Hacker News Reader

Comment by jrowley | Hacker News Reader

Why would your employer fix you to a specific version of chrome? Thats bizarre.

Never underestimate the degree to which enterprise IT departments view change as something to be feared. I once heard someone say that they wanted to delay Chrome updates until their security team could review them — said review process basically being waiting in a backlog for weeks and then someone searches for CVEs posted on that version.

> Never underestimate the degree to which enterprise IT departments view change as something to be feared.

This. These supposedly risk-averse organisations also have no concept of the risk of stasis, only the risk of change.

I worked with a Government group that firmly rejected the concept of Windows security updates.

The general premise was, if you apply an update and something breaks (note that "changed behaviour" means "broken"), someone's head will roll. If you do nothing and get compromised, it's those damned <country> hackers again.

> Never underestimate the degree to which enterprise IT departments view change as something to be feared.

Never underestimate the management's ability to fire a Enterprise IT workers for applying an update that the developer's swear changes no behavior in the companies enterprise software, but actually does.

// been on both sides, we suck at testing and risk assessment in this profession

Definitely — when you see people afraid to do something, that almost always indicates a deeper organization problem.

Large companies tend to be bad at keeping up-to-date. I know of a bank that still uses OpenOffice. No, not Apache OpenOffice: they still use the real OpenOffice.org.

Workstations are often locked down, so employees can't install or upgrade anything.

A friend of mine working for the government told me that in one major government agency, the most popular version of IE used on their website is IE11.

The second most popular version? IE 6. Not even 8. IE 6.

Who still uses it? Employees of other government departments...

Yeah… just a reminder: IE6 was released in August 2011.

No it wasn't... It was released in 2001

A little earlier than that: August 2001.

Can I blame bitrot? Yes, thanks, of course I meant 2001.

For a sense of just how long ago that was, IE6 was released before 9/11. Truly a more innocent time.

2001, not 2011. Time flies. :)

While this is plausible for the past, I think this info is outdated now. https://analytics.usa.gov has lots of data on this (and you can break it out by agency using the dropdown at the top). It also estimates that only 5% of data comes from federal networks.

(Disclaimer: I work on analytics.usa.gov.)

I didn't say US Government. Australia :)

We should have analytics.dto.gov.au.

It's open source. ;) https://github.com/18f/analytics.usa.gov#analyticsusagov

https://www.dto.gov.au/blog/building-better-services-with-an...

I would hope that they are using IE11 set to IE6 compatibility mode. My employer has an application that requires IE5 compatibility mode.

This is because some project once created an internal application with a web interface, which was tested with IE6. This application may be critical to keeping people happy (e.g. the HR system) or some unqualified bozo may want to 'cut costs' like updating apps to new browsers, so mandates sticking to a 'stable' version like IE6. And all future apps will have to target IE6 forever more...

It gets worse... People write apps that use Flash (online training) or Java applets.

There are solutions to this, but none of them involve using the one true SOE, one SOE to rule them all!

Even if the employee can update it themselves, it is often prohibited, and fixing a vulnerability is treated as unauthorized installation of software, which is clearly against the terms of employment when using company computers. Whether they treat it as a big deal or not depends on who is involved, of course.

Java applets! I know a government department that'll be stuck on Chrome 44 for a looong time.

Someone could make a mint selling a Java applet runner to government agencies.

I (anecdote) know a country- sized governamental system that sticks to specific versions of Firefox. Not chrome or edge or IE or Safari or... Just Firefox. Specific versions. With some big lag when new versions of Firefox come out.

Companies and citizens, live with that.

Firefox has the ESR release for this purpose.

Yes, thanks for this information.

But sadly no, they don't follow this kind of stable release.

Yes, yes it is.

Reply on news.ycombinator.com