Of course, since it’s a Microsoft-sponsored campaign, it’s only promoting upgrades, rather than promoting an upgrade-or-switch message.

Static HTML points out why you might want to put your effort into some other campaign instead. Because IE6 Countdown is only an upgrade campaign, and IE6 users are all on Windows XP or below (Vista ships with IE7), they can only ever upgrade as far as IE8. Given the huge gap between IE8 and IE9 in terms of standards support, HTML5, CSS3, and so forth, IE8 will soon become the new millstone around the web’s neck.

So instead of plugging IE, consider plugging your own favorite browser, be it Firefox, Chrome or Opera. Or perhaps plug another switch campaign. After all, there are quite a few alternative web browsers out there!

IE6 is now two versions behind the current release.

IE6 is almost 8 years old (it was released in 2001).

IE6 is lacking in many capabilities that all other modern web browsers have, in web technology, in security, and in features you can use.

You can read a review at Wired, a write-up from the IE team, or a summary of technical changes from WaSP.

Of course, Internet Explorer isn’t the only option out there. There’s Firefox, Opera, Chrome and a host of other alternative browsers that are worth checking out.

If you’re still running Windows 2000 or some other old version of Windows that can’t run IE7 or IE8, I’d absolutely recommend Firefox or Opera. Either will be much better than IE6, both will run on Windows 2000, and Opera will even run on Windows Me and Windows 98 (but you really ought to move to something more current than Windows Me.)

Back when I wrote the original post, I had a series of 5 or 6 milestones in mind, but decided to keep it simple and only post the first two. The next one after Firefox passing IE6 was for Firefox 2+ to pass IE6. I should have been checking in more frequently, since it already has.

So what’s next? Well, I expect to see the following in the next year or two:

• Firefox 3 replacing Firefox 2. It’s already got a strong pre-release following. (Fx2 will stick around while there are still Win98 and WinMe users, but they’re already at less than 1% here and falling.)
• Firefox 1 fading into the sunset in favor of newer, more capable releases.
• Netscape disappearing into history. (It’s already below 1% here.)
• IE6 dropping below 25%, 20%, 10% (watching it go to single digits will be satisfying), and finally 1%.
• Safari approaching 10%. It’s holding steady here, but keeps climbing globally.

Things I’d like to see, but am less confident about in the near-term:

• IE6 disappearing from the radar. There are hold-outs, both at the user and the sysadmin level, plus a sizeable minority on Windows 2000. Plus I think Microsoft is committed to supporting IE6 through the lifetime of Windows XP, which means they’ll keep shipping security fixes until 2014. On the other hand, IE 5.0 is technically still supported as part of Windows 2000, but I see very few IE5 visitors these days.
• IE8 replacing IE7, for most of the same reasons it’s taking so long for IE7 to replace IE6.
• Opera breaking out of its steady marketshare and hitting a solid 5%. That would make them much harder to ignore. (10% would be better, since Safari’s still struggling for recognition at 6%.) Of course, to get there they’ll have to pull off a major publicity coup.
• IE dropping below 50%. Could be done, but it’ll be tough. If there’s no majority browser, it’ll be very difficult to justify building a site for one browser only.

Of course, these will probably all happen faster locally than globally, since the audience seems to skew slightly toward the alternatives, but then local stats are the ones that actually matter for a specific site.

Well, yeah. That’s our job.

And a bunch of random websites blocking IE6 aren’t going to convince people to change. If I were to block IE6, or only allow Firefox, or only allow Opera, I’d have to have seriously compelling content to get people to switch. Mostly, people would get annoyed and move on. Who’s going to install a new browser just so they can read the history of the Flash? Or choose an ISP? Or buy a product that they can get from another site?

Slapping the User in the Face

It’s so easy for someone to walk away from your site. One of the tenets of good web design is to make the user jump through as few hoops as possible to accomplish whatever you want him/her to do. Every hoop you add is an obstacle. Too many obstacles, and they’ll just go somewhere else more convenient.

Back when I was following Spread Firefox, every once in a while someone would suggest blocking IE. Every time, people like me would shoot it down. And think about it: what does the average Firefox user (or Opera user, for that matter) do when confronted with a site that will only run in IE? Fire off a complaint, or move on, unless it’s something they can’t live without, like, say, their bank. Only then will they bring up the site’s preferred browser…just long enough to do their business and move on.

Plus it goes against the grain of the concept that a website should be viewable in any browser. It offends my sense of… I don’t know, egalitarianism.

Recommend vs. Demand

My current tactics: I target the latest versions of each browser (or rather, the overlap in their standards support), toss in enhancements where I think something would be nice, but not critical (off-site link icons using generated content, for instance, which works in everything except IE≤7, or rounded corners, which only work in Gecko and WebKit so far). And I take that, and make it look reasonably good in IE6. I don’t try to make it perfect anymore (case in point, the header of this blog), but I try to make sure it’s functional and doesn’t look broken.

Then I include a polite notice recommending that people upgrade to something a little more capable or modern for a better experience, but I don’t require them to do so. I don’t pop up anything that moves, or blocks content, or forces them to click through an extra page.

Enter: PayPal

Now, remember what I said about banks? PayPal intends to block “unsafe” browsers from accessing their site (via Slashdot). They aren’t technically a bank, but PayPal is actually in a position where they might be able to do it: they’re the most well known online payment service where two random people can send each other money. Probably more people will switch browsers and keep PayPal than switch payment services and keep their browser.

They’ve since indicated that they don’t intend to block “current versions of any browsers,” but will focus on “obsolete browsers on outdated or unsupported operating systems.” So you IE4 users on Windows 98? Upgrade already! (And since you can’t install IE7, try Opera. It still runs on Win98!)

They’ve also cited such safety features as phishing protection (present in IE7, Firefox 2, and Opera 9) and support for Extended Validation SSL Certificates (present in IE7 and the upcoming Firefox 3 and Opera 9.5).

Hazards of Browser Sniffing

Of course, once you start actively blocking browsers, you have three choices:

• Keep track of every single browser out there, and every version.
• Let most browsers in, but only block a few problem browsers (similar to Yahoo’s Graded Browser Support)
• Unfairly block browsers that might be perfectly adequate just because you can’t be bothered to investigate them.

The last seems the most prevalent. Just ask any Opera user today, or any Firefox user of 3 years ago. (I remember using Firefox and being told to “upgrade” to Netscape 6, even though NS6 was based on an older version of the same engine. Remember: Gecko is Gecko.)

Whitelist approaches to browser detection are, by their nature, either going to require constant updating or block too much. In this case, issues would include:

• Less well-known browsers, like Flock, which uses the same anti-phishing features as Firefox
• Browsers that don’t do phishing detection themselves, using third-party plugins to do the job.
• Changes in status, when browsers add the capabilities required to get on the list.

Thankfully, it looks like PayPal is going with the most minimally-intrusive approach: blocking only the most troublesome browsers, and letting the rest connect normally.

Will it Work?

There’s still the question of whether it’ll actually make users less likely to land on a PayPal phishing site.

For one thing, it’s not clear whether they’ll block IE6. The initial report would definitely have excluded it, since it lacks both EV support and anti-phishing (without an add-on). But the follow-up statement was focused on Safari. Does PayPal consider IE6 to be a “current” version since Microsoft still supports it? Or do they consider IE7 to be current, and IE6 to be obsolete?

Certainly, if they don’t block IE6, this will really only impact the tiny fraction of users running horribly outdated software. (Well, more horribly outdated.)

The thing to remember is that the features PayPal is promoting will only help if users switch for general browsing. In fact, anti-phishing will make no difference at all on PayPal’s actual site, unless it gets hacked (at which point the user is screwed anyway.)

So let’s suppose that they do block IE6. As much as I’d like people to switch to Firefox or Opera full-time, I’m sure there will be some people who only fire up an alternative to use PayPal, and who stick with IE6 the rest of the time. They’re just as likely as before to click on a bogus “Pay with PayPal” button, or a link in a phishing email. If they weren’t going to do that in the first place, the browser requirement wasn’t needed. If they were, the browser requirement doesn’t help. The bogus sites won’t require phishing detection, or EV certs. Imagine the user saying, “Hey, PayPal fixed the problem where it wouldn’t let me use IE!”

And of course it won’t stop someone with a stolen login and password from connecting using an “approved” browser.

The ISC has also weighed in re: limitations of EV certificates. Among other things: it may be easier to get an EV cert than suggested, in which case it won’t indicate any greater degree of trust than a standard SSL certificate. And it doesn’t prevent other issues, like keyword loggers or trojans that simply hijack a user’s session.

I apologize for the rambling nature of this post (yeah, site title and all that). But I worked on it on a succession of late nights, and decided it was time to just post the thing. Also, I should have a somewhat more concise post up on OperaWatch soon now.

The ISC reminds us that IE7 will be pushed out to WSUS next week, which should help get rid of IE6. Yeah, I’d rather more people switched to Firefox or Opera, but I’m at the point where I’d love to be able to stop worrying about IE6′s shortcomings when trying to build sites. IE7′s shortcomings are much easier to work around. (Sorry to keep harping on this!)

The inventor of Norton Antivirus talks about computer security and has some rather interesting ideas on what policies are worth pursuing…and what policies aren’t. Long passwords? Great for protecting a stand-alone machine, but on a 10,000 machine network, they only need to crack one. Patch everything? Not every vulnerability gets exploited. I’ll have to read the Slashdot thread when I have time; that should be really *ahem* interesting.

Finally!

Breakdown of major browsers according to AWStats:

The gap between IE7 and IE6 is solid, nearly 6 percentage points. That’s Safari and Opera combined. And the gap between Firefox and IE6 is closing, with Firefox climbing and IE6 falling. With any luck, it won’t be long before Firefox overtakes IE6 here.

Of course, stats here always seem to skew higher for alternative browsers than global stats. I think it’s because most of the traffic is for a comic fan site. Visitors are probably a bit geekier than average, and therefore more tech savvy than average, and therefore more likely to have installed something other than the default IE.

If you’re still running IE6, and you aren’t required to for policy or compatibility reasons, it’s time to look into a change. The web is moving on. I highly recommend that you either upgrade to IE 7 or switch to an alternative like Firefox or Opera.

Really, the only things holding me back from jumping up to Firefox 3 on my main computers at home and at work were Firebug and some of the HTML validator extensions. Firebug is complicated enough that I didn’t want to rely on the Nightly Tester Tools to disable the compatibility checks. Then I found out that there’s a Firebug beta that does work with Firefox 3. That was enough. Last night I took the plunge.

Meanwhile, things look good on the ditch-IE6 front. After last month’s false alarm due to a local maximum, it looks like IE7 has solidly overtaken IE6 on this site! For the first 13½ days of January, Internet Explorer accounted for 62.5% of total hits. IE7 was 33.5%, and IE6 was only 28.4%. Even better, that’s barely over 1 percentage point from Firefox’s 27.2%!

Most likely, a lot of people got new computers for Christmas. New Windows boxes would mostly be Vista, and would ship with IE7. Another factor might be techies visiting their relatives and helping clean up/update their computers. They might have taken the opportunity to install IE7 or Firefox.

Not by a lot. IE7 has 32.7% and IE6 has 30.3% of the total. And I expect it’ll level out or even reverse as stats from a regular work week filter in. But still, something has finally surpassed that moldering, zombified, shambling heap of a web browser.

Next step: getting Firefox’s numbers (currently 26.8%, also above the global levels) over IE6.

Come on, let’s put a stake in this relic. It’s done.

Update (Thursday): And now Microsoft is finally starting to talk about IE8…even if it is just to say they’ve picked out a name. Whee.

As for the stats, the gap has closed somewhat in the last 2 days, with IE7 at 31.6% and IE6 at 31.2%. This is definitely looking like a home/office split. I’m going to have to write a script sometime to do a daily breakdown of browser versions and see if this actually fits.

Update (Saturday): Yes, IE6 has caught up. 32.2% to 31.1%. *sigh* It turns out I was just seeing a local maximum.

Because Microsoft takes its commitment to help protect the entire Windows ecosystem seriously, we’re updating the IE7 installation experience to make it available as broadly as possible to all Windows users. With today’s “Installation and Availability Update,” Internet Explorer 7 installation will no longer require Windows Genuine Advantage validation and will be available to all Windows XP users.

As much as I prefer alternatives like Firefox and Opera, I’ve been frustrated at the relatively slow uptake of IE7. It’s just insane that 6 years after its release, we’re still stuck designing for IE6 as the world’s most-used browser.

So who’s still running IE6?

1. People running older versions of Windows that can’t run IE7, and who haven’t switched to something else. (This is a pretty small percentage, judging by OS stats.)
2. People who don’t know how to upgrade to IE7, or why they should.
3. People who actually want to stay with IE6 (whether for technical reasons or just stubbornness)
4. People who would be happy to upgrade to IE7, except they can’t/won’t run WGA (on principle, or because it’s broken on their system, or because their OS is pirated).

I don’t know how big each group is, but Microsoft seems to think it’s worth going after #4.

It’ll be interesting to see whether there’s a jump in IE7′s marketshare relative to IE6. Maybe we’ll reach that next milestone sooner than I expected.