Hacker News Reader

Comment by rockwotj | Hacker News Reader

Wish I could use this, but Safari only started supporting this as of 15.4, which was released less than a year ago. I'll likely have to wait another 2-3 years until our site stops seeing these older Safari browsers.

EDIT: looks like Firefox released support around the same time, but my company's Firefox users seem to be all be ok more recent versions.

View on HN

Surely there is a polyfill you can use?

https://github.com/GoogleChrome/dialog-polyfill

Luckily I've never had to bother with supporting Safari, but isn't one of the only good things about dealing with it that customers generally update Safari relatively quickly?

I don't really understand the Safari release schedule myself (browser updates only seem to come with combined operating system updates?) so I don't know what's keeping users from updating their browsers. Are these Apple users all running vulnerable browsers for some reason?

I find it nice that Safari <15.4 is still considered a valid target for your company, given that its market share is about that of Firefox (https://caniuse.com/usage-table). Must be hell to develop for, though.

Perhaps the upcoming inclusion of non-Safari browsers on iOS will help users stuck on old versions of the OS use a normal browser so these problems can go away. Chrome and Edge manage to release monthly updates that almost everyone installs so hopefully that option comes available to iOS users as well.

1. How do you get away with not supporting the second-most popular browser? [1]

> help users stuck on old versions of the OS use a normal browser

Funny, iOS tends to be upgraded further back (ie support older devices), and faster [2], than (say) Android [3], because Apple is aggressive about updating users.

[1] https://gs.statcounter.com/browser-market-share

[2] https://gs.statcounter.com/ios-version-market-share

[3] https://gs.statcounter.com/android-version-market-share

If you're developing a desktop browser app for a non-English speaking market, you can ignore Safari oftentimes.

E.g. in Germany desktop Firefox has roughly double the market share of Safari.

But supporting mobile Safari usually gives you desktop Safari support for "free". Not many first world markets you can ignore Safari mobile in.

If you cater to the Windows-heavy corporate market, and if your software is meant to be used at a desk, the market share of Safari goes down to 0%.

This. Why is there not a billion devices using QQBrowser or something other obscure at place two? Mobile IMHO is different - not every website will work.

Which really sucks on iPads, because not real free adblockers, faulty SVG rending in safari for a project I ran two years ago, and less support for browser features (PWA features mostly, so classical web often kinda works) makes browsing the web with touch often easy, yet very hard, when something is broken or nagging.

Don't these corporate people all have iPhones and want to quickly take care of something while on the run?

Depends on the industry and use-case. Some line-of-business apps might be designed without caring about any mobile/responsive usage. Others might be meant to be used at a specific workstation that has a computer as part of it (for example, the app might be controlling some equipment), or in some other environment in which mobile usage makes no sense.

Luckily, the corporate people usually only need to view the marketing site on their phones!

> 1. How do you get away with not supporting the second-most popular browser? [1]

Not speaking for the OP, but the internal tools I work on only supprt Chrome - you can only login to these systems using Single Sign On, which is only possible to login via Chrome (Google SSO). Makes devving loads easier!

> 1. How do you get away with not supporting the second-most popular browser?

Quite easily: desktop SaaS web application; no Macs in the office and no interest in buying them specifically for iOS; no customers using Macs. Also, Safari works Well Enough (TM) for people not to complain about the minor CSS offsets and if they do they can always install Firefox. I don't work there anymore, but I doubt any customer will even try to switch to Macs in the next five years.

For my personal use cases: if my site doesn't work on Safari, I can't legally test it on any of my devices so I don't bother. Even Microsoft published a cross-platform browser, I'll care about Safari the moment I can apt-install safari-dev/winget install safari.

> Funny, iOS tends to be upgraded further back (ie support older devices), and faster [2], than (say) Android [3], because Apple is aggressive about updating users.

Yes, iOS updates devices faster. However, Chrome isn't tied to the OS.

I've said it before and I'll say it again: my perfectly good iPad 2 is useless despite its quite competent CPU purely because there are no browsers for it. Had it run Android, I could just install Chrome and use it for slower but quite usable browsing; with the Safari lockdown the device became useless.

You can't install an up-to-date version of Safari onto iOS 15 because of Apple's architecture decisions, despite iOS 15 still receiving plenty of other updates, which means you're restricted in features if you can't install the latest major upgrade.

Google decoupled WebKit from the system image years ago and has always allowed alternative browser engines like Firefox, which means you can install the latest version of Firefox on Android 5.0 (November 2014) or Chrome on Android 7.0 (March 2016), but not Safari 16 on iOS 8 (September 2014) or iOS 10 (September 2016). My Oneplus One (April 2014) still browses the web fine, and it's a mere budget device compared to something like an iPhone!

> but isn't one of the only good things about dealing with it that customers generally update Safari relatively quickly?

Most users, not all. Either because they don't want to upgrade the OS or they can't.

I worked in the education industry for some years and a big issue were kids using old iPads.

Ran into this on nytimes.com. Ended up using the polyfill. The benefits of dialog are just too great to not use it. So much easier than using other modal libraries or rolling your own.

Yeah but 15.4 is supported on versions going back to Catalina.

What sort of company do you work at where you can't prod your users to upgrade their browsers? Surely this is a security risk. I'm at a company of 100k employees and our small team has no problem telling users they need to upgrade.

What are talking about? Most companies don't do this. Talk about a bubble.

Maybe it’s sarcasm? On the other hand, the new school does have it pretty good these days with the evergreen browsers, so it could be genuine lack of perspective. Webkit is stubborn and slow moving, but nothing like what we endured with IE, especially since polyfills were not a ubiquitous concept and checking for feature support at runtime was a kind of dark art. I shudder just thinking about user agent strings again. If anything, my daily dose of strange BS these days comes from imposed third-party SaaS vendors rather than browser interop even when accounting for older versions of Safari.

We force updates when users have not updated their browser by deadline. Security updates are not optional here.

Most organizations with any sort of audit, insurance, or regulatory requirements do. Updating software is one of the most basic things covered by any security benchmark.

Maybe internally. If done externally, extorting your users to update their stuff, then it is clearly overstepping the boundaries. Creating awareness is good and necessary, but insisting on another entity, be it a user or another company doing something, because it is in your company's security benchmark, is inappropriate. Quickly silly things, that have no security benefit at all make it into that benchmark and are tried to be forced upon other entities. Suddenly a company will be interested in how you internally handle your SSH keys. Do you make new ones every 3 months? No sorry, every 4 months is too long for our security benchmark.

The possibility of something being done poorly doesn’t mean that it can’t be done more thoughtfully. For example, most banks will refuse to let you do online banking using IE6 or SSLv3 and pretty much everyone is okay with that because the risks are obvious.

That’s always the tradeoff you have to make since you’re balancing the benefits to the user and cost of development - customers do benefit if you can ship better things faster because you’re not held back by discontinued browsers. <dialog> might not be there quite yet but it’s close and if you already don’t support IE11 there’s an obvious appeal.

I think you've got a good point there. It would be good to come together at a table and discuss such things on an eye to eye level, between entities. Obviously not always possible for natural persons to all come together. Announcing things well ahead of time can go a long way, rather than suddenly dropping support from one day to the next.

What I would proprose then is, that companies should state their minimum security requirements to work with any other entity somewhere publicly available, so that it will not be something ad-hoc invented for some entity.

I have seen companies trying to treat smaller ones like some kind of supplicant entity, that one can push around and ask about interna, that could easily lead to the bigger company building a copy of the smaller company in a few months, since they got much more workforce to put to it, if they really wanted. Asking for things like "architecture diagrams". I am quite sure, that big companies will laugh you out of the room, if you asked them to provide same for their architecture.

> 100k employees and our small team

I’m almost afraid to ask, but what do you think is a large team?

My guess is they are a small internal team and their users are company employees. Otherwise, I can't imagine another scenario where that statement makes sense.

It’s a bit odd though, because I’ve heard plenty of stories with those conditions where that’s still not true. One example is bank software that must run on IE11 because IT refuses to upgrade the equipment and security isn’t a priority because it’s airgapped or something silly like that.

I’m just going assume that they don’t have much variety of experience under their belt.

In the case of safari, upgrades are tied to OS updates, so upgrading may require updating the entire OS, and in the worst case might require the user to buy a new phone.

Most shopping websites or social media come to mind. I use to work in airline web contracting and when doing work for certain countries' national airline booking systems we had to support ie6 until 2019 (gmail had dropped support in 2010 and Microsoft officially EOL'd it in 2016)

> certain countries' national airline booking systems

Korea?

There are also government sites which really need to support all browsers since time immemorial because many people will access them from old and outdated devices.

The user I was responding to indicated it was internal users though, not a public website.

If people can use the entire web in their eyes without having to update their browser (which they can because they haven't had to update yet) EXCEPT for my site, why am I so specially that they need to update specifically for me?

Bad UX. Or maybe you're in an industry where it is your job to secure users computers.

Your last sentence isn't some side note. It's critical. Any browser over a year old is going to be riddled with security issues.

I have a newish MBP from 2018. It’s still fast as hell and reliable. I can’t upgrade the OS because it is not supported. I don’t use Safari, but I’m sure there are people out there using a perfectly fine computer that Apple has dropped support for.

Hmm. Which MBP is that? As far as I can tell, even the oldest and slowest MBP from 2018 can run Ventura.

Nope. Says it’s not supported when I try to install it. It doesn’t give a reason though. It’s a maxed out Intel unit from 2018, it’s not listed as a supported model for Ventura. When I get home I can get the model number.

Is there a valid reason for this? Like their code not running on the hardware anymore or is it just for profit? Do you at least get security updates?

Some kid somewhere digs up a rock under gunpoint and we're expected to throw it out as soon as something shinier comes along, disgusting. It's because of companies acting like this we need regulations on support and right to repair.

Ventura supports all MacBook Pros from 2017 onwards:

https://support.apple.com/en-sg/HT213264

As far as I can see, the only possibility for buying a new MacBook Pro in 2018 that can’t run Ventura is if you bought the MacBook Pro Retina (Mid 2015) model, which wasn’t discontinued until mid-2018. All the older MacBook Pros that can’t run Ventura were discontinued in 2017 or earlier:

https://en.wikipedia.org/wiki/List_of_Mac_models#2015

I think Ventura not supporting a model released more than seven years beforehand is a reasonable cut-off point. But if there are people who want to use an older model with a newer browser, they can use Firefox or Chrome.

Ah, yep it’s the 2015 model.

On a normal system you can update the browser but on iOS you are stuck with the one coming with the OS version you have, you can't really tell them to update their browser because that's not feasible (and yes it's a security risk but there's nothing you can do about it).

Apple recently released “security updates” for the iPhone 5s - released in 2013.

Reply on news.ycombinator.com