The impending crisis that is Windows XP and IE 8 | Hacker News Reader

The impending crisis that is Windows XP and IE 8

troyhunt.com

63 pointstroyhunt78 comments

I hardly think this is a crisis.

Support it or piss off your userbase. That's your call.

In our case, becaues we're a corporate provider, 65% of our userbase is on IE8 still and will be for the forseeable future.

Do we have a problem? No.

Why? Because we're not fickle when it comes to technology. We're not obsessed with the latest thing. We're not going to throw this policy away and it's not a crisis.

Compatibility is something which people have stopped valuing, which is bad.

Depends on your market.

As you have rightly pointed out in your case supporting IE8 is very very important.

For others, not important.

The fact that your last few lines seem to, in your opinion from what I can tell, place you in the "right" regarding this issue seems a bit hypocritical given your first two lines.

To each their own, the market (and an XP EOL next year) should eventually kill off IE8.

I'm stating the truth that you can do what you like, but I don't think that is necessarily right.

We still have a lot of corporate users on windows XP with no sign of them upgrading any time soon. Why? They don't need to - they're not on the public internet and everything they already do still works. There is little value in them changing. Their windows 7 upgrade is scheduled as an incremental step around 2015 but only on hardware failures.

Imagine you're a representative of an advanced space faring civilisation and have been given the task of safe-guarding a small stone-age settlement of promising humanoids. Their planet is rich in precious ores but the galaxy is at war and their position is precarious. Do you teach them the secrets of metal work or let them grub around in the mud for another few thousand years?

Nope. I just live in the real world in a company which isn't a social network or VC funded wank fest selling iPhone apps, cloud storage, useless productivity cloud crap and doesn't use Haskell, LISP or Clojure for anything.

In some parts of the real world it is now possible to replace corporate rich client applications with all their complicated deployment and update work with (well written) modern HTML5/Javascript apps that also provide an opportunity to better abstract the application middle and back ends. IE 6-9 are barriers.

We have had success with Chrome Frame but some IT departments are still resistant to even this because they are afraid their IE 6 active X specific web apps will stop working. Even if they don't, it's just something they don't want to think about, and Microsoft aren't providing a corporate IT dept transition for IE 6 to HTML5 etc.

Agreed it's possible. In fact our main line of deployment is web application which is fairly up to date feature wise, but it still degrades to the lowest denominator.

However, the resistance is usually budgetary and apathy related rather than for any technical reason. They are thinking about it, but it's still cheaper to keep your old stuff than update it, even if it is old.

> we're not fickle when it comes to technology

> Compatibility is something which people have stopped valuing, which is bad.

OK, test your website in Netscape 4.

That's an extreme point. IE8 is only 3 years old and still supported. Netscape 4 hasn't been around for nigh on ten years.

> Netscape 4 hasn't been around for nigh on ten years.

So? Ten years is nothing. There's no good reason for your site to not work in it.

I've actually tried it. It actually mostly works. There was one JavaScript error which I've fixed and the layout is broken but still flows properly.

It is pretty interesting that most people don't take compatibility seriously.

There is the famous saying, "If it ain't broken don't fix it" and another "Move forward", compatibility I feel is the link between the two, moving forward while not breaking anything.

So yes it is very important.

Some cool examples:

[o]You can still design a fully functional website using the basic html markup and it will still render finely on a Netscape 4.

[o]You can still make Doom play on the latest Windows.

[o]You can still get one of the oldest linux programs such as DC Calc or Roff to work with the lastest Ubuntu.

> It is pretty interesting that most people don't take compatibility seriously.

If you don't test in NS4, you don't take it seriously, either.

Is anyone actively blocking Netscape 4 or charging a Netscape 4 tax? Do any Netscape 4 users show up in your traffic log?

That aside, your site should mostly look like crap in Netscape 4, but it should work. That was the whole point of using an open technology like HTML.

"Do we have a problem? No."

So now comes jQuery 2 and now what? Maybe you don't use it, but just replace it with any library you use in your environment.

This comes from somebody doing C++ on VS 2008 on Windows XP, so I feel your pain. I just think it's not a very feasible stance to take. I've held out on XP for as long as I could, but I'm not sure how long I'll be able to last.

(although, to be honest, I haven't found any real compatibility issues yet; of course I'm not using IE any more so that probably shields me from most issues. I did have one problem a few weeks ago with a Windows 2000 server not being able to run recent Firefox versions, but I guess Win2k is really deprecated by now ;) )

jQuery 2 can fuck off. In fact jQuery as a whole can fuck off. It's been a disasterous slog using it for us. No end of problems with it and associated half-arsed shitty plugins to the point we've developed our own internal JS API and toolkit which we can control. Even minor version upgrades of jQuery have been dependency hell (we have 110kloc of JS excluding jQuery plugins - a lot!).

We deploy desktop apps (via ClickOnce / direct) as well as web applications, so we're supposedly in the same mire, however they still "just work". They don't suddenly stop working one day. Youre entire toolchain is fine. Just keep it in a VM.

We only just killed a desktop app deployed on Windows NT4 which was thrown together with VC++ 6. I have the VM running now as I'm porting it to .Net 4 (C# this time).

> to the point we've developed our own internal JS API and toolkit which we can control

I would have thought submitting a bug fix to jQuery might have been less work.

Harder than it looks. Submitted 20+ bug reports, got 1 solved. jQuery's issue tracking and source management was a baron land of incompetence.

By that time we had our own wrapper API that fixed all the jQuery bugs so we just took the guts out and replaced then with our own.

jQuery 1.9 and 2.0 will be API compatible - just use an IE conditional include to source the right version. Only downside is if you have a tight asset pipeline that minifies _everything_ and it causes 1 extra request.

I'm surprised there isn't more criticism of Microsoft in this article.

There's one big reason why IE9 isn't available on XP, and it's commercial rather than technical. Microsoft know that businesses don't have many reasons to upgrade from XP (at least not before 2014), and they're trying to force them. I manage a few standardised XP desktops and it's going to take some work before we can upgrade them to Windows 7. If IE9/IE10 was available for XP then I'd have upgraded already.

Sorry, that's crazy talk. If IE9 were available for XP, these business wouldn't use it for the same reason they aren't upgrading to Google Chrome (even though its free and available).

Perhaps you missed the latter part of my comment. I am a sysadmin at one of those businesses. I can't upgrade Windows but I would look at an upgrade to IE9 tomorrow if it were possible. (In our case we have Chrome and Firefox installed alongside, but the reasoning for IE is the same).

The really upgrade-averse businesses are still on IE6/IE7, but that's not really what the article is discussing.

I appreciate the info. But I still can't seem to fathom why you can / would want to upgrade to IE9 if it were available. Or how MS is trying to spur OS sales by restricting a still terrible browser when 2 superior ones exist and are available for free.

Am I missing something fundamental here?

Given that IE 9 builds on top of a lot of new things that have been introduced with Windows 7, most notably rendering-wise (DirectWrite, Direct2D), I guess it certainly is a technical reason. Replicating that on XP would either need backporting those APIs which is not going to happen because XP is out of mainstream support, or developing abstractions or fallbacks within IE which would need more resources within the IE team.

Sure, you could use suitable abstractions from the start, but why bother for an OS that's not supported anymore? Other browsers went that way, because they often run on multiple OSes, but you probably wouldn't expect a Linux version of IE anytime soon either.

I don't see why DirectWrite or Direct2D could not be ported to XP - why would it be any more difficult than a gamer updating DirectX?

It is not. There are all over internet tutorials on how to install DX 10 and beyond on XP.

That is not the MS native implementation which requires the new driver model. MS ditched the old DirectX redists after 9.0c in 2004 and since then only updated D3DX. Sure there is the Platform Update for Vista, but that is only possible because Vista already have the new driver model and it uses a completely different installer.

That's interesting. I was aware of some of the security APIs used in IE9, but in those cases I always thought that it was still essentially a business decision not to provide an XP-compatible version. IE9 is supported on Vista as well as 7 though, and it seems that they had to backport some APIs to allow this (see KB2117917). I don't know enough about the underlying code to know how hard it would have been to do that for XP, but I can definitely see that it could be a significant effort.

I'm not so sure that this is to their commercial advantage, in fact I think it could be quite the opposite. Where there is the motivation (i.e . by those managing the desktop environments), the IE8 dependency is an easy one to solve via alternate browsers. This, of course, takes people further away from the MS stack.

A word of advice: don't go charging your customers a "tax" which doesn't exist. That's how you get arrested for fraud. Call it a "fee" or "penalty" or "charge" but not "tax".

I was hoping for some discussion of how viable Chrome Frame was as a solution in corporate environments.

My current feeling is that it's not worth the bother and you'd be better installing full Chrome and hiding IE unless you also need the compatibility for internal apps.

Chrome Frame is viable and a solution we push for. The reason is that our product is sold to a variety of customers, some wanting "cutting edge" and keen on automatic upgrades, while others are more reluctant and want a more static panorama (control issues, or 'special' demographics that would be lost on a browser switch), yet both want convenience features like file attachments via drag and drop.

We have limited resources, therefore we stay focused on our area of expertise and stick to standards (zero flash/java/silverlight to minimise support area and odds of yet another thing possibly going wrong), develop edge (HTML5, CSS3, responsive...) first, and have fallbacks for less compliant browsers (e.g IE9), and possibly block access to part or entirety of our products to old browsers, while clearly informing the user as to why he should live with it or get on board, and that he can use Chrome Frame to not change anything to his habits but raise the "features" bar (most of the resistance comes from ivory tower project managers and BOFH sysadmins, while users mostly don't care or agree). This is, for us, the only viable solution in the long term.

I've observed several attempts at pushing chrome frame to large multinationals with IE6 and IE7. Couldn't get traction. It's too much of an unknown, and in one case they were using a custom browser around IE's browser control and chrome frame wouldn't have worked.

I work for a Fortune 200 company and I just recently led the effort for them to adopt Chrome Frame. We were using a charting package that we could either render in Flash or SVG and because of our BYOD strategy we chose SVG but the performance in IE8 was abysmal.

Chrome Frame fit the bill nicely. You include a tag in your HTTP header to request Chrome Frame. If it hasn't been installed then IE8 renders the page. The nice thing is the site self-selects that it wants Chrome Frame so your legacy sites continue to get IE8. Even better, your users are still launching IE so you don't have the support hassle of this site requires this browser while this other site requires this other browser.

Meanwhile this gives us an opportunity to modernize our legacy web applications. Chrome Frame has been a great solution for us.

Question: does Chrome Frame support Windows Integrated Authentication?

IT supports NTLM but not credential transfer from the current user session i.e. you have to enter your username and password each time.

Straight off the top of my head, some things that don't work in IE8:

* Semantic HTML5 tags (<nav>, <article> etc.)

* Media Queries

* Flex Layout

* CSS Transforms (2D and 3D)

* CSS Transitions

* SVG

* Geolocation

* Canvas

* HTML5 Video

* HTML5 Audio

* Rounded corners

* Multiple backgrounds in CSS

* Web Sockets

* Web Workers

--- These are are from memory, I haven't taken the time to look these up so correct me if I have anything wrong.

And for nigh on 10 years we didn't need ANY of them...

I'm not suggesting that the features are not nice, but to be honest, we can do without if we need to support it.

My favorite are the 10+ years old XHTML (look up "polyglot XHTML" for example) and DOM Level 2.

Windows XP boots faster and is snappier than Windows 7.

It's lightweight-ness makes it the best choice for a VM guest as well as its small post install size.

Windows XP post installation base size is 1.5GB, Windows 7's is 15GB -- this makes XP more suitable for image deployed environments.

You know, that Microsoft website doesn't look so bad on IE5. Information appeared to be the king, nicely situated with clean interface.

So use Firefox then. You don't have to run IE on Windows XP.

One of the points of the post was that switching from IE to FireFox is not a straightforward option. There is a lot of code running that depends upon features, functionality (and perhaps the idiosyncrasies) of IE.

I'm really not sure you can have this both ways. Either you use a modern, up to date browser and code to standards (and thus reduce your coding workload and maintenance), or you can code to an old, out of date browser.

The fact is, the main reason that he wants people to upgrade to IE10 is to reduce the support and maintenance burdens of supporting old browsers with weird javascript and rendering bugs. The heading is, after all "Old technology is wasting everyone’s time and money". The solution I put to everyone is to stop supporting IE8 and install Firefox. You can even deploy it via Active Directory and update it via Group Policy, AFAIK.

So the simple solution is to switch to something like Firefox. Or you could continue to support IE8. It's really not ideal to do both, which you'll need to do if you have Windows 7 or above given you will almost certainly have IE9 or above on these installs.

The main problem is all the internal webapps that were written to support IE6, still works with IE8, and are very costly to rewrite, upgrade or replace.

So in many cases they have to _add_ Firefox, they can't simply replace IE. That means even more user training (what, they've installed a second internet with a fox on it? Which should I use??), so the more tempting option is to just sit it out and wait, because they know that they will have to upgrade to Win7 or Win8 next year anyway if they still want security fixes.

First, you don't need to switch. Installing Firefox does not make removing IE from the machine mandatory

Second, installing FF or Chrome is not viable only if you're an IT drone or similar.

(blah blah corporate policy blah blah)

But of course FF is to blame as well when they came with that upgrade plan of theirs (of several frequent versions)

Firefox now do 'Extended Support Releases' for controlled environments where the admins dont want constant updates http://www.mozilla.org/en-US/firefox/organizations/

In most managed corporate environments, you do have to run IE. The freedom of installing your own software at will doesn't exist.

I understand, but it seems to me that if corporations change their standard to something like Chrome or Firefox, then they will have less maintenance costs in the long run. I think it's easier and more cost effective to deploy the latest version of Firefox than it is to:

a. purchase new hardware for the latest OS from Microsoft,

b. Get all the OS images ready to deploy,

c. Train staff to use all the new applications that have changed UIs due to older versions of the software not working well on the new OS.

Not only this, but as I've said ad nauseum, development costs should reduce when you use something that is updated as often to the latest standard as Chrome and Firefox.

Many companies use custom applications that simply don't work in other browsers. A browser like Chrome or Firefox is not appealing to companies who don't want to have to worry about a new version coming out every couple of months and having to constantly test their application to make sure it still works.

This argument is flawed. There are really only two types of custom apps that you are referring to: apps that rely on ActiveX controls, and apps that use nonstandard eventing and DOM APIs, as well as bugs built into Internet Explorer.

In each case you have a problem: those who use ActiveX will eventually find a total lack of support and updates for these apps, and those apps that rely on non-standard behaviour risk getting broken in even minor updates. Not to mention there will come a time when Microsoft will completely stop supporting the browser version the app is relying on, even for security updates.

As has been pointed out by someone else, Firefox has special long term updates for corporations in restricted environments, so it's not a huge concern in terms of lots of updates being applied every few months.

Does anything stop people from running Portable Firefox [1], the version built to run without installation, e.g. off USB drives and such?

[1] http://portableapps.com/apps/internet/firefox_portable

(edited to add forgotten link)

USB ports being disabled on corp PCs for one.

Plus the penalty for running unauthorised software being dismissal.

Yes - education! Your average desk jockey will know when the sites they use break, they won't know why and they won't know about the alternatives.

Group policies can be used to disable execution from any user-writeable directory.

So now we have minimum system requirements for Web pages? How is this any better or simpler than desktop apps? Moreover, what's the point of having an open spec if I need to update my browser every 6 weeks to run the latest version of site X? And what consumer is actually asking for this?

As a rule, you don't. However, Firefox is overall more feature complete, standards compliant and willing to correct bugs in an open fashion than Microsoft is with Internet Explorer.

The ROI isn't really on the end user, it's on those who develop apps and must maintain them.

Incidentally, for many web apps there are indeed minimal system requirements: must do CSS correctly, must follow DOM event model correctly, must render pages in a standards compliant manner, etc.

Assuming consumers lead to your revenue, you should be serving them, not telling them they're not supported. But I realize that's an unpopular opinion here.

The whole "standards compliant" is now just something Web devs tell each other. Browser vendor prefix usage is at an all-time high. Devs are routinely targeting features added by browsers from draft specifications (because that never turns out to be bad). And "standards compliant" seems to always mean the latest standard, which naturally precludes any device that predates that portion of the standard. CSS 1, 2, and 2.1 are all standards too.

Oh, and my question about the consumer is given the choice between having no access at all or geolocation and drop shadows, I'm guessing almost all would rather just be able to access the site. I can't see much coming out of all this browser innovation that normal people care about or would ever ask for.

Actually, it's usually the case that the customer is forced into using an ancient and unsupported environment which is forced on them, by the custom application. That's why organisations stay with old browsers, not the other way around.

Not quite.

There are many corporate environments that fully control their desktop and don't allow chrome or IE.

There are some major applications that work only in IE.

With "Google Chrome Frame" this is hardly a problem any more.

Google Chrome Frame needs to be installed, often not possible for the end-user. Besides, who wants to _install_ something to view a web page?

From what I understand Admin rights are not needed for a chromeframe install. I'm not sure how locked down a PC would need to be to prevent its installation.

But it solves "the big problem". In a nearly perfect way.

As soon as I install Chrome frame, I can now use all my old legacy custom web apps that were built by my trusty 2005 ASP3 dev team (half of whom unfortunately have died of lung cancer or liver disease since then). And all new web apps pretty much invariably use the meta tag for Chrome Frame, I can continue using whatever site I want.

The IT team just has to spend the 2 hours, 2 days, or 2 months to figure out how to roll out the update. No matter how much time they spend, it will be worth it in the long run. Now we don't have to upgrade from XP for another 10 years.

Now we don't have to upgrade from XP for another 10 years.

and what about os-level security updates?

Well, you know.. besides that.

"Paradoxically, the current version of Chrome runs just fine in XP."

Well, actually it doesn't. As per the lead developer of the Chrome (when last time I was defending XP):

http://news.ycombinator.com/item?id=4860203

That article is talking about how Chrome is less secure when run under XP, due to XP lacking security features found in later versions of Windows. But Chrome still runs well on XP, and probably has no worse security on XP than IE8 does.

I did not see any reason to move to win8. We can use chrome/firefox for modern sites. Existing software on XP is more than enough to do anything. More bloated office 13? Thanks, there is no way that I will use it.

If I want an easy life, Linux is here, it is much faster, much easier to use with tiled windows managers like dwm (much less clicks & mouse movements). More tools to use, much easier to update with package manager like pacman. Windows seem like trash for me to drag human kind down a lot.

Good write-up of a lot of key issues facing corporates and thus by implication all ISVs.

Minor quibble - the Compaq iPaq had supplanted the Palm offerings as the "cutting edge" with colour, great sound quality and a lot of (admittedly battery emptying) performance. I was writing code for both platforms in that year.

The "problem" is that when almost none of the web works in IE6/7/8/9 is that people won't upgrade because they have no idea how to. They'll buy a new PC, which is fair enough if they were running XP, but then they'll be shocked to realise there is no start menu.

How many of those about-to-be-EOL'ed customers will upgrade to newer Windows/IE, and how many will jump ship for other browsers or OS's?

What's the best way the FOSS community can take advantage of this situation to gain market share?

Having perfect compatibility and interoperability with Word, Excel, Access (both file and keyboard/mouse compatibility) and the ability to run VBA would be a minimum requirement for a lot of them.

What's the status on the Windows 95 and IE 5.5 crisis? ;)

What doesn't run on IE8 at the moment? Trello is one prominent app that steadfastly refuses.

Why do all these posts by mvps feel ... clueless, mindless and fanboyish? I can't quite put my finger on it. Maybe it's the ridiculous tone of defending the undefendable that all these posts have in common.

Which bit was that Toshio? I can't see any MS defending, the post essentially said "This is what's happening, here's what to expect, these are some of the considerations". Whether what MS has done around OS and browser integration is wrong or right is not the issue, what we're all going to do about it is.

Reply on news.ycombinator.com