3 ms·

What sort of company do you work at where you can't prod your users to upgrade their browsers? Surely this is a security risk. I'm at a company of 100k employee

What sort of company do you work at where you can't prod your users to upgrade their browsers? Surely this is a security risk. I'm at a company of 100k employees and our small team has no problem telling users they need to upgrade.

eyelidlessness 4y ago
> 100k employees and our small team I’m almost afraid to ask, but what do you think is a large team?
- zrobotics 4y ago
  My guess is they are a small internal team and their users are company employees. Otherwise, I can't imagine another scenario where that statement makes sense.
  - CSSer 4y ago
    It’s a bit odd though, because I’ve heard plenty of stories with those conditions where that’s still not true. One example is bank software that must run on IE11 because IT refuses to upgrade the equipment and security isn’t a priority because it’s airgapped or something silly like that.
    - KyeRussell 4y ago
      I’m just going assume that they don’t have much variety of experience under their belt.
stereocodes 4y ago
What are talking about? Most companies don't do this. Talk about a bubble.
- CSSer 4y ago
  Maybe it’s sarcasm? On the other hand, the new school does have it pretty good these days with the evergreen browsers, so it could be genuine lack of perspective. Webkit is stubborn and slow moving, but nothing like what we endured with IE, especially since polyfills were not a ubiquitous concept and checking for feature support at runtime was a kind of dark art. I shudder just thinking about user agent strings again. If anything, my daily dose of strange BS these days comes from imposed third-party SaaS vendors rather than browser interop even when accounting for older versions of Safari.
- ihateolives 4y ago
  We force updates when users have not updated their browser by deadline. Security updates are not optional here.
- acdha 4y ago
  Most organizations with any sort of audit, insurance, or regulatory requirements do. Updating software is one of the most basic things covered by any security benchmark.
  - zelphirkalt 4y ago
    Maybe internally. If done externally, extorting your users to update their stuff, then it is clearly overstepping the boundaries. Creating awareness is good and necessary, but insisting on another entity, be it a user or another company doing something, because it is in your company's security benchmark, is inappropriate. Quickly silly things, that have no security benefit at all make it into that benchmark and are tried to be forced upon other entities. Suddenly a company will be interested in how you internally handle your SSH keys. Do you make new ones every 3 months? No sorry, every 4 months is too long for our security benchmark.
    - acdha 4y ago
      The possibility of something being done poorly doesn’t mean that it can’t be done more thoughtfully. For example, most banks will refuse to let you do online banking using IE6 or SSLv3 and pretty much everyone is okay with that because the risks are obvious. That’s always the tradeoff you have to make since you’re balancing the benefits to the user and cost of development - customers do benefit if you can ship better things faster because you’re not held back by discontinued browsers. <dialog> might not be there quite yet but it’s close and if you already don’t support IE11 there’s an obvious appeal.
thayne 4y ago
In the case of safari, upgrades are tied to OS updates, so upgrading may require updating the entire OS, and in the worst case might require the user to buy a new phone.
motoxpro 4y ago
If people can use the entire web in their eyes without having to update their browser (which they can because they haven't had to update yet) EXCEPT for my site, why am I so specially that they need to update specifically for me? Bad UX. Or maybe you're in an industry where it is your job to secure users computers.
- colordrops 4y ago
  Your last sentence isn't some side note. It's critical. Any browser over a year old is going to be riddled with security issues.
squeaky-clean 4y ago
Most shopping websites or social media come to mind. I use to work in airline web contracting and when doing work for certain countries' national airline booking systems we had to support ie6 until 2019 (gmail had dropped support in 2010 and Microsoft officially EOL'd it in 2016)
- ihateolives 4y ago
  > certain countries' national airline booking systems Korea?
- dmitriid 4y ago
  There are also government sites which really need to support all browsers since time immemorial because many people will access them from old and outdated devices.
- colordrops 4y ago
  The user I was responding to indicated it was internal users though, not a public website.
withinboredom 4y ago
I have a newish MBP from 2018. It’s still fast as hell and reliable. I can’t upgrade the OS because it is not supported. I don’t use Safari, but I’m sure there are people out there using a perfectly fine computer that Apple has dropped support for.
- tomasf 4y ago
  Hmm. Which MBP is that? As far as I can tell, even the oldest and slowest MBP from 2018 can run Ventura.
  - withinboredom 4y ago
    Nope. Says it’s not supported when I try to install it. It doesn’t give a reason though. It’s a maxed out Intel unit from 2018, it’s not listed as a supported model for Ventura. When I get home I can get the model number.
- worksonmine 4y ago
  Is there a valid reason for this? Like their code not running on the hardware anymore or is it just for profit? Do you at least get security updates? Some kid somewhere digs up a rock under gunpoint and we're expected to throw it out as soon as something shinier comes along, disgusting. It's because of companies acting like this we need regulations on support and right to repair.
- JimDabell 4y ago
  Ventura supports all MacBook Pros from 2017 onwards: https://support.apple.com/en-sg/HT213264 https://support.apple.com/en-sg/HT213264 As far as I can see, the only possibility for buying a new MacBook Pro in 2018 that can’t run Ventura is if you bought the MacBook Pro Retina (Mid 2015) model, which wasn’t discontinued until mid-2018. All the older MacBook Pros that can’t run Ventura were discontinued in 2017 or earlier: https://en.wikipedia.org/wiki/List_of_Mac_models#2015 https://en.wikipedia.org/wiki/List_of_Mac_models#2015 I think Ventura not supporting a model released more than seven years beforehand is a reasonable cut-off point. But if there are people who want to use an older model with a newer browser, they can use Firefox or Chrome.
realusername 4y ago
On a normal system you can update the browser but on iOS you are stuck with the one coming with the OS version you have, you can't really tell them to update their browser because that's not feasible (and yes it's a security risk but there's nothing you can do about it).
- deleted 4y ago
  [deleted]
- scarface74 4y ago
  Apple recently released “security updates” for the iPhone 5s - released in 2013.

eyelidlessness 4y ago

> 100k employees and our small team I’m almost afraid to ask, but what do you think is a large team?

zrobotics 4y ago
My guess is they are a small internal team and their users are company employees. Otherwise, I can't imagine another scenario where that statement makes sense.
- CSSer 4y ago
  It’s a bit odd though, because I’ve heard plenty of stories with those conditions where that’s still not true. One example is bank software that must run on IE11 because IT refuses to upgrade the equipment and security isn’t a priority because it’s airgapped or something silly like that.
  - KyeRussell 4y ago
    I’m just going assume that they don’t have much variety of experience under their belt.

stereocodes 4y ago

What are talking about? Most companies don't do this. Talk about a bubble.

CSSer 4y ago
Maybe it’s sarcasm? On the other hand, the new school does have it pretty good these days with the evergreen browsers, so it could be genuine lack of perspective. Webkit is stubborn and slow moving, but nothing like what we endured with IE, especially since polyfills were not a ubiquitous concept and checking for feature support at runtime was a kind of dark art. I shudder just thinking about user agent strings again. If anything, my daily dose of strange BS these days comes from imposed third-party SaaS vendors rather than browser interop even when accounting for older versions of Safari.
ihateolives 4y ago
We force updates when users have not updated their browser by deadline. Security updates are not optional here.
acdha 4y ago
Most organizations with any sort of audit, insurance, or regulatory requirements do. Updating software is one of the most basic things covered by any security benchmark.
- zelphirkalt 4y ago
  Maybe internally. If done externally, extorting your users to update their stuff, then it is clearly overstepping the boundaries. Creating awareness is good and necessary, but insisting on another entity, be it a user or another company doing something, because it is in your company's security benchmark, is inappropriate. Quickly silly things, that have no security benefit at all make it into that benchmark and are tried to be forced upon other entities. Suddenly a company will be interested in how you internally handle your SSH keys. Do you make new ones every 3 months? No sorry, every 4 months is too long for our security benchmark.
  - acdha 4y ago
    The possibility of something being done poorly doesn’t mean that it can’t be done more thoughtfully. For example, most banks will refuse to let you do online banking using IE6 or SSLv3 and pretty much everyone is okay with that because the risks are obvious. That’s always the tradeoff you have to make since you’re balancing the benefits to the user and cost of development - customers do benefit if you can ship better things faster because you’re not held back by discontinued browsers. <dialog> might not be there quite yet but it’s close and if you already don’t support IE11 there’s an obvious appeal.

thayne 4y ago

In the case of safari, upgrades are tied to OS updates, so upgrading may require updating the entire OS, and in the worst case might require the user to buy a new phone.

motoxpro 4y ago

If people can use the entire web in their eyes without having to update their browser (which they can because they haven't had to update yet) EXCEPT for my site, why am I so specially that they need to update specifically for me? Bad UX. Or maybe you're in an industry where it is your job to secure users computers.

colordrops 4y ago
Your last sentence isn't some side note. It's critical. Any browser over a year old is going to be riddled with security issues.

squeaky-clean 4y ago

Most shopping websites or social media come to mind. I use to work in airline web contracting and when doing work for certain countries' national airline booking systems we had to support ie6 until 2019 (gmail had dropped support in 2010 and Microsoft officially EOL'd it in 2016)

ihateolives 4y ago
> certain countries' national airline booking systems Korea?
dmitriid 4y ago
There are also government sites which really need to support all browsers since time immemorial because many people will access them from old and outdated devices.
colordrops 4y ago
The user I was responding to indicated it was internal users though, not a public website.

withinboredom 4y ago

I have a newish MBP from 2018. It’s still fast as hell and reliable. I can’t upgrade the OS because it is not supported. I don’t use Safari, but I’m sure there are people out there using a perfectly fine computer that Apple has dropped support for.

tomasf 4y ago
Hmm. Which MBP is that? As far as I can tell, even the oldest and slowest MBP from 2018 can run Ventura.
- withinboredom 4y ago
  Nope. Says it’s not supported when I try to install it. It doesn’t give a reason though. It’s a maxed out Intel unit from 2018, it’s not listed as a supported model for Ventura. When I get home I can get the model number.
worksonmine 4y ago
Is there a valid reason for this? Like their code not running on the hardware anymore or is it just for profit? Do you at least get security updates? Some kid somewhere digs up a rock under gunpoint and we're expected to throw it out as soon as something shinier comes along, disgusting. It's because of companies acting like this we need regulations on support and right to repair.
JimDabell 4y ago
Ventura supports all MacBook Pros from 2017 onwards: https://support.apple.com/en-sg/HT213264 https://support.apple.com/en-sg/HT213264 As far as I can see, the only possibility for buying a new MacBook Pro in 2018 that can’t run Ventura is if you bought the MacBook Pro Retina (Mid 2015) model, which wasn’t discontinued until mid-2018. All the older MacBook Pros that can’t run Ventura were discontinued in 2017 or earlier: https://en.wikipedia.org/wiki/List_of_Mac_models#2015 https://en.wikipedia.org/wiki/List_of_Mac_models#2015 I think Ventura not supporting a model released more than seven years beforehand is a reasonable cut-off point. But if there are people who want to use an older model with a newer browser, they can use Firefox or Chrome.

realusername 4y ago

On a normal system you can update the browser but on iOS you are stuck with the one coming with the OS version you have, you can't really tell them to update their browser because that's not feasible (and yes it's a security risk but there's nothing you can do about it).

deleted 4y ago
[deleted]
scarface74 4y ago
Apple recently released “security updates” for the iPhone 5s - released in 2013.