I thought I’d check my sites’ stats to see how quickly people are upgrading to Firefox 1.5. I’ve got a script I wrote a while back that totals hits by Firefox 0.x, 1.0.x, and now 1.5.x and shows the percentage of the latest version out of all Firefox hits.

I tried it on this month’s logs from the Alternative Browser Alliance first, since it’s a much smaller log file, and saw that Firefox 1.5 accounts for anywhere from 43% to 69% of Firefox users visiting the site on a given day. Then I checked it against Hyperborea, which gets a more mainstream audience, and found that only 15-24% of its Firefox hits were from users who have upgraded.

Sticking with the more mainstream site, I looked at some other statistics. While Firefox as a whole is doing quite well at 18.9% (plus another 1.4% for Netscape and 1.2% for Mozilla), there’s a shockingly large number of people still using Internet Explorer 5 for Windows. MSIE 5.0 and MSIE 5.5 are eachpulling 1%. That doesn’t sound like much, but there are more people on outdated versions of IE than any version of Netscape, and each IE version is pulling in more than all versions of Opera combined (0.9%).

This, frankly, sucks. MSIE 6 is a free upgrade that will run on any system that can run ether 5.0 or 5.5, and is a significant improvement over either. IE6, Firefox, or Opera will all run on even obsolete versions of Windows—and there are more ofthose than you might think as well! (I’m seeing 4.8% of traffic coming from Windows 98—more even than Windows Me.)

Internet Explorer 6.0 came out in October 2001, so people have had four years to upgrade, and 2.7% of IE users still haven’t upgraded. Maybe they can’t, because IT has locked their systems down. Maybe they don’t know there’s both a newer version and a wealth of alternatives. Maybe they don’t think it’s worth changing. Even IE5/Mac has its adherents after Microsoft abandoned it in favor of Apple’s own Safari. And while some might disagree, we’re stuck developing for it.

Firefox should have a faster upgrade curve than IE, if Dave Shea’s pre-installed/downloadable split holds true and people who make the effort to add a browser still make more effort to upgrade it. (It seems to be holding for Opera, at least, since the majority of Opera users are already on 8.5 after only a few months.) But I still see hits from Firefox 0.8 and 0.9, and I’ve seen a lot of people with that red update icon in the toolbar.  I have to wonder if the mainstream acceptance of Firefox may have altered the patterns that held during the IE6 era.

I’m hoping uptake of Firefox 1.5 will go faster. Aside from getting people onto auto-updates, it brings new design possibilities with SVG, canvas, etc. But I know there are a lot of fire-and-forget admins out there, and a lot of everyday users who just installed it once and don’t see why they need to upgrade. It’ll be interesting to see how SFX’s new dual mission will go.

Originally posted on my Spread Firefox blog.

The internet is a hostile place. Viruses, worms, and worse are constantly trying to break or break into your computer. Software developers are constantly fixing the holes that can let them in. It’s become critical to keep your system up to date. Unfortunately this can be very frustrating, even for a power user, for one simple reason: you have to keep track of each program individually.

Sure, the operating systems have their own centralized places. Microsoft has Windows Update, and Apple has Software Update. But every application that exposes itself to the network directly or opens untrusted files has to be updated, and there are many that aren’t part of the operating system.

So Symantec has Live Update. Real Player has its own updater. iTunes and QuickTime for Windows can update themselves. Adobe Reader has an update function. Firefox is redesigning its update system. Games check for updates when they connect to the network.

But wouldn’t it be nice if Windows would grab the Acrobat updates overnight, instead of waiting until the next time you launched it? Wouldn’t you like to be able to patch everything on your system at once and just not worry about it? As a software developer, wouldn’t you like to be able to let someone else deal with the update problem instead of re-inventing the wheel yet again?
Continue reading

FirefoxIf you’re a Firefox user, and you see a little red circle with an up-arrow (or a tree, depending on your interpretation) in the upper-right corner of the window, it’s time to upgrade.

Firefox update warning icon (red circle)This icon tells you that an updated version of Firefox is available. There have been several security updates since Firefox 1.0 was released last October, with the current version being 1.0.4. I’ve seen a lot of these on computers I don’t manage myself. Either it’s too subtle or people have interpreted “more secure” as “completely secure” and don’t know they need to keep up to date.

You don’t need to uninstall Firefox in order to upgrade, and you don’t need to create a new profile. These used to be true when it was still in beta, but haven’t been necessary since it hit 1.0. (There also used to be a bug where Firefox would be listed twice in Add/Remove Programs, but it wouldn’t cause any problems.)

Just clicking on the red circle will give you a chance to grab the installer. Yes, with FF 1.0 it does still need to download the whole installer—all 4 MB of it, which is still smaller that some of the updates I’ve had to grab for IE—but Mozilla is working on major improvements to the updater for 1.1.

Incidentally, if you see a blue circle instead of a red one, that means some of your extensions have updates available. Just click and follow directions.

We finally replaced our 4-year-old Windows Me computer with a new Dell (I’d had enough of building computers a few weeks ago) and it arrived yesterday. Katie had already asked me to upgrade her Mac while she made pizza for an office party. I had planned to finish installing Tiger first, but once you get past a couple of options and the EULA it’s all a matter of waiting for it to finish.

There’s something oddly exhilarating about simultaneously setting up both a Mac and a PC.

Of course I spent the next few hours registering the pre-installed software and updating everything. Run Windows Update. Reboot. Run LiveUpdate for Norton Internet Security. Reboot. Run Office Update (twice). It’s nice that Dell will pre-install stuff for you, but given that the computer is built to order, you’d think they could apply the updates before shipping.

With today’s hostile internet, it would greatly benefit not just new computer owners but the world at large if Microsoft (and Apple and Red Hat, while we’re at it) would take a cue from SuSE and Mandrake and tie their update systems into the setup process.

To Microsoft’s credit, Windows XP setup gives you a chance to turn on automatic updates, and recommends it to the point of “Well, if you really want to turn it off, you can, but you’ll be sorry!” And I’m reasonably certain Windows Firewall was turned on by default (i.e. it’s on now, and I don’t remember turning it on), though Norton supersedes a lot of its functionality. Depending on the default firewall rules, that should mitigate the impact of any worms that happen to pick your IP address before you run Windows Update.

Correction: It seems Windows Firewall wasn’t on as I thought. Norton Personal Firewall kept asking me whether I wanted to disable redundant rules (makes sense) or disable Windows Firewall entirely (I told it no—twice), so I assumed it was running. I hope it was only off because Norton was pre-installed.

People have justifiably criticized Firefox’s update system. It’s nowhere near what anyone wanted for 1.0, and it’s apparently a priority for 1.1. But for all its faults, at least they managed not to release a browser with publicly-known security vulnerabilities* to immense fanfare, then release a fixed version a day later—without any fanfare I could see—the way “Netscape” did.

Six days later, my copy of “Netscape” 8 still hasn’t noticed that there’s a critical security update available, even when I tell it to check. Fortunately I’m not using it for everyday browsing, since I just grabbed it out of curiosity. I finally gave up and downloaded 8.0.1, just in case I forgot about it later.

*Just as Netscape 6-7 were based on Mozilla, Netscape 8 is based on Firefox. Netscape 8.0 was based on Firefox 1.0.3, which contained a pair of security bugs that had already been fixed in Firefox 1.0.4. Given that the holes were widely publicized on May 7, Mozilla released a fix on May 12, and AOL released Netscape 8.0.1 on May 20, I don’t see why they couldn’t have incorporated the fix for the May 19 release.