Enterprise-wide Browser Upgrades, IE, and Patching? 53
newkid asks: "Our company needs to upgrade its standard browser, a difficult decision when we factor security, compatibility and the logistics of actually doing it. For compatibility, Internet Explorer is required by internal applications like IBM Tivoli Storage Manager, so we have to keep it. On the security front, expert bulletins keep ranting every week about the latest gaping holes in IE but nobody really seems concerned: for example, many on-line banking services only work in IE, and they don't check for patches. Meanwhile, users do not care, as a large portion of the traffic still comes from IE 5.5, a version discontinued by Microsoft.
As for logistics,the software distribution technology and the cost of patching both make the project much larger than we can undertake this year.
Our two options are: roll-out IE without patching, or roll-out IE and Netscape, but lock IE so it can only surf on intranet sites, and update NS with rsync or Ant. What is your company doing? What is your strategy? How serious are the security threats? What are the documented security breach caused by IE? We need a reality check."
Many go unpatched anyways (Score:5, Informative)
Mozilla (Score:5, Insightful)
Why can't you install Mozilla on a couple of shares and update them. It doesn't have to be on a local machine, and most internal networks remain fairly idle. (The other 60+mbps not being using by an external source.)
On a very different note: these machines are running Windows, right? Why the security concern over IE?
Quick and dirty... (Score:5, Funny)
Oh, and look for snakes in your office when you get back.
Re:Quick and dirty... (Score:2)
Look for something called 'pstools', it is half of what you need. the others are a
Re:Quick and dirty... (Score:2)
We have both. (Score:5, Interesting)
We've put Phoenix on the desktop, and quick launch bars.
We hid explorer in the Programs->Accessories->System Tools.
And of course, you get Konqouror and Phoenix when you log into our VNC server.
But as far as risk is concerned:
Lthe largest risk is Outlook and Outlook Express - they use the core of IE to do their mail previews. Most of our users don't visit odd websites - but they sure could be sent a virus now and then.
Easy (Score:4, Insightful)
MyCorp finally decided that IE 6 was an improvement over NS 4.7 for our Windows machines. Despite disliking the borglike tactics of MS, the decision made sense locally. It's almost easier to just let Windows have its way and use IE by default. But I would insure the security patches are up to date. Use SMS to update them.
Our migration to IE was decided before Mozilla was as good as it is now. Also, Opera ain't bad, nor Konqueror/Safari. Check `em all out and keep your internal sites W3C standards compliant so you have options in the future instead of handcuffs.
Re:Easy (Score:5, Interesting)
But then again, so is every other browser which does not lie about its CSS support, and can render standards-compliant pages.
The main problem with IE is that it accepts garbage, so people keep using garbage, saying 'it works in IE'...
Accepting garbage. (Score:2)
Writting programs that spew un-RFC compliant crap, like IIS or Outlook -- that's poor software design. Always be exacting in what you output, as much as you are per
Re:Easy (Score:2)
Course you don't think I'll make a statement like this without giving a couple examples off the top of my head do you?
IE will not get rid of the borders on frames without an attribute in the frameset tag, it ignores frameborder="0" in frame tags. The standard defines them in the frame tags and no border related attribute in the frameset tag.
(I should note, while not the same attribute in the frameset, netscape also suffers from this
Re:Easy (Score:1)
div > table {
background:red;
}
with
<html>
<body>
<div >
<table><tr><td>hello</td></tr></table>
</div>
</body>
</html>
try
<div style="left-margin:20px;right-margin:30px:overflo w
<div style="position:fixed;width:100%">
this test should be fixed
</div>
<pre>
this
is
some
text
that
should
make
the
div
scrolable
</pre>
</div>
IE + CSS ummm..... (Score:1)
When you start using CSS (or anything vaguely complicated) you start to see just how much IE sucks. sure Mozilla and Opera arn't perfect IE just isn't.
Are you sure you *need* IE? (Score:5, Interesting)
I do all my banking, and the company's with Mozilla with no problems. A friend of mine also uses Moz for his banking. That's three separate banks that have no problem with Mozilla.
There are probably more good choices in web browsers right now than there ever was. It is a good time for change.
Re:Are you sure you *need* IE? (Score:4, Insightful)
Be wary of any application which requires a certain browser for an interface (IE, Mozilla or otherwise).
Browser-specific sites are bad, but apps are worse.
Re:Are you sure you *need* IE? (Score:4, Insightful)
Re:Are you sure you *need* IE? (Score:2)
It may be for someone, but not me. I am on a team which is developing an application which will be tested against IE6 *only* because this is the supported browser of the company who will use our product. We are not using a browser based interface for portability, we are using it so we can easily rollout changes without having to touch a single machine on of the 40,000 users will access our app
Re:Are you sure you *need* IE? (Score:2)
Re:Are you sure you *need* IE? (Score:2)
Re:Are you sure you *need* IE? (Score:1)
We have to certify against IE6, and nothing else since it is the target platform. If the client wants to use another browser, at very least they will have
Re:Are you sure you *need* IE? (Score:2)
Re:Are you sure you *need* IE? (Score:1)
Tim
Re:Are you sure you *need* IE? (Score:1)
My $0.02 (Score:3, Interesting)
2) Banking sites can usually be tricked with a simple change in the Useragent string in Mozilla/Netscape. Are you sure you need IE?
Switch to Windows Server 2003 (Score:1, Flamebait)
Now, it makes some pages break, but that's the price.
Re:Switch to Windows Server 2003 (Score:1)
In other words, switching to Server 2003 is an option. Dogs and cats living together! Mass hysteria!
Whose has the final say? (Score:1)
By the way, this joke was a bit of a stretch for me as I don't really like Star Trek.
IE 5.5 still supported by MS (Score:1)
We keep NS 7.0.2 and IE 5.5sp2 on our users' desktops, as IE6 had issues with Office 2000 on a Win2ksp3 workstation [go figure - all 3 packages are made by MS!].
Only problem is that the MS Update w3 site always wants the users to upgrade to
Wait. Just a little... (Score:3, Interesting)
Patch management (Score:3, Funny)
_______________________________________________
If it doesn't fit, file it. But it gets dirty and you can't clean it. So you have to THORW IT AWAY!!
Tivoli? (Score:3, Interesting)
At least give MS a go properly. (Score:5, Informative)
Install a copy of Software Update Services [microsoft.com] and then use group policies to configure your workstations to use and automatically install the patches.
It's a partial solution, while it doesn't upgrade Internet Explorer itself, it *does* apply all relevant patches to IE and the OS.
You do use Group Policies, right? This is one managment area where Windows 2000 out-of-the-box beats any Linux managment system hands down.
Generally.. the patches aren't that important, but notable exceptions exist. (Such as Outlook Express opening certain mime types automatically! - virus writers were quick to take advantage of *that* one..) The problem is that you never quite know which ones are going to be important.
Re:At least give MS a go properly. (Score:3, Informative)
Use IEAK to build a custom version of IE.
Use Intellimirror if you're on an all Win2k+ network, to roll out, well, any software you want, really.
Use SMS if you're not on an all Win2K network, to, well, roll out any software you want, really.
Block the windowsupdate sites at your proxy.
Do NOT let users have admin access to their own machines.
Re:At least give MS a go properly. (Score:1)
Oh, and subscribe to NTBUGTRAQ [ntbugtraq.com]. That's pretty much an abosoulte must - heads up as to which patches (like MS 03-010) it might be a good idea to hold off on.
SUS lets the admin specify which patches the workstations are to download and install. It uses the same (more or less) client software as the standard windows auto-update, but you use Group Policies to connect to your own, internal, controlled, server.
And, yes, you *do* need to automatically install the
Re: We GAVE MS a go properly. (Score:1)
And that's with Mozilla 1.2, back in January!
I started using Mozilla 1.0 when SP1 for IE6 rendered IE unable to render all the graphics of many web pages. Refreshing would sometimes show more of them, sometimes less. I tried Mozilla out of necessity, my first use of open source software. Then I uninstalled SP1 & was thrown back to IE 5.5 (isn't that sp
Block IE at Proxy (Score:1)
As for upgrading Netscape 7, Mozilla or Opera: you really don't have a software distribution system installed? How do you update other software? How many clients?
IEAK (Score:2)
IEAK (Score:5, Informative)
You also didn't mention your network setup. However, you're considering IE so I'm going to guess most of your clients are running Windows. Also, if you're really entering into a rollout your network must be on the larger side (else it would just be you installing something on a few machines). So if you've got a a)large b)Windows network there's a good chance you've got some kind of domain model there. Or at least something that provides login scripts. Go fix yourself up a custom IE install with IEAK and launch the setup from the login script. Heck, if you're running AD on a Win2K server whip up an MSI and push it out to the clients. But if you can't do enough research on you own to discover IEAK, then you probably won't even be able to spell MSI.
If you've never heard of IEAK, got a large Windows network, and aren't using some sort of login script functionality, then the SARS has truely taken over and a browser rollout is the least of your troubles.
DISCLAIMER: no SARS were injured during the creation of this reply
Darn (Score:1, Insightful)
"...the then SARS have already won."
Re:IEAK (Score:1)
Mod parent up!
How on earth did he get into a stupid situation where "Roll out IE without patches" was ever any kind of option?
It's
a) dangerous not to patch and
b) easy to patch.
You just have to know what you are doing, which that dork obviously doesn't.
standard config.. (Score:2)
It gives you the technology to to have a 'golden host' on which you base every desktop. You then download the chnages automatically once a day (or when you hit the button for emergency updates!).
Turbo Linux has a similar product which has been recently bought by a Californ
A reasonable idea (Score:3, Informative)
In some browsers like opera, you can change the Client string so it looks like IE6. I did that with the opera browsers on some public Pentium2 computers and the clients have been happy to my knowledge. Opera is also more robust, low on resources and fast.
I'm tempted to think something like cygwin rsync would work on windows machines to update opera. Of course, if you dont have apps that require win32, you can move to linux completely, possibly using xpde for naive clients.
Re:A reasonable idea (Score:2)
Having to deal with many, MANY web apps, I can tell you that this doesn't always work. Some apps are so heavily built with IE-only components that there's no other browser that works with it. PERIOD.
Mozilla and Opera are wonderful web browsers, and could easily kill IE if developers would stop writing web apps that only work in IE.
If using Active Directory, try MSI packages (Score:1)
Group Policy in Windows 2000 allows you to create MSI packages that can be rolled out to multiple clients and that will be installed when the user starts up the computer. If you check the Windows 2000 Server CD, you'll find the light version of WinInstall, called WinInstall LE (winstally around here). This will let you scan a computer, then you can run any updates (for exam
Is "enterprise" now a synonym for "organization"? (Score:1)
1/2 of our virus infections are a'la IE (Score:2)
Browser Fear (Score:2)
People that used to love Netscape have pretty much turned to IE due to the NS4 line's stagnation and the netscape branch of mozilla being inadequate (I'm highly looking forward to a branch of the 1.4 trunk). They don't complain or they'll get laughed at.
The l
Re:Browser Fear (Score:2, Informative)
http://www.litepc.com/ier_lic.html