Hacker News Reader

Comment by parhamn | Hacker News Reader

I'm a bit torn on this when it comes to browsers.

We recently had a user email us that our app stopped working for them. After we dug into it it was because their Chromebook was last updated in 2021 and didn't have Object.hasOwn (which a third-party library uses) and it's not even included in most common polyfills either. We fixed it, because I hate these sorts of compatibility issues.

Nevertheless, I left a bit concerned that they hadn't updated their Chrome in 3 years. Software decays much quicker than hardware in a real way, especially with the never ending list of security vulnerabilities found every year. Theres definitely a case to be made that forcing software upgrades is good for the end user too.

View on HN

Just a remark on that specific case: Object.hasOwn landed in Chrome 93 in August 2021, and came last to Safari 15.4 in March 2022. My general advice is: never depend¹ on features less than two years old, avoid depending on features less than three years old, and treat two-and-a-half-year-old Safari as a bigger deal than one-and-a-half-year-old any other browser, because of how Safari major versions are tied to major OS versions to at least some extent².

—⁂—

¹ When I say “depend” I mean “break if it’s not present”. A degraded but still functional experience is acceptable.

² I don’t use Apple stuff, so correct me if I’m wrong, but I believe that this used to be the case for macOS but may be fixed since macOS 12 <https://en.wikipedia.org/wiki/Safari_(web_browser)#Version_c...>, and is still the case with iOS et al. I believe iOS/Safari 15 is still the current version on some actively supported devices.

On my 2012 macbookpro I am forced to use chrome or orion since safari is stuck on 15.X. On my 2015 iMac I can still use the current version of safari, but probably not safari 18 when it will come out. So, for now, the cut-off is 10 years. Pretty good I would say.

Yes, macOS makes it possible to install newer Safari versions on older versions of the OS. However, if you are the type that doesn't update your major OS version regularly, you probably don't check for random software updates anyway, because Apple still shows the Safari updates in the same place as general OS updates. From the settings app, it's the same little red update dot regardless of what the update actually is.

I suspect that many people who use old Safari versions are either used to sites being broken, or they use Chrome and don't care. I wish we had more data to verify those assumptions.

One cant update an iphone if there is insufficient free storage, they may have very limited storage and there is no good way to manually move photos and videos to windows over usb or from icloud. People then end up deleting media one by one by hand while taking new pictures and making new videos. It can take a very long time. Most pictures are/feel more valuable than the update.

Totally. The phone problem I think is unavoidable for a large enough organization. At a certain size of company, with enough users, you just have to accept that your tech stack will lag behind for a few years, OR, you're going to spend an extraordinary amount of dev time building backwards compatibility for less capable devices.

I find it silly how some people tack on "just ship a fallback stylesheet" as a legitimate answer (not accusing you) because we all know that it's never that simple.

I just don't use any of the new features until someone complaints about it. If support is there and it doesn't make it impossible to reason about ill adopt it and thank them.

   @container style(color: green) and style(background-color: transparent),
    not style(background-color: red),
    style(--themeBackground),
    style(--themeColor: blue) or style(--themeColor: purple),
    (max-width: 100vw) and style(max-width: 600px) {
  /* <stylesheet> */
  }

It is useful as a selector for people. Best not let that guy anywhere near my code.

Sometimes you can't even update. I have an iPad that is perfectly fine for browsing. We use it mainly for TV purposes. It doesn't get any updates anymore.

Now, some streaming services do not work anymore, because the website doesn't work. Why? There is no real technical reason for this. For some streaming services I have a collection of the real streaming URL. That still works fine. The problem is not the streaming itself, it's the website to choose the right stream.

Yes, for browsers the window for what qualifies as being recent enough to be safe has shrunken dramatically. I’d be on edge about using a browser that hadn’t been updated in even one year… if I had to use a 2+ years outdated browser, I’d have it locked down (NoScript installed, bells and whistles like webfonts disabled, etc) and be much more cautious than I am normally.

> Software decays much quicker than hardware in a real way, especially with the never ending list of security vulnerabilities found every year.

What's the connection to security vulns? How does that impact devs not using "a separate stylesheet to support everyone." or ignoring "progressive enhancement"?

Or what's the vulnerability explanation of hasOwn?

It seems it mostly decays quicker on some webby platforms that culturally don't care much about backwards compatibility

Is there a Chrome LTS channel?

Firefox has an LTS version which can be a baseline for features, but which receives security updates at the very least.

I don't know about, say, Chrome 80 line that would receive security fixes but not new features. I also think that would be against Google's interests to have such an LTS line, it would decrease the moat between it an other browsers.

Why do you need Chrom LTS to use "a separate stylesheet to support everyone."?

Because supporting older Chrome releases is pointless: they should be replaced because of their security holes, discovered later. You may, of course, to decide to put the baseline somewhere, but that baseline would be arbitrary.

With Firefox (ESRs are at 102 and even 52) and, to an extent, Safari (tied to iOS releases) there are non-arbitrary baselines, where you know what kind and size of the audience you additionally cover by staying away from newer features.

They point is the same for Chrome - "should" is a wish, not a description of reality, so if you care about users using old versions, you use a fallback method.

Also don't you have stats by version number, what is extra non-arbitrary about LTS?

Security vulnerabilities are found in browsers.

Browsers are updated to fix the security vulnerabilities.

People upgrade to the latest version to get the security fixes.

If a person is using a browser that is years out of date, they are subject to a lot of security vulnerabilities in a piece of software that is constantly exposed to untrusted code.

Using an old browser is unsafe. If you encounter people using old browsers, you should strongly encourage them to do whatever they can to update their browser for their own good. If they do this, a nice side-effect is that you don’t have to support their older browser version.

Yours is s PSA for updating browsers, but this doesn't explain breaking backwards compatibility since newer browsers with security updates don't break older CSS features.

> Nevertheless, I left a bit concerned that they hadn't updated their Chrome in 3 years. Software decays much quicker than hardware in a real way, especially with the never ending list of security vulnerabilities found every year. Theres definitely a case to be made that forcing software upgrades is good for the end user too.

It seems very easy to understand the logic here. What part don’t you grasp? Don’t support older versions => this pressures them to upgrade => upgrading is good for their security.

I think you can expect that for a Chromebook, but a different type of laptop might not support modern Chrome? I remember that Steam uses enough chromium nowadays that they had to drop support for Windows 7 early. Chrome doesn't have quite as long a support window for older OSes as the OSes do for security updates.

Is that true? Windows 7 OS updates ended in 2020, while Chrome continued to update until M109 in 2023[1].

[1] https://support.google.com/chrome/thread/185534985/sunsettin....

Reply on news.ycombinator.com