Blog

Kill. IE6. Now.

By Mike Rothman

I tend to be master of the obvious. Part of that is overcoming my own lack of cranial horsepower (especially when I hang out with serious security rock stars), but another part is the reality that we need someone to remind us of the things we should be doing. Work gets busy, shiny objects beckon, and the simple blocking and tackling falls by the wayside.

And it’s the simple stuff that kills us, as evidenced once again by the latest data breach study from TrustWave.

Over the past couple months, we’ve written a bunch of times about the need to move to the latest versions of the key software we run. Like browsers and Adobe stuff. Just to refresh your memory:

Of course, the news item that got me thinking about reiterating such an obvious concept was that Google is pulling support for IE6 for all their products this year. Google Docs and Google sites loses IE6 support on March 1. Not that you should be making decisions based on what Google is or is not supporting, but if ever there was a good backwards looking indicator, it’s this. So now is the time.

To be clear, this isn’t news. The echo chamber will beat me like a dog because who the hell is still using IE6? Especially after our Aurora Borealis escapade. Right, plenty of folks, which brings me back to being master of the obvious. We all know we need to kill IE6, but it’s probably still somewhere in the dark bowels of your organization. You must find it, and you must kill it.

Not in the Excuses Business

Given that there has been some consistent feedback every time we say to do anything, that it’s too hard, or someone will be upset, or an important application will break, it’s time to man (or woman) up. No more excuses on this one. Running IE6 is just unacceptable at this point.

If your application requires IE6, then fix it. If your machines are too frackin’ old to run IE7 or IE8 with decent performance, then get new machines. If you only get to see those remote users once a year to update their machines, bring them in to refresh now.

Seriously, it’s clear that IE6 is a lost cause. Google has given up on it, and they won’t be the last. You can be proactive in how you manage your environment, or you can wait until you get pwned. But if you need the catalyst of a breach to get something simple like this done in your environment, then there’s something fundamentally wrong with your security program.

But that’s another story for another day.

  • Comment from Rich: As someone who still develops web sites from time to time, it kills me every time I need to add IE6 compatibility code. It’s actually pretty hard to make anything modern work with IE6, and it significantly adds to development costs on more-complex sites. So my vote is also to kill it!
No Related Posts
Comments

Mike,

I like you, I respect you but that article was a waste of electrons.

I was really hoping you could enlighten me as to why to ditch IE6 but “because it is old” or “because it sucks” are not good enough reasons.

IE6 goes through Microsoft’s excellent patch program so vulnerabilities are not a major issue (not more than Firefox, Opera, IE7+8, etc).

The only SECURITY advantages these browsers have over IE6 are site blocking and good cert management for HTTPS. With a good proxy server both of these are non-issues.

By Allen Baranov


I basically agree with you, and hate IE6 as much as the next person, but saying this:

“If your machines are too frackin’ old to run IE7 or IE8 with decent performance, then get new machines”

is just silly. Telling people to upgrade their hardware in order to use a newer version of a browser taints the rest of your argument.

By pgl


The way Microsoft completely redesigned the GUI from IE7 has definitely something to do with it. 60 percent of companies still use Internet Explorer 6 as their default browser [1]. The change management challenge is too big for companies with basic business needs. Few IT managers accept the risk to flood the helpdesk with disgruntled users and to hurt productivity as long as IE6 gets supported. Do not expect any major change until corporations roll out the next major OS upgrade (yeah I mean Windows 7).

[1] http://news.cnet.com/8301-17939_109-10231713-2.html

By TLG


If you like to leave comments, and aren’t a spammer, register for the site and email us at info@securosis.com and we’ll turn off moderation for your account.