Last modified: 2014-10-15 15:50:31 UTC
Old IE versions in particular have a host of client-side vulnerabilities. We try to mitigate those as much as possible, but since there are so many we won't ever be able to avoid all of those. One option to prevent these security issues from causing real damage is to stop handing out sessions to old and insecure browsers. According to http://stats.wikimedia.org/wikimedia/squids/SquidReportClients.htm IE6 for example currently performs only 0.31% of all requests. If we can establish that only a handful active users are actually still using IE6, then we could simply encourage those to upgrade and stop handing out sessions to IE6. Reading will still work, only editing would be disabled for IE6 users. Advantages: * free up resources, can focus on things more relevant to current users * lets us get rid of complexity and limitations in the code Information we need: * browser market share of active editors vs. anonymous users, with a focus especially on old browsers Nice to have, if possible: * JS support of logged-in users vs. anon readers
Change 93526 had a related patch set uploaded by Ori.livneh: Log User-Agent strings on successful authentication requests https://gerrit.wikimedia.org/r/93526
Change 93526 abandoned by Ori.livneh: Log User-Agent strings on successful authentication requests Reason: Logged by default. https://gerrit.wikimedia.org/r/93526
Note, Windows XP hit End of Life today, meaning there are no more security updates (except for companies that can afford Custom Support contracts). This is the last supported desktop OS that could run IE6.
Using event logging data, Oliver found that IE 6 has only 0.00479% of logged-in page views these days. That means that disabling logins for IE 6 could be a good option to avoid spending more time on IE 6 specific XSS issues. Other relevant browsers: IE 6 0.00479% IE 7 0.768% IE 8 1.616% IE 9 1.899% Full data: "user_agents.vec" "Freq" "Percentages" "Firefox 27" 33628 26.8950845370059 "Chrome 33" 32820 26.2488603099957 "Chrome 32" 9410 7.5259529408001 "IE 11" 7993 6.39266119615465 "Firefox 28" 3254 2.60249212214278 "Opera 12" 2740 2.19140393812883 "Safari 7" 2549 2.03864548842715 "Mobile Safari 7" 2462 1.96906441447926 "IE 9" 2375 1.89948334053138 "IE 10" 2343 1.8738903018379 "IE 8" 2021 1.6163603499848 "Firefox 26" 1968 1.57397187964874 "Safari 5" 1506 1.20447238351168 "Chrome 31" 1275 1.01972263544316 "Safari 6" 1269 1.01492394068813 "Android 4" 1143 0.914151350832574 "IE 7" 961 0.768590943263432 "Firefox 24" 803 0.642225314714398 "Opera 20" 798 0.638226402418542 "Opera 19" 688 0.550250331909721 "Chrome 34" 500 0.399891229585553 "Mobile Safari 6" 453 0.362301454004511 "Chrome Mobile 33" 449 0.359102324167826 "Firefox 25" 431 0.344706239902746 "Android 2" 403 0.322312331045955 "Chrome 30" 353 0.2823232080874 "Firefox 3" 351 0.280723643169058 "Firefox 17" 349 0.279124078250716 "Firefox 22" 325 0.259929299230609 "Chrome Mobile 32" 318 0.254330822016412 "Firefox 16" 316 0.252731257098069 "Chrome 29" 312 0.249532127261385 "Chrome 27" 302 0.241534302669674 "Firefox 20" 272 0.217540828894541 "Yandex Browser 13" 272 0.217540828894541 "Firefox 29" 270 0.215941263976198 "SeaMonkey 2" 267 0.213541916598685 "Chromium 32" 254 0.203144744629461 "Firefox 23" 254 0.203144744629461 "Chrome 35" 249 0.199145832333605 "Iceweasel 24" 241 0.192747572660236 "Chrome 21" 238 0.190348225282723 "Mobile Safari 5" 222 0.177551705935985 "Firefox 30" 207 0.165554969048419 "Chrome Mobile iOS 33" 190 0.15195866724251 "Chrome 28" 189 0.151158884783339 "Firefox 12" 189 0.151158884783339 "Chrome 26" 186 0.148759537405826 "Yandex Browser 14" 175 0.139961930354943 "Pale Moon (Firefox Variant) 24" 145 0.11596845657981 "Firefox 21" 144 0.115168674120639 "IE Mobile 10" 143 0.114368891661468 "Firefox 10" 142 0.113569109202297 "Safari 4" 129 0.103171937233073 "Chrome Mobile 28" 112 0.0895756354271638 "Firefox 14" 111 0.0887758529679927 "Chrome 24" 109 0.0871762880496505 "Firefox 19" 109 0.0871762880496505 "Maxthon 4" 109 0.0871762880496505 "Opera 11" 109 0.0871762880496505 "Firefox 18" 108 0.0863765055904794 "Chrome Mobile 18" 105 0.0839771582129661 "Firefox 15" 96 0.0767791160804261 "Amazon Silk 3" 80 0.0639825967336884 "Firefox 11" 79 0.0631828142745173 "Mail.ru Chromium Browser 28" 79 0.0631828142745173 "Chromium 31" 77 0.0615832493561751 "Chrome 23" 75 0.0599836844378329 "Chrome 25" 75 0.0599836844378329 "Chrome 22" 72 0.0575843370603196 "Sogou Explorer 1" 67 0.0535854247644641 "Sleipnir 4" 65 0.0519858598461218 "Chrome 11" 63 0.0503862949277796 "Chrome 18" 61 0.0487867300094374 "Firefox 9" 61 0.0487867300094374 "Iceweasel 17" 60 0.0479869475502663 "Opera 18" 57 0.045587600172753 "Chromium 33" 55 0.0439880352544108 "Iceweasel 27" 53 0.0423884703360686 "Firefox 31" 52 0.0415886878768975 "Chrome Mobile 31" 50 0.0399891229585553 "Firefox Mobile 27" 50 0.0399891229585553 "Firefox 13" 47 0.037589775581042 "Firefox 5" 47 0.037589775581042 "Iceweasel 3" 43 0.0343906457443575 "BlackBerry WebKit 7" 39 0.0311915159076731 "Camino 2" 37 0.0295919509893309 "Firefox 8" 37 0.0295919509893309 "Chromium 25" 36 0.0287921685301598 "Opera Mobile 12" 36 0.0287921685301598 "Chrome Mobile 30" 35 0.0279923860709887 "Chrome Mobile iOS 32" 34 0.0271926036118176 "Avant 1" 31 0.0247932562343043 "Chrome 6" 31 0.0247932562343043 "Opera 16" 31 0.0247932562343043 "Chromium 30" 29 0.0231936913159621 "UC Browser 9" 29 0.0231936913159621 "Iceweasel 10" 28 0.022393908856791 "Iron 31" 27 0.0215941263976198 "Chrome Frame 32" 26 0.0207943439384487 "Chrome Mobile iOS 31" 23 0.0183949965609354 "Firefox 6" 23 0.0183949965609354 "Chrome 4" 22 0.0175952141017643 "Other Other" 22 0.0175952141017643 "Chrome 16" 21 0.0167954316425932 "Firefox 4" 21 0.0167954316425932 "Firefox 7" 21 0.0167954316425932 "Chrome 20" 20 0.0159956491834221 "Konqueror 4" 19 0.015195866724251 "Iceweasel 20" 18 0.0143960842650799 "Iron 32" 18 0.0143960842650799 "BlackBerry WebKit Other" 16 0.0127965193467377 "Iron 30" 16 0.0127965193467377 "Mobile Safari 4" 16 0.0127965193467377 "NetFront NX 3" 16 0.0127965193467377 "Chrome 10" 15 0.0119967368875666 "Chrome 5" 15 0.0119967368875666 "Sleipnir 2" 15 0.0119967368875666 "BlackBerry WebKit 6" 13 0.0103971719692244 "Opera 15" 13 0.0103971719692244 "Chrome 15" 12 0.00959738951005327 "Chrome 19" 12 0.00959738951005327 "Chrome 9" 12 0.00959738951005327 "Firefox Mobile 28" 12 0.00959738951005327 "Midori 0" 12 0.00959738951005327 "QQ Browser Other" 12 0.00959738951005327 "Safari Other" 12 0.00959738951005327 "Chromium 18" 11 0.00879760705088216 "Chromium 6" 11 0.00879760705088216 "Iron 23" 11 0.00879760705088216 "AOL 9" 10 0.00799782459171105 "Chrome 13" 10 0.00799782459171105 "Chrome 17" 10 0.00799782459171105 "Chrome Mobile 26" 10 0.00799782459171105 "Chromium 29" 10 0.00799782459171105 "IE Mobile 9" 10 0.00799782459171105 "Iron 27" 10 0.00799782459171105 "Iron 28" 10 0.00799782459171105 "Yandex Browser 1" 10 0.00799782459171105 "Chrome 8" 9 0.00719804213253995 "Chromium 28" 9 0.00719804213253995 "Epiphany 2" 9 0.00719804213253995 "Epiphany 3" 9 0.00719804213253995 "Opera 10" 9 0.00719804213253995 "Chrome 12" 8 0.00639825967336884 "Iceweasel 26" 8 0.00639825967336884 "Iron 24" 8 0.00639825967336884 "Opera 17" 8 0.00639825967336884 "Opera 21" 8 0.00639825967336884 "Opera 9" 8 0.00639825967336884 "Sleipnir 5" 8 0.00639825967336884 "Amazon Silk 1" 7 0.00559847721419774 "Chrome Mobile iOS 30" 7 0.00559847721419774 "Firefox Mobile 23" 7 0.00559847721419774 "Iceape 2" 7 0.00559847721419774 "Iceweasel 25" 7 0.00559847721419774 "Lunascape 6" 7 0.00559847721419774 "Opera Mobile 19" 7 0.00559847721419774 "Opera Mobile 20" 7 0.00559847721419774 "AppleMail 537" 6 0.00479869475502663 "Chrome Frame 31" 6 0.00479869475502663 "Chrome Mobile 34" 6 0.00479869475502663 "IE 6" 6 0.00479869475502663 "IE Large Screen 9" 6 0.00479869475502663 "Maxthon 3" 6 0.00479869475502663 "Chrome 14" 5 0.00399891229585553 "Chromium 13" 5 0.00399891229585553 "Chromium 20" 5 0.00399891229585553 "Iceweasel 29" 5 0.00399891229585553 "Mail.ru Chromium Browser 17" 5 0.00399891229585553 "Mail.ru Chromium Browser 27" 5 0.00399891229585553 "Mobile Safari Other" 5 0.00399891229585553 "OmniWeb 622" 5 0.00399891229585553 "Pale Moon (Firefox Variant) 20" 5 0.00399891229585553 "Comodo Dragon 21" 4 0.00319912983668442 "Dolfin 2" 4 0.00319912983668442 "Firefox Alpha 10" 4 0.00319912983668442 "Firefox Alpha 15" 4 0.00319912983668442 "Firefox Mobile 25" 4 0.00319912983668442 "Iceweasel 28" 4 0.00319912983668442 "Iron 29" 4 0.00319912983668442 "Iron 8" 4 0.00319912983668442 "RockMelt 0" 4 0.00319912983668442 "Safari 3" 4 0.00319912983668442 "Sleipnir 3" 4 0.00319912983668442 "UC Browser 2" 4 0.00319912983668442 "Android 0" 3 0.00239934737751332 "BlackBerry WebKit 2" 3 0.00239934737751332 "Chrome 7" 3 0.00239934737751332 "Chrome Frame 21" 3 0.00239934737751332 "Chrome Mobile iOS 19" 3 0.00239934737751332 "Chrome Mobile iOS 28" 3 0.00239934737751332 "Chromium 22" 3 0.00239934737751332 "Conkeror 1" 3 0.00239934737751332 "Firefox Mobile 26" 3 0.00239934737751332 "Google Earth 7" 3 0.00239934737751332 "Iceweasel 21" 3 0.00239934737751332 "Iceweasel 23" 3 0.00239934737751332 "Iron 14" 3 0.00239934737751332 "Kindle 3" 3 0.00239934737751332 "Opera Tablet 12" 3 0.00239934737751332 "Android 3" 2 0.00159956491834221 "AppleMail 531" 2 0.00159956491834221 "AppleMail 534" 2 0.00159956491834221 "Chromium 34" 2 0.00159956491834221 "Googlebot 2" 2 0.00159956491834221 "Iron 17" 2 0.00159956491834221 "Iron 22" 2 0.00159956491834221 "Iron 33" 2 0.00159956491834221 "Iron 6" 2 0.00159956491834221 "Lynx 2" 2 0.00159956491834221 "Maxthon 0" 2 0.00159956491834221 "Opera Mobile 16" 2 0.00159956491834221 "Pale Moon (Firefox Variant) 15" 2 0.00159956491834221 "Pale Moon (Firefox Variant) 3" 2 0.00159956491834221 "Phantom Browser 2" 2 0.00159956491834221 "UC Browser 3" 2 0.00159956491834221 "Chrome 0" 1 0.000799782459171105 "Chrome Frame 25" 1 0.000799782459171105 "Chrome Frame 29" 1 0.000799782459171105 "Chrome Mobile 27" 1 0.000799782459171105 "Chrome Mobile 29" 1 0.000799782459171105 "Chrome Mobile iOS 23" 1 0.000799782459171105 "Chrome Mobile iOS 25" 1 0.000799782459171105 "Chrome Mobile iOS 29" 1 0.000799782459171105 "Chromium 12" 1 0.000799782459171105 "Chromium 27" 1 0.000799782459171105 "Chromium 35" 1 0.000799782459171105 "Firefox Mobile 24" 1 0.000799782459171105 "Firefox Mobile 29" 1 0.000799782459171105 "Flock 2" 1 0.000799782459171105 "Galeon 2" 1 0.000799782459171105 "iCab 4" 1 0.000799782459171105 "IceCat 3" 1 0.000799782459171105 "Iceweasel 8" 1 0.000799782459171105 "Iron 19" 1 0.000799782459171105 "Iron 21" 1 0.000799782459171105 "Iron 25" 1 0.000799782459171105 "Iron 26" 1 0.000799782459171105 "Jasmine 1" 1 0.000799782459171105 "Links 0" 1 0.000799782459171105 "Mobile Safari 3" 1 0.000799782459171105 "NetFront NX Other" 1 0.000799782459171105 "Nokia Browser 8" 1 0.000799782459171105 "Opera Mobile 21" 1 0.000799782459171105 "Rekonq 1" 1 0.000799782459171105 "SeaMonkey 1" 1 0.000799782459171105 "Uzbl 0" 1 0.000799782459171105 "WebKit Nightly 535" 1 0.000799782459171105 "webOS Browser 3" 1 0.000799782459171105
