Firefox Users Stay Ahead On the Update Curve

Reader Alex links to news of a study comparing the currency and patch level of various Web browsers, excerpting: "Firefox users were far and away the most likely to use the latest version, with an overwhelming 83.3 percent running an updated browser on any given day. However, despite Firefox's single click integrate auto-update functionality, 16.7 percent of Firefox users still continue to access the Web with an outdated version of the browser, researchers said. The study also revealed that the majority of Safari users (65.3) percent were likely to use the latest version of the browser between December 2007 and June 2008, after Safari version 3 became available. Meanwhile, Microsoft's Internet Explorer users ranked last in terms of safe browsing. Between January 2007 and June 2008, less than half of IE users — 47.6 percent — were running the most secure browser version during the same time period."

This makes sense

[The Ancients]

It's rational fear of the unknown.

I've never had a Firefox or Safari issue toast my machine. I've had IE updates do it twice before (on different machines).

I just don't see how a browser can cause such mayhem to the OS - considering it's the browser that supposedly runs inside the OS, and not the other way around.

Well ok, I can. To rephrase: I don't see how a browser should cause such mayhem to the OS.

Well jeeze, you guys!

[iminplaya]

If I spend all my time keeping up with upgrades, I won't have any time left to actually use my damn computer. And sometimes an older version works better for me. All that automatic crap is turned off. My disks are backed up...I think... I'll upgrade if something breaks. I hope you're ok with that.

What has single click got to do with it?

[LesFerg]

I'm not sure why they couldn't have the update option for version 2.xx at least offer the option to update to version 3. It just kept telling me there were no new updates available. I wouldn't call it 'single click' at all.

Re:Likely business users skew the results.

[barista]

An organization affiliated with ours has some web apps that only work with IE6, so I leave that on most machines in our department. It was over a year after IE6 came out before they supported that, so I figure it is a matter of time before they support IE7...probably when IE8 comes out. Many of the users in my department wouldn't know what their default browser is if I asked them. They would say it's, "the Internet". All they know is whether it works or not. If it works, that's all that matters.

FWIW, this type of situation might be one of the (many) reasons why Vista hasn't been widely deployed in enterprise (not as widely as XP, anyway). I don't think IE6 is available for Vista, so apps that don't work with IE7 would give some companies yet another reason to think about holding off on deploying Vista.

Re:Push

[Thiez]

AC makes no sense. Assuming it takes users some constant time C to update, and all users update theri browsers (big assumption...), then with two updates per week, users will run the latest version of the browser 1-C/7 of the time. With updates twice per month, users will run with the latest version 1-C/30 of the time. Obviously C/7 > C/30 therefore if you update less often users will be up-to-date more often.
That firefox users are up-to-date 83-ish% of the time is MORE, not less, impressive because Mozilla pushes out a fix for something about twice a week.

Re:Trust

[martin-boundary]

I'm not in favour of auto-update type features for software. IMHO, it's much better if the updates are integrated directly with the system package manager, so that all the software on a computer can be upgraded consistently and regularly.

If users are asked to upgrade their software shortly after they've launched it, it's firstly an annoyance, but secondly it means that the software they don't launch regularly won't get updated regularly, and other software which might need to interoperate will fall out of sync with the new version.

Perhaps it's time to define a standard package manager API (not a standard package manager, just an API available in all major languages), before we get a culture where every piece of software manages its own updates interactively?

Stop making it optional

[linzeal]

Firefox developers heed my call. Stop making security updates optional past a certain version.

Web developers heed my call. Stop making websites accept security corrupting browsers because half the time they are pry zombies. Look at your logs and see the rate at which these computers increase revenue. Drop them at whatever delta you think prudent.

Corporate policy?

[ZipOtter]

I wonder how much of that 47.6% figure is due to corporate IT departments refusing or unable to roll out newer versions of IE. I work on a fairly popular european website, with close to half of its IE users (around 25% total) still using IE 6. Site usage spikes around noon with a sharp dropoff on the weekend, suggesting that people browse it from work. So I did a quick internal survey in my (tech) company and found that outside of IT and Software Development, almost everyone was still using Windows 2000, which of course doesnt't get IE 7+. It's a shame, really. As a web developer, I hate IE 6 with a burning passion but it's not going away until MS activates the secret killswitch in W2K in a desperate attempt to get people to switch to Vista...

Re:IE7 is not installed with automatic updates

[Repossessed]

IE7 was rammed down most of the populations throat with an automatic security update a while back, though it has the graces to not try to install it again if you say no to the IE7 license agreement. I'm also not sure if this happened before the start of the study.

Re:Usual drivel

[Gnavpot]

When Microsoft has shit flashing on the screen automatically to remind you to do updates, it's evil intrusion in to one's privacy. But when Firefox does exactaly the same thing, they're God's gift to enlightenment.

I would wish that Firefox had shit flashing on the screen automatically.

Unfortunately, it only does so if I run Windows as a user with administrative privileges or have Firefox installed in an alternate location where I have write access.

As a limited user, I don't even get a message that it is time to login as an administrator to get the newest update.

I wonder how many of those 16.7 % are actually among the few of us who have their Windows user account configured correctly.

I find it disturbing that a browser which is being marketed as a safe browser has an update mechanism which relies on an unsafe Windows configuration.

(Disclaimer: Somewhere around 2.0.0.12 I granted myself write access to the FF directory, and now I get the updates. So the problem described above may have been solved since then without me noticing.)

Re:easiest to update means it gets updated

[Anonymous Coward]

For at least some of those cases, the reason why we don't update is because Firefox doesn't tell us when an updated version is available when we're running as limited users (i.e. not root). I don't know how it works on other OSes, but in Windows XP, if you don't have write access to the Firefox directory, it won't even notify you that an update is available. Sometimes I don't find out until a month or two after the update is released that it even exists. It's ironic that a user who tries to run more securely gets left out of security updates.

Now that FF3 is out, I've got a dilemma because of this. One of my systems is staying FF2 for the time being, but there's no way I can find out if a new version of FF2 is out since the Mozilla products page doesn't list the latest 2.x version anymore.

Re:Usual drivel

[Anonymous Coward]

i know the feeling, dont know how many times the PC at work rebooted during the night to install some patches without any approval.

It's even rebooted due to this when it should notify when patches where available, so now it's disabled to even check for new patches. Seems like there was some "this critical patch should be installed and the user cannot choose" override. If i only had a choice with what OS i could run at work :P

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:Trust

[DigitAl56K]

When Mozilla sends out a buggy update, which has happened twice to my memory, a) it doesn't cripple the entire system, and b) there's a new version the next day. This goes back to my personal definition of trust: I don't necessarily expect a software vendor to be perfect 100% of the time. That's unrealistic. But I expect mistakes to be infrequent, non-severe, and for them to correct them quickly so that I'm not inconvenienced too much.

OTOH when Microsoft sends out a buggy update you have to keep your fingers crossed for something to be available in a few weeks. I don't want to come across as anti-Microsoft, but realistically that's the difference between the two in my experience.

fanbois

[thc4k]

I think this just shows that firefox user are, just like my fellow opera users, just a bunch of browser fanbois. Hell, i even run weekly snapshot builds of opera for no reason. IE users dont care about the browser in the first place, Safari isn't something Mac users chose to use because it's so great either. So why would they bother updating all the time?
So in conclusion, this study shows: If you chose to use some special software, you will update it when you use it. Big suprise ...

Re:Usual drivel

[hedwards]

Um, Windows, OS X, Linux, *BSD and pretty much every OS ever have required command line knowledge to make the most of things.

Realistically, the biggest problem with Windows is that there's so much stuff there that is just available through the CLI and isn't particularly well publicized.

Things like robocopy are far more useful than the GUI tools, and in most cases don't even have a proper GUI equivalent.

Re:Understandable

[BradleyUffner]

There is an option in the group policy manager you can apply locally by running gpedit.