Microsoft to drop support for older versions of Internet Explorer & .NET Framework

[Arthur]

About time!

 

Sources: Microsoft (IE / .NET Framework) (via Ars Technica / ZD Net)

 

Microsoft has supported Internet Explorer for an awfully long time. Each new version of Windows comes with a minimum of five years of mainstream support and five years of extended support. That support window covers all bundled and integrated software—including Internet Explorer—and any software updates.

 

Windows Server 2003, for example, is supported until July 2015. As such, Internet Explorer 6 (bundled with that operating system), Internet Explorer 7 (available as an update for that operating system), and Internet Explorer 8 (likewise, an update) are all supported until July 2015.

 

But all that is set to change under a new support policy announced today that is scheduled to take effect in about 18 months. Starting 12 January 2016, only the newest version of Internet Explorer for any given version of Windows will be supported. Older versions will cease to receive security fixes and other updates.

 

Once the new policy takes effect, Windows Vista and Server 2008 users must use Internet Explorer 9, and Windows 7 and Server 2008 R2 users must use Internet Explorer 11. Windows Server 2012 users must use Internet Explorer 10, while Windows 8.1 and Windows Server 2012 R2 users must have Internet Explorer 11.

 

[...]

 

As we note each month, while the majority of Chrome and Firefox users are all using the newest version of those browsers, Internet Explorer has a large user base that's using old versions. Internet Explorer 8 is currently the most widely used version of the browser.

 

Microsoft started making Internet Explorer updates automatic with Internet Explorer 9 and made them automatic from day one with Internet Explorer 10. The result was that versions 10 and 11 spread much more quickly than their predecessors. But unlike the competition, the carrot of better performance and standards compliance never had a corresponding stick of non-support.

 

In 2016 that will finally change, a move that should help push old versions of Internet Explorer off the Internet. As we've seen with Windows XP, that change sadly won't be instant, but any bit of pressure to discourage the use of old browsers can only be a good thing.

 

 

In an unrelated backward-compatibility development, Microsoft also announced today that .NET Framework 4.5.2 will be the only supported version for .NET 4 applications:

 

We will continue to fully support .NET 4, 4.5, 4.5.1, and 4.5.2 until 12 January 2016, this includes security updates as well as non-security technical support and hotfixes. Beginning 12 January 2016 only .NET Framework 4.5.2 will continue receiving technical support and security updates. There is no change to the support timelines for any other .NET Framework version, including .NET 3.5 SP1, which will continue to be supported for the duration of the operating system lifecycle.

[Arthur]

Old versions of the Java plug-in will also be blocked in IE starting next week.

 

Source: Microsoft (via ComputerWorld)

 

 

IE plays security catch-up, will block outdated Java plug-ins

Microsoft today said that Internet Explorer (IE) will begin blocking out-of-date ActiveX controls -- the browser's proprietary plug-in format -- when the company updates the versions that run on Windows 7 and Windows 8 next week.

 

In a blog post, a pair of Microsoft managers said that IE8, IE9, IE10 and IE11 on Windows 7, as well as IE10 and IE11 on Windows 8's classic desktop, will be refreshed next Tuesday. The updated browser will then display a notification when a website tries to load an outmoded ActiveX control.

 

Initially, IE will only block outdated versions of Java.

 

"It's very important that you keep your ActiveX controls up-to-date because malicious or compromised Web pages can target security flaws in outdated controls to collect information, install dangerous software, or let someone else control your computer remotely," Fred Pullen, a senior product manager for IE, and Jasika Bawa, a program manager from Microsoft's security team, said in the Wednesday blog.

 

When IE encounters an obsolete Java ActiveX control, the warning will let users choose between ignoring the alert, thus running the control, or updating the Java plug-in. Clicking on the "Update" button will direct the browser to the control vendor's website to download the newest version.

 

IT administrators will have several new Group Policy settings to manage IE on workers' PCs, including one that turns off the warning altogether and another that deletes the "Run this time" button and so prevents employees from overriding the notification.

 

After Tuesday, IE will block all but the current versions of Java. For Java 8, that means a warning will appear if the browser's running any version except for Java SE 8 Update 11, which Oracle released in mid-July.

 

Although Microsoft is starting with Java -- which has long been targeted by cyber criminals because of a glut of vulnerabilities, but also because users typically run outdated versions -- it promised to expand the blocking program.

[Trapper]

So for Brum schools - HR and Finance portal or Dot Net applications!

[computer_expert]

Is it me or does anyone find it strange that 2008 R2 gets IE11 whereas the newer server 2012 only gets IE10?

 

I realize that not many people would browse the net on a server though!

[Arthur]

Is it me or does anyone find it strange that 2008 R2 gets IE11 whereas the newer server 2012 only gets IE10?

This was mentioned in the Ars Technica article (see quote below). It's because 2008 R2 was based on Windows 7 and Windows Server 2012 was based on Windows 8.0. This means the former gets IE11, while the latter is stuck with IE10.

 

The Windows Server 2012/Internet Explorer 10 pairing is due to Microsoft's slightly odd handling of the transition from Windows 8 to 8.1, and 2012 to 2012 R2. There is no version of Internet Explorer 11 for Windows 8. However, for Windows 8, the Windows 8.1 update is essentially a service pack, and this includes Internet Explorer 11. Windows 8 and 8.1 have two years of "parallel" support, during which both receive updates. After that period, the (free) 8.1 update becomes mandatory anyway. The cut-off date for Windows 8.0 is also January 12, 2016.

 

Windows Server 2012 is the server counterpart to Windows 8 and ships with Internet Explorer 10. However, Windows Server 2012 R2, the counterpart to Windows 8.1, isn't treated like a service pack and isn't a free update (except for Software Assurance customers). Instead of two years of parallel support, both Windows Server 2012 and Windows Server 2012 R2 are supported all the way through 2023.

 

Unless Microsoft remedies this somehow (either by treating the server operating system the same way as the desktop operating system, or by releasing the new browser for the older operating system), Internet Explorer 10 will continue to be supported and updated.

Edited August 9, 2014 by Arthur

[pete]

While I welcome this, I suspect that Microsoft will relent like they always do after the whining starts.

[free780]

I was impressed with Java 6 U 81 I thought it only went up to 45. Turns out you have to pay oracle for updates.

[localzuk]

Oh God. The Java one will be annoying, considering how many releases they make.

[free780]

Turn the feature off via GPO.

Download Administrative Templates for Internet Explorer 11 from Official Microsoft Download Center

[Arthur]

Oh God. The Java one will be annoying, considering how many releases they make.

Turn the feature off via GPO.

Better still, keep the feature enabled, but add the sites you want the Java plugin to work on to your Local Intranet or Trusted Sites security zones. Simples!

 

http://blogs.msdn.com/b/cjacks/archive/2014/08/12/the-impact-to-the-enterprise-of-blocking-out-of-date-activex-controls.aspx

 

We don't believe that blocking old versions of ActiveX controls will impact the enterprise because we’re excluding the two zones that enterprise apps live in: Local Intranet and Trusted Sites.

 

I phrase it as “we don’t believe” very deliberately, because it happens all the time that we have reasoned our way to some conclusion, and we haven't seen a side of the problem that invalidates our conclusion. So, if you believe you have a reason why this impacts you, and you are an enterprise, then we're curious to understand the scenario. But otherwise, our expectation is that we've built a feature that protects your users when you're surfing the big bad internet, blocking potentially malicious sites from instantiating a vulnerable control on your users’ devices, while continuing to allow it for internal sites. This feature should make you safer without having a significant compatibility impact.