UK Government Rejects Calls To Upgrade From IE6

pcardno writes "The UK government has responded to a petition encouraging government departments to move away from IE6 that had over 6,000 signatories. Their response seems to be that a fully patched IE6 is perfectly safe as long as firewalls and malware scanning tools are in place, and that mandating an upgrade away from IE6 will be too expensive. The second part is fair enough in this age of austerity (I'd rather have my taxes spent on schools and hospitals than software upgrade testing at the moment), but the whole reaction will be a disappointment to the petitioners." Update: 07/31 11:43 GMT by S : Dan Frydman, the man who launched the petition, has posted a response to the government's decision.

Comments

Cleanup

[Tubal-Cain]

The second part is fair enough in this age of austerity (I'd rather have my taxes spent on schools and hospitals than software upgrade testing at the moment), but the whole reaction will be a disappointment to the petitioners."

That AutoRun virus that was going around a while back, how much did that cost to clean up?

An ounce of prevention is worth a pound of cure.

Re:Cleanup

[phoenix321]

Software being too old, insecure and barely compatible is reason enough. A browser is a must-have piece of software nowadays and if you absolutely depend on a specific version of a specific product line, you're doing things wrong in the first place.

As IE6 is absolutely not available on any new version of Windows, it's effectively holding back all significant upgrades on the core operating system. Without updates to the operating system, the entire IT landscape is not only severely hobbled for innovation, but thoroughly insecure on major issues.

Don't allow yourself to fall prey to the illusion that software upgrades are an entirely voluntary - or useless - effort. In the best possible scenarios, holding back upgrades is saving a few percent of the cost and postponing the rest of upgrade expenditures. In friendly real-world scenarios, it's not saving any, merely postponing all upgrade costs. In any case, it's very very likely that during decade-long upgrade holdouts, IT department will lose it's edge and sharpness, get complacent and behind on the current state-of-the-art. And with that, the whole company will lose its pace.

Upgrading from Vista to Windows 7 is easy. Upgrading from XP to Windows 7 is a major undertaking and upgrading from any older version is financial disaster.

Just because you CAN use old equipment until it literally falls apart, it doesn't mean it's the most sensible or cost-effective option to do so.

Re:Cleanup

[Gonoff]

Software being too old, insecure and barely compatible

old
What is the inherent problem with software just being old? Do some of the bits fall off? Some of the bytes?

insecure
Many people here would remind you that it is insecure because of what it is - MS Windows. If you are going to replace it with MS Windows, it will still be insecure. Large organisations spend a lot of time keeping it secure. That is why people tell me they are not happy about our rules on what you can connect to our network, rules on USB, security policies and much much more.

barely compatible
That is a lot better that Vista which is not compatible at all and Windows 7 which needs to run a virual machine to be able to run most "corporate" applications.
In fact, this is the big killer. We have completely avoided Vista because major applications would not work. Now we are being told that we need to roll out an operating system that will not run on a reasonable fraction of our estate. Then, to make things work, we need to have XP on all of them as well?

Yes, I know that if we have to have the applications rewritten, getting them to work in a grown-up operating system would be a good idea and making all web apps browser agnostic is a must. That costs money now. Carrying on pushes it into the future.

Re:Cleanup

[mpe]

But the real reason to not get too much behind on upgrading is user experience: switching from XP to Vista feels differently, but not a whole lot. Switching from Vista to Win7 is also noticeable with the GUI and interface, but with even less differences than before. But switching from XP to 7 is quite a jump.

Would this "jump" be any smaller going from XP to Ubuntu? Which also means getting rid of complex to administer software licence systems, EULAs, CALs, etc, etc.

Myopia

[VincenzoRomano]

The consideration about costs is right, if you defer security decisions so much that you're still running IE6 in 2010.
The consideration about firewalls and scanners is also right, if your policy is to go on patching a broken roof instead or making proper repairs.
God save the Great Britain (as well as the Little one)!

Re:Assume IE 6 earns them 1 million dollars a day.

[dangitman]

I have a bit of a mantra when I talk about IE6. Whenever anyone asks me why anyone would run IE6, I give this response:
Assume IE 6 earns them 1 million dollars a day. If they stop using IE6. They start losing 1 million dollars a day. Thats the reality of the situation.

That's about the most nonsensical thing I've ever heard. If this is your mantra, then you should not be employed anywhere, for any job.

Re:it shouldn't cost anything

[Skrynesaver]

When you are a large institution who have (over)paid consultants to create workflow tools on your intranet, upgrading is far from free. The new approved browser will have to be validated against your existing tools, then you'll have to do rewrites where you had horrible IE6 kludges. The cost of the software isn't the issue, it's the cost of delivering your applications on that platform that is the issue.

With that said it provides a wonderful example of why organisations should avoid proprietary extensions to standards. One day the world will move on and you'll be stuck with an un-integrateable piece of shit platform.

Re:Reality: deal with it

[Ice Tiger]

That's why as part of your upgrade you upgrade / fix those apps to work on a modern browser, the alternative is you come to day when you can't upgrade anything in your IT ecology due to everything being so brittle.

Another way of looking at things is that as IE6 gets dropped from supported browser lists over the next few years you can be faced with the situation of critical app a stuck with IE 6 but critical app b needing to be upgraded but because it has dropped support for IE 6 you can't without incurring massive project costs.

Not keeping your software at least to supported versions is a false economy, much like the money you save not putting oil in your car, that is of course until the engine seizes.

Re:Assume IE 6 earns them 1 million dollars a day.

[mlts]

Actually, the tech details are just pushing a .MSI file out with IE8, or just approving it from a WSUS server.

My rant: IE6 is 10 year old technology. A Web browser is on the front lines of keeping a machine secure, almost as much so as a router. IE6 is meant to deal with spyware from the year 2001. Not the botnets and SCADA-seeking malware of 2010. Anyone who has any sense can see this.

There is just no reason to run IE6 on XP unless it is testing backlevel versions. IE8 fixes a lot of security issues. Even Windows XP needs to be binned because it is going to be a decade old, and organizations need to move forward to operating systems more able to handle the security issues of this decade.

This doesn't even need a car example, but a war example: You don't send out Greek phalanxes in formation against people with 10,000 rpm chainguns, Apache helicopters, and flamethrowers. Fielding Windows XP is doing just this.

The blackhats, phishers, scammers, spammers, criminals, and other miscreants are not going to be easing up attacks anytime soon. So why deal with threats of 2010 with an OS made nine years ago?

Of course, firewalls mitigate this, but there is something sort of wrong with compensating for a poor OS's security by having to fortify the router and perimeter instead of having the OS be reliable enough so a blackhat isn't home free once they get into the core network fabric.