Slashdot Log In
Internet Users Not Updating Browser
Posted by
CmdrTaco
on Mon Jul 21, 2008 07:31 AM
from the but-it's-just-so-hard dept.
from the but-it's-just-so-hard dept.
Jackson writes "Security researchers from ETH Zurich, Google, and IBM Internet Security Systems have shown that more than 600 million Internet users don't use the latest version of their browser. The researchers' paper, shows that as of June 2008, only 59.1 percent of Internet users worldwide use the latest major version of their preferred web browser.
Suggestions have also been made to inform users that their browser is out of date."
Related Stories
[+]
Firefox Users Stay Ahead On the Update Curve 328 comments
Reader Alex links to news of a study comparing the currency and patch level of various Web browsers, excerpting:
"Firefox users were far and away the most likely to use the latest version, with an overwhelming 83.3 percent running an updated browser on any given day. However, despite Firefox's single click integrate auto-update functionality, 16.7 percent of Firefox users still continue to access the Web with an outdated version of the browser, researchers said. The study also revealed that the majority of Safari users (65.3) percent were likely to use the latest version of the browser between December 2007 and June 2008, after Safari version 3 became available. Meanwhile, Microsoft's Internet Explorer users ranked last in terms of safe browsing. Between January 2007 and June 2008, less than half of IE users — 47.6 percent — were running the most secure browser version during the same time period."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
How many of those users CAN upgrade? (Score:5, Interesting)
If you're running Win9x/2000, you can't upgrade to the latest version of Internet Explorer.
Re:How many of those users CAN upgrade? (Score:5, Informative)
Windows 9x users cannot use the latest version of Firefox either [slashdot.org].
Parent
Re:How many of those users CAN upgrade? (Score:5, Informative)
They can still upgrade to Opera, which supports down to Windows 95.
Parent
Re:How many of those users CAN upgrade? (Score:5, Funny)
Parent
Re:How many of those users CAN upgrade? (Score:4, Informative)
Neither can Vista users.
Both Firefox and Thunderbird refuse to update automatically under certain conditions (not running under Admin all the time as one of those conditions). Fixing it is more or less a PITA, too. I haven't done it yet, so I can hardly expect, for instance, my grandmother to do it.
Parent
Re:How many of those users CAN upgrade? (Score:5, Informative)
While Firefox 3 chose to abandon Windows 95 compatibility, Firefox 2 is still being patched and maintained.
Unlike the IE6 users of Windows 95, who no longer get MS patches.
Parent
Re: (Score:3, Interesting)
... not that I think this is at all the reason people don't update.
http://www.w3counter.com/globalstats.php [w3counter.com]
Windows 98 is listed as less than 1%.
And I'm pretty sure FF3 still works on Windows 2000 which just barely beats out Linux in popularity.
Re:How many of those users CAN upgrade? (Score:4, Informative)
And I'm pretty sure FF3 still works on Windows 2000 which just barely beats out Linux in popularity.
FF3 works in Windows 2000. I installed it last month on an older computer, and it is used daily as the default browser.
Parent
Re:How many of those users CAN upgrade? (Score:4, Insightful)
While Firefox 3 chose to abandon Windows 95 compatibility, Firefox 2 is still being patched and maintained. Unlike the IE6 users of Windows 95, who no longer get MS patches.
If you're running an OS thats 13 years old, you have much bigger issues than running the latest web browser.
Parent
Re:How many of those users CAN upgrade? (Score:5, Informative)
Parent
Re: (Score:3, Informative)
I would have assumed that Windows ME users were pretty much screwed from the beginning.
As I recall, current versions of Firefox 2 will still run on anything newer than Windows 95. It's just the 3.0 branch which dropped support for 98 and ME.
Re:How many of those users CAN upgrade? (Score:5, Insightful)
Firefox 2.0 is just as current as 3.0, and will be until the end of this year. Anyone who says differently is selling something.
Parent
Re:How many of those users CAN upgrade? (Score:4, Interesting)
There are other reasons not to upgrade to Firefox 3 - in particular, my company has production code that uses something like div_element.offsetParent.offsetTop (variable name changed intentionally to protect the guilty) without checking first to see if offsetTop is null (this is used to get the height in a browser) and Firefox 3 javascript crashes and burns but no other browser has a problem with it (of the four we support).
Our official policy is that Firefox 3 is not supported, meaning every single one of our customers needs to either use Firefox 2 or a different browser until we do certification on it (which I believe isn't even planned for this year due to other scheduling needs). I have notified the people in charge of that javascript, so it potentially could be fixed/patched beforehand, or if it's a FF3 bug, the Mozilla team will get notified - I'm not the author or maintainer and have no power to change that code.
Parent
Re:How many of those users CAN upgrade? (Score:5, Informative)
Who in their right mind have a computer online with Windows 95/98 or ME on it?
Someone whose business applications only run on Windows 95/98 or ME, and either there is no upgraded version of it (maybe the vendor went out of business) or the upgrade doesn't convert the old data, or doesn't have a feature being used, or otherwise isn't workable.
Parent
That's what emulators are for. (Score:4, Insightful)
Someone whose business applications only run on Windows 95/98 or ME
...can run existing Windows 95/98 or ME licenses in a virtual machine.
Parent
Re: (Score:3, Interesting)
Dare I ask why? Unless you know of some security vulnerability in Win 9x's TCP/IP stack, I'm not sure what would be the problem in running Opera 9.51 on Windows 9x. Should you use outdated flash plugins, java plugins, etc? No. But you don't *need* those to browse the web (and odds are good that if you're running Win 9x, you're using a machine that wouldn't work well with the latest flash/java apps anyways
Re: (Score:3, Insightful)
How many are IE6? (Score:5, Informative)
I wonder how many of those are IE6, which a lot of people use because they CAN'T upgrade to IE7.
And as an above commenter pointed out, I highly doubt they factored in that some OS's can't actually run the latest version of their browser.
Re:How many are IE6? (Score:4, Interesting)
I wonder how many of those are IE6, which a lot of people use because they CAN'T upgrade to IE7.
Can't? More like won't for me.
I really don't know what it was. May its the fact that IE7 always ran sluggish for me or the fact that Firefox and Opera run so much quicker and with fewer crashes.
IE7 was my last straw when it came to Microsoft applications.
Parent
Re:How many are IE6? (Score:5, Informative)
Even if you do not explicitly use Internet Explorer for browsing, you should upgrade it as it is a core part of the Windows Kernel.
Internet Explorer it is used behind the scenes in many places; the eye-candy interfaces of most Norton products, for example, runs on the IE engine.
Not that I recommend Norton products, still...
Parent
Re:How many are IE6? (Score:5, Insightful)
Even if you do not explicitly use Internet Explorer for browsing, you should upgrade it as it is a core part of the Windows Kernel.
That is another part about IE that I have issues with. Why make a web browser part of the OS? It makes very little sense. It should, at most, be a bloated application that I could uninstall at whim. But no! It has to totally screw with everything else. As it is now, I specify Firefox as the default browser and disable access to IE. It doesn't matter which version of IE, I'm still not using it.
Not that I recommend Norton products, still...
Thanks to a run-in with their overly-aggressive virus scanning process (that can't be turned off) I no longer use Norton home products. Their corporate/enterprise software that I use at work is waaaaaay better.
Parent
Re: (Score:3, Informative)
Every version of Internet Explorer in recent history has exported a COM interface. This makes it trivial for a Win32 developer to add web rendering support to an application - you just hook the interfaces Internet Explorer provides, and *bam!* HTML rendering!
This is why it's difficult (and why you're not "supposed" to) remove Internet Explorer - a lot of applications use it, even if it's just one function call to process a blue hyperlink in their help-about.
That's also why it's a good idea to upgrade it.
So a better title would be.. (Score:5, Insightful)
And these same users are probably happily using windows 98 on their Pentium II's, and don't give a damn about having the most shiny, newest toy.
Maybe they *can't* upgrade (Score:5, Insightful)
Large numbers of corporate users are at the mercy of the IT department's update/upgrade schedule. In my environment, there are a large number of applications that will break if IE7 is installed, and the schedule to update and test those dependencies is lengthy.
Furthermore, we've spent so much time training users to ignore messages that say "Your $FOO is out of date! Click here to install the latest version because it's almost always malware, and now you want to turn around and do the exact opposite?
Re:Maybe they *can't* upgrade (Score:5, Informative)
If using a different Web browser to access a server causes it to crash, you have more serious things to worry about, like finding another vendor that doesn't write software that takes down your server when it's accessed in a perfectly reasonable manner.
Parent
Re:Maybe they *can't* upgrade (Score:4, Insightful)
Wait, your server is so bad that is crashes when it's accessed by Firefox?! And you're blaming FIREFOX for that?!!
Parent
Firefox vs. IE (Score:5, Insightful)
If you have automatic updates turned on in Windows, they automatically update as well.
However, most people I know turn off automatic updates because it can be so obnoxious. Many folks also disable the BITS service because of the process overhead it chews up.
It's the difference between being a virtually seamless integration (like Firefox) or an overly-obtrusive integration that eats up system resources.
For instance - firefox tells you when you go to close the program that there are updates ready. Microsoft pops a little icon that #1 interrupts what you are doing #2 may very well crash the machine or lock it up if it happens while you're playing a game, etc. Remember that letter Gates sent about usability? It's the key in this case, I think.
I also wonder if this took business users into account - I can't update because my IT department won't let me. I doubt that would be different if we were using Firefox or Opera rather than IE.
Re: (Score:3, Informative)
Actually, I'm trying to figure this out on my mac. Last night I got the update popup. I clicked yes and realized I was not an admin. I waited for it to prompt me for my admin user/pass or just error out, but it said it completed successfully.
I'm really confused.
Re:Firefox vs. IE (Score:5, Interesting)
Noscript is ridiculous... I mean, it's not like ad-block where advertisers find new ways to annoy you and ad-block has to find a way to counter it; nocscript simply disallows running scripts... is it that bad that there's three new versions a week?
The answer is no... from what I read elsewhere, noscript updates take advantage of a flaw in computing the popularity of plug-ins by continuously updating so that they always get ranked at or near the top.
Parent
Only 59.1%? (Score:5, Insightful)
Yeah, but (Score:5, Funny)
Any idea... (Score:3, Insightful)
How many FF2 users just hate "AwsomeBar"?
Last I checked, FF2 security updates were still being pushed automatically, so what's the big deal about using 2.x over 3.0?
Re:Any idea... (Score:5, Insightful)
Awesome Bar was a feature I wasn't even aware of until FF3 went gold, but it was as appreciated and innovative as it was unexpected. Words are for people, DNS names are for computers.
Parent
Browsers at work (Score:3, Insightful)
What about your browsers that are provided by your IT department of your company?
I work in pretty large company and our IT dept. have disabled auto-updates from XP, Firefox and so on. Then they push updates to users when needed.
Above works fine in my company, but what about those companies with similar policies and non-existing or incompetent IT department? Browsing tubes all day long with old versions.
A good chuck of that 52% is corporate policy. (Score:5, Interesting)
The IT drones at my employer rigidly demand that all company machines must run IE6. They've coded all their intranet applications solely for that version and by god they will not budge. Firefox is forbidden as a "security risk" and no where to be seen is IE7. Fortunately for me I work on Linux based projects and and run what I please.
Murphy Was an Optimist (Score:3, Interesting)
no Firefox-3.x (Score:3, Insightful)
Firefox-2.0.0.16 with NoScript and without any plugins - for general purpose web browsing...
Seamonkey-1.1.11 with all the plugins, flash, java & mplayerplug-in - used only at trusted websites and only when there is media I want to see (used rarely) and Seamonkey for email too (I dont like thunderbird enough to use it)...
I don't really like Firefox-3.x because of the way it is being developed which is starting to look like feature creep is going to bloat it up, I would like to see it forked and have the fat trimmed off of it more, make it like dillo only better, if I was a clever code monkey genius I would grab the source for Firefox-3.x and fork it myself and trim it down to something like Firefox-1.x or 2.x (or a little leaner)...
Boring "security" (Score:4, Interesting)
- encryption
- steganography
- signatures
- passwords and
- access control lists.
That is cool maths and tech. Stuff that matters. How disappointed I get when the "security researchers" write about, not interesting security measures, but just how the security is implemented. Boring, that's sociology! Making sure your users use secure software is important and all, but it's not something I want to read about on Slashdot. I want my old geeky Slashdot back!
I am not going to upgrade to Fire Fox 3 (Score:3, Insightful)
Opera users have upgraded, then reverted to 9.27 (Score:3, Insightful)
It depends on the browser. (Score:5, Interesting)
Within days after the release of Firefox 3, over 40% of my visitors
had switched to it. Another ~50% use the newest 2.0.x version.
Conclusion:
It makes a huge difference if the user is aware of existing choices and has
actively chosen a certain browser (i.e. installed something other than the default).
Also, Firefox' autoupdate mechanism works very well.
I cannot say anything about IE users - they make for less than 0,2% of my hits
Also, I don't claim to have representative numbers for the "general Mozilla crowd",
as my target audience are the more tech-savvy.
hmm, let's see... (Score:5, Funny)
in a manner of speaking.
Wait for native video/audio support... (Score:3, Interesting)
Corporate users (Score:4, Informative)
Re:No point in updating IE6 (Score:5, Insightful)
Please, for the love of all that's holy, upgrade to IE7.
Once IE6 installations get down below a certain point, we won't have to spend crazy amounts of time rewriting web pages so they *also* work in IE6.
Parent
Yes there is a point (Score:5, Informative)
Not upgrading to IE7 because you don't "use" it is dangerous. Because, as you mentioned, IE is closely integrated into the operating system, its components can be used by other applications regardless of whether you click the blue 'E' icon or not. Any Windows application that has the ability to handle HTML content is likely to use some IE components. So if IE is not fully up to date, these other applications can put you at risk.
So, for example, vulnerabilities that only affect IE6 may affect other applications that use the relevant IE components for HTML rendering (think email, IM, etc.). Such as:
http://www.kb.cert.org/vuls/id/923508 [cert.org]
Or, even better... A recent Safari for Windows vulnerability:
http://www.kb.cert.org/vuls/id/127185 [cert.org]
Safari, a "stand-alone" web browser, is actually at a higher risk on systems with IE6 as opposed to IE7.
As with any software on your computer, you should upgrade it whether you *think* you use it or not.
Parent
Re:What do you expect? (Score:4, Insightful)
Parent
Re:Do they count IE 6.latest or FoxPro 2.latest? (Score:5, Insightful)
If they say "IE 6.latest" or "Foxpro 2.latest" doesn't count as "latest" and those versions have no known unpatched vulnerabilities not shared by IE 7.latest or Foxpro 3.latest then they aren't counting properly.
I agree. dBASE III works just fine for me, and I see no reason to update to dBASE IV when Ashton Tate currently provides the same level of support for both.
Parent
Re: (Score:3, Informative)
Suggestions have also been made to inform users that their browser is out of date.
Why? I know I run an out-of-date browser (FF1.5), and just don't care.
Well, you should [mozilla.org].
Most of those issues are present in earlier versions as well, as stated on the vulnerabilities page for 1.5
Have a look at http://www.mozilla.org/security/known-vulnerabilities/ [mozilla.org] - and have fun browsing on with your sieve.
Re: (Score:3, Insightful)
...and when Firefox 5 is out, people will say the same about Firefox 3 users. "OMG security vulnerabilities have fun browsing on your sieve."
People said the same thing about 1 vs 1.5 as well. You HAVE to upgrade to 1.5 because it's the secure version and it doesn't have all those security holes.
What's the difference?
Is that a serious question?
Did you look at the links I gave?
Time is the difference. Those lists list known vulnerabilities. They are in those versions of Firefox, and some are actively exploited by malicious websites, right now.
Those lists get longer with time due to exposure of the software to a curious public. I can guarantee you that a lot of the unknown vulnerabilities in Firefox 3 will have become
very well known ones by the time Firefox 5 will be out.