Like Google's Chrome, Mozilla To Silently Update Firefox 4

I like it by .Bruce+Perens · 2010-08-07 01:23 · Score: 0, Funny

They're doing it right, by making it a toggle. Silent mode is perfect for Grandma, since every single damn dialogue box turns into a phone call for me.

Man is she losing it. Last week she called me "Schtopi" (her nickname for my deceased grandfather) and tried to cup my balls.

--

Thanks,
Bruce

I hope this can be disabled... by Anonymous Coward · 2010-08-07 01:25 · Score: 0, Insightful

I don't know about you, but IMHO, Firefox is suffering from it's increasing popularity. At least since Version 3.

Re:I hope this can be disabled... by ThePhilips · 2010-08-07 03:32 · Score: 2, Insightful

They have essentially reached the point of time when there was no competition (technologically, *) left, and interpreted the achieved stability as a stagnation. And that freaked them out and they set out to destroy themselves by screwing up what was working perfectly before.
Kidding. FireFox's focus was always a grandma type of user. The moment when they say goodbye to their tech savvy audience was ought to come and I believe it is upon us. It started in 2.x with some enhancements one couldn't turn off (and had to install couple of add-ons to disable stuff), further expanded in 3.x and I think might peak in 4.x.
I'm already searching for a FireFox' replacement on Windows... IE is too dumb and arrogant (+ poor extensions + idiotic security). Chrome's too primitive (+ constant quirks due to forced updates). Opera is way too feature overloaded and cluttered.
(*) Except for the further development of HTML itself.

--
All hope abandon ye who enter here.
Re:I hope this can be disabled... by Khuffie · 2010-08-07 03:42 · Score: 1

Opera is cluttered? Any extra features you don't use are disabled (ie, if you don't use the built-in mail client, it's not running).
Re:I hope this can be disabled... by ThePhilips · 2010-08-07 03:57 · Score: 0, Troll

Clutter: too many sub-menus, too many functions, too many shortcuts, too many hidden functions. Hitting something by accident on keyboard or with mouse often is pretty much lethal to the browsing session.
My last problem with Opera was that I was by accident triggering something what was bringing my current tab to the speed dial. Button "->" was active but clicking it was doing nothing. Trying to close tab didn't work. Trying to open a new tab didn't work. The menu button couldn't be pressed. Animations and fancy sh*te was working - but there were no reaction from Opera itself. Mouse gestures are disabled. The only thing I could do was to close the browser. Go figure.

--
All hope abandon ye who enter here.
Re:I hope this can be disabled... by Peach+Rings · 2010-08-07 08:13 · Score: 1

The moment when Firefox jumped the shark for me was when I went to about:config and got some snarky anti-grandma click-through.
Re:I hope this can be disabled... by ThePhilips · 2010-08-07 08:27 · Score: 1

But not everything now has an option in about:config.
Tab tear off cannot be disabled at all. (Happens all the time - accidentally - when one opens lots of tabs, e.g. when searching through with bugzilla.) And there is no option for it at all - request on bugzilla was denied.
For faster start-up FireFox loads initial tabs from cache. And there is no option to tell it to fetch the pages from net instead.
The about:config might remain, but its usefullness sunk in the 2.x/3.x times - and I do not expect that to improve in 4.x.

--
All hope abandon ye who enter here.
Re:I hope this can be disabled... by cbhacking · 2010-08-07 11:02 · Score: 2, Insightful

I realize this may seem like sacrilege on /. but IE8 plus an extension called IE7Pro (which despite its name works great on 8) gives Firefox a good run for its money. It's actually more secure in some important ways (sandboxing, ASLR), includes ad-blocking out of the box (set the registry key to enable InPrivate Filtering on every startup) and Flash filtering (under the Flash add-on options, delete the Use on sites: *.* then you can manually add sites when they request it) and while its JS engine is weak compared to Firefox, it works fine on 99.9 percent of the sites I've seen (Acid3 being pretty much the other 0.1%). Plus, call me weird but I actually find its Accelerators feature handy, and feel its tabbed browsing is a lot better than Firefox's.
IE7Pro ( http://ie7pro.com/ ) gives you more ad-block and flash-block options, spell checking, a download manager, user agent switching, customizable mouse gestures and keyboard shortcuts, fast proxy switching, pre-fetching options, GreaseMonkey-style user scripts, and a lot more.
Firefox still wins on JS and HTML5, but I find the advantages worth it.

--
There's no place I could be, since I've found Serenity...
Re:I hope this can be disabled... by Peach+Rings · 2010-08-07 13:39 · Score: 1

The most ridiculous option to be absent from about:config is the option to ignore the no-password-saving flag set on login forms by "super secure" sites, used for everything from online banks to Exchange webmail logins.
IIRC the justification was (and is, as the bug is WONTFIX) that banks would blacklist firefox and that - and I closely paraphrase - "The success of the project takes precedence over the experience of the users." Meanwhile, seamonkey supports the option with no problem, and so does every sane browser.
Re:I hope this can be disabled... by Tacvek · 2010-08-07 14:01 · Score: 1

You do realize that Firefox already has the feature in question? Look in Firefox's setting window, in the "updates" tab of the "advanced" pane. In there is the option to prompt or to automatically install updates.
If you do the latter, they will download in the background when you browse, and the next time you start the browser, it will show a progress bar for a bit, and then the browser will open. I have the option set, so on occasion I see this.
All Mozilla is doing is changing the default for this setting. You can change it back if you want.

--
Stylish sheet to fix many problems in Slashdot's D3: https://gist.github.com/801524
Re:I hope this can be disabled... by enoz · 2010-08-08 14:09 · Score: 1

For faster start-up FireFox loads initial tabs from cache. And there is no option to tell it to fetch the pages from net instead.
This annoys me to no end.
Re:I hope this can be disabled... by Anonymous Coward · 2010-08-09 21:01 · Score: 0

No, they are also changing the behaviour so that the update is silent. Currently, it updates when you start the browser up and shows you a dialogue. This will not do that, but will be totally invisible.
Re:I hope this can be disabled... by Tacvek · 2010-08-10 02:44 · Score: 1

I quote from the summary: "Unfortunately users will still see the updating progress bar on load, but this is an implementation issue as opposed to a [user interface] one".
They want to make it totally invisible, but it does not sound like they have gotten there yet. It does not chane the fact that it will still use the same setting underneath.

--
Stylish sheet to fix many problems in Slashdot's D3: https://gist.github.com/801524
Re:I hope this can be disabled... by cbhacking · 2010-08-10 13:08 · Score: 1

Oh, also: if you're interested in a highly customizable browser, Konqueror can run on Windows these days. It's not a small install footprint (KDE base libraries are required) and it still has some quirks to iron out, but it works as a day-to-day browser.

--
There's no place I could be, since I've found Serenity...

silent, or totally invisible by gbjbaanb · 2010-08-07 01:25 · Score: 4, Interesting

to be honest, I'm not so worried about this - its only a browser, and I install all those security updates anyway. What I'm not so keen on is the "silent, in the background, don't bother the user" implementation. I'd like to know that it is doing it, pop a little UI element on the status bar that says "updating latest version now" and then gets on with it, and then puts a little version marker somewhere so I know its been done.

Be polite to your users, be open in your communication, inform us. (and a link to the things that were fixed if you click the version number would be a nice to have)

Re:silent, or totally invisible by Anonymous Coward · 2010-08-07 01:34 · Score: 0

How do you know it'll only be security updates? How do you know a keylogger won't sneak in there, undetected?
Re:silent, or totally invisible by Anonymous Coward · 2010-08-07 01:36 · Score: 1, Insightful

I think it's a fine. Most users don't need or want that updating status or whatever because it confuses them.
If you are more savvy then you can turn on the notifications and see everything it's doing. Seems perfectly acceptable to me.
I wonder if there will be some way to enable this silent update on other OS's though. Seems stupid to assume Linux users are more savvy than Windows users. I have many non-tech people running Linux (and loving it).
Re:silent, or totally invisible by Anonymous Coward · 2010-08-07 01:40 · Score: 0

As long as it has the ability to change it back to prompting before install.
That way, if they FUBAR an update, I can flip the option on and rollback to a previous version without the damn thing re-updating itself.
Ideally, it would have a list of previous versions for me to pick from as well (though, this is probably more appropriate for an Addon).
Re:silent, or totally invisible by Anonymous Coward · 2010-08-07 01:45 · Score: 3, Funny

I wrote a script to disassemble all the programs on my computer to check for comments which say "start keylogger".
Re:silent, or totally invisible by ProfanityHead · 2010-08-07 01:52 · Score: 1

How do you know it'll only be security updates? How do you know a keylogger won't sneak in there, undetected?
How do you know that isn't happening several times a day anyway? You could have thousands of keyloggers on your machine by now.
Re:silent, or totally invisible by Seth+Kriticos · 2010-08-07 01:56 · Score: 5, Insightful

This is not necessary. Linux distributions come with package managers and update systems that take care of upgrading everything on your system including your browser.
This kludge is only brought to the Windows version, because there is no coherent system to update third party software and the popups got old.
Re:silent, or totally invisible by Kozz · 2010-08-07 01:59 · Score: 4, Informative

In fact, I welcome this update! It was hard enough getting those less-than-savvy relations to use Firefox, but even getting my WIFE to update FF is a chore. Automatic updates for these folks will be especially welcome. It's depressing to be on the cutting edge of FF public releases only to visit your mother and find she's still running FF 2.0.17 and has been ignoring the update suggestions forever.

--
I only post comments when someone on the internet is wrong.
Re:silent, or totally invisible by RJFerret · 2010-08-07 02:12 · Score: 2, Insightful

So far computers aren't intelligent, nor smarter than their users (despite opinions to the contrary), they generally pick the worst time to try to do updates.
There currently isn't a way for a computer to predict when it's getting in your way (hint, right at boot-up is the worst time, as I turned on the computer to get something done). Until then, there should be a clear indication it WANTS to update, with user ability to postpone for a specified period without distraction/interference.
Computers and other tools/appliances should never do something without the users/owners knowledge, or they become untrustworthy.
Ever watch someone turn on their computer to show you something? They have a task, start the machine, load the browser, get to Youtube, find the video, click play.
On my system, it comes out of hibernation, Firefox is already running, new tab, search, play. All auto-updating is turned off.
On most systems, after the OS boots, some things auto-update, some things ask to update. The user clicks cancel on all the permissible updates, but their system is bogged down the the hidden updates. Their browser takes inordinately long to load, they bitch about it. When their browser is finally up, they, oh wait, now browser updates. Okay NOW we can try to load Youtube, only our network connection is being interfered with and it doesn't play smoothly.
The Twitter post of mine that got the most reaction was how to disable Window's update nag box--it can wait until the TV show is over, or whatever the user needs/wants to do.
A better method would be for the OS to have an updating control, like on the Windows task bar, with progress meters for various software, with controls to aborting, pausing without anything hidden/secretive/subversive/untrusted.
Sure, give the users the ability to have background updates for those who prefer it, even provide an OS control so that you don't have to tell each individual piece of software that's your preference, that would be great. Thankfully Firefox is not inhibiting user control--yet (or I'd be seeking an alternative browser).
No computer software should behave like it knows what I want (or need) more than I do. A computer is only useful when it's doing what *I* desire it to, anything more is interfering, and the presumed benefit is outweighed by not being able to realize that benefit.
Re:silent, or totally invisible by bgfay · 2010-08-07 02:13 · Score: 1

This is smart thinking. The process should be easy but not invisible. I like that Chrome does a lot of things easily, but don't like that I don't know about those things. It leads to the sudden "this thing doesn't work anymore" syndrome where things break with no seeming reason.
That said, I hate that Firefox has to be restarted to install add-ons. Things like that aren't good enough. I should be able to install the add-on and use it immediately.
Combine the two ideas: tell me that my program is being updated but do it for me when I push "OK".

--
Yeah, I'm as old as my UID would suggest.
Re:silent, or totally invisible by e065c8515d206cb0e190 · 2010-08-07 02:13 · Score: 1

Will you know it's a keylogger when instead Firefox prompts you "we have 5 security updates for your browser, would you like to install them now?".

I agree the silent thing is maybe not the best, but having the ability to turn it off is enough IMHO (unlike IE's privacy setting which MS supposedly restores to "share my info" when the browser is restarted).
Re:silent, or totally invisible by Netshroud · 2010-08-07 02:28 · Score: 2, Interesting

If only someone brought Sparkle to Windows...
Re:silent, or totally invisible by ultranova · 2010-08-07 02:28 · Score: 2, Insightful

Most users don't need or want that updating status or whatever because it confuses them.

Most users need to know when something has changed so they can associate any potential breakage with the correct event.
The more computers act like magical black boxes, the harder it becomes using them.

--
Forget magic. Any technology distinguishable from divine power is insufficiently advanced.
Re:silent, or totally invisible by siride · 2010-08-07 02:38 · Score: 3, Insightful

If things break, users probably won't be able to fix them without calling someone for help. It's easy enough to check whether there has been an update.
My mom, for example, frequently fails to tell me of important events like software updates when things stop working. Instead she just tells me that "the Internet stopped working today" and other vague things like that. I have to dig to find out that she upgraded such and such, or disabled this or that.
So I say either you are savvy enough to turn off silent updates, or at least check to see if there's been an update, or you aren't savvy enough for knowledge of updates to be useful to you directly.
Re:silent, or totally invisible by Anonymous Coward · 2010-08-07 02:42 · Score: 0

Firefox 2.0.17? So you haven't visited Mom since December 2008? Bastard.
Re:silent, or totally invisible by Anonymous Coward · 2010-08-07 02:45 · Score: 0

Speaking of which, I like the way Chrome handles this (at least on Ubuntu - I've not tried with anything else). When you install Chrome from the .deb package, it adds the Google package repositories automatically. That way, even though Chrome does not come packaged with the distribution, you still get updates through the same channel as everything else.
Mozilla could do the same for Firefox, but they don't. Instead, they rely on distributions to manage all of this for them. It works fine (especially since Mozilla don't have to actually do anything), but it does make it more difficult to upgrade to a newer major version of Firefox.
I wonder what they're doing for the Mac version. Like Windows, Mac OS X lacks any kind of central update mechanism, and relies on applications to update themselves.
Re:silent, or totally invisible by Anonymous Coward · 2010-08-07 02:54 · Score: 0

You could have thousands of keyloggers on your machine by now.
Surely you'd know about that? Surely you machine would be running a little slow, and your cpu usage going mad just when typing? Unless you haven't got a clue, in which case you shouldn't be using a PC.
(Somebody might point out that keyloggers are relatively simple applications that don't do a great deal to tie up the cpu, but don't forget that most 'malicious' programs are written by kids with home-learnt programming/scripting skills, so they're probably extremely inefficient and buggy (the programs, that is). Ok, maybe that's a very clichéd view...)
Re:silent, or totally invisible by Anonymous Coward · 2010-08-07 03:15 · Score: 0

How productive you are.
Re:silent, or totally invisible by Anne_Nonymous · 2010-08-07 03:37 · Score: 2, Informative

>> has been ignoring the update suggestions forever
If fewer updates broke things, people would be more inclined to update (not just Firefox, but software in general).
Re:silent, or totally invisible by clone53421 · 2010-08-07 04:00 · Score: 1

No; exactly the opposite... “ideally the update could be applied in the background”? About freaking time someone figured that out.
If they can find a way to do it without opening security holes, I’m all for it. Hell... there’s nothing dumber, IMHO, than restarting my browser just to install the update that it downloaded.
Make it optional. You want to vet each update? Fine. You want to turn it on and forget about it? Also fine. We have auto bill-pay so we don’t even have to think about it and we won’t get late fees; we have auto-update on our antivirus so we don’t even have to think about it and we hopefully don’t catch the latest greatest virus because our definitions were a day or two old; why do we have to decide how often we restart our browser (or OS) based on its update releases?

--
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
Re:silent, or totally invisible by Fumus · 2010-08-07 04:02 · Score: 1

At first I also thought that this is an annoying move, but then your post made me realize that my family is the same. Each time an update window appears they want me to come over and see what is it because they don't know and "Do you want to update?" is just as alien to them as "would you like to polarize the photon deflectors now?"
I welcome this change now that I have realized what it truly means. As long as there is a fairly easy way to enable the nagging screen if you want it, then I won't mind it being hidden by default.
Re:silent, or totally invisible by Anonymous Coward · 2010-08-07 04:02 · Score: 0

I like being notified when a piece of software is updating itself or would like to - and would like to have a say on whether it notifies me or automatically handles it.
I am annoyed, however, at HP constantly asking me if it can go out and check for updates only to have either a) no updates found (even though there really are important driver updates) or b) the only update being for the HP update program (I believe its only purpose is to make sure it is up to date itself, not your system's software or drivers).
Re:silent, or totally invisible by clone53421 · 2010-08-07 04:08 · Score: 1

No; the more computers act like magical black boxes, the easier it becomes using them. It becomes harder to fix them, if you don’t understand how the black box works.
Ideally I want to understand it. But for day-to-day use, I’d just assume forget, in a practical sense, that I know about it, and treat it like a magical black box. As long as it does what I want and expect, I’m satisfied. If it doesn’t, or if my expectations change, I have the knowledge to figure out what’s wrong or find new software to do the new thing that I’m wanting it to do, but in a static situation it should be easy to use without needing to think about all of that.
Yesterday I had to take a screwdriver to a server because the incantation I typed at the command line wasn’t working the way it should have. I’d have much preferred to not need to get my hands dirty, so to speak.

--
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
Re:silent, or totally invisible by Yaa+101 · 2010-08-07 04:09 · Score: 1

If you install a Mozilla version in your user account by hand then the automatic update functionality works fine, the versions that come through the package manager are often outdated.
Of course they have to be more secure because they are installed system wide, that is the reason for being outdated it takes time to patch.
So they are 2 different concepts with the same product.
Re:silent, or totally invisible by Yaa+101 · 2010-08-07 04:10 · Score: 1

I am referring to GNU/Linux
Re:silent, or totally invisible by Anonymous Coward · 2010-08-07 04:10 · Score: 0

+100
Re:silent, or totally invisible by Tubal-Cain · 2010-08-07 04:29 · Score: 1

All the family gatherings are elsewhere?
Re:silent, or totally invisible by Anonymous Coward · 2010-08-07 04:30 · Score: 0

I thought Mozilla left everything up to the Linux distributions including porting to Linux, and testing it. If that's the case why would they even care about packaging it?
Do we trust Mozilla to build and package it anyway? It has always been full on Windows and half cocked Linux. Remember when Windows versions of Firefox under Wine were kicking the shit out of Linux versions?
Re:silent, or totally invisible by toleraen · 2010-08-07 04:43 · Score: 3, Insightful

Can you name five security updates in the last two years that actually broke functionality for you? Not that my installation base is that huge, but I can think of maybe two updates out of hundreds where some level of functionality was actually lost to the average user.
Re:silent, or totally invisible by icebraining · 2010-08-07 04:57 · Score: 2, Insightful

A better method would be for the OS to have an updating control, like on the Windows task bar, with progress meters for various software, with controls to aborting, pausing without anything hidden/secretive/subversive/untrusted.
Sure, give the users the ability to have background updates for those who prefer it, even provide an OS control so that you don't have to tell each individual piece of software that's your preference, that would be great. Thankfully Firefox is not inhibiting user control--yet (or I'd be seeking an alternative browser).
Hmm, install Linux distro of choice? All updates (OS, Firefox, etc) handled by _one_ system, can show you a little icon/notification when there are new upgrades, easy to choose when to upgrade, etc.

--
Dilbert RSS feed
Re:silent, or totally invisible by basotl · 2010-08-07 05:02 · Score: 1

If a user wants to be notified they can set it to do so. The silent updates will be for the masses who don't care about that sort of thing.

--
HTC EVO 4G LTE w/ CM 10.2 | NookColor w/ CM 10.2 | Samsung Epic 4G w/ CM 10.1
Re:silent, or totally invisible by Anonymous Coward · 2010-08-07 05:40 · Score: 1, Interesting

That's not really unlike the IE privacy setting at all. By default, IE's privacy setting is off, and the user can easily do a one-off enable of it or they can enable permanently -- exactly like most other browsers' settings (though firefox makes the one-off enable kind of difficult).
The whole article earlier raised two points:
1. IE's privacy settings go further than other browsers, where it's mostly about not storing cookies whereas IE's tries to heuristically deny trackers and other things.
2. Somebody thought (1) was really useful and thought IE's default privacy setting should be on and that turning it off should be one-off.
3. They followed the common techie principal that engineers = good and marketing = bad and therefore decided that since (2) didn't happen, that's bad, and thus came from marketing.
Enabling privacy modes by default and making it opt-out would guarantee that legitimate standards-based sites would be broken. Cookies are the obvious problem and losing cookies is a potentially big user regression, but there are others, for instance, JQuery shares enough characteristics with a tracking pixel that it would be flagged and blocked; and there's obviously performance issues caused by dropping the cache on the floor.
Anyway, the point is, it's much the same, because despite the epic misinterpretations of an article with comments by one random guy on the Internet, there is a reliable way to permanently set IE to privacy mode, and there's a way to permanently disable Firefox's auto-update strategy.
Re:silent, or totally invisible by LifesABeach · 2010-08-07 05:46 · Score: 1

Maybe a Check Box that states, "I don't want to see this message again", would be useful? And the programming to do it is relatively straight forward.

Openness of Communication has been the Fan and Light for the "Smoke and Mirror" types out there. This simple fact acts like a salt on an open wound to every "Secret by Silence" business model I have been exposed to. I proudly state to BSOD victims that one of the most successful aspects of Openness is that the bad guys are shut down in to two to three weeks, where as other user types can get a solution when ever their parents get around to it. In maybe a year or so? Maybe.

Yes there are grandma's and grandpa's using this device only because writing a letter, or talking face to face has become "inconvenient" to others; so in order to communicate, these people learn enough of the machine. I know their pain
Re:silent, or totally invisible by Tumbleweed · 2010-08-07 05:50 · Score: 1

Most users need to know when something has changed so they can associate any potential breakage with the correct event.
Most users are complete dunderheads when it comes to anything resembling logic. They don't associate anything with anything. Giving mental ammunition like information to someone who's mental weapon is a broken slingshot is rather pointless. But giving them something that will automatically protect them in the VAST majority of real world use cases, is a great idea, and far more valuable than the other way around. Automatic updates for things like security patches should be the way of the entire computing industry, as long as they provide a way to turn on more explicit notifications or turn it off if desired, for the rest of us.
Re:silent, or totally invisible by Anonymous Coward · 2010-08-07 05:51 · Score: 0

It is enabled in the Official Mozilla builds for GNU/Linux tho (the updater launcher is disabled if the uid of the Firefox process doesn't have write permission where firefox it's installed)
Re:silent, or totally invisible by wwphx · 2010-08-07 05:59 · Score: 1

I HATE Google doing this! In fact, I ripped out Picassa and Chrome on my Mac because of these silent updates. I don't have a problem if this was a configuration option set on during install that I could turn off, but it isn't. Since Firefox will allow it to update in the traditional manner, I'm fine with that, but I HATE it being done silently in the background!

I have found that there is a way to block Google's silent update on a Mac, it basically requires creating an empty file in a certain directory with the name of their update process and then locking the permissions to that. I assume the technique would easily work for *nix, dunno about Win. However, I really don't care for Chrome or Picassa, I mainly had them for checking web site updates across multiple browsers.

I've never had an update FUBAR my system, but I've seen it happen and I will not apply an update until it has sat around for a few days. Perhaps that's not the soundest strategy as I maintain good backups and it's really easy to reinstall a Mac from an OS CD and Time Machine backup, still... I almost got pwned four years ago when an exploit was found in VNC, but that's another story.

--
When you sympathize with stupidity, you start thinking like an idiot.
Re:silent, or totally invisible by dangitman · 2010-08-07 06:21 · Score: 1

The more computers act like magical black boxes, the harder it becomes using them.
If by harder," you mean "easier." Other than that, you're completely correct.

--
... and then they built the supercollider.
Re:silent, or totally invisible by ultranova · 2010-08-07 06:30 · Score: 1

No; the more computers act like magical black boxes, the easier it becomes using them. It becomes harder to fix them, if you don't understand how the black box works.

A computer is not a car. It is a general-purpose device. If it doesn't let you, say, install a program, is that caused by 1) something being misconfigured, 2) security policy preventing a user from installing anything or 3) an anti-virus detecting an infected program? Why, that depends entirely on what the owner wants.
There is no difference between fixing and using a general-purpose device. That's why anything that makes them harder to fix also makes them harder to use. And refusal to accept this is what causes almost all computer problems in the world.

--
Forget magic. Any technology distinguishable from divine power is insufficiently advanced.
Re:silent, or totally invisible by correnos · 2010-08-07 06:39 · Score: 1

Rumor is that a software store (and assumedly a unified update manager) are coming to Windows 8.That'd be nice.
Re:silent, or totally invisible by correnos · 2010-08-07 06:45 · Score: 1

Packages are only slow to update if they are part of a lethargic/paranoid distribution Very little patching is generally involved. Packages are almost always designed to be installed to root, but you're right that it is possible to install it for single users. Using Arch, update times are hardly ever a problem.
Re:silent, or totally invisible by Anonymous Coward · 2010-08-07 07:53 · Score: 0

There is no difference between fixing and using a general-purpose device. That's why anything that makes them harder to fix also makes them harder to use. And refusal to accept this is what causes almost all computer problems in the world.
That explains a lot... about why the year of linux on the desktop isn’t going to be anytime soon.
Re:silent, or totally invisible by Thing+1 · 2010-08-07 08:04 · Score: 1

[...] why do we have to decide how often we restart our browser (or OS) based on its update releases?

I second this. I'm also thinking that "restarting my browser" should take a couple seconds at most, regardless of how many tabs I have open.
I've got essentially "unlimited" disk space. Please, Firefox, save the pages in their entirety (including state, JavaScript execution, etc), so that it doesn't have to take 5 minutes of grinding loading when it restarts. Make it optional for those with smaller drives. This will save time.
Of course, being able to update without restarting is even better, so go work on that instead. :)

--
I feel fantastic, and I'm still alive.
Re:silent, or totally invisible by Thing+1 · 2010-08-07 08:08 · Score: 1

I'd just assume forget, in a practical sense, that I know about it

You don't sound like an English-as-a-foreign-language speaker, but benefit of the doubt: "I'd just as soon forget".
(At least it wasn't what an old girlfriend said (yes, I should try a young one), "You're making a mountain out of a mohill." Upon questioning, she could not explain what the original thing was that I was turning into a mountain, just that it was not appropriate to do so...)

--
I feel fantastic, and I'm still alive.
Re:silent, or totally invisible by Thing+1 · 2010-08-07 08:10 · Score: 1

Automatic updates for things like security patches should be the way of the entire computing industry, as long as they provide a way to turn on more explicit notifications or turn it off if desired, for the rest of us.

Somewhat agreed; I also think it should be provided as an OS service, instead of being reimplemented poorly by every program author.

--
I feel fantastic, and I'm still alive.
Re:silent, or totally invisible by Peach+Rings · 2010-08-07 08:18 · Score: 1

I guess the (wrong, imo) approach that firefox takes is to allow addons to implement that kind of stuff. My Firefox is locked down hard and bulletproof against active content, but it requires some addons.
Re:silent, or totally invisible by clone53421 · 2010-08-07 08:26 · Score: 1

You don't sound like an English-as-a-foreign-language speaker, but benefit of the doubt: "I'd just as soon forget".
I disagree. To “assume” something (as it is used there) is to become it or wear it, and that is an appropriate use.

"You're making a mountain out of a mohill."
What’s a mohill?

--
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
Re:silent, or totally invisible by Sigma+7 · 2010-08-07 08:52 · Score: 1

Can you name five security updates in the last two years that actually broke functionality for you? Not that my installation base is that huge, but I can think of maybe two updates out of hundreds where some level of functionality was actually lost to the average user.
While not necessarily in the past two years, there was a Javascript update sometime around 2.0.~13-14 which fixed a security hole. This introduced a race condition on some webpages, which caused the browser to crash when exiting the page.
For issues I know are within the past two years, practically any update from Firefox tends to disable the extensions that I use. It took until I discovered the nightly build tools extension to get them working again, and even so, Mozilla seemed to want to disable them at every update (including when I switch from a build from source to an earlier stable version) - which basically causes every update to be disruptive. The situation may have changed by now, but I haven't updated Firefox recently enough to tell.
Re:silent, or totally invisible by Anonymous Coward · 2010-08-07 09:17 · Score: 0

It's easy for Linux OSes to do that, what with the limited software library you guys have.
Besides, I don't want my computer updating anything unless I expressly ask it to. If it's not broken, I'm not going to fix it. I don't need the latest software update unless it's highly important or introduces a feature that I just can't live without.
Re:silent, or totally invisible by Anonymous Coward · 2010-08-07 10:07 · Score: 0

http://www.filehippo.com/updatechecker/
Re:silent, or totally invisible by Anonymous Coward · 2010-08-07 10:24 · Score: 0

Extremely. Far more productive than I ever was with Windows or Mac OS X.
Re:silent, or totally invisible by darthdavid · 2010-08-07 11:15 · Score: 1

the opposite of a lesshill
Re:silent, or totally invisible by Captain+Segfault · 2010-08-07 11:56 · Score: 1

"I'd just as soon [action]" is an idiom, as is "make a mountain out of a molehill"
It's not really a matter of grammar or syntax (although "I'd just assume forget" isn't proper grammar, as far as I can tell) -- it's closer to being an issue of spelling/pronunciation. You're slightly misspelling "I'd just as soon", and you're probably slightly mispronouncing it too.
I confused these two myself for a while -- it's understandable because "as soon [action]" isn't a common construct in modern English aside from this idiom.
Re:silent, or totally invisible by Anonymous Coward · 2010-08-07 12:48 · Score: 0

Update your wife first.
Re:silent, or totally invisible by clone53421 · 2010-08-07 13:46 · Score: 1

It’s short for I’d just assume to forget, and AFAIK it’s pretty much accepted grammar.

--
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
Re:silent, or totally invisible by Anonymous Coward · 2010-08-07 14:43 · Score: 0

What the fuck is "GNU/Linux"? There is no such thing. There are the "GNU utilities" and the "Linux kernel". If you run the GNU utilities on top of the Linux kernel, the entire system is just called "Linux", not "GNU/Linux". Likewise when you run the GNU utilities on The Hurd, the entire system is just called "The Hurd", not "GNU/The Hurt". When you run the GNU utilities on Mac OS X, the entire system is just called "Mac OS X", not "GNU/Mac OS X". When you run the GNU utilities on Windows, the entire system is just called "Windows", not "GNU/Windows".
Re:silent, or totally invisible by Richard+Steiner · 2010-08-07 15:12 · Score: 1

It depends on whether your particular style of usage follows the same set of assumptions as the people to build and configured the OS you use. As more and more assumptions are made for you by the software makers, it can become harder and harder to operate outside of that core assumption set.

--
Mainframe/UNIX Bit Twiddler and long time Windows/Linux Hobbyist.
The Theorem Theorem: If If, Then Then.
Re:silent, or totally invisible by Captain+Segfault · 2010-08-07 21:10 · Score: 1

Note that Google shows 17.6M results for "just as soon", compared to 869K for "just assume" -- this perversion is perhaps becoming more common, but that's no reason to use it!

It’s short for I’d just assume to forget
Whatever retconning justification you want to apply, the origin of "just assume" is people mishearing "just as soon".
It's a bit of a stretch in any case. "just as soon forget" means "given the choice, I'd forget as soon as I would (whatever)". Assume just doesn't quite mean what it would need to mean for this construct to make sense. (Obviously it's close -- otherwise it wouldn't be common!)

and AFAIK it’s pretty much accepted grammar.
I think you're right to this extent -- if it made any sense to use "assume" here you would drop the "to".
Re:silent, or totally invisible by Simetrical · 2010-08-08 06:31 · Score: 1

I wrote a script to disassemble all the programs on my computer to check for comments which say "start keylogger".
Disassembled binaries generally have no comments, but you get points for effort.

--
MediaWiki developer, Total War Center sysadmin
Re:silent, or totally invisible by Thing+1 · 2010-08-08 08:15 · Score: 1

Your grammar defense is silly.
To answer your question, I have no idea; she could parrot the phrase, and knew it to mean "making the issue bigger than it deserves to be", but could not define all of the words that she used. That was not the last straw, but it was close to the time I decided she wasn't for me.

--
I feel fantastic, and I'm still alive.
Re:silent, or totally invisible by clone53421 · 2010-08-08 11:09 · Score: 1

It’s molehill. Making a mountain out of a molehill.

--
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
Re:silent, or totally invisible by Acaeris · 2010-08-09 00:17 · Score: 1

Addons breaking on updates is due to one of three things. Either the author is still fixing the addon for the latest update (as it's just a small tweak if nothing is actually broken), the addon is no longer developed or you are using a nightly, in which case the author hasn't even had the chance to test their own addon yet, let alone fix it.
None of this is Mozilla's responsibility, nor should it be.
Re:silent, or totally invisible by Sigma+7 · 2010-08-09 10:08 · Score: 1

None of this is Mozilla's responsibility, nor should it be.
If it's not supposed to be Mozilla' responsibility, then there should be an option to make it that way.
One of the options in the various extensions prevents it from being used if it is newer than a specific version (i.e. an extension originally written for 3.5.8 won't work for 3.5.8.1). It's the same form of version checking found in some old DOS programs that needed SetVer to run properly, and making that form of check in Mozilla is obstructive to experienced users.
It's no different from preventing Netscape 4 from running on sites designed for Netscape 3, and forcing them to redownload Netscape 4.
Re:silent, or totally invisible by Thing+1 · 2010-08-09 12:39 · Score: 1

Apparently you missed the part where this was a direct quote from an ex-girlfriend. Her use of the word, and subsequent inability to define it, was essentially the "straw that broke the camel's back" and prompted me to end the relationship. And it was in quotes in the original. My apologies for your reading comprehension. I'd just as soon not continue this thread. (You see what I did there.)

--
I feel fantastic, and I'm still alive.
Re:silent, or totally invisible by Acaeris · 2010-08-09 20:35 · Score: 1

How would you or the author of the addon have any idea whether the addon will work with any future update?
From what work I've done with Firefox addons (fixing one I was using after the author stopped supporting it), you can set a range of versions your addon supports but the vast majority of authors don't support versions that don't exist yet because they have no idea what Mozilla might need to change. These same authors generally check their code with the beta builds (and some with the nightly builds) and when THEY are happy that it works they'll bump up the version support and post an update.
Considering how much addons can change Firefox, I'd rather have it this way than what you are suggesting. Especially as I have had up to date addons break the entire UI before where the author had missed checking something like 'does it work if [X] toolbar isn't visible?'.
As for you Netscape comment, is it Netscape's problem that the website coder hasn't updated his code for the latest version? No. It's the website coder's problem and if he doesn't fix it people will go elsewhere. The same is true for addons.
Re:silent, or totally invisible by clone53421 · 2010-08-09 23:50 · Score: 1

I thought you “have no idea” what she meant. So I told you. If you really had no idea, now you know. And if you already knew, you’re an asshat.
Either way, her quote was wrong of course. I’m not defending that.

--
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
Re:silent, or totally invisible by Anonymous Coward · 2010-08-10 18:50 · Score: 0

I’ve recently started a blog, the information youAir Jordan
provide on this site has helped me tremendously. Thank you for all of your time work.

Welcome to the Mozilla botnet ... by Lazy+Jones · 2010-08-07 01:26 · Score: 2, Insightful

... silent updates suck.

--
"I love my job, but I hate talking to people like you" (Freddie Mercury)

Re:Welcome to the Mozilla botnet ... by fearlezz · 2010-08-07 02:11 · Score: 3, Informative

Yes. Silent updates suck. Well at least, for people that want to control their own computer, it does. But for my sister, my dad, my great aunt and all these people that think i'm their personal helpdesk, this is perfect. I've seen so many family members who had 2 year old browsers and stuff...

--
.sig: No such file or directory
Re:Welcome to the Mozilla botnet ... by commodore64_love · 2010-08-07 02:23 · Score: 0, Troll

They wouldn't have 2 year old browsers if you turned on "automatic updates" like I did for my brother's machine.
Personally I think Mozilla's silent updates are bullshit. If programmers were perfect, it would be okay, but programmers are human and make mistakes which means sometimes the update will kill a browser (or plugin) and make it unusable. It should be up to ME to decide when to update, not some arrogant asshole saying, "I know what's good for you" and ramming it up my ass.
Opera did this to me - forcing me to upgrade from 10.0 to 10.5, and now 10.5 doesn't run anywhere near as well as 10.0 did. You should not "force" people to do something. In fact if you're using that word - force - then you're automatically doing something wrong. People should be allowed to make their own choices.
C=64_love
----- Pro-Choice on everything.

--
"I disapprove of what you say, but I will defend to the death your right to say it." - historian Evelyn Beatrice Hall
Re:Welcome to the Mozilla botnet ... by Trelane · 2010-08-07 02:47 · Score: 1

Yes. Silent updates suck. Well at least, for people that want to control their own computer, it does.
Fortunately, you (or someone or collection of persons you trust) have the source, can build it, use it, and redistribute it. Thus, you don't *have* to use the software with silent update functionality, even if you keep using the browser itself. (though you'll lose the branding; call it "iceweasel" perhaps ;)

--

--
Given enough personal experience, all stereotypes are shallow.
Re:Welcome to the Mozilla botnet ... by kbrosnan · 2010-08-07 02:54 · Score: 2, Informative

The devs already said that this is going to be a preference.

--
These people look deep within my soul and assign me a number based upon the order I joined. -Homer Simpson
Re:Welcome to the Mozilla botnet ... by swillden · 2010-08-07 03:08 · Score: 1, Troll

Yes. Silent updates suck. Well at least, for people that want to control their own computer, it does.
But they're only doing this on Windows, so it's for people who've already given up controlling their own computer.

--
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
Re:Welcome to the Mozilla botnet ... by Anonymous Coward · 2010-08-07 03:19 · Score: 0

Opera certainly didn't force you to upgrade.
Re:Welcome to the Mozilla botnet ... by FooBarWidget · 2010-08-07 03:44 · Score: 1

Bullshit? "Force"? Then what part of "Mozilla will let users change the default silent service to the more traditional mode, where the browser asks permission before downloading and installing any update" did you not understand?
Re:Welcome to the Mozilla botnet ... by Macthorpe · 2010-08-07 03:54 · Score: 1

Opera doesn't force upgrades on it's users - or are you using a different definition of 'force' from the rest of us?

--
"It does not do to leave a live dragon out of your calculations, if you live near him." - Tolkien
Re:Welcome to the Mozilla botnet ... by NotBorg · 2010-08-07 05:11 · Score: 1

Yes. Silent updates suck. Well at least, for people that want to control their own computer, it does. But for my sister, my dad, my great aunt and all these people that think i'm their personal helpdesk, this is perfect. I've seen so many family members who had 2 year old browsers and stuff...
There's a lot of truth here.
Often the only updates that happen are automatic or silent. If they aren't automatic they typically don't happen. The silent updates that I speak of are when geeks like me do it for their friends and family because they wouldn't happen otherwise. Yeah I know those aren't technically silent or automatic, but they are to the user. I don't think the user is much worse off with silent updates because they genuinely are not interested in updating software. In fact, they probably have an aversion to updating software because of past experiences which were unpleasant.
At any rate you must trust Mozilla or you wouldn't be running their software to begin with. Right? Do you examine the source every time an update comes out to see if it does what the change log says?

--
I want this account deleted.
Re:Welcome to the Mozilla botnet ... by ljgshkg · 2010-08-07 05:18 · Score: 1

Personally though, I think silent update is good for minor updates for security and minor fixes. As long as the user know it's updated, it's all fine.

We who know the importance of updating (minor updates for security) wouldn't be a problem. But there are just all too many people outside who, when you ask them if they want an update, they'll refuse to. And then when they have security problem, they'll turn back to shout at Mozilla. I think silent update is good for both end.

It's not like you who care can't turn it off.
Re:Welcome to the Mozilla botnet ... by Trelane · 2010-08-07 05:22 · Score: 1

Sure, and if that's not good enough for you, you still have options.

--

--
Given enough personal experience, all stereotypes are shallow.
Re:Welcome to the Mozilla botnet ... by maztuhblastah · 2010-08-07 05:44 · Score: 1

My root partition is read-only.
Good luck updating my software without me sitting a root prompt, jerks.

--
The real litigious bastards...
Re:Welcome to the Mozilla botnet ... by Anonymous Coward · 2010-08-07 05:52 · Score: 0

FORCE CHOKE YOUR CHICKEN!
Re:Welcome to the Mozilla botnet ... by fluffy99 · 2010-08-07 06:02 · Score: 1

Yes. Silent updates suck. Well at least, for people that want to control their own computer, it does.
Fortunately, you (or someone or collection of persons you trust) have the source, can build it, use it, and redistribute it. Thus, you don't *have* to use the software with silent update functionality, even if you keep using the browser itself. (though you'll lose the branding; call it "iceweasel" perhaps ;)
And what percentage of Windows boxes even have a compiler installed, much less a user who know how to use it? Are you really going recompile by hand everytime you get an update? Yeah, I thought so.
Re:Welcome to the Mozilla botnet ... by Trelane · 2010-08-07 06:28 · Score: 1

You're rather missing the point. Please reread the section you quoted, and particularly look for the part where I mention relying on another party or set of parties. Much like I don't know how to fix the transmission in my car, but I can find someone to fix it for me instead of going to the dealer, with FOSS you can hire (or otherwise convince) someone to do the work for you.

--

--
Given enough personal experience, all stereotypes are shallow.
Re:Welcome to the Mozilla botnet ... by commodore64_love · 2010-08-07 06:43 · Score: 0, Troll

Actually in the case of 10.5, they did. It was impossible to make the "update to 10.5" popup go away. Even when I clicked "no" it just kept coming back again and again.
Probably a programming error, but it nevertheless it left me with no choice.

--
"I disapprove of what you say, but I will defend to the death your right to say it." - historian Evelyn Beatrice Hall
Re:Welcome to the Mozilla botnet ... by correnos · 2010-08-07 07:13 · Score: 1

And how does seeing "This application has an update" allow you to magically deduce whether the update will be good or not? If you're decently tech savvy you'll probably just look and see if it is a major version, and if not just update and be done with it. If you're not, you'll hide the update in the corner and treat it like the devil, and maybe call your poor poor cousin to help you out. They already said that major updates will still ask for confirmation, and for security updates all parties are better off with auto updates. Unless you're a security auditing nazi, in which case you can disable the auto-update feature for yourself, no one's stopping you.
Re:Welcome to the Mozilla botnet ... by commodore64_love · 2010-08-07 12:33 · Score: 1

When I see updates I usually wait a month to see if there's word-of-mouth about problem with it. For example I had heard the recent Firefox update 3.6.Whatever broke people's Youtube Downloader Addons. i.e. It was buggy.
So I just didn't bother. However if the update had been forced, then I would have suffered the same problem those early adopters faced
.

--
"I disapprove of what you say, but I will defend to the death your right to say it." - historian Evelyn Beatrice Hall
Re:Welcome to the Mozilla botnet ... by Anonymous Coward · 2010-08-07 14:24 · Score: 0

If they put in an about:config option where I can set it to be manual, then I would appreciate this as an advanced user and fully support their move. I'm more concerned about the performance issues in FF4, honestly. Wish they'd skip this feature until they can get up to speed parity with Chrome.
Re:Welcome to the Mozilla botnet ... by swillden · 2010-08-07 14:47 · Score: 1

I knew /. was dominated by Windows users these days, but I didn't realize it was dominated by Windows users who can't take a joke.

--
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
Re:Welcome to the Mozilla botnet ... by Richard+Steiner · 2010-08-07 15:15 · Score: 1

If a user doesn't know about that option, it appears to them as if the updates are being made in spite of their desires. That would be "forced", at least from their perspective.

--
Mainframe/UNIX Bit Twiddler and long time Windows/Linux Hobbyist.
The Theorem Theorem: If If, Then Then.
Re:Welcome to the Mozilla botnet ... by FooBarWidget · 2010-08-07 20:42 · Score: 1

Show me even one user who knows he doesn't want updates, but also doesn't know how to look for a checkbox to disable them.
Re:Welcome to the Mozilla botnet ... by Anonymous Coward · 2010-08-07 21:39 · Score: 0

I know tons of people who never update anything. Even if they have a "Windows Update" icon, or an Adobe one popping up every day. Lets face it, there's no reason NOT to update to a more secure version (it is only for minor builds anyway), and it'll make sure that everyone is up to date instead of having less tech-savvy people not upgrade for some reason best known to themselves.
Re:Welcome to the Mozilla botnet ... by correnos · 2010-08-08 07:19 · Score: 1

In which case they could downgrade. I would at least hope that firefox will make that task somewhat easy. The thing to remember is that security/bugfix updates are (almost) always-you guessed it-fixing bugs and security holes. The better way to go IMO is to fix the problems you know and give a chance to revert in case the fix breaks some other untested thing.
Re:Welcome to the Mozilla botnet ... by commodore64_love · 2010-08-08 12:06 · Score: 1

Actually in the case of 10.5, Opera did force me to upgrade from 10.0.
It was impossible to make the "update to 10.5" popup go away. Even when I clicked "no" it just kept coming back again and again. Probably a programming error, but nevertheless it left me with no choice.

--
"I disapprove of what you say, but I will defend to the death your right to say it." - historian Evelyn Beatrice Hall
Re:Welcome to the Mozilla botnet ... by commodore64_love · 2010-08-08 12:43 · Score: 2, Insightful

>>>If a user doesn't know about that option, it appears to them as if the updates are being made in spite of their desires.
Precisely. That's why it's called "silent updates" because Firefox 4 will be automatically defaulting to doing upgrades without the user's knowledge. If programmers were perfect, it would be okay to do that, but programmers are human and make mistakes just like any other human. That means sometimes the update will kill a browser (or plugin) and make it unusable.
I prefer to hold-off on updates until a suitable time has elapsed (say one month). Let the early adopters be the one who get screwed if the update has a bug in it.

--
"I disapprove of what you say, but I will defend to the death your right to say it." - historian Evelyn Beatrice Hall

I love Mozilla by Voulnet · 2010-08-07 01:26 · Score: 1, Funny

I love Mozilla. They can do no wrong! If Apple fanboys and MSFT apologists can do it, so can I!

Bigger Number by Macrat · 2010-08-07 01:26 · Score: 0, Troll

Using a bigger number has got to make the app better, right?

Really? by Anonymous Coward · 2010-08-07 01:26 · Score: 0

I realise firefox can be installed per user as opposed to system wide but this isn't how the majority of people are running it. Who exactly is running their web browser with the priviledges required to install an update?

Re:Really? by fearlezz · 2010-08-07 01:42 · Score: 1

If the software is installed with the privileges to install system-wide, it think can install an service with privileges to update as well. So that shouldn't be a problem.

--
.sig: No such file or directory
Re:Really? by DrSkwid · 2010-08-07 02:06 · Score: 2, Insightful

I have installed by the Administrator account and then Unpriv users can't do updates, it requires manual intervention.
So instead we'll get "couldn't silently update" dialog boxes !

--
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
Re:Really? by Tubal-Cain · 2010-08-07 04:34 · Score: 4, Insightful

Who exactly is running their web browser with the privileges required to install an update?
Virtually everyone.

As long as the browser asks for permission by nebulus4 · 2010-08-07 01:27 · Score: 2, Interesting

why would this be considered a bad idea?

--
"It would be wrong to refuse to face the fact that everything is fundamentally sick and sad."

Re:As long as the browser asks for permission by Anonymous Coward · 2010-08-07 01:37 · Score: 5, Informative

I don't mind if the browser asks. It looks like they are going to default to silent updates unless you change the setting. They only way I can see this as a bad idea for the non-techinical user is in the case where Mozilla screws up and a patch hoses up the browser or operating system itself (and don't act like that can't happen because it has for other software, even if it wasn't Mozilla that did it, it could still happen.)
FTA (bolding mine):

Firefox 4's silent update will only be offered on Windows, Mozilla has said.
Most updates, including all security updates, will be downloaded and installed automatically without asking the user or requiring a confirmation, said Alex Faaborg, a principal designer on Firefox. ...
Unlike Google, Mozilla will let users change the default silent service to the more traditional mode, where the browser asks permission before downloading and installing any update.
Re:As long as the browser asks for permission by asdf7890 · 2010-08-07 01:43 · Score: 1

why would this be considered a bad idea?
Some take exception to their software installing stuff (even updates) without their express permission (or request), or to software refusing to run until it is updated (MS's IM client does this, or so I'm told). There are a number of reasons why you might want to hold back on an update - perhaps you are a dev who want to keep old versions around for testing how their pages work in older versions that have certain issues, or perhaps you just prefer to hold back a day or so to make sure there are no massive bugs in the new release (letting the early adopters get scalped instead). Providing the off switch should alleviate these concerns for people who care though.
There is a potential security issue too: what if someone manages to hack Mozilla's DNS to point to a malicious site pretending that there is an update (which introduces malware)? I hope they are planning on properly signing and verifying updates to deal with this possibility.
Re:As long as the browser asks for permission by asdf7890 · 2010-08-07 01:45 · Score: 1

Also (missed this from my previous post) I don't want my browser deciding it want to download an several Mb update while I'm connected via a very slow cellular connection (i.e. GPRS in area with no 3G or wifi coverage) trying to get something done with what little bandwidth is available in such circumstances.
Re:As long as the browser asks for permission by MonsterTrimble · 2010-08-07 01:47 · Score: 1

I think on a fresh install or upgrade to FF4, make the silent updating an opt-in. If you want it, you got it. Otherwise you stay traditional.
Myself, I would like to stay traditional on updates, but that's me.

--
I call it 'The Aristocrats'
Re:As long as the browser asks for permission by Anonymous Coward · 2010-08-07 01:48 · Score: 5, Informative

There is a potential security issue too: what if someone manages to hack Mozilla's DNS to point to a malicious site pretending that there is an update (which introduces malware)? I hope they are planning on properly signing and verifying updates to deal with this possibility.
Unlike many others, Mozilla already does sign it's updates.
Re:As long as the browser asks for permission by Servaas · 2010-08-07 02:04 · Score: 1

MS's IM client does this, or so I'm told
If you are talking about Live Messenger then you were told wrong. You can still use old version even if its not up to date.
Re:As long as the browser asks for permission by hedwards · 2010-08-07 02:24 · Score: 0, Troll

You don't see the problem with that? The people that should be using it are the same ones that would likely get that wrong. Whereas the individuals that don't really need to use it would have very little trouble going into the preferences and disabling it.

Opt in isn't always the best choice, especially when the people that most need to opt in are the ones with the least ability to make an informed decision.
Re:As long as the browser asks for permission by Anonymous Coward · 2010-08-07 02:59 · Score: 2, Insightful

Just take a hint from the silent updates that Windows does;
Do you want Firefox to be updated automatically?
(x) Yes, check for updates and install automatically (recommended).
( ) No, notify me but I will decide to install updates myself.
( ) Do not check for updates (not recommended).
Note: with automatic updates, you will still be asked for permission to instal major updates.
Re:As long as the browser asks for permission by Anonymous Coward · 2010-08-07 03:05 · Score: 0

You don't see the problem with that? The people that should be using it are the same ones that would likely get that wrong. Whereas the individuals that don't really need to use it would have very little trouble going into the preferences and disabling it.
Opt in isn't always the best choice, especially when the people that most need to opt in are the ones with the least ability to make an informed decision.
That's the same argument (and almost the exact same wording) that BoA, Chase, Etc. used to use to argue that checking account overdraft 'protection' needed to be opt-in instead of opt-out (as will soon be required by law).
The annoying thing is ... they're right and you're right. But once you've made a decision to limit another adult's choices for their own good you have become an evil, overbearing asshole.
Re:As long as the browser asks for permission by hedwards · 2010-08-07 03:37 · Score: 1

This isn't really limiting their choices, it's just requiring them to take a step to opt out if they like. Sort of like the move to automatically enrolling people in their companies 401k unless they opt out. Since most people do opt in or at least want to do it, doing so gives most people what they want without having to do any work. Those that don't want to have ample time to opt out if they choose to.

And sometimes it is the appropriate thing to do. Sane defaults dictate that sometimes the default be included and sometimes to be excluded.
Re:As long as the browser asks for permission by Toonol · 2010-08-07 06:29 · Score: 1

That pretty much defuses my complaints. I'll turn it off, of course; but for the majority of nontechnical users, it's probably a good thing. Mozilla has been going down a route over the last year or two of FORCING change on the users (damn Awesomebar). I'm glad to hear it sounds like they'll at least give you the OPTION of turning it off this time.
Re:As long as the browser asks for permission by MechaStreisand · 2010-08-07 07:24 · Score: 1

I couldn't. I had to switch to AMSN because Microsoft wouldn't release updates for XP-64 anymore, and Messenger refused to function without updates. Assholes.

--
Disclaimer: IANAL. This post is, however, legal advice, and creates an attorney-client relationship.
Re:As long as the browser asks for permission by Anonymous Coward · 2010-08-07 07:26 · Score: 0

The extension and plugin developers will probably "love" this idea as well. As a Firefox user, I often hold back on some updates until I'm fairly certain that my extensions have also been updated to work with them. Now if Firefox rolls over the updates on its own, odds are there's going to be more bitching in userland when their favorite add-on doesn't work anymore.
At least its optional... If they were smart about the silent updates, they'd also make it able to some version compatibility checks on all installed add-ons and wait and hold off until compatible versions are available before updating everything. If it's some really important security thing that the devs want to push through, then perhaps it should still do the update request but inform the user of possible incompatibilities.
Re:As long as the browser asks for permission by maestroX · 2010-08-07 08:14 · Score: 1

There is a potential security issue too: what if someone manages to hack Mozilla's DNS to point to a malicious site pretending that there is an update (which introduces malware)? I hope they are planning on properly signing and verifying updates to deal with this possibility.

Unlike many others, Mozilla already does sign it's updates.

ftzz .. as if you know what you're installing anyway. Oh, and the private cerficate is locked away in a secure location with no internet .. right ... someone has to sign those Windows binaries and post them remember..
Re:As long as the browser asks for permission by Anonymous Coward · 2010-08-07 11:29 · Score: 0

You know, there is a slight difference in complexity between your local network admin setting up an infection proxy to replace unsigned updates (a matter of ~10min) and your local network admin locating & cracking the computer which performs update signing for Mozilla and then obtaining the signature key to sign malicious updates while remaining undetected.
But let me guess, you're still using telnet instead of ssh because you think that no system can be 100% secure.

Choice vs. Sleek by Amorpheus_MMS · 2010-08-07 01:28 · Score: 4, Insightful

I like that a lot of what makes Firefox different from Chrome is due to the "we'll let users decide how they want it" approach instead of just telling them how it's going to be done.

Re:Choice vs. Sleek by Nerdfest · 2010-08-07 02:21 · Score: 1

It does sound like there will be a setting that can be changed, but the default is silent install.
Re:Choice vs. Sleek by Anonymous Coward · 2010-08-07 05:38 · Score: 0

I generally agree, and think that this move is fine since there will be an option to disable it.
But this attitude isn't universal in Firefox--despite much criticism, there is no way to disable the Awesomebar....
Re:Choice vs. Sleek by onefriedrice · 2010-08-07 08:25 · Score: 1

I like that a lot of what makes Firefox different from Chrome is due to the "we'll let users decide how they want it" approach instead of just telling them how it's going to be done.
Yeah, like how Chrome insists on being a fast browser without letting the user decide. Just watch; the next version of Firefox will finally give us the option: "Do you want a slow, bloated experience, or do you want a slow, bloated experience?" Mozilla: different because we give you options!

Okay calm down FF fanboys; it's just a joke... kinda.

--
This author takes full ownership and responsibility for the unpopular opinions outlined above.
Re:Choice vs. Sleek by Amorpheus_MMS · 2010-08-07 08:33 · Score: 1

Then it should have been funny. The thing about speed is something I never understood... it's a browser. I mostly care about it working the way I want it to, not if it can render some JavaScript gizmo at 35 FPS instead of 20. The smoother interface is nice, but what does loading a webpage 20ms faster buy me? Not much at all.
Re:Choice vs. Sleek by onefriedrice · 2010-08-07 13:39 · Score: 1

Then it should have been funny.
That's why I said it's only kinda a joke. After I wrote it, I realized that mostly it was just a sad truth. You're being disingenuous if you think 20ms is a reasonable measurement of the overhead of the Firefox bloat, but you probably know that. Regardless, we're just fortunate that there are now better free options waiting to catch the collateral damage after Mozilla cannibalizes the once-great browser.

--
This author takes full ownership and responsibility for the unpopular opinions outlined above.
Re:Choice vs. Sleek by Amorpheus_MMS · 2010-08-07 20:42 · Score: 1

20ms was just to say "not a whole lot" - all the small differences amount to nearly as much as when you have dedicated benchmarks showing how Firefox is particularly slow in certain aspects. I tried Chrome for a few weeks recently and the only two things it did noticably better was UI smoothness and web apps like Google Maps. Other than that I was mostly annoyed at many little things that I couldn't adjust, like forcing "new window" links to open in the current tab. And the extensions barely deserve to be called that.
It's nice if Chrome suits you, but get off that high horse.

Thank you thank you thank you thank you by Anonymous Coward · 2010-08-07 01:33 · Score: 0

It's SOOOOO generous of Mozilla to set my options BACK to the way I want, after Mozilla changes them without my permission.

Puts them right up there with Mother Teresa.

wont work for "program files", permission denied by Anonymous Coward · 2010-08-07 01:33 · Score: 0

unless it wants to install a updater service for administrator, WHICH WON'T HAPPEN
and even that won't work on windows 7

OMG! by pushing-robot · 2010-08-07 01:33 · Score: 4, Insightful

Mozilla is stealing our freedoms with communist security updates!

...Seriously, folks, they're just automating the updates that everyone installs already. It saves us time, which last time I checked was a valuable commodity.

--
How can I believe you when you tell me what I don't want to hear?

Re:OMG! by Anonymous Coward · 2010-08-07 02:12 · Score: 0

The communist fingerpointing is getting old, capitalism has already brought us everything that made communism so frightening.
Re:OMG! by Lazy+Jones · 2010-08-07 02:20 · Score: 0

...Seriously, folks, they're just automating the updates that everyone installs already. It saves us time, which last time I checked was a valuable commodity.
Mozilla is not immune to a) faulty updates, b) hacked/hijacked servers, c) intervention on behalf of government agencies. Being able to deny an update adds another layer of security to users' computers because they might be informed of such issues before Mozilla fixes them. Also, not all users are stupid. If there is no option to deny an update, well, there are still some alternatives out there...

--
"I love my job, but I hate talking to people like you" (Freddie Mercury)
Re:OMG! by siride · 2010-08-07 02:48 · Score: 1

If you read the damn summary, you'll see that you can turn off silent updates.
Re:OMG! by noidentity · 2010-08-07 03:05 · Score: 1

Seriously, folks, they're just automating the updates that everyone installs already. It saves us time, which last time I checked was a valuable commodity.

Except those people who don't. Next you'll be telling me that everyone always uses the latest version of everything, since the latest versions never have bugs or problems that previous versions had, and are never slower, etc.
Re:OMG! by Anonymous Coward · 2010-08-07 03:31 · Score: 1, Insightful

My computer, my rules: no automatic updates, and especially not silent ones. I want to know when software is updating, I want to know how it is updating (which process in the task list is responsible, so I can kill it if desired), I want to know why it's updating, I want to do it on *my* schedule, and I want the option of refusing to update. For me there's nothing more annoying than forever-resident background programs that are hogging memory and CPU for no reason other than checking "is there an update yet?", or having them decide to download while you are already using the machine for other things.
Apparently they've done the right thing and made a switchbox to go back to the regular behaviour. Good. I wasn't relishing the thought of going through the same kind of nonsense as I did with Adobe Reader to kill it's update program (Adobe Update / Adobe Application Manager). Had it been anything like that (for gods' sake how hard is it to allow "Never update" and "Disable/uninstall" in a switchbox????) I would stick with v.3.
Oh, and if Windows vendors could get together and come up with a single automatic update program, rather than reinventing the wheel over and over so that I have half a dozen of the stupid things running at once, one for each product/vendor, maybe I might leave that one program on. I could set my preferences for automatic updates and leave it. This is something that Linux does *SO* much better.
Re:OMG! by apoc.famine · 2010-08-07 04:08 · Score: 1

Being able to deny an update adds another layer of security to users' computers...
No, it does not. At least not on the net average. For you or I? Sure. But my mom and dad, my sister and her boyfriend, the kids I used to work with all use Firefox. And their reliability is nonexistant. If it asks them for permission, half the time they say ok. If it pops up when they're trying to type something, they close it and ignore it.

If Firefox never pops anything up, but stays updated, that's a huge step up in security for the majority of users. If they can be trained NOT to just click 'OK' on dialogs and read them, even better. And the first step in doing that is having less dialogs pop up. If dialog boxes are rare, they are much less likely to get ignored. Vista showed us the best way to get them ignored...

Personally, I'm not happy with this at all. I'm on a pretty wimpy connection, and when 10-20mb comes thumping down the pipe, I notice. I'd also rather read my updates and decide whether or not to install them. But overall, considering all users, this is a HUGE step up in security. If it results in even some small percentage less zombified computers, I'm all for it. And I think it will.

--
Velociraptor = Distiraptor / Timeraptor
Re:OMG! by Anonymous Coward · 2010-08-07 04:17 · Score: 0

If the best option is to turn it off, then this steals some time. The claim was that it saves us time.
Re:OMG! by basotl · 2010-08-07 05:00 · Score: 1

Read the last line of the summary.

--
HTC EVO 4G LTE w/ CM 10.2 | NookColor w/ CM 10.2 | Samsung Epic 4G w/ CM 10.1
Re:OMG! by Miseph · 2010-08-07 05:09 · Score: 1

Communism and capitalism are two sides of the same coin, and the whole coin is morally neutral. The problem comes when you let greedy, sociopathic tyrants flip the coin... then it becomes a matter of which terrible outcome you get, not whether you get one.

--
Try not to take me more seriously than I take myself.
Re:OMG! by Indigo · 2010-08-07 05:15 · Score: 1

+1 Insightful
Re:OMG! by pushing-robot · 2010-08-07 07:47 · Score: 1

The communist fingerpointing is getting old
Well, for a while I had to switch to terrorism for my scare-mongering, but last time I checked everyone was back to socialism. It's hard to keep up with the neoconservative fear-of-the-month club.

--
How can I believe you when you tell me what I don't want to hear?

Silent updates are not ideal. by aussersterne · 2010-08-07 01:33 · Score: 5, Insightful

I get more complaints from family and friends about "slow computers" than anything else, and usually these are all about silent background updates in the end. It's damned near impossible to explain to someone that's not computer literate what and update is, how it's affecting their computer, why it's necessary that the update gets installed, etc. They don't even know what Firefox is ("You mean my Internet?") much less any of the other things. Even my wife struggles to comprehend why there's always an update running; she tends to think I'm lying or dismissing her concerns. Every single application running on her computer does silent background updates:

Windows
Office
AntiVirus/Firewall Software
Adobe Flash Player
Adobe Reader
Sun JRE
Nero
Skype
etc.

Even tiny little apps from the vendor do this... Volume control, display control, trackpad control, blah, blah...

Another background process running automatic updates each and every icon in the tray and for each and every folder and application in the Start menu, as well as for browser plugins, third party configuration tools/extensions, drivers, etc.

At the very least they should try to display a notification somewhere on the screen saying "Updating XYZ, may slow your computer..." each time they do this, rather than silently saturating an internet connection (as 10 different updaters are in competition with one another), a CPU, and/or a hard drive's activity.

--
STOP . AMERICA . NOW

Re:Silent updates are not ideal. by tcdk · 2010-08-07 01:47 · Score: 1

I've a older (winXP) notebook that I use sparsely, if it's been off-line much more than a week, it needs about 15-20 minutes on first boot for updates, before I can use it.

--
TC - My Photos..
Re:Silent updates are not ideal. by fearlezz · 2010-08-07 01:51 · Score: 1

I installed the nvidia driver on my Linux system from the rpmfusion repository. When I run "yum update", yum updates both normal Fedora updates and nvidia driver updates. I could even configure yum-updatesd to update all packages without me even noticing.
Why can't it be this simple on windows? Windows update on Vista/Win7 is okay for updating microsoft software. Now if only third parties could add their own 'repositories' to windows update, this would make updating a lot easier, and computing a lot safer.

--
.sig: No such file or directory
Re:Silent updates are not ideal. by evanspw · 2010-08-07 01:52 · Score: 1

most of those can be set to manual update, or at least a notification that an update is ready to download. i know that's got it's downside too.

--
Interstitial spaces are filled with cream.
Re:Silent updates are not ideal. by Jorl17 · 2010-08-07 01:53 · Score: 1

You forget that browser updates matter. And, in theory, OS security updates should as well. So let's not say that silent updates are not ideal for all cases. They're not ideal for stupid and silly apps that you shouldn't be supporting any way (woops, broke the rule of not bashing useful but bloated apps -- kill me!; woops, did it again!)

--
Have you heard about SoylentNews?
Re:Silent updates are not ideal. by Anonymous Coward · 2010-08-07 01:59 · Score: 0

Use linux. Seriously.
Re:Silent updates are not ideal. by at_slashdot · 2010-08-07 02:00 · Score: 1

Hopefully Windows (Microsoft) will implement a repository system like in Linux distros. There's no reason to have EACH program run an updater for itself. Or, if you don't like the Linux example think of Apple app store....

--
"It is our choices, Harry, that show what we truly are, far more than our abilities." -- Prof. Dumbledore
Re:Silent updates are not ideal. by Anonymous Coward · 2010-08-07 02:01 · Score: 2, Insightful

This is why i hate that OSes... well, Windows, hasn't got a decent package manager.
Auto updates could easily be handled through a single program for the entire OS.
All you do is just add to a file or registry item where the URL is, current version number, date / frequency of check and an optional "where to extract this to" for non-install archives.
Then you can make whatever damned EXE you need to make for doing updates then, whether it is Chromes silent updater or a Windows updates.
Windows Task Manager != an updater system. It is a hack, and it still requires a separate EXE to check anyway.
But it is Microsoft, they never do anything good for anyone.
They deliberately make their OS stupid and cumbersome, lock the SHIT out of it and throw a crappy shiny sub-standard wasteful copy of contemporary UIs of the latest OSes.
MICROSOFT, MAKING YOUR LIFE EASIER.
Re:Silent updates are not ideal. by Anonymous Coward · 2010-08-07 02:04 · Score: 1

That's one major disadvantage of using Windows.
I can boot my GNU/Linux (Debian) machine after a month of not using it, run apt-get update && apt-get -u dist-upgrade as root, walk away to make a coffee, and when I return 5 minutes later, everything is up to date again and I can start working.
I can boot my Windows machine, and after I log in as Administrator, I have to wait 5min until the system is usable because every Application starts it's own update-agent and tries to find out whether there is an update for it or not. Then I get various annoying update pop-ups. And I have to click through at least 5 "wizards" to update my system, I takes an awful lot of time, and, worst of all, I have to constantly sit there and watch it, because I have to click on "next" for downloading the update, then again for extracting it, and finally for installing it. And even after that, my system is not up to date, because I don't have automatic updates turned on for every application (that would really kill the system), only for very important ones from a security point of view (OS, Browser, E-Mail client, Adobe Reader, Adobe Flash and a few others)
Re:Silent updates are not ideal. by hedwards · 2010-08-07 02:28 · Score: 4, Insightful

Linux can do that because virtually all the software is free either pricewise or GPLed. In which case most of those people are thrilled to have somebody else picking up the tab on the distribution and advertising. In the Windows world, that's not really the case. Much of it is commercial software and the freeware and opensource stuff is so numerous that I doubt MS is interested in taking on the responsibility and cost of hosting those files.
Re:Silent updates are not ideal. by at_slashdot · 2010-08-07 02:40 · Score: 1

Two words: App Store. Apple can do it. They even make money out of it. GPL and free software is a red herring.

--
"It is our choices, Harry, that show what we truly are, far more than our abilities." -- Prof. Dumbledore
Re:Silent updates are not ideal. by siride · 2010-08-07 02:45 · Score: 1

It doesn't need to have a repo system. It just needs to have a standard protocol for installation and update. Programs, once installed, can register with the update service, point Windows to the update URL source and then when there's an update, Windows can do it all in one batch.
Re:Silent updates are not ideal. by Anonymous Coward · 2010-08-07 02:58 · Score: 0

Exactly what I thought, too. The protocol could also require signed updates, which would be a major security improvement for many programs.
The only problem I can see with that is that not every software developer would support the (hopefully standardized) update protocol. But anyway, even if just the major ones would support it, it would be an improvement already.
Re:Silent updates are not ideal. by Anonymous Coward · 2010-08-07 03:01 · Score: 0

This is only going to run the update when Firefox is open, and I don't know what you've done to your system if installing a new version of Firefox slows it to a crawl.
Re:Silent updates are not ideal. by Anonymous Coward · 2010-08-07 03:02 · Score: 0

Windows would be better off with something like the FreeBSD Ports system. But instead of source and makefiles, have a framework which installs/updates/removes binary packages. It would be pretty easy to have a vendor like Adobe or Mozilla submit a Binary Port to Microsoft and tie it into the Automatic Update service. I'm a bit surprised they haven't done it already. It would let MS escape distributing files and give ISV a way to send out automatic updates to everyone without writing their own update code.
Re:Silent updates are not ideal. by tepples · 2010-08-07 03:05 · Score: 1

Now if only third parties could add their own 'repositories' to windows update
How much would Microsoft and Microsoft's certificate authority partner (that is, VeriSign) charge third-party application publishers for such a service? And how would developers of Free applications for Windows be able to afford it?
Re:Silent updates are not ideal. by Anonymous Coward · 2010-08-07 03:40 · Score: 0

A few more words: 30% commission.
That's how they make money out of it. It's ridiculously expensive to have your software in that store. If you're the developer, why would you instantly reduce your revenue by 30% just to have MS handle your updates? App Store only works because Apple forces it as the only "legal" distribution channel. No such lock-in exists on desktops (nor should it).
Re:Silent updates are not ideal. by apoc.famine · 2010-08-07 04:13 · Score: 1

What the hell are you talking about? OSX does NOT have a central repository for updating programs. I get spammed only a bit less than windows for updates to the various programs I have installed on OSX. If you're talking iPhone specifically, then you're talking about programs which Apple distributes being updated by Apple. This is not what is being talked about here - these are programs that are distributed by a large number of companies, being updated by those companies specifically. And that's the problem. Is your solution to have Microsoft distribute all the windows programs in the world?

--
Velociraptor = Distiraptor / Timeraptor
Re:Silent updates are not ideal. by at_slashdot · 2010-08-07 04:48 · Score: 1

Is your solution to have Microsoft distribute all the windows programs in the world?
No, but it could distribute or _facilitate_ the distribution for the most common programs. I don't expect my Linux distro to distribute all the programs available on Linux but I'm happy with the 20k+ that it does distribute, among them Firefox and Chrome, neither has to use computer resources to check separately if there's an upgrade available. I get Chrome as soon as is released, Firefox usually takes a while until is packaged for my distro.
But I hope you realize that having each program check independently if it has an upgrade does not scale.
And yes, I was talking about iPhone, that's another example of good model of application distribution (it sure can be improved, but it's better than Windows or even Mac way).

--
"It is our choices, Harry, that show what we truly are, far more than our abilities." -- Prof. Dumbledore
Re:Silent updates are not ideal. by dbcad7 · 2010-08-07 04:58 · Score: 1

Poor, poor, pitiful Microsoft.. can't be bothered with the cost of maintaining a repository of trusted and tested programs, like the fat cat big spenders on the Linux distro world.. but it's ok, their other approaches to security are working so well.. Don't kid yourself, that it's a "cost" issue, or am issue of "too many" applications.. The REAL REASON they don't follow suit with a repository system, is that there are whole industries built around the system they have.. Thousands of little Dutch boys would have to find new uses for their fingers, and be out of work.

--
waiting for ad.doubleclick.net
Re:Silent updates are not ideal. by Anonymous Coward · 2010-08-07 05:24 · Score: 0

Apt and the like support multiple sources and different keys for each source. How hard would it be for each vendor that wanted to distribute updates to host and sign their own, and on installation of the initial program, add their key.
Re:Silent updates are not ideal. by bhtooefr · 2010-08-07 05:34 · Score: 1

There is a solution to that, but the Windows implementation that I've seen was downright dreadful. (Well, the one that works for third-party software...)
Have all applications register with an updater program that checks for updates when the machine is idle.
The problem is, there's two choices I've seen: Windows Update, which is really just for Microsoft software (but works fairly well for that,) and InstallShield Update Manager, which is great in theory... but in practice, it doesn't respect settings to not GET IN YOUR FACE with a window every week, and when you tell it not to update ANYTHING, and to never even ASK about updating... every week, the pile of crap comes up to say, "Please check for updates to the following products... InstallShield Update Manager"
Re:Silent updates are not ideal. by vlueboy · 2010-08-07 07:01 · Score: 1

Firefox updates require the most current full installer to be run, and most corporate users have no access rights for that. I am surprised that nobody on the dev forum mentioned this issue; they all assume a home machine with full admin right accounts is the only environment for Mozilla Firefox deployment. In Windows, updates only work when the binary protected by System Folder rights negotiates an independent daemon that triggers elevated-privilege installs in the background, like you mention. Firefox does not use this option. Firefox also does not set up the main browser engine under the User-writable profile; Chrome doing this means more seamlessness than Mozilla's current design choice.
I'm mentioning all that because geeks and on the FF forum seem oblivious to this simple and pervasive problem:
Non-admin rights usually fail to permit installs and updates.. Firefox's shameful reality is that since Version 2.0 or earlier, the default is for the software to update everything automatically. Any failures seen by all of us are caused by rights problems.
I have built windows environments for kids and mom/pop users. Just like corporations, I give them a "Limited User" account to keep their machine secured. They cannot install system-wide software without my Admin password. The result is that firefox just pops up notifications stating that an update is available but cannot be installed. That's all fine on single user computers, and FF being the grassroots software, geeks tend to install on HOME machines or machines where users have special rights. The result is that we have a reality distortion field on what it means to have updates be automatic.
Remember how people have been clamoring for Mozilla to add Group policy and Windows-server distribution / control to Firefox. That's because nobody wants manually log in as admin on hundreds of machines and initiate a manual install.
Re:Silent updates are not ideal. by Rich0 · 2010-08-07 08:07 · Score: 1

All MS needs to do is set up an API for software to register itself for updates. System owners could have full visibility into what is going on, and OK only security updates, or functional updates as well, etc.
MS doesn't need to host any files to do it. Software could just register a URL to obtain updates from, maybe using RSS/etc. MS could also centrally host the update data stream, but not the actual files. They could even charge for the privilege, maybe offering different levels of service (host nothing, host update RSS feed/etc, host it all).
Bottom line is that Windows could certainly use a package manager. Many linux distros create packages even for proprietary apps - they just don't redistribute the actual copyrighted code (prompting for CDs, or having users put the installer in a given place, etc).
Re:Silent updates are not ideal. by Anonymous Coward · 2010-08-07 09:17 · Score: 0

That is a sufficient condition, but it's far from necessary. Apple, for instance, goes about 1/4 of the way there with www.apple.com/downloads, but there's no reason why an OS vendor can't maintain a patch repository on behalf of software vendors whose products run on their OS.
They could even charge for it, as "part of the blahbiddy-blah auto-update" would be a selling point (eventually, once it's established.).

This is problematic and I hope it can be disabled by Anonymous Coward · 2010-08-07 01:34 · Score: 4, Insightful

This is problematic on slow links where every byte is precious (dial-up)

This is problmeatic on expensive links where every byte costs money (satellite, cellular)

This is problematic in managed environments where the end user does not have write-permission to the filesystem containing the software

I hope it can be disabled.

FYI: That will trigger alarms by Anonymous Coward · 2010-08-07 01:34 · Score: 0

My personal firewall checksums executables and warns me the next time I start them if they have changed. If I don't know why an internet-enabled application has changed, I'll have to suspect shenanigans. Don't change executable code behind my back!

Re:wont work for "program files", permission denie by Anonymous Coward · 2010-08-07 01:39 · Score: 0

...won't work on windows 7

What are you smoking? Background services work just fine on Windows 7, as they did on all NT-based versions of Windows, provided you know how to program and set them up.

A feature to disable by Crock23A · 2010-08-07 01:43 · Score: 1

While I usually install all updates for firefox, and Windows, for that matter... I keep both update mechanisms disabled. I update my PC when I choose to and more often than not, i read changelogs and release notes. This feature is probably best for the average Joe type of computer user who doesn't know or care about updates.

I agree by Jorl17 · 2010-08-07 01:49 · Score: 5, Insightful

At the risk of being /. assassinated, I have to say that I agree with this. Particularly because it is possible to disable such a feature.

Non-techie people don't get a thing about browsers, updating, security, etc. The medium-techie usually want to be all updated, so will update to even RCs and Betas if they find them out. Techie guys, us, do whatever they want, but I believe that they want to be in control and know what's going on -- thus, they'll disable such feature.
But especially for the non-techies, this is a way of getting free security upgrades. The upgrades will probably be carefully chosen so that there are no compatibility issues -- and if there are, non-techie to medium-techie users won't care that much.

All in all, it is good for people who don't care, and enables us who care to keep things the way we want it.

--
Have you heard about SoylentNews?

Re:I agree by Nerdfest · 2010-08-07 02:23 · Score: 1

I won't disable automatic updates, but I will disable silent automatic updates. When something stops working, I generally look at what has changed. If I don't know what to look at, it makes things very difficult to debug.
Re:I agree by syousef · 2010-08-07 07:21 · Score: 1

Yeah it's all sugar and cream till a silent update breaks the browser or worse.
There's a reason people don't update. Some updates are a cure worse than the disease.
I see the Firefox team pushing things that some users will despise more and more. Where I come from that's called arrogance. If this browser goes the way of Netscape this is the most likely reason.

--
These posts express my own personal views, not those of my employer
Re:I agree by Jorl17 · 2010-08-07 07:33 · Score: 1

"The upgrades will probably be carefully chosen"(...)

I said that foreseeing answers like yours. They're bringing in SECURITY updates. Besides that, I think they're smart enough to do some private testing before sending them to the wild. Additionally, they give you the chance of disabling that feature. Do you actually think that a security update is going to break that much? And don't bring me old examples, because those are, as it says, "old". Now that the team has made this decision, them they will surely think carefully before sending out updates. And if a bug does come out on the wild, it won't be that much of a deal, as an update is sent to fix a security bug. I'd rather not have a browser running because it had a faulty updated than browsing with known security "breaches".
Sure, I'd be pissed off that they let something like that out, but that could happen with anything I own and I want to be as safe as possible. Besides, as I said, you can disable it if that pisses you off that much, get over yourself.

--
Have you heard about SoylentNews?
Re:I agree by syousef · 2010-08-07 12:22 · Score: 1

"The upgrades will probably be carefully chosen"(...)
No body plans for a catastrophe.

I said that foreseeing answers like yours. They're bringing in SECURITY updates.
Yes because they are magical and never break anything. Nor could such a mechanism ever be targeted for an exploit itself, could it/ Hackers must be wetting themselves. Updates you can't turn off.

Besides that, I think they're smart enough to do some private testing before sending them to the wild.
Smart doesn't mean infallible. Testing can't ever guarantee you've missed nothing. Did the Firefox team intend to introduce the vulnerability in the first place? No. Well if not what makes you think this process will fare any better?

Additionally, they give you the chance of disabling that feature.
I'm reading that this won't be allowed. If it is allowed I don't have as big an issue, though it is still one more thing I could forget to turn off - out out sucks - and I would want to be able to configure it before first automatic update.

Do you actually think that a security update is going to break that much? And don't bring me old examples, because those are, as it says, "old".
You want me to bring you examples from the future? Fucking hell.

Now that the team has made this decision, them they will surely think carefully before sending out updates.
Are you implying they were careless before?

And if a bug does come out on the wild, it won't be that much of a deal, as an update is sent to fix a security bug.
...if it hasn't broken the browser or allowed malicious code by mistake...

I'd rather not have a browser running because it had a faulty updated than browsing with known security "breaches".
I'd rather have the browser *I* have tested on my system running.

Sure, I'd be pissed off that they let something like that out, but that could happen with anything I own and I want to be as safe as possible. Besides, as I said, you can disable it if that pisses you off that much, get over yourself.
Well I was being sarcastic, but trying to avoid getting personal. But as you've let that slip, why don't you fucking get a clue. All this is going to do is make more IT departments ban Firefox, and the first slight issue will turn users off the browser. It is a browser that targets advanced users. The main reason to use it has always been extensions. Advanced users don't like being opted into shit.

--
These posts express my own personal views, not those of my employer

User Account Control by Crock23A · 2010-08-07 01:50 · Score: 4, Interesting

I wonder how this will get around UAC, a substantially annoying feature of Windows Vista/7. Will they be installing firefox to the user's home directory? Will it be sand-boxed from the OS? I admit I haven't done much looking into the pre-release so I apologize for any ignorance I might be showing.

Re:User Account Control by Rockoon · 2010-08-07 02:00 · Score: 1

I also thought about this almost immediately. You cant silently do anything under /Program Files/ or /Program Files (x86)/ without administrator rights.

Is it their intention to install the binaries/etc some place that doesnt require admin rights to modify them? How could that possibly be safer/better?

Maybe instead they intend to install a service set up with admin privileges. How is an extra service, with admin and network access rights and intent on modifying /program files/, safer/better?

Updates should be noisy anyways, regardless of the increased risks this sort of thing creates.

--
"His name was James Damore."
Re:User Account Control by TheSeer2 · 2010-08-07 03:31 · Score: 1

You obviously haven't actually used 7 (though your criticisms are somewhat more valid for Vista) if you think there's too many UAC prompts. :P
Re:User Account Control by sadler121 · 2010-08-07 07:19 · Score: 2, Interesting

Chrome has it's exe in APPDATA, that is how they get around UAC.
Re:User Account Control by cbhacking · 2010-08-07 10:45 · Score: 1

NEWS: Mozilla today announced that they were also going to be adding the automatic silent updater to Linux builds.
Slashdot reader Crock23A was quoted as asking "I wonder how they're going to get around the fact that only root can write to /bin, a substantially annoying feature of Linux.
Seriously, people like you are what's wrong with computer security in the world today. There will always be bugs in code, that's inevitable. It takes true stupidity to think that running with full permissions is a good idea.
In answer to your question, there are plenty of ways to fix this. The simplest are to install to a user-writable location, or to modify the ACLs on the install location so that it is user-writable. This isn't exactly rocket science, people.

--
There's no place I could be, since I've found Serenity...

Restart after update? by hcdejong · 2010-08-07 01:52 · Score: 1

Until now, FF updates require a restart. The update may be silent, but the restart is still going to require user notification. So what's the advantage here?

Re:Restart after update? by PRMan · 2010-08-07 02:26 · Score: 1

I imagine it would wait until the user restarted Firefox...

--
Peter predicted that you would "deliberately forget" creation 2000 years ago...
Re:Restart after update? by tepples · 2010-08-07 03:22 · Score: 1

I imagine it would wait until the user restarted Firefox...
Which gets into cases where a user leaves Firefox open for days, putting the computer to sleep instead of shutting it down.
Re:Restart after update? by apoc.famine · 2010-08-07 04:14 · Score: 2, Funny

Adobe has created a fix for this...just install flash...

--
Velociraptor = Distiraptor / Timeraptor

You thought you'd sneak that by me? by bursch-X · 2010-08-07 01:55 · Score: 2, Insightful

Nah, little Snitch will tell me. I really do hate that Google Chrome feature; just when I least expect it one of the Google background processes is for no apparent reason trying to connect to certain sites. Makes me wary, even if for the right reasons some software tries to sneak in any update without telling me. Even Apple gives me more freedom there.

--
There are two rules for success:
1. Never tell everything you know.

Re:You thought you'd sneak that by me? by dzfoo · 2010-08-07 23:17 · Score: 1

Unless the connection is through HTTP and--in an inspired moment of sanity--you decided to allow your web browser to use that port freely.
Seriously, I thought the same thing, and then I realized that I already gave Firefox access to port 80 and 443, specifically because it was insanely annoying to be prompted for permissions per host. Damn!
I just won't upgrade. I personally mitigate my risks with additional factors, such as not surfing into strange sites and using a combination of additional security layers. I also seem to be using Safari more often recently, ever since I was able to set up AdBlock in it.
-dZ.

--
Carol vs. Ghost
...Can you save Christmas?

Leave the question! by coldmist · 2010-08-07 01:58 · Score: 0, Troll

And what if some of your plugins aren't ready for 4? suddenly, websites look different (like maybe a craigslist image laoder stops working), or worse yet your tab extension is borked, and you can't do anything with tabs any more?

Maybe a user doesn't like the new 4.0 look and wants to stay at 3.5?

Give the user a box and ask.

Do not change this behavior!

--
Don't steal. The government hates competition.

Re:Leave the question! by the_other_chewey · 2010-08-07 02:10 · Score: 4, Informative

Maybe a user doesn't like the new 4.0 look and wants to stay at 3.5? Give the user a box and ask. Do not change this behavior!
Congratulations for not even reading the summary: They will only do silent updates for
minor versions, i.e. security and stability updates.

The question will be kept for major updates, like 3.x to 4.
Re:Leave the question! by Dunbal · 2010-08-07 02:23 · Score: 1

The beauty of open source - you don't like it, fork it.

--
Seven puppies were harmed during the making of this post.
Re:Leave the question! by capebretonsux · 2010-08-07 02:38 · Score: 1

Give the user a box and ask.

Good luck with that. I'm still using firefox 2.0.0.20 simply because the awesome-bar was a dealbreaker for me since day one. And no, the 'oldbar' addon just makes it look the same, when the old behaviour is what I want most. What makes it even more depressing is how every other browser on the face of the earth which supports ad-blockers and noscript add-ons have followed mozilla over that cliff.

Lynx is looking more and more attractive by the day.
Re:Leave the question! by Anonymous Coward · 2010-08-07 03:52 · Score: 0

Ya, because there are no barriers to entry like hosting the project, managing the project, or the technical expertise required to manage the particular feature. This is just a lame excuse thrown out there by people who like to win pissing matches. Didn't this used to be the reason people hated Microsoft - deciding things for the user? Now it's OK when Mozilla does it why?
Re:Leave the question! by TubeSteak · 2010-08-07 16:48 · Score: 1

They will only do silent updates for minor versions, i.e. security and stability updates.
And no company has ever screwed over millions of users with a bad automatic/mandatory security or stability update.

--
[Fuck Beta]
o0t!

Re:This is problematic and I hope it can be disabl by Anonymous Coward · 2010-08-07 02:00 · Score: 0

It has been like this for 6 years - what's the problem ? Disable the update if you don't like it.

The biggest issue with auto-updates... by Anonymous Coward · 2010-08-07 02:00 · Score: 0

The biggest issue with auto-updates is that when I'm on 3G on my laptop, I have to make pretty sure everything has its update mechanisms disabled, and re-enable them when I get home, otherwise my bill runs up pretty quickly.

Case in point, Steam. It's not exactly an auto-updater, but it'll insist on immediately syncing the games I installed on my desktop. And that's a *load* of traffic. Sure, I can always shutdown Steam, but I can't shutdown Firefox or Chrome, which I need for my everyday browsing. And BAM, out of nowhere, I've already spent ~20 MB out of my quota, and it hurts.

Re:The biggest issue with auto-updates... by MysteriousPreacher · 2010-08-07 02:35 · Score: 1

That and these hidden updates could cause problems in the corporate world. Normally when browsers are updated I see vendors advising users to wait until the browser has been tested. That mostly applies to major updates, but any kind of update could patch a hole that a web application relied on - or introduce a new bug.

--
-- Using the preview button since 2005

The EASY and OBVIOUS solution by Roark+Meets+Dent · 2010-08-07 02:00 · Score: 0, Offtopic

... Simply set your application firewall to block all IP traffic originating from Firefox.

Oops by Anonymous Coward · 2010-08-07 02:03 · Score: 1, Insightful

So much for rolling out Firefox for Enterprize.

Re:Oops by eliphalet · 2010-08-07 08:44 · Score: 1

My employer blocks the Firefox install and update sites. The want us to use only their outdated and crippled version, which is "approved" but not "supported".
Re:Oops by dzfoo · 2010-08-07 23:19 · Score: 1

They don't use Firefox in the Enterprise, silly. The Computer has a direct connection to the Federation Network through a specialized protocol.
-dZ.

--
Carol vs. Ghost
...Can you save Christmas?

More Mozilla Fail by duffbeer703 · 2010-08-07 02:25 · Score: 4, Insightful

I'd love to be able to actually deploy and maintain Firefox in the large enterprise that I work in. Users want it. Unfortunately, users don't have admin rights, and Mozilla makes applying updates and configuring the browser from a central location difficult and has a history of not thinking about and actively shooting down any proposals which would potentially benefit system administrators trying to support Firefox.

I don't get why they don't get it.

--
Conformity is the jailer of freedom and enemy of growth. -JFK

Re:More Mozilla Fail by Anonymous Coward · 2010-08-07 03:48 · Score: 1, Informative

i guess you need this "The CCK Wizard can be used to create an extension that customizes Firefox. To access it, after installation, select Tools->CCK Wizard. " https://code.google.com/p/ff-cckwizard/
Re:More Mozilla Fail by Anonymous Coward · 2010-08-07 03:59 · Score: 1, Informative

Look up FrontMotion Firefox. I've been using it for about six years now with little or no problems in a school enviroment (500 machines). It even comes with an ADM template so you can set some control in your network. They also disable any type of auto update by default. Pretty sure they will do the same in version 4 as well.
Re:More Mozilla Fail by Anonymous Coward · 2010-08-07 04:22 · Score: 1, Insightful

I don't get why they don't get it.
They get it, but it's an ego trip for many of the module owners. What they have decided is best and there's no possible way that some imbecile on the outside could possibly have a suggestion worthy of their consideration. Were you around when Stuart Parmenter removed support for MNG from Mozilla under the auspices of saving download time? That seriously was his argument. Then, when someone optimized the code to add less than 20k to the download, he still refused to add it back. It was an ego contest at that point and there was no way he was going to add MNG support back even if it saved space. It wasn't until years later that we learned Stuart was actually developing a pet project that was direct competition to MNG.
Re:More Mozilla Fail by Ant+P. · 2010-08-07 08:02 · Score: 2

I saw the whole trainwreck (bugzilla bug 18574) unfold over several years. The libmng developers deserve medals for their effort - every time the goalposts were moved and they were ordered to make the library fit into an (intentionally) impossible small size, they actually did it.
Thanks for another useless, proprietary format that none of us can use, Mozilla. Open Web my fucking ass.
Re:More Mozilla Fail by JeffAtl · 2010-08-07 12:27 · Score: 1

The parent's comment certainly deserves modding up. This is the first I had heard of this and after checking out Bugzilla found out it is a 10 year old battle where the powers that be refuse to budge because the module owner seems to be well connected.
Sadly, this just illustrates that open source projects, just like governments and corporations, can fall prey to giving power to a well connected, self-serving person who wants his own private kingdom. The organization then jumps through hoops making idiotic excuses in an attempt to justify the actions that person makes.
Ten years is still a long time though - this module owner must be very well connected within Mozilla.
Re:More Mozilla Fail by duffbeer703 · 2010-08-09 15:03 · Score: 1

No, I don't need one of the many 3rd party hacks that have been built due to Mozilla's insistence on developing software like it's still 1996.
Why not?
- Users don't have admin rights. They cannot write to the registry. They cannot write to program files.
- The nice folks at Mozilla break these 3rd party packages every few months. (Ask the Debian/Ubuntu folks -- this isn't just a Windows problem)
The authors of trivial software packages have been getting this for a long time. Even Apple Safari on Windows is better than Mozilla. And Apple doesn't give a hoot about anyone! Mozilla doesn't care, and yes, I've worked with people in the past willing to write code and put up cash to get work done -- we were rebuffed and called a bunch a newbie idiots for daring to make a contribution.
Guess what? The 45,000 people I provide services to are not using Firefox, and are not clicking on Adsense while using the Firefox search box. This is one of the top 3 reasons we didn't deploy desktop Linux to a subset of users as well. We're on IE and doing proof of concepts with Chrome.

--
Conformity is the jailer of freedom and enemy of growth. -JFK

Do not want. by unity100 · 2010-08-07 02:32 · Score: 0, Troll

as simple as that. i wont upgrade to 4, as long as my software gets updated behind my back. i dont care about the reasons, i dont care about the rationalizations, i dont give a damn about anything else. it is MY computer, MY browser.

--
Read radical news here

Re:Do not want. by RabbitWho · 2010-08-07 02:41 · Score: 1

It says right there you have the option to turn off silent updates.

--
it's under construction
Re:Do not want. by siride · 2010-08-07 03:21 · Score: 2, Informative

Dude, you can turn off silent updates. I know nobody reads the article, but at least read the summary before frothing at the mouth about a non-problem.
Re:Do not want. by Anonymous Coward · 2010-08-07 03:58 · Score: 0

You're kind of an idiot, aren't you?
Re:Do not want. by unity100 · 2010-08-07 04:06 · Score: 0, Troll

if there wasnt such an article, would i know that there were silent updates, and, i could turn them off ?

--
Read radical news here
Re:Do not want. by siride · 2010-08-07 04:16 · Score: 1

I assume that if it bothered you that much, you'd probably search for a way to turn it off. The summary did say that you will still know when the updates are being applied with a progress bar, it just doesn't ask you or go through a whole hullaballoo to install updates.
Re:Do not want. by Teknikal69 · 2010-08-07 05:12 · Score: 1

I'll not be updating either but mostly because I just don't like the new chrome like GUI, this is another minus point however I like to see what's happening on my own PC it helps me troubleshoot if nothing else.
Re:Do not want. by unity100 · 2010-08-07 06:04 · Score: 0, Troll

how could i think of a reason to search it up, if i didnt know that it was updating itself behind my back ? had i not read this article, would i know ?

--
Read radical news here
Re:Do not want. by siride · 2010-08-07 06:06 · Score: 1

Because it still tells you that it's updating...
Re:Do not want. by unity100 · 2010-08-07 06:17 · Score: 0, Troll

it tells me it is updating, BEFORE me knowing that it is updating. so, update will happen, and i will know when its happening, and only then will realize that i should seek a way to disable it and make it manual ...

--
Read radical news here
Re:Do not want. by siride · 2010-08-07 06:29 · Score: 1

A one-time problem, easily fixed. If you really want to be safe, unplug your internet connection. Maybe go outside, talk to some real women, something like that.
Re:Do not want. by wbo · 2010-08-09 03:55 · Score: 1

Yes, an individual user can turn off silent updates but is there a setting that turns off silent updates for all users on a system? On Windows at least, Firefox update settings are stored per user, making it difficult to manage in a multiuser lab environment.

Why not... by johosaphats · 2010-08-07 02:46 · Score: 1

Why not ask whether you want to be notified once it gets ready to update for the first time? This way, people who don't want to be notified in the future can elect not to (make this the default choice), and those that do can uncheck to box easily. Everyone's happy.

silent update will only be offered.. by tirnacopu · 2010-08-07 02:48 · Score: 2, Insightful

on Windows, Mozilla has said.

Nothing to see here, move along..

Egad. Use intelligent defaults. by ccady · 2010-08-07 02:54 · Score: 5, Insightful

How stupid! Show the user the dialog box, and put a checkmark on it which says (approx) "Don't notify me of these updates anymore, just do them."

--
J'aime mieux les méchants que les imbéciles, parce qu'ils se reposent. -- Alexandre Dumas

Signed with what certificate? by tepples · 2010-08-07 03:09 · Score: 2, Insightful

The protocol could also require signed updates

Signed with a certificate issued by whom, purchased with what money? A company like Mozilla Corp could afford it, just as it can afford the Authenticode certificate to digitally sign Firefox Setup, but individual hobbyist developers of freeware and free software likely can't spare 200 U.S. dollars per year plus whatever their state charges to form a business entity.

Re:Signed with what certificate? by Anonymous Coward · 2010-08-07 04:08 · Score: 0

Well, it doesn't have to be signed by a PKI. I don't trust any program just because someone was willing to pay a root CA to sign their keys.
For example, look at the Debian project. They sign all their packages with their own keys (which aren't signed by a CA AFAIK). So I download their keys over a secure channel when I download the distribution or buy them on CD. Now I can download packages even over untrusted networks (like at an University, or other public places) and I can be rather certain that I get the unmodified Debian packages.
The update protocol could just store the signing key from a particular software during registration. If any subsequent update isn't signed by that exact key, a warning could be displayed. I consider such a system to be much more secure than a complex PKI system where thousands of keys are allowed to sign the updates.
There was actually a fun story regarding update signing with a PKI a few years ago. Microsoft had signed their updates, but before installation, the only thing Windows checked was whether the update was signed with a key which was signed by the same root CA as Microsoft's key was.
So a few guys collected private keys for certificates which were signed by the same CA, which was possible during that time because of the predictable PRNG Bug in Debian's OpenSSL package.
Then, in possession of some private keys whose corresponding public keys were signed by VeriSign, they were able to sign Windows updates, just like any person who was willing to pay $200 to VeriSign for a CSR was, because all certificates signed by VeriSign were trusted by Windows.
Even the BlackHat audience couldn't believe that when they heard it the first time...(see "Hacking and Injecting Federal Trojans.")

How to disable updater only on pay-per-bit? by tepples · 2010-08-07 03:12 · Score: 1

Anonymous Coward wrote:

Disable the update if you don't like it.

Can you recommend an easy-to-understand user interface to configure the updater to disable itself when on a pay-per-bit connection to the Internet yet reenable itself when on a less strictly metered connection (such as a home LAN or a restaurant hotspot)?

Re:Egad. Use intelligent defaults. by genner · 2010-08-07 03:17 · Score: 1

How stupid! Show the user the dialog box, and put a checkmark on it which says (approx) "Don't notify me of these updates anymore, just do them."

What's an update?
Son quick get in here, I got a virus!

Re:This is problematic and I hope it can be disabl by Anonymous Coward · 2010-08-07 03:20 · Score: 0

I hope it can be disabled.

Duh. Given how much fine-grained control Firefox does give you on about:config, chances are you won't just be able to disable it, you'll also be able to fine-tune what kinds of updates you receive, how often the check will be performed, and what server the updates will be fetched from (which might be useful for companies).

Say whatever you want about Firefox and Mozilla - I don't always agree with their default choices, and this one seems like something I'd not be happy with, either, but they DO allow you to configure things to your liking.

Updater need not have network access by tepples · 2010-08-07 03:20 · Score: 1

How is an extra service, with admin and network access rights and intent on modifying /program files/, safer/better?

The updater service can be audited separately because it is a much smaller program than Firefox itself. After the main app has finished downloading the update package to the Local Settings folder in the user's home directory, it starts the updater service. The updater service itself does not connect to any network; all it does is verify the digital signature of the update package and then replace the executable with the updated copy. I don't know how Windows ACLs work in depth, but if the updater runs as a user that can't write outside /Program Files/Mozilla Firefox, that's another way to limit the damage it can do.

Re:Updater need not have network access by Rockoon · 2010-08-07 03:27 · Score: 1

I don't know how Windows ACLs work in depth, but if the updater runs as a user that can't write outside /Program Files/Mozilla Firefox, that's another way to limit the damage it can do.
It can't if it runs as a regular user. Thats sort of the point.

The article summary claims silent updating, so the service can't run as the logged in user.

--
"His name was James Damore."
Re:Updater need not have network access by tepples · 2010-08-08 03:48 · Score: 1

the service can't run as the logged in user.
That's why it runs as a different user with appropriate permissions. Or does Windows require a regular user to elevate just to wake another user's service?
Re:Updater need not have network access by Rockoon · 2010-08-08 09:28 · Score: 1

That's why it runs as a different user with appropriate permissions.
Go back to the first post of mine that you replied to. How is having such a service safer/better?

--
"His name was James Damore."
Re:Updater need not have network access by tepples · 2010-08-09 01:22 · Score: 1
How is having such a service safer/better?
I'll rephrase my earlier post to number my points so that we can refer to the numbers in further discussion:
1. The service is a smaller chunk of code than the browser itself, meaning it can be audited more closely.
2. The service does not have network access; all the downloading is done by the browser.
3. The service cannot write to the file system outside the specific application's folder in Program Files.
Re:Updater need not have network access by Rockoon · 2010-08-10 01:49 · Score: 1

1) How is someone auditing the code for the updater more closely going to change anything?

Updates are already digitally signed. What further advantage does this system offer to offset the disadvantage that a service can silently alter at least one previously trusted binary on my system?

What, am I supposed to pray to god that (A) the browser cant be fooled into downloading a bogus update, and (B) that the mozilla boys remain vigilant about protecting their private key, and that (C) nobodies botnet with more computing power than the #1 supercomputer on the planet cracks the key anyways?

I dont think that you understand real security methods, or what the real dangers are.

How is it SAFER, or BETTER? This is no better than The Same as Now, only with dangerous silent updates added.

--
"His name was James Damore."
Re:Updater need not have network access by tepples · 2010-08-10 02:24 · Score: 1

What, am I supposed to pray to god that [the publisher's signing key isn't discovered]
Do you have the same objections to the Automatic Updates feature in Windows? When you perform manual updates, how do you verify those?

nobodies botnet with more computing power than the #1 supercomputer on the planet cracks the key anyways?
Distributed.net isn't making noticeable progress cracking a 72-bit RC5 symmetric key. What makes you think a black-hat botnet will be any more efficient?

How is it SAFER, or BETTER?
It's safer in the case where a computer's administrator may be physically absent for substantial periods of time. Say Mozilla Corp learns of a defect in the browser that allows compromise of a user account, and its developers fix the flaw and issue an update. Under the current system (user installs), the user has to wait for the computer's administrator to come back, during which time the user's account is vulnerable to exploits of this defect. But with a service, if the administrator chooses to trust Mozilla Corp and enable silent updates, the update gets installed, at which point the hole gets closed.
Re:Updater need not have network access by Rockoon · 2010-08-10 04:04 · Score: 1

Do you have the same objections to the Automatic Updates feature in Windows?
yes. end of story.

Distributed.net isn't making noticeable progress cracking a 72-bit RC5 symmetric key. What makes you think a black-hat botnet will be any more efficient?
You mean besides the fact that each time mozilla ships an update, there is more information available to crack the private key?

It's safer in the case where a computer's administrator may be physically absent for substantial periods of time.
The absolute last thing an administrator does when (s)he leaves for "substantial periods of time" is leave any sort of automatic updating enabled. If the automatic update breaks something, thats the end game nightmare of zero uptime "for a substantial period of time." With firefox this problem is confounded by the fact that it isnt easy to remotely manage the installations (Active Directory) so they couldn't reliably and easily disable such silent updating prior to leaving for that "substantial period of time."

The 'Administrator Isn't Around' card doesnt apply here because of thats the case, the administrator is a fool if he lets things update at all, let alone silently do so.

--
"His name was James Damore."

It has my vote by Skythe · 2010-08-07 03:30 · Score: 1

I like how Chrome updates silently - if anything the additional thing I'd like is to see a changelog of what has been updated; not because I want to scan it for government spy code, but out of curiosity/new minor features. As for the updates in terms of less computer literate users, I'd rather it update silently for them. Having worked at an ISP, I know the frustrations of having to deal with someone using a horridly outdated browser. If not for the features and to make their browsers more usable, then for the security updates of which they wouldn't even really realize the implications of.

why? by SuperDre · 2010-08-07 03:44 · Score: 0

Why is this only on the windows platform? and why can't it be the other way around, ASK me if I want a silent update or not instead of silent updates being the default.. This seems more to me like a way to hush hush how vulnerable FF really is..

Re:This is problematic and I hope it can be disabl by FooBarWidget · 2010-08-07 03:45 · Score: 3, Insightful

"And I hope it can be disabled"

Read the summary.

What if I'm not an administrator? by wiredlogic · 2010-08-07 03:47 · Score: 2, Interesting

I don't normally run as administrator on my computers. I have installed Firefox as an admin., though, and I must use that account for updates. This is slightly annoying with Firefox because I get update nag notifications under my user account which can't be used to perform the updates. I don't always want to go through the hassle of shutting down my current session and switching accounts for the latest update. I hope this new feature can be turned off to avoid additional problems with the update process.

--
I am becoming gerund, destroyer of verbs.

Re:What if I'm not an administrator? by Anonymous Coward · 2010-08-07 07:31 · Score: 0

Right click on firefox.exe and choose "Run as administrator". Problem solved. Keep in mind that you'd have to close your current session anyway. And RTFS; it says that it can, in fact, be turned off.
Re:What if I'm not an administrator? by cbhacking · 2010-08-07 10:48 · Score: 1

This is exactly why UAC exists... if you're not running an OS with UAC, your OS is at least 7 years old since its last major update (and I doubt you're running Server 2003). Maybe you should upgrade to an OS with a modern featureset, including security features (ASLR, for example) that are completely unavailable on your current OS?

--
There's no place I could be, since I've found Serenity...

Re:This is problematic and I hope it can be disabl by MpVpRb · 2010-08-07 03:49 · Score: 1

This is problematic on computers used as digital audio workstations, where background processes can cause glitches in playback

Re:This is problematic and I hope it can be disabl by Anonymous Coward · 2010-08-07 03:55 · Score: 0

Yes it is: "Unlike Google, Mozilla will let users change the default silent service to the more traditional mode, where the browser asks permission before downloading and installing any update."

Re:This is problematic and I hope it can be disabl by webheaded · 2010-08-07 04:02 · Score: 1

It can be disabled. It says that right there in the summary. Geez dude, did you just read the title and call it a day? :p

--
"Those who would sacrifice essential liberties for a little temporary safety deserve neither liberty nor safety." - BenF

Bad Move by JeremyGNJ · 2010-08-07 04:34 · Score: 1

Wow, these companies are really shooting themselves in the foot when it comes to corporate adoption.

No right-minded SysAdmin would want this sort of thing in their environment. While I understand that you CAN turn it off, Im willing to bet (without caring enough to actually look), that they have neglected to add any security features that would prevent an end user from turning the "auto update" back on.

Update manager != Automatic updates by Anonymous Coward · 2010-08-07 04:35 · Score: 0

Huh? You don't seem to get it.

Automatic updates does not slow down anything, unless they are update managers that runs constantly like Adobe's. But Firefox / Mozilla can check the new updates e.g. when starting browser or after ~2 minutes of running the browser, anyways they use resources (if no update is found, it should ideally use resources as much as one Ajax request) only very small amount of time per week, they don't need no stinking update manager running all the time.

Re:This is problematic and I hope it can be disabl by Nemyst · 2010-08-07 04:38 · Score: 1

RTFS please, even if you don't read anything else.

Unlike Google, Mozilla will let users change the default silent service to the more traditional mode, where the browser asks permission before downloading and installing any update.

Why is this even modded Insightful?

Re:Egad. Use intelligent defaults. by Nemyst · 2010-08-07 04:39 · Score: 2, Insightful

People ignore update dialogs. Why do you think they wouldn't ignore that, too?

please let me just use the stupid browser by Ndkchk · 2010-08-07 04:41 · Score: 1

So with this new silent update process, half the time when I start Firefox it'll have to update before I can use it? And this is something that just happens? Mozilla, you should stop worrying about browser cold start time and start worrying about update time. I just want to be able to open a web browser and use the internet; I don't need any more progress bars before I can do so.

Re:This is problematic and I hope it can be disabl by basotl · 2010-08-07 04:58 · Score: 1

From the summary:
"Unlike Google, Mozilla will let users change the default silent service to the more traditional mode, where the browser asks permission before downloading and installing any update."

--
HTC EVO 4G LTE w/ CM 10.2 | NookColor w/ CM 10.2 | Samsung Epic 4G w/ CM 10.1

Re:This is problematic and I hope it can be disabl by Anonymous Coward · 2010-08-07 05:04 · Score: 0

From TFS:

Unlike Google, Mozilla will let users change the default silent service to the more traditional mode, where the browser asks permission before downloading and installing any update.

No money required by Anonymous Coward · 2010-08-07 05:06 · Score: 0

Is GnuPG signed with a certificate issued by a CA? No, it isn't

Does this mean you can't trust it? No it doesn't.
GnuPG, like a many other FOSS programs, is simply signed by the developer's signature key. If you have once obtained said key over a secure channel, or verified it by other means (like having downloaded it 15 years or/and having cross-verified it over various different channels), you can verify the integrity of every release of GnuPG with this key.

Can this system be by-passed?
Yes, just like nearly any other system. If you never had a secure channel to obtain the key.
But it's the risk is probably lower than the risk that someone added a bogus SSL/TLS root certificate to your favorite browsers certificate DB during it's initial download.

What I'm trying to say is that it's a common misinformation that there has to be a PKI one has to pay for in order to securely sign anything. Moreover, the PKIs you're referring to are partially based on DNS, which isn't exactly a secure protocol, at least not before DNSSEC is rolled out everywhere. For example, some CAs use your e-mail address to verify that you're the legitimate owner of the domain. It has happened multiple times already that someone could get a signed certificate from a CA without being the owner of the domain specified in the certificate.
See Dan Kaminsky's work if you're interested in some of the issues with (current) PKIs. Bruce Schneier has also some interesting points.

Re:No money required by tepples · 2010-08-08 04:00 · Score: 1

GnuPG, like a many other FOSS programs, is simply signed by the developer's signature key. If you have once obtained said key over a secure channel
What channel is secure, other than a channel established with the aid of a face-to-face meeting known as a key signing party? I, for one, don't fly often enough to attend those.

or verified it by other means (like having downloaded it 15 years or/and having cross-verified it over various different channels)
A developer who is new to a particular web of trust won't have a 15-year track record like the GnuPG team. So to which "various different channels" are you referring?

a bogus SSL/TLS root certificate
Which is why Authenticode, for example, uses a different set of root certificates from TLS in part because TLS is such a juicy target.

Moreover, the PKIs you're referring to are partially based on DNS
To break HTTP, you'd have to bypass DNS. To break HTTPS, you'd have to both bypass DNS and either fool a CA or fool the user into installing a root certificate.
Re:No money required by Anonymous Coward · 2010-08-09 00:59 · Score: 0

What channel is secure, other than a channel established with the aid of a face-to-face meeting known as a key signing party? I, for one, don't fly often enough to attend those.
Look, it's pretty simple. The whole business of a CA is to verify the identity of the people who send them CSRs. The practical upshot of which is that as a user, you don't have to verify every person as long as you trust the CA.
However, I can assure you, no CA is going physically verify any key signing party for $200 either. Which means, you don't get much extra security.
Furthermore, do you trust all the CAs? I know I don't. They're just companies. They have to make profit. And if you trust them, did you verify their CAs root certificates? Most people don't. Do they still use MD2?

A developer who is new to a particular web of trust won't have a 15-year track record like the GnuPG team. So to which "various different channels" are you referring?
Yes, true. But is he any more trustworthy just because a CA claims that he is who he claims to be? This is ridiculous.

To break HTTPS, you'd have to both bypass DNS

Not even necessary if you're an ISP.

and either fool a CA
As I said, this is easier than most people think it is. They're not really verifying you for $200. And they need money.

or fool the user into installing a root certificate.
Which is equally easy as fooling the user into downloading a fake public key of a developer. One has to get the certificates at some point.
I'm not saying PKIs aren't any good. But they're not a silver bullet, and if you look at how they work in practice, you'll see that many times a simple approach may be more secure. Of course my view is a bit skewed, as I am myself a FOSS developer and I have established a relatively large network of trust over the time. If I get a new key which is signed of by 35 developers and I know/trust 3 of them, I am more confident in it's authenticity than I am when I get a new key signed of by CA I can't know/trust (why should I?). For a CA, the verification process is just an opportunity to earn $200 and costs them ~30min of work.
Back to the original point, I still think requiring signed updates is the right way to go. That doesn't imply that the keys need to be "verified" by CAs, it could be optional. So that FOSS developers like me still can rely on their web of trust and don't need to pay for a CA.
Anyway, we're talking about an imaginary protocol which I'm probably never going to use because I don't use Windows, so we shouldn't rack our brains about it too much ;-)
happy trusting!

I have to say no to this by Stan92057 · 2010-08-07 05:16 · Score: 1, Insightful

I have to say no to this, It should not be on by default. As much as everyone loves foxfire they make mistakes updates brick computers and so on. If we have no clue there was an update before the computer acts up this is a bad thing. We all ask what was the last thing you did? correct? It can be an option but thats it, an option.

--
Jack of all trades,master of none

Standalone by EnsilZah · 2010-08-07 05:35 · Score: 1

As a windows user I'd like to see a big player like Mozilla release a standalone updater that all the other software can use so every app doesn't have to check for updates on its own and use its own halfassed update method.

Re:This is problematic and I hope it can be disabl by Anonymous Coward · 2010-08-07 05:35 · Score: 0

This is problematic on slow links where every byte is precious (dial-up)

This is problmeatic on expensive links where every byte costs money (satellite, cellular)

This is problematic in managed environments where the end user does not have write-permission to the filesystem containing the software

I hope it can be disabled.

Well I know this is slashdot but you could at least read the entire fucking summary as it clearly states that you can disable this in the settings

Compile? by Anonymous Coward · 2010-08-07 05:42 · Score: 0

I compile my Firefox (on Linux of course) from the source code. In this case, silent updates make no sense whatsoever.

Re:This is problematic and I hope it can be disabl by Anonymous Coward · 2010-08-07 06:03 · Score: 1, Informative

"Unlike Google, Mozilla will let users change the default silent service to the more traditional mode, where the browser asks permission before downloading and installing any update."

Of course Opera's cluttered by billstewart · 2010-08-07 06:31 · Score: 1

When I first used it, the distribution fit on half a 3.5" floppy drive. It's rather larger than that now...

--

Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks

Re:This is problematic and I hope it can be disabl by Anonymous Coward · 2010-08-07 07:16 · Score: 0

Hah, and you'd let a browser run on such a system? Dear user, please do not browse the web with this browser or you may disturb audio playback. If you must browse the web, do not browse any computationally complex nor I/O-heavy websites. If you do not know what that means, good luck and God speed.

its only a browser??? by nurb432 · 2010-08-07 07:18 · Score: 1

The browser is the most important app for most people. Its the front door to most viruses ( ok, trojans techincally ) and is their window to the world.

It should be taken more seriously.

--
---- Booth was a patriot ----

Why the secrecy? by Kazymyr · 2010-08-07 07:23 · Score: 1

"Unfortunately users will still see the updating progress bar on load"

I don't understand this. Why is that unfortunate? Why would they want the browser update to happen completely out of the user's awareness?

My paranoia kicks in.

--
I hadn't known there were so many idiots in the world until I started using the Internet -Stanislaw Lem

Re:This is problematic and I hope it can be disabl by Ant+P. · 2010-08-07 07:43 · Score: 2, Funny

Because illiteracy isn't just for ACs, it extends to people with mod points too.

30 euro phone bill in a sort time by El_Muerte_TDS · 2010-08-07 08:07 · Score: 3, Insightful

Silent updates is the reason why I received a 30 euro phone bill for a few minutes.

I was on holiday, and let a friend use my laptop and telephone to send an important email (it was party invitation, nothing more important than that). And of course... I forgot to displace all things that would silently try to update whatever they could when a network connection was found. Withing a short time, a few megabyte was downloaded. And mobile data from a foreign country is more expensive than HP ink.

So please mozilla, provide a nice toggle though the preferences screen to change this, an not through a about:config option.

Re:30 euro phone bill in a sort time by Anonymous Coward · 2010-08-08 04:35 · Score: 0

And mobile data from a foreign country is more expensive than HP ink.
is mobile data from a foreign country also made of unicorn blood?

Re:This is problematic and I hope it can be disabl by Christopher_Wood · 2010-08-07 08:22 · Score: 1

I hope so too. Will I have to chmod -R -w /path/to/firefox-dir?

as long as by Anonymous Coward · 2010-08-07 08:35 · Score: 0

it's not silently being updated by oracle..

Re:This is problematic and I hope it can be disabl by Ksevio · 2010-08-07 08:44 · Score: 1

No problem. Firefox is opensource so you're free to edit it to do whatever you want.

So no FF4 for me. by SharpFang · 2010-08-07 10:32 · Score: 1

So no FF4 for me. At least on the netbook...
I can use my mobile connection responsibly and the 500MB limit will last me a month. But at some $0.25/500K above limit, if Firefox decides to download 15MB of updates, sorry, no deal.

--
45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2

Re:So no FF4 for me. by xSander · 2010-08-08 20:28 · Score: 1

Read the summary. It can be disabled.

Re:This is problematic and I hope it can be disabl by BZ · 2010-08-07 11:06 · Score: 1

> This is problematic on slow links where every byte is precious (dial-up)

How is it more problematic than the default setup today, where the updates are downloaded automatically, but not applied automatically?

> This is problematic in managed environments where the end user does not have write-
> permission to the filesystem containing the software

Not any more so than the current behavior.

> I hope it can be disabled.

Reading comprehension?

Re:Egad. Use intelligent defaults. by Webz · 2010-08-07 11:46 · Score: 1

Showing the user something he probably doesn't need* to see undermines what could have been an automagical experience.

* for varying definitions of need. Slashdot users, in all their technical glory, sure love talking about edge cases that wouldn't apply to the vast majority of people out there...

Chrome by Acecoolco · 2010-08-07 12:47 · Score: 1

I would switch 100% to Chrome... if it worked... Anytime I click a link that opens the default browser (set to chrome), chrome opens up and shows an error dialog. Chrome will then not load any pages. You have to close Chrome, and reopen it with the desktop shortcut in order for it to work properly. Win 7 64, 4gb, 8800gt oc, quad q6600 2.4 running at 3.0ghz, Asus P5K

--
Just because it works, Doesn't make it right. - JTM

NO WAY by Anonymous Coward · 2010-08-08 18:12 · Score: 0

WHAT THE FUCK?!

Security by anguirus.x · 2010-08-12 00:54 · Score: 1

It's only a matter of time before someone figures out how to send data which tricks Firefox into believing it's time to update and installing malware.

Slashdot Mirror

Like Google's Chrome, Mozilla To Silently Update Firefox 4

287 comments