because, if Mozilla can't solve those two problems, then they seem to be ignorant of some very basic strategies in software development. In web-based application development lately, you see a lot of "MVC" talk. MVC is far from a new concept, but more people are starting to see the wisdom of keeping your business logic separate from your UI logic. There's no reason why a web browser shouldn't be constructed the same way. Internally, it should be separated into distinct parts -- the network interface, the rendering engine, the user interface, etc. -- with those parts communicating only through a largely static API. Each of those parts should then endeavor to separate the security-related logic from the rest of the application logic. In other words, there is absolutely no reason why it should be impossible to apply and maintain security fixes to multiple versions of the code base, simultaneously. Once upon a time, programmers saw the wisdom of maintaining separate versions of their applications, and they helped their system administration brethren by signaling the impact of changes in the version numbering: major.minor.revision Sysadmins running a specific major.minor of an application could always feel comfortable blindly updating .revisions, which typically consisted of things like security updates. If a .revision ever broke anything at all, the developers were generally considered to have screwed up. Sysadmins could more leisurely apply major.minor updates, after double-checking that the .minor change didn't break any of the stuff that their network relied on. And, meanwhile, sysadmins could even more leisurely take their time in developing comprehensive testing periods and update roadmaps for major releases, so that nobody in the company would get caught with their pants down. So, not only is Mozilla committing an egregious error in not being able to apply just security updates without changing any other application functionality, but they're committing a whole other sin of long-standing software best practices by abandoning the most sensible version numbering system that was ever developed, and developed for damn good reason. I think it's clear that Mozilla simply doesn't give a shit about their users at this point. They are either accidentally or intentionally ignorant of why these practices were developed and what problems they were intended to solved, not only in corporate markets but in home users as well. Mozilla is also digging the graves of system administrators everywhere who pushed for deployment of Mozilla applications in corporate environments and are now going to be faced with nothing less than a huge fucking maintenance nightmare -- and I promise you that nearly every corporate IT department has an administrative overlord who is much less interested in why a particular software product is technically better than they are in what the cost will be or how many people are going to complain. I'm beyond furious, personally. Way, way beyond furious. I've been making similar comments in every single Mozilla-related thread since this was announced. My company was still switching our clients -- clients who work with us because they trust our judgement -- to Firefox as of last week. This new release strategy has just fucked us in the ass. As of now, we've completely halted Firefox conversions, and I have to figure out what to do next. As far as website compatibility goes, would it really be so hard to support a simple comment tag at the top of the page that listed the browser major versions that the site had been built for, and then -- because the application was designed well so as to be capable of such magic as this -- use the appropriate rendering engine, dynamically loaded?

ratsbane 15y ago

The corporate mindset is the problem. They've got to get away from the hubris of thinking their software testing process is so special or better than the community's. Although it's a pretty cushy assignment. I'm sure plenty of bigcorp PMs would rather do that than to manage something with more complicated deliverables.

Nitramp 15y ago
I agree. The assumption here is that the corporate IT mindset is the constant factor, and Mozilla, Chrome, or whatever, have to adapt to it. I don't agree with that assumption. Corporate IT has to get better and faster, or they will get marginalized by cloud hosted solutions that can move faster and deliver superior experiences at better cost. If your internal software is so crappy you can't upgrade your browser, maybe you should try and fix your internal software.
- Silhouette 15y ago
  > Corporate IT has to get better and faster, or they will get marginalized by cloud hosted solutions that can move faster and deliver superior experiences at better cost. That's easy to say when you're not responsible for a system where an hour of downtime comes with a seven-figure number in brackets on this quarter's review. Corporate IT guys get a lot of grief about imposing picky rules and making life difficult, but the bottom line is that they are the guys who are going to take the flak if stuff breaks. Most of these policies are not there because someone at the head office wants to throw their weight around, they are there because a lot of people on the corporate network really could cause serious damage without even knowing how or why if left to do whatever they wanted. If you want to blame someone for this cultural problem, blame the big software and infrastructure providers, who haven't yet collectively invented a robust global IT architecture where risk can reliably be localised to the user at fault. Or step up and do something about it and get very rich, because it's a real problem facing literally billions of staff every day. Alternatively, you could take the view that cloud computing is the way forward, releasing a new browser every three months will make these sorts of problems go away, and everyone who develops in-house tools and operates a conservative IT policy is a moron with no idea how to run a successful business. Good luck with that. :-)

synnik 15y ago

The problem I see with this complaint is what "End of Life" means in corporate IT. What it boils down to in practical terms is that the vendor no longer is available for support calls. We continue to run many EOL apps because of these kinds of issues -- we know the apps are stable for our usage of them, and it is a low risk that we would have needed vendor support anyway. We make an explicit decision to accept that risk So this is technical impact, but really it is a risk management issue.

bradleyland 15y ago
The FF4 EOL announcement has a bit more impact than that. It has been announced that FF4 will not received security updates. This means that if you deploy FF4 in your enterprise, you'll not only be committing to software without support, you'll have internet-facing software that contains published vulnerabilities (as they appear). That's just unacceptable. Browser vendors would do well to adopt a release strategy that is similar to Ubuntu's model. You have a churn of releases with a periodic LTS release that will receive security patches for a longer term. The key here is understanding that there is some middle ground. The "release often, period" method of software development is attractive to a lot of us individually, but it's nearly impossible to plan for when you manage hundreds of PCs per tech support staff member. Providing a consistent LTS release schedule would at least give corporations the ability to plan.
- dpark 15y ago
  Corporations don't want LTS. They want RidiculouslyLTS. Ubuntu's LTS releases are supported for 3 years. IE 6 is now almost 10 years old. This is what corporations want. They want to install software and forget about it for a decade. This is not a realistic model for a browser. Even 3 years is not very realistic. 3 years means running Firefox 3.0 now, in June 2011. Sure, some people do it, but it's not a great idea for many reasons. When you're looking at Microsoft Word, expecting long-term support makes sense. It's shrink-wrapped software and upgrading is a big ordeal. You have to upgrade everyone at once, or someone's going to (repeatedly and consistently) send out docx files to coworkers who cannot open them. It can take a lot of time and money to upgrade everyone. Browsers are (or should be) different. The web is continually evolving. New exploits pop up fairly often. Regular upgrades are necessity for security and functionality, so upgrading a browser should be a minor, easy thing, and it should happen frequently. The problem is not the lack of support from Mozilla, but the expectation from corporations that browsers should be treated like Word processors.

markokocic 15y ago

So? Let's all get stuck with FF 3.6 like IE6? Please no. Mozilla shouldn't slow down the release cycle just because big corporations can't keep up with it. Alternatively, what would help those big customers to keep up would be the opposite of what they require. Instead of having infrequent "big" releases every few months, having continuous updates ala Chrome where each increment in almost compatible with the next one could help to mitigate the problem. There will be no big breakages and everyone that wants will be able to keep up when time comes.

Silhouette 15y ago
> Mozilla shouldn't slow down the release cycle just because big corporations can't keep up with it. No-one can keep up with it. Not big corporations. Not people who make web sites and web apps. Not even people who make extensions for the browser itself. The only people who can keep up are users who ticked the "update me whenever you feel like it" box. They only benefit in practice if the people providing the content can take advantage of any new functionality. Otherwise, it's just a no-win/lose proposition, a significant risk of breaking stuff that used to work for no real benefit.
- daleharvey 15y ago
  Its a vast improvement for web developers who have to develop for 1 version of chrome versus 4 versions of ie, Its a vast improvement for web developers who get to use new functionality to deliver better experiences to their users, Its a vast improvement for users who get a faster, smoother, more featureful web experience. The only people it sucks for is large corporations who for some reason have applications that are tied to 10 year old technology and for extension developers, its a shame but certainly not worth holding back the web for
  - Silhouette 15y ago
    > Its a vast improvement for web developers who have to develop for 1 version of chrome versus 4 versions of ie, Its a vast improvement for web developers who get to use new functionality to deliver better experiences to their users, Its a vast improvement for users who get a faster, smoother, more featureful web experience. It would be a vast improvement if any of those things were actually true, but unfortunately none of them is. Web developers aren't developing for one version of Chrome or Firefox now, they're developing for one version every three months. That is far worse than supporting, say, IE8 and IE9. (Please can we drop the IE6 nonsense now? The remaining market share is negligible and the arguments are academic outside of niche markets.) Web developers can't use the new features if they can't keep up with them, and in any case they are typically not portable, robust or future-proof enough for production work when first released. That means users don't get a more featureful experience. If anything, they get less, because trendy web sites use trendy CSS3 features and the like to save time, and those features don't work for a very substantial proportion of the web-surfing public where the older but tried-and-tested techniques did.

CWuestefeld 15y ago

Staying at FF3.6 wouldn't make them the most out-of-date by a longshot. A majority of our site's corporate users are on IE6! But it seems to me that part of this problem is that they're trying to accomplish two things with the browser, that for their needs might be better separated into two. For internal corporate apps, there's probably little reason to upgrade. In particular, the security risk posed by accessing internal systems on a backlevel browser is pretty minimal. They could retain FF3.6 for use in this context. For general web browsing (research, etc.), you really want to be as up-to-date as possible, but there shouldn't be any repercussions to doing so. If you're accessing the internal apps on your old FF3.6, then you can have a separate "external browser" that's kept current. So my suggestion is to stick where you are for the internal apps, and separately install Chrome or IE or something for external access. Set up configurations that restrict each browser to only be able to access its intended sphere.

bluedanieru 15y ago
If the reason behind the upgrade is to take advantage of a new and more performant JavaScript interpreter, you might want that used for internal apps first, if anything. It depends on whether the sticking point is security or backward compatibility.
jrwoodruff 15y ago
I can't imagine trying to get everyone in a large corporation to use the right browser for the right thing. Most normal people barely understand that IE is not the internet, let alone understanding the difference between websites, web apps and internal and external servers. In a very small company, maybe, but not in corpo-land.
- CWuestefeld 15y ago
  There would certainly be a training issue, but I think people would get it if their system were configured so that each browser is only able to access its intended targets. Something as simple as giving the internal-only one a different, non-standard icon might help. Using policies in IE6, it should be easy enough to disable access to internal sites. And in FF3.6 (for the internal apps) it's probably trickier (and I don't know how to deploy the policy), but one might point it to a non-existent proxy, and tell it not to use that proxy for internal sites.

eli 15y ago

I think this is a challenge especially for open source projects. I'd rather write documentation then have to maintain an old, deprecated codebase.

billybob 15y ago

Merits of the argument aside, I was surprised to see the tone that Asa Dotzler took on that thread. To me, it sounded like "you enterprises are dumb and we don't care about you." If I were "Community Coordinator for Firefox marketing projects," I think I would have tried to be more tactful. I'm not trying to throw darts at him, but it may be instructional for those of us who are geeks to consider how our words can come across online.

asadotzler 15y ago
I didn't say anything that could be remotely construed as calling enterprises dumb. I said that they have not, and in my opinion, should not, be Firefox's target.
- fierarul 15y ago
  Actually it's unclear by reading this blog post alone what are you trying to say. It becomes clear if people read the end of your previous post[1] where you say: "For corporate deployments, there has to be a stable branch. I bet someone is probably going to make a nice business out of creating and maintaining a stable branch…" 1. http://mike.kaply.com/2011/06/21/firefox-rapid-release-process/ http://mike.kaply.com/2011/06/21/firefox-rapid-release-proce...
- mindcrime 15y ago
  Well, you believe what you believe, and nobody can fault you for your beliefs, in and of themselves. I happen to disagree with you, but that's not my issue with your comment... my issue is that - regardless of what you intended - your tone came off as very arrogant, dismissive and mean-spirited. And, like it or not, there is a PR aspect to consider anytime someone - who is as visible and well known as you are - says something that sparks controversy. I think this whole thing has done some damage to the Firefox brand, and that makes me sad, as I've been a Firefox (and before that, Mozilla... going back as far as Mozilla M2, IIRC) supporter for a long time.
- jubalfh 15y ago
  Now what you actually said is: ‘if you want to provide standarised and stable non-Windows browsing environment, screw you, sucker’. Yes, yes, I heard that ‘someone go and make business of stabilising the crap out of firefox’ song. Well, there's one problem – there's no such product yet.

dsr_ 15y ago

If you don't learn from history, what are you planning on learning from? Debian solved this sort of problem by forking Firefox to produce Iceweasel, which is a stable FF version plus security patches. There's nothing to prevent someone from doing the same for a Windows build of Firefox. There might even be a plausible business plan in providing support and updates. The releases would be free, but you can charge a fee for integrating and writing new patches, plus .msi installer scripts, plus answering questions. Cygnus was doing this for a bunch of GNU projects up until their merger with Red Hat.

chrisjsmith 15y ago

Stuff changes. Corporates need to get used to that. Add to that the motivation for buying software is usually either a bonus for completing a project or cash backhand from the vendor rather than on the merits of a tool. Also, I know a certain large company that used paper envelopes for asset tracking. They bought in a fantastic electronic system to handle it and all the staff sabotaged it because: A) it made them accountable ... B) it made people visible of what they were doing. TBH I think most corps are deranged as are any groups of humans with N > 5.

biturd 15y ago

It appears to me that corporate wants to repeat mistakes of past. Is it really Microsofts fault that IE6 won't die? Why is IE8 still around? Microsoft, of all companies, has tried to support legacy software for as long as possible, and often longer than possible, by reversing EOL'd announcements. The fact you can still run most 10+ year old software on a modern OS from Microsoft illustrates this. Look where Microsoft is today, I certainly don't wonder why that is. Corporations define policies and procedures for software releases internally. They find what is stable, slap a stamp of infinity approval on it, and forget about it. If this is to continue, there will be an IE6 problem again in a few years, only this time it will be FireFox that is being blamed. Browsers need to be updated often, this is only going to become more important as the web advances. If this breaks your stuff, if your intranet falls apart as a result, more than likely, this is the fault of your intranet, not that of the vendor software. If it is the vendor software, in a few days, a patch will auto update. As a corporation, you can chose to fix your intranet, put in the time and money to repair your mistakes, or not. Doing so will benefit you moving forward, and eventually, your intranet will be modern enough that these issues will be no more than a small inconvenience. It is not the problem of a browser vendor to stagnate their software because you want to allow your own software to stagnate. The source is available, you have options. You can fork your own, keep the software where you want it, and patch it internally. If you don't like that option, contribute back to the current version, and help move things along. If you don't like that, write a check to someone to do this for you. I would bet that Firefox will be more than happy to backport for the right price. You don't get to have your cake and eat it too, especially at the expense of the rest of the internet using world. All the suggestions in the comments of the linked article lean on FireFox developing different versions and augmented policies to somehow continue to support an old version to aid in keeping crappy intranet's working. Why should FireFox spend a moments thought on making a Corporate Legacy Infinity Support Humping Along version just to appease the corporations inability to progress. Sure, it is a lot of work to roll out 500,000 updates to FireFox. Move to Chrome and that won't be an issue, you are always up to date. Or, maybe there is an auto-update mechanism to FireFox for that scale. But doing that, removes the need for a large staff to take months to years to plan a browser update. That sentence is so insane, having a team to plan and document the upgrade of a browser! People will find small portions of their jobs are irrelevant. Progress is like that. One day, many of our jobs will be replaced by robots. There must have been resistance to the copy machine, and all those secretaries no longer had to hand type a letter from the boss. Carbon copy paper may have had equal resistance. Progress happens, sometimes at the expense of jobs. Stay on top of your industry, and change with it, and your job should be secure. Don't get comfortable with the fact that your job is hanging on by a thin thread of aged policy in a corporate environment that changes slowly. That will be forced to change, as we are seeing now. Corporate IT workers are demanding to turn FireFox into the IE6 problem. This has come at the expense of the entire internet using public in the past. FireFox is not willing to allow that to happen. Version numbers are going to stop mattering. When you check the version number in the future, it will say "current" or "needs updating". Embrace this, and your intranet will be modern and more bulletproof. Don't, and I hope you are confident there are other aspects of your business that do not rely on technology so you will still be relevant in some other field. Someone will always need to put more paper in the copy machine, maybe you can create a procedure for making sure that all the copy machines waste a page per print. Your job is safe for at least your lifetime.

m0nty 15y ago

To counter a point that has been made several times here: it's not just corporations which operate a "conservative" IT policy: many SMEs do so as well. Innovations are great at home but at work, they confuse users, break things which have worked forever, and represent an unknown quantity in support terms. I've already decided not to put FF4 in front of my users because of the interface changes (I know I can restore the address bar, etc, but I don't want to spend my time doing that for each user). The Firefox team are solving problems most users don't know they have, i.e. I rarely hear complaints that "the address bar is confusing", or "the status-bar is in the way", but frequently "I went to Google Image search and it's trying to install something on my computer". Time spent solving the second problem is far more valuable to me than time spent on the first (non-) problem.

jarin 15y ago

I used to do IT in the Navy and participated in upgrade processes like this, and this is exactly why I didn't go work at a government software contractor like most of my shipmates did after we got out.

fleitz 15y ago

What makes the web great is its constant change and innovation. How is it that a 2 person startup can deal with it's users changing browsers whenever they want, but a giant corporation can't? When your browser is beholden to a corporate dev cycle what you get is Internet Explorer. What exactly would be wrong with a test system that included support for a variety of browsers? Perhaps they could automate this test suite. Any process that made your dev system more agile would be a step forward in this turbulent economy. The current rate of change in the world is going to be increasing exponentially for the foreseeable future. Those well adapted to this environment will prosper those who aren't will perish. Furthermore, "faced with deciding which is more important: security updates or the critical production web application needed to manufacture your product is not a happy place to be." if you're running the same browser to browse the web and do process control you're asking for XSS/CSRF attacks against your process control system, setup some special link on the desktop that launches a custom browser, then you can keep that browser stable and have an up to date browser for the rest of the internet. Personally, if I was charged with securing a process control system I would have it entirely disconnected from the rest of the corporate network. Only systems that need to access the process control should be connected to that network. We live in the world of stuxnet.

vogonj 15y ago
> What makes the web great is its constant change and innovation. How is it that a 2 person startup can deal with it's users changing browsers whenever they want, but a giant corporation can't? That two-person startup consists of two hackers who eat, sleep, and fucking breathe Web technologies. They have bookmarklets for six different sets of Web documentation, and they can quote chapter and verse from any of them. They work 18-hour days because they love their job. The giant corporation's line-of-business app team consists of an IT guy, an accountant who owns a couple of dogeared books on JavaScript, and maybe a couple of contractors. They work 8-hour days, only half of which is actually devoted to the application they're working on, and they don't care about standards as long as they can finish writing that Web app and get back to their actual job. I'm certainly exaggerating a bit, but the reason is because that giant corporation's business is almost certainly not writing Web apps for a living.

Tichy 15y ago

"Education programs, documentation updates, communications all are planned." Couldn't you just fire all employees who need education programs and documentation updates for a browser update? I know it sounds harsh and will get me downvotes, but think about it? Maybe there are legit employees who are unable to grasp a new browser. But maybe for them a full blown browser is the wrong solution anyway. Perhaps somebody should step in and create dummy browsers that only have a couple of buttons for the limited set of activities those users are capable of performing. Seriously: the point of apps with nice UI is to make documentation superfluous. So instead of creating documentation nobody wants to read, create apps that make the docs superfluous. It could be some kind of "browser generator".

pnathan 15y ago
One indeed might wonder at the people who need education programs for a browser. seriously, the only major ui innovation since netscape 2.x? 3.x? was the merging of url bar and search bar.
MKaply 15y ago
You're thinking about it wrong. There are support documents with screenshots, self-help videos and things like that. All these things have to be redone when there are major visual changes to the browser.