Our largest clients (both large banks over here) are still on XP+IE8 on their standard desktops. At least we are no refusing to support anything older (there are still pockets of IE7 at RBS it would seem) but I'd love to refuse to support IE8 too...
We couldn't. We don't sell off-the-shelf, we are selling on contract and that contract states that we will support their default build. We could argue the point at the next contract negotiations but if we simply refuse they will simply take their business elsewhere. Our concerns have been raised a number of times and will be raised again and minuted each time, so if there is a problem that comes down to their use of an outdated browser we won't (ligitimately) get it in the neck.
We are charging extra for any custom work to allow for testing and bug resolution specific to ancient combinations, and refusing to address superficial issues at all without a full change request and appropriate payment, but we simply can't refuse to aupport XP+IE8 without telling them to take their £20,000/month elsewhere.
We do have big new potential customers on the horizon, and they are more up-to-date in that respect. Maybe if these people don't upgrade soon and we do get huge new contracts, we'll be in a position to say "your choice, upgrade or go be a problem to our competitors" come the next contract round. I hope so.
I'm betting it will be just as safe/unsafe on April 8th as it is on April 7th. Yes people should have gotten off XP by now, but real life isn't always perfect.
There will not be a massive XP infection on April 8th, it will come at least a few weeks after that ;)
It might very well come on April 8th, since malware authors who find exploits in the period leading up to that date would wisely wait until right after the no-more-patching cliff to release their new 0days.
Considering how many Firefox flaws were saved up for the recent hackathon (since the rewards are 6x what Mozilla usually pays as a bounty), I'm betting on at least a couple critical ones being unleashed the day after, though it may take some time for them to be caught.
