1495991 - Reconsider extending security support for Firefox 52ESR on Windows XP and Vista

Status: RESOLVED WONTFIX

(Firefox :: Security, enhancement)

Description

[Mateusz Jończyk]

As can be read in the Mozilla Manifesto,
	"We are committed to an internet that includes all the peoples of the earth — where a person’s demographic characteristics do not determine their online access, opportunities, or quality of experience."

This paragraph may relate to the users of Windows XP and Vista. These versions of Windows are currently used disproportionately by disadvantaged people --- people who frequently cannot afford to buy a new computer. By neglecting to provide security support for these people, Mozilla is putting them at risk of the dangers of the Internet: of ransomware and banking malware --- at risk of losing the little money they have. 

Therefore I would like to politely ask Mozilla to consider providing further security updates in the 52 ESR branch for Windows XP and Vista users. I am not certain how resource-intensive that would be, but probably the cost would be tiny in proportion of people still using Firefox on XP and Vista. The updates could be provided on a best-effort basis, without extensive testing. 

According to Statcounter [1], in September around 2.53% [2] of all dekstop users used Windows XP and Vista. On the other hand, in September around 6.16% [3] of all Firefox users were using Firefox 52 ESR - down from 8.37% [4] in July 2018. So it may be safe to assume that around 3-4% of all Firefox users are on Windows XP and Vista.

It is true that there will always be people who are using Windows XP and Vista. Support may be continued for another year, or until the usage share of these systems drops to 1%.

[1] http://gs.statcounter.com/windows-version-market-share/desktop/worldwide/#monthly-201708-201809
[2] Windows XP - 2.51% of all Windows users.
Windows Vista - 0.58% of all Windows users.
Windows users - 81.77% of all desktop users.

	(2.51 + 0.58) * 81.77/100 = 2.53%

[3] http://gs.statcounter.com/browser-version-market-share
	Firefox 52: 0.31% of all Internet users (desktop and mobile),
	Firefox all: 5.03%

	0.31 / 5.03 = 6.16%

[4] 	Firefox 52: 0.42%
	Firefox all: 5.02%

	0.42 / 5.02 = 8.37%

Comment 1

[Mateusz Jończyk]

I do not have a solid access to Windows XP, but could help applying patches.

Comment 2

[Sylvestre Ledru [:Sylvestre]]

I am sorry but this effort won't happen.
We delayed several time the end of life of the support of Windows XP/Vista and this wasn't an easy call to make.

Chutten explained some of the rational in this blog post: https://chuttenblog.wordpress.com/2018/09/05/the-end-of-firefox-windows-xp-support/
https://chuttenblog.wordpress.com/2017/12/20/another-stay-of-execution-for-firefox-users-on-windows-xp/

Comment 3

[vallap]

I like how Chutten makes implications about the current XP usage percentage without actually providing the percentage. If indeed "this trend [of decline] continued without much change", why not show that as a fact?

And as previous discussions with Mozilla staff over at firefox-dev have shown, your people aren't even aware that the Windows Embedded POSReady 2009 variant of XP is in fact still in extended support by Microsoft until 4/9/2019; and virtually all of its security patchea are easily applicable to vanilla XP verbatim, and are actively being used for this very purpose by many.

Not that this would change anyone's minds around here, because percentages are everything, and the fact that each 1% stands for over a million users means nothing. Everyone knows that manifestos are just for show and we must disenfranchise people in order to innovate, right?...

Considering Firefox's own market share decline trends from February 2016, going by the logic employed with XP, you must already be planning on closing up shop pretty soon, no?

Comment 4

[vallap]

Assuming I got me-too'ed based on the "no whining" rule, I'd say that pointing out the fact of an XP variant still being in support more than qualifies as "further evidence to support reopening", as the main argument for this decision has been that XP is long out of support. So, Sylvestre, would you kindly stop burying facts?

Comment 5

[Sylvestre Ledru [:Sylvestre]]

Thanks for your input. However, I don't think we will come back on our decision.
Firefox has been supporting Windows XP for much longer than the main other browsers.

Comment 6

[vallap]

Let's say that's so, but would you mind unhiding the comment where I presented the additional fact? I realize there was some bitterness in what I said, but I don't think I crossed any lines and I think the fact itself deserves to be seen in the open.

Comment 7

[mirh]

Putting aside I hardly can see firefox fitting the windows XP embedded use case, how much microsoft is or isn't supporting its OS should be irrelevant. 
It's all a matter of employing manpower in the best possible way. 
Which in turn is some kind of gain/effort ratio. 

The first thing is the number of users affected. 
Which might be low as a percentage, but that's not the point, it's still a lot of users in absolute value (for as much as decreasing)
The problem is the effort. 
The more time advances, the more 2001 APIs are *so much* limiting (the story could be a bit different with Vista, but it's objectively a boat that sailed long ago, away from the.. love of any people). 

It's really saddening for some computers to become paperweight (with the last standing "firewall" for a remotely safe internet browsing, after OS itself and AVs, becoming eventually stale too) but it had to come. 
But, I mean, it's not like 7 isn't an alternative for just about any hardware back to the Pentium 2 and dx7 days, if one is really invested? Or linux (even though mileage may vary with gpu drivers)?