Change Details

Old IE versions in particular have a host of client-side vulnerabilities. We try to mitigate those as much as possible, but since there are so many we won't ever be able to avoid all of those. One option to prevent these security issues from causing real damage is to stop handing out sessions to old and insecure browsers. According to http://stats.wikimedia.org/wikimedia/squids/SquidReportClients.htm IE6 for example currently performs only 0.31% of all requests. If we can establish that only a handful active users are actually still using IE6, then we could simply encourage those to upgrade and stop handing out sessions to IE6. Reading will still work, only editing would be disabled for IE6 users. Advantages: * free up resources, can focus on things more relevant to current users * lets us get rid of complexity and limitations in the code Information we need: * browser market share of active editors vs. anonymous users, with a focus especially on old browsers Nice to have, if possible: * JS support of logged-in users vs. anon readers -------------------------- **Version**: wmf-deployment **Severity**: normal **See Also**: https://bugzilla.wikimedia.org/show_bug.cgi?id=52295 https://bugzilla.wikimedia.org/show_bug.cgi?id=58368 https://bugzilla.wikimedia.org/show_bug.cgi?id=28235

Old IE versions in particular have a host of client-side vulnerabilities. We try to mitigate those as much as possible, but since there are so many we won't ever be able to avoid all of them. One option to prevent these security issues from causing real damage is to stop handing out sessions to old and insecure browsers. According to http://stats.wikimedia.org/wikimedia/squids/SquidReportClients.htm IE6 for example currently performs only 0.31% of all requests. If we can establish that only a handful active users are actually still using IE6, then we could simply encourage those to upgrade and stop handing out sessions to IE6. Reading will still work, only editing would be disabled for IE6 users. Advantages: * free up resources, can focus on things more relevant to current users * lets us get rid of complexity and limitations in the code Information we need: * browser market share of active editors vs. anonymous users, with a focus especially on old browsers Nice to have, if possible: * JS support of logged-in users vs. anon readers -------------------------- **Version**: wmf-deployment **Severity**: normal **See Also**: https://bugzilla.wikimedia.org/show_bug.cgi?id=52295 https://bugzilla.wikimedia.org/show_bug.cgi?id=58368 https://bugzilla.wikimedia.org/show_bug.cgi?id=28235

Old IE versions in particular have a host of client-side vulnerabilities. We try to mitigate those as much as possible, but since there are so many we won't ever be able to avoid all of thosethem. One option to prevent these security issues from causing real damage is to stop handing out sessions to old and insecure browsers. According to http://stats.wikimedia.org/wikimedia/squids/SquidReportClients.htm IE6 for example currently performs only 0.31% of all requests. If we can establish that only a handful active users are actually still using IE6, then we could simply encourage those to upgrade and stop handing out sessions to IE6. Reading will still work, only editing would be disabled for IE6 users. Advantages: * free up resources, can focus on things more relevant to current users * lets us get rid of complexity and limitations in the code Information we need: * browser market share of active editors vs. anonymous users, with a focus especially on old browsers Nice to have, if possible: * JS support of logged-in users vs. anon readers -------------------------- **Version**: wmf-deployment **Severity**: normal **See Also**: https://bugzilla.wikimedia.org/show_bug.cgi?id=52295 https://bugzilla.wikimedia.org/show_bug.cgi?id=58368 https://bugzilla.wikimedia.org/show_bug.cgi?id=28235