Like Google's Chrome, Mozilla To Silently Update Firefox 4

CWmike writes "Taking a page from rival Google's playbook, Mozilla plans to introduce silent, behind-the-scenes security updating to Firefox 4. The feature, which has gotten little attention from Mozilla, is currently 'on track' for Firefox 4, slated to ship before the end of the year. Firefox 4's silent update will only be offered on Windows, Mozilla has said. Most updates will be downloaded and installed automatically without asking the user or requiring a confirmation. 'We'll only be using the major update dialog box for changes like [version] 4 to 4.5 or 5," said Alex Faaborg, a principal designer on Firefox, in the 'mozilla.dev.apps.firefox' forum. 'Unfortunately users will still see the updating progress bar on load, but this is an implementation issue as opposed to a [user interface] one; ideally the update could be applied in the background.' Unlike Google, Mozilla will let users change the default silent service to the more traditional mode, where the browser asks permission before downloading and installing any update."

Comments

silent, or totally invisible

[gbjbaanb]

to be honest, I'm not so worried about this - its only a browser, and I install all those security updates anyway. What I'm not so keen on is the "silent, in the background, don't bother the user" implementation. I'd like to know that it is doing it, pop a little UI element on the status bar that says "updating latest version now" and then gets on with it, and then puts a little version marker somewhere so I know its been done.

Be polite to your users, be open in your communication, inform us. (and a link to the things that were fixed if you click the version number would be a nice to have)

Re:silent, or totally invisible

[Anonymous Coward]

I think it's a fine. Most users don't need or want that updating status or whatever because it confuses them.

If you are more savvy then you can turn on the notifications and see everything it's doing. Seems perfectly acceptable to me.

I wonder if there will be some way to enable this silent update on other OS's though. Seems stupid to assume Linux users are more savvy than Windows users. I have many non-tech people running Linux (and loving it).

Re:silent, or totally invisible

[Anonymous Coward]

I wrote a script to disassemble all the programs on my computer to check for comments which say "start keylogger".

Re:silent, or totally invisible

[ProfanityHead]

How do you know it'll only be security updates? How do you know a keylogger won't sneak in there, undetected?

How do you know that isn't happening several times a day anyway? You could have thousands of keyloggers on your machine by now.

Re:silent, or totally invisible

[Seth Kriticos]

This is not necessary. Linux distributions come with package managers and update systems that take care of upgrading everything on your system including your browser.

This kludge is only brought to the Windows version, because there is no coherent system to update third party software and the popups got old.

Re:silent, or totally invisible

[Kozz]

In fact, I welcome this update! It was hard enough getting those less-than-savvy relations to use Firefox, but even getting my WIFE to update FF is a chore. Automatic updates for these folks will be especially welcome. It's depressing to be on the cutting edge of FF public releases only to visit your mother and find she's still running FF 2.0.17 and has been ignoring the update suggestions forever.

Re:silent, or totally invisible

[RJFerret]

So far computers aren't intelligent, nor smarter than their users (despite opinions to the contrary), they generally pick the worst time to try to do updates.

There currently isn't a way for a computer to predict when it's getting in your way (hint, right at boot-up is the worst time, as I turned on the computer to get something done). Until then, there should be a clear indication it WANTS to update, with user ability to postpone for a specified period without distraction/interference.

Computers and other tools/appliances should never do something without the users/owners knowledge, or they become untrustworthy.

Ever watch someone turn on their computer to show you something? They have a task, start the machine, load the browser, get to Youtube, find the video, click play.

On my system, it comes out of hibernation, Firefox is already running, new tab, search, play. All auto-updating is turned off.

On most systems, after the OS boots, some things auto-update, some things ask to update. The user clicks cancel on all the permissible updates, but their system is bogged down the the hidden updates. Their browser takes inordinately long to load, they bitch about it. When their browser is finally up, they, oh wait, now browser updates. Okay NOW we can try to load Youtube, only our network connection is being interfered with and it doesn't play smoothly.

The Twitter post of mine that got the most reaction was how to disable Window's update nag box--it can wait until the TV show is over, or whatever the user needs/wants to do.

A better method would be for the OS to have an updating control, like on the Windows task bar, with progress meters for various software, with controls to aborting, pausing without anything hidden/secretive/subversive/untrusted.

Sure, give the users the ability to have background updates for those who prefer it, even provide an OS control so that you don't have to tell each individual piece of software that's your preference, that would be great. Thankfully Firefox is not inhibiting user control--yet (or I'd be seeking an alternative browser).

No computer software should behave like it knows what I want (or need) more than I do. A computer is only useful when it's doing what *I* desire it to, anything more is interfering, and the presumed benefit is outweighed by not being able to realize that benefit.

Re:silent, or totally invisible

[bgfay]

This is smart thinking. The process should be easy but not invisible. I like that Chrome does a lot of things easily, but don't like that I don't know about those things. It leads to the sudden "this thing doesn't work anymore" syndrome where things break with no seeming reason.

That said, I hate that Firefox has to be restarted to install add-ons. Things like that aren't good enough. I should be able to install the add-on and use it immediately.

Combine the two ideas: tell me that my program is being updated but do it for me when I push "OK".

Re:silent, or totally invisible

[e065c8515d206cb0e190]

Will you know it's a keylogger when instead Firefox prompts you "we have 5 security updates for your browser, would you like to install them now?".

I agree the silent thing is maybe not the best, but having the ability to turn it off is enough IMHO (unlike IE's privacy setting which MS supposedly restores to "share my info" when the browser is restarted).

Re:silent, or totally invisible

[Netshroud]

If only someone brought Sparkle to Windows...

Re:silent, or totally invisible

[ultranova]

Most users don't need or want that updating status or whatever because it confuses them.

Most users need to know when something has changed so they can associate any potential breakage with the correct event.

The more computers act like magical black boxes, the harder it becomes using them.

Re:silent, or totally invisible

[siride]

If things break, users probably won't be able to fix them without calling someone for help. It's easy enough to check whether there has been an update.

My mom, for example, frequently fails to tell me of important events like software updates when things stop working. Instead she just tells me that "the Internet stopped working today" and other vague things like that. I have to dig to find out that she upgraded such and such, or disabled this or that.

So I say either you are savvy enough to turn off silent updates, or at least check to see if there's been an update, or you aren't savvy enough for knowledge of updates to be useful to you directly.

Re:silent, or totally invisible

[Anne_Nonymous]

>> has been ignoring the update suggestions forever

If fewer updates broke things, people would be more inclined to update (not just Firefox, but software in general).

Re:silent, or totally invisible

[clone53421]

No; exactly the opposite... “ideally the update could be applied in the background”? About freaking time someone figured that out.

If they can find a way to do it without opening security holes, I’m all for it. Hell... there’s nothing dumber, IMHO, than restarting my browser just to install the update that it downloaded.

Make it optional. You want to vet each update? Fine. You want to turn it on and forget about it? Also fine. We have auto bill-pay so we don’t even have to think about it and we won’t get late fees; we have auto-update on our antivirus so we don’t even have to think about it and we hopefully don’t catch the latest greatest virus because our definitions were a day or two old; why do we have to decide how often we restart our browser (or OS) based on its update releases?

Re:silent, or totally invisible

[Fumus]

At first I also thought that this is an annoying move, but then your post made me realize that my family is the same. Each time an update window appears they want me to come over and see what is it because they don't know and "Do you want to update?" is just as alien to them as "would you like to polarize the photon deflectors now?"

I welcome this change now that I have realized what it truly means. As long as there is a fairly easy way to enable the nagging screen if you want it, then I won't mind it being hidden by default.

Re:silent, or totally invisible

[clone53421]

No; the more computers act like magical black boxes, the easier it becomes using them. It becomes harder to fix them, if you don’t understand how the black box works.

Ideally I want to understand it. But for day-to-day use, I’d just assume forget, in a practical sense, that I know about it, and treat it like a magical black box. As long as it does what I want and expect, I’m satisfied. If it doesn’t, or if my expectations change, I have the knowledge to figure out what’s wrong or find new software to do the new thing that I’m wanting it to do, but in a static situation it should be easy to use without needing to think about all of that.

Yesterday I had to take a screwdriver to a server because the incantation I typed at the command line wasn’t working the way it should have. I’d have much preferred to not need to get my hands dirty, so to speak.

Re:silent, or totally invisible

[Yaa 101]

If you install a Mozilla version in your user account by hand then the automatic update functionality works fine, the versions that come through the package manager are often outdated.

Of course they have to be more secure because they are installed system wide, that is the reason for being outdated it takes time to patch.

So they are 2 different concepts with the same product.

Re:silent, or totally invisible

[Yaa 101]

I am referring to GNU/Linux

Re:silent, or totally invisible

[Tubal-Cain]

All the family gatherings are elsewhere?

Re:silent, or totally invisible

[toleraen]

Can you name five security updates in the last two years that actually broke functionality for you? Not that my installation base is that huge, but I can think of maybe two updates out of hundreds where some level of functionality was actually lost to the average user.

Re:silent, or totally invisible

[icebraining]

A better method would be for the OS to have an updating control, like on the Windows task bar, with progress meters for various software, with controls to aborting, pausing without anything hidden/secretive/subversive/untrusted.

Sure, give the users the ability to have background updates for those who prefer it, even provide an OS control so that you don't have to tell each individual piece of software that's your preference, that would be great. Thankfully Firefox is not inhibiting user control--yet (or I'd be seeking an alternative browser).

Hmm, install Linux distro of choice? All updates (OS, Firefox, etc) handled by _one_ system, can show you a little icon/notification when there are new upgrades, easy to choose when to upgrade, etc.

Re:silent, or totally invisible

[basotl]

If a user wants to be notified they can set it to do so. The silent updates will be for the masses who don't care about that sort of thing.

Re:silent, or totally invisible

[Anonymous Coward]

That's not really unlike the IE privacy setting at all. By default, IE's privacy setting is off, and the user can easily do a one-off enable of it or they can enable permanently -- exactly like most other browsers' settings (though firefox makes the one-off enable kind of difficult).

The whole article earlier raised two points:

1. IE's privacy settings go further than other browsers, where it's mostly about not storing cookies whereas IE's tries to heuristically deny trackers and other things.
2. Somebody thought (1) was really useful and thought IE's default privacy setting should be on and that turning it off should be one-off.
3. They followed the common techie principal that engineers = good and marketing = bad and therefore decided that since (2) didn't happen, that's bad, and thus came from marketing.

Enabling privacy modes by default and making it opt-out would guarantee that legitimate standards-based sites would be broken. Cookies are the obvious problem and losing cookies is a potentially big user regression, but there are others, for instance, JQuery shares enough characteristics with a tracking pixel that it would be flagged and blocked; and there's obviously performance issues caused by dropping the cache on the floor.

Anyway, the point is, it's much the same, because despite the epic misinterpretations of an article with comments by one random guy on the Internet, there is a reliable way to permanently set IE to privacy mode, and there's a way to permanently disable Firefox's auto-update strategy.

Re:silent, or totally invisible

[LifesABeach]

Maybe a Check Box that states, "I don't want to see this message again", would be useful? And the programming to do it is relatively straight forward.

Openness of Communication has been the Fan and Light for the "Smoke and Mirror" types out there. This simple fact acts like a salt on an open wound to every "Secret by Silence" business model I have been exposed to. I proudly state to BSOD victims that one of the most successful aspects of Openness is that the bad guys are shut down in to two to three weeks, where as other user types can get a solution when ever their parents get around to it. In maybe a year or so? Maybe.

Yes there are grandma's and grandpa's using this device only because writing a letter, or talking face to face has become "inconvenient" to others; so in order to communicate, these people learn enough of the machine. I know their pain

Re:silent, or totally invisible

[Tumbleweed]

Most users need to know when something has changed so they can associate any potential breakage with the correct event.

Most users are complete dunderheads when it comes to anything resembling logic. They don't associate anything with anything. Giving mental ammunition like information to someone who's mental weapon is a broken slingshot is rather pointless. But giving them something that will automatically protect them in the VAST majority of real world use cases, is a great idea, and far more valuable than the other way around. Automatic updates for things like security patches should be the way of the entire computing industry, as long as they provide a way to turn on more explicit notifications or turn it off if desired, for the rest of us.

Re:silent, or totally invisible

[wwphx]

I HATE Google doing this! In fact, I ripped out Picassa and Chrome on my Mac because of these silent updates. I don't have a problem if this was a configuration option set on during install that I could turn off, but it isn't. Since Firefox will allow it to update in the traditional manner, I'm fine with that, but I HATE it being done silently in the background!

I have found that there is a way to block Google's silent update on a Mac, it basically requires creating an empty file in a certain directory with the name of their update process and then locking the permissions to that. I assume the technique would easily work for *nix, dunno about Win. However, I really don't care for Chrome or Picassa, I mainly had them for checking web site updates across multiple browsers.

I've never had an update FUBAR my system, but I've seen it happen and I will not apply an update until it has sat around for a few days. Perhaps that's not the soundest strategy as I maintain good backups and it's really easy to reinstall a Mac from an OS CD and Time Machine backup, still... I almost got pwned four years ago when an exploit was found in VNC, but that's another story.

Re:silent, or totally invisible

[dangitman]

The more computers act like magical black boxes, the harder it becomes using them.

If by harder," you mean "easier." Other than that, you're completely correct.

Re:silent, or totally invisible

[ultranova]

No; the more computers act like magical black boxes, the easier it becomes using them. It becomes harder to fix them, if you don't understand how the black box works.

A computer is not a car. It is a general-purpose device. If it doesn't let you, say, install a program, is that caused by 1) something being misconfigured, 2) security policy preventing a user from installing anything or 3) an anti-virus detecting an infected program? Why, that depends entirely on what the owner wants.

There is no difference between fixing and using a general-purpose device. That's why anything that makes them harder to fix also makes them harder to use. And refusal to accept this is what causes almost all computer problems in the world.

Re:silent, or totally invisible

[correnos]

Rumor is that a software store (and assumedly a unified update manager) are coming to Windows 8.That'd be nice.

Re:silent, or totally invisible

[correnos]

Packages are only slow to update if they are part of a lethargic/paranoid distribution Very little patching is generally involved. Packages are almost always designed to be installed to root, but you're right that it is possible to install it for single users. Using Arch, update times are hardly ever a problem.

Re:silent, or totally invisible

[Thing 1]

[...] why do we have to decide how often we restart our browser (or OS) based on its update releases?

I second this. I'm also thinking that "restarting my browser" should take a couple seconds at most, regardless of how many tabs I have open.

I've got essentially "unlimited" disk space. Please, Firefox, save the pages in their entirety (including state, JavaScript execution, etc), so that it doesn't have to take 5 minutes of grinding loading when it restarts. Make it optional for those with smaller drives. This will save time.

Of course, being able to update without restarting is even better, so go work on that instead. :)

Re:silent, or totally invisible

[Thing 1]

I'd just assume forget, in a practical sense, that I know about it

You don't sound like an English-as-a-foreign-language speaker, but benefit of the doubt: "I'd just as soon forget".

(At least it wasn't what an old girlfriend said (yes, I should try a young one), "You're making a mountain out of a mohill." Upon questioning, she could not explain what the original thing was that I was turning into a mountain, just that it was not appropriate to do so...)

Re:silent, or totally invisible

[Thing 1]

Automatic updates for things like security patches should be the way of the entire computing industry, as long as they provide a way to turn on more explicit notifications or turn it off if desired, for the rest of us.

Somewhat agreed; I also think it should be provided as an OS service, instead of being reimplemented poorly by every program author.

Re:silent, or totally invisible

[Peach Rings]

I guess the (wrong, imo) approach that firefox takes is to allow addons to implement that kind of stuff. My Firefox is locked down hard and bulletproof against active content, but it requires some addons.

Re:silent, or totally invisible

[clone53421]

You don't sound like an English-as-a-foreign-language speaker, but benefit of the doubt: "I'd just as soon forget".

I disagree. To “assume” something (as it is used there) is to become it or wear it, and that is an appropriate use.

"You're making a mountain out of a mohill."

What’s a mohill?

Re:silent, or totally invisible

[Sigma 7]

Can you name five security updates in the last two years that actually broke functionality for you? Not that my installation base is that huge, but I can think of maybe two updates out of hundreds where some level of functionality was actually lost to the average user.

While not necessarily in the past two years, there was a Javascript update sometime around 2.0.~13-14 which fixed a security hole. This introduced a race condition on some webpages, which caused the browser to crash when exiting the page.

For issues I know are within the past two years, practically any update from Firefox tends to disable the extensions that I use. It took until I discovered the nightly build tools extension to get them working again, and even so, Mozilla seemed to want to disable them at every update (including when I switch from a build from source to an earlier stable version) - which basically causes every update to be disruptive. The situation may have changed by now, but I haven't updated Firefox recently enough to tell.

Re:silent, or totally invisible

[darthdavid]

the opposite of a lesshill

Re:silent, or totally invisible

[Captain Segfault]

"I'd just as soon [action]" is an idiom, as is "make a mountain out of a molehill"

It's not really a matter of grammar or syntax (although "I'd just assume forget" isn't proper grammar, as far as I can tell) -- it's closer to being an issue of spelling/pronunciation. You're slightly misspelling "I'd just as soon", and you're probably slightly mispronouncing it too.

I confused these two myself for a while -- it's understandable because "as soon [action]" isn't a common construct in modern English aside from this idiom.

Re:silent, or totally invisible

[clone53421]

It’s short for I’d just assume to forget, and AFAIK it’s pretty much accepted grammar.

Re:silent, or totally invisible

[Richard Steiner]

It depends on whether your particular style of usage follows the same set of assumptions as the people to build and configured the OS you use. As more and more assumptions are made for you by the software makers, it can become harder and harder to operate outside of that core assumption set.

Re:silent, or totally invisible

[Captain Segfault]

Note that Google shows 17.6M results for "just as soon", compared to 869K for "just assume" -- this perversion is perhaps becoming more common, but that's no reason to use it!

It’s short for I’d just assume to forget

Whatever retconning justification you want to apply, the origin of "just assume" is people mishearing "just as soon".

It's a bit of a stretch in any case. "just as soon forget" means "given the choice, I'd forget as soon as I would (whatever)". Assume just doesn't quite mean what it would need to mean for this construct to make sense. (Obviously it's close -- otherwise it wouldn't be common!)

and AFAIK it’s pretty much accepted grammar.

I think you're right to this extent -- if it made any sense to use "assume" here you would drop the "to".

Re:silent, or totally invisible

[Simetrical]

I wrote a script to disassemble all the programs on my computer to check for comments which say "start keylogger".

Disassembled binaries generally have no comments, but you get points for effort.

Re:silent, or totally invisible

[Thing 1]

Your grammar defense is silly.

To answer your question, I have no idea; she could parrot the phrase, and knew it to mean "making the issue bigger than it deserves to be", but could not define all of the words that she used. That was not the last straw, but it was close to the time I decided she wasn't for me.

Re:silent, or totally invisible

[clone53421]

It’s molehill. Making a mountain out of a molehill.

Re:silent, or totally invisible

[Acaeris]

Addons breaking on updates is due to one of three things. Either the author is still fixing the addon for the latest update (as it's just a small tweak if nothing is actually broken), the addon is no longer developed or you are using a nightly, in which case the author hasn't even had the chance to test their own addon yet, let alone fix it.

None of this is Mozilla's responsibility, nor should it be.

Re:silent, or totally invisible

[Sigma 7]

None of this is Mozilla's responsibility, nor should it be.

If it's not supposed to be Mozilla' responsibility, then there should be an option to make it that way.

One of the options in the various extensions prevents it from being used if it is newer than a specific version (i.e. an extension originally written for 3.5.8 won't work for 3.5.8.1). It's the same form of version checking found in some old DOS programs that needed SetVer to run properly, and making that form of check in Mozilla is obstructive to experienced users.

It's no different from preventing Netscape 4 from running on sites designed for Netscape 3, and forcing them to redownload Netscape 4.

Re:silent, or totally invisible

[Thing 1]

Apparently you missed the part where this was a direct quote from an ex-girlfriend. Her use of the word, and subsequent inability to define it, was essentially the "straw that broke the camel's back" and prompted me to end the relationship. And it was in quotes in the original. My apologies for your reading comprehension. I'd just as soon not continue this thread. (You see what I did there.)

Re:silent, or totally invisible

[Acaeris]

How would you or the author of the addon have any idea whether the addon will work with any future update?

From what work I've done with Firefox addons (fixing one I was using after the author stopped supporting it), you can set a range of versions your addon supports but the vast majority of authors don't support versions that don't exist yet because they have no idea what Mozilla might need to change. These same authors generally check their code with the beta builds (and some with the nightly builds) and when THEY are happy that it works they'll bump up the version support and post an update.

Considering how much addons can change Firefox, I'd rather have it this way than what you are suggesting. Especially as I have had up to date addons break the entire UI before where the author had missed checking something like 'does it work if [X] toolbar isn't visible?'.

As for you Netscape comment, is it Netscape's problem that the website coder hasn't updated his code for the latest version? No. It's the website coder's problem and if he doesn't fix it people will go elsewhere. The same is true for addons.

Re:silent, or totally invisible

[clone53421]

I thought you “have no idea” what she meant. So I told you. If you really had no idea, now you know. And if you already knew, you’re an asshat.

Either way, her quote was wrong of course. I’m not defending that.

Welcome to the Mozilla botnet ...

[Lazy Jones]

... silent updates suck.

Re:Welcome to the Mozilla botnet ...

[fearlezz]

Yes. Silent updates suck. Well at least, for people that want to control their own computer, it does. But for my sister, my dad, my great aunt and all these people that think i'm their personal helpdesk, this is perfect. I've seen so many family members who had 2 year old browsers and stuff...

Re:Welcome to the Mozilla botnet ...

[Trelane]

Yes. Silent updates suck. Well at least, for people that want to control their own computer, it does.

Fortunately, you (or someone or collection of persons you trust) have the source, can build it, use it, and redistribute it. Thus, you don't *have* to use the software with silent update functionality, even if you keep using the browser itself. (though you'll lose the branding; call it "iceweasel" perhaps ;)

Re:Welcome to the Mozilla botnet ...

[kbrosnan]

The devs already said that this is going to be a preference.

Re:Welcome to the Mozilla botnet ...

[swillden]

Yes. Silent updates suck. Well at least, for people that want to control their own computer, it does.

But they're only doing this on Windows, so it's for people who've already given up controlling their own computer.

Re:Welcome to the Mozilla botnet ...

[FooBarWidget]

Bullshit? "Force"? Then what part of "Mozilla will let users change the default silent service to the more traditional mode, where the browser asks permission before downloading and installing any update" did you not understand?

Re:Welcome to the Mozilla botnet ...

[Macthorpe]

Opera doesn't force upgrades on it's users - or are you using a different definition of 'force' from the rest of us?

Re:Welcome to the Mozilla botnet ...

[NotBorg]

Yes. Silent updates suck. Well at least, for people that want to control their own computer, it does. But for my sister, my dad, my great aunt and all these people that think i'm their personal helpdesk, this is perfect. I've seen so many family members who had 2 year old browsers and stuff...

There's a lot of truth here.

Often the only updates that happen are automatic or silent. If they aren't automatic they typically don't happen. The silent updates that I speak of are when geeks like me do it for their friends and family because they wouldn't happen otherwise. Yeah I know those aren't technically silent or automatic, but they are to the user. I don't think the user is much worse off with silent updates because they genuinely are not interested in updating software. In fact, they probably have an aversion to updating software because of past experiences which were unpleasant.

At any rate you must trust Mozilla or you wouldn't be running their software to begin with. Right? Do you examine the source every time an update comes out to see if it does what the change log says?

Re:Welcome to the Mozilla botnet ...

[ljgshkg]

Personally though, I think silent update is good for minor updates for security and minor fixes. As long as the user know it's updated, it's all fine.

We who know the importance of updating (minor updates for security) wouldn't be a problem. But there are just all too many people outside who, when you ask them if they want an update, they'll refuse to. And then when they have security problem, they'll turn back to shout at Mozilla. I think silent update is good for both end.

It's not like you who care can't turn it off.

Re:Welcome to the Mozilla botnet ...

[Trelane]

Sure, and if that's not good enough for you, you still have options.

Re:Welcome to the Mozilla botnet ...

[maztuhblastah]

My root partition is read-only.

Good luck updating my software without me sitting a root prompt, jerks.

Re:Welcome to the Mozilla botnet ...

[fluffy99]

Yes. Silent updates suck. Well at least, for people that want to control their own computer, it does.

Fortunately, you (or someone or collection of persons you trust) have the source, can build it, use it, and redistribute it. Thus, you don't *have* to use the software with silent update functionality, even if you keep using the browser itself. (though you'll lose the branding; call it "iceweasel" perhaps ;)

And what percentage of Windows boxes even have a compiler installed, much less a user who know how to use it? Are you really going recompile by hand everytime you get an update? Yeah, I thought so.

Re:Welcome to the Mozilla botnet ...

[Trelane]

You're rather missing the point. Please reread the section you quoted, and particularly look for the part where I mention relying on another party or set of parties. Much like I don't know how to fix the transmission in my car, but I can find someone to fix it for me instead of going to the dealer, with FOSS you can hire (or otherwise convince) someone to do the work for you.

Re:Welcome to the Mozilla botnet ...

[correnos]

And how does seeing "This application has an update" allow you to magically deduce whether the update will be good or not? If you're decently tech savvy you'll probably just look and see if it is a major version, and if not just update and be done with it. If you're not, you'll hide the update in the corner and treat it like the devil, and maybe call your poor poor cousin to help you out. They already said that major updates will still ask for confirmation, and for security updates all parties are better off with auto updates. Unless you're a security auditing nazi, in which case you can disable the auto-update feature for yourself, no one's stopping you.

Re:Welcome to the Mozilla botnet ...

[commodore64_love]

When I see updates I usually wait a month to see if there's word-of-mouth about problem with it. For example I had heard the recent Firefox update 3.6.Whatever broke people's Youtube Downloader Addons. i.e. It was buggy.

So I just didn't bother. However if the update had been forced, then I would have suffered the same problem those early adopters faced
.

Re:Welcome to the Mozilla botnet ...

[swillden]

I knew /. was dominated by Windows users these days, but I didn't realize it was dominated by Windows users who can't take a joke.

Re:Welcome to the Mozilla botnet ...

[Richard Steiner]

If a user doesn't know about that option, it appears to them as if the updates are being made in spite of their desires. That would be "forced", at least from their perspective.
 

Re:Welcome to the Mozilla botnet ...

[FooBarWidget]

Show me even one user who knows he doesn't want updates, but also doesn't know how to look for a checkbox to disable them.

Re:Welcome to the Mozilla botnet ...

[correnos]

In which case they could downgrade. I would at least hope that firefox will make that task somewhat easy. The thing to remember is that security/bugfix updates are (almost) always-you guessed it-fixing bugs and security holes. The better way to go IMO is to fix the problems you know and give a chance to revert in case the fix breaks some other untested thing.

Re:Welcome to the Mozilla botnet ...

[commodore64_love]

Actually in the case of 10.5, Opera did force me to upgrade from 10.0.

It was impossible to make the "update to 10.5" popup go away. Even when I clicked "no" it just kept coming back again and again. Probably a programming error, but nevertheless it left me with no choice.

Re:Welcome to the Mozilla botnet ...

[commodore64_love]

>>>If a user doesn't know about that option, it appears to them as if the updates are being made in spite of their desires.

Precisely. That's why it's called "silent updates" because Firefox 4 will be automatically defaulting to doing upgrades without the user's knowledge. If programmers were perfect, it would be okay to do that, but programmers are human and make mistakes just like any other human. That means sometimes the update will kill a browser (or plugin) and make it unusable.

I prefer to hold-off on updates until a suitable time has elapsed (say one month). Let the early adopters be the one who get screwed if the update has a bug in it.

I love Mozilla

[Voulnet]

I love Mozilla. They can do no wrong! If Apple fanboys and MSFT apologists can do it, so can I!

As long as the browser asks for permission

[nebulus4]

why would this be considered a bad idea?

Re:As long as the browser asks for permission

[Anonymous Coward]

I don't mind if the browser asks. It looks like they are going to default to silent updates unless you change the setting. They only way I can see this as a bad idea for the non-techinical user is in the case where Mozilla screws up and a patch hoses up the browser or operating system itself (and don't act like that can't happen because it has for other software, even if it wasn't Mozilla that did it, it could still happen.)

FTA (bolding mine):

Firefox 4's silent update will only be offered on Windows, Mozilla has said.

Most updates, including all security updates, will be downloaded and installed automatically without asking the user or requiring a confirmation, said Alex Faaborg, a principal designer on Firefox. ...

Unlike Google, Mozilla will let users change the default silent service to the more traditional mode, where the browser asks permission before downloading and installing any update.

Re:As long as the browser asks for permission

[asdf7890]

why would this be considered a bad idea?

Some take exception to their software installing stuff (even updates) without their express permission (or request), or to software refusing to run until it is updated (MS's IM client does this, or so I'm told). There are a number of reasons why you might want to hold back on an update - perhaps you are a dev who want to keep old versions around for testing how their pages work in older versions that have certain issues, or perhaps you just prefer to hold back a day or so to make sure there are no massive bugs in the new release (letting the early adopters get scalped instead). Providing the off switch should alleviate these concerns for people who care though.

There is a potential security issue too: what if someone manages to hack Mozilla's DNS to point to a malicious site pretending that there is an update (which introduces malware)? I hope they are planning on properly signing and verifying updates to deal with this possibility.

Re:As long as the browser asks for permission

[asdf7890]

Also (missed this from my previous post) I don't want my browser deciding it want to download an several Mb update while I'm connected via a very slow cellular connection (i.e. GPRS in area with no 3G or wifi coverage) trying to get something done with what little bandwidth is available in such circumstances.

Re:As long as the browser asks for permission

[MonsterTrimble]

I think on a fresh install or upgrade to FF4, make the silent updating an opt-in. If you want it, you got it. Otherwise you stay traditional.

Myself, I would like to stay traditional on updates, but that's me.

Re:As long as the browser asks for permission

[Anonymous Coward]

There is a potential security issue too: what if someone manages to hack Mozilla's DNS to point to a malicious site pretending that there is an update (which introduces malware)? I hope they are planning on properly signing and verifying updates to deal with this possibility.

Unlike many others, Mozilla already does sign it's updates.

Re:As long as the browser asks for permission

[Servaas]

MS's IM client does this, or so I'm told

If you are talking about Live Messenger then you were told wrong. You can still use old version even if its not up to date.

Re:As long as the browser asks for permission

[Anonymous Coward]

Just take a hint from the silent updates that Windows does;

Do you want Firefox to be updated automatically?
(x) Yes, check for updates and install automatically (recommended).
( ) No, notify me but I will decide to install updates myself.
( ) Do not check for updates (not recommended).

Note: with automatic updates, you will still be asked for permission to instal major updates.

Re:As long as the browser asks for permission

[hedwards]

This isn't really limiting their choices, it's just requiring them to take a step to opt out if they like. Sort of like the move to automatically enrolling people in their companies 401k unless they opt out. Since most people do opt in or at least want to do it, doing so gives most people what they want without having to do any work. Those that don't want to have ample time to opt out if they choose to.

And sometimes it is the appropriate thing to do. Sane defaults dictate that sometimes the default be included and sometimes to be excluded.

Re:As long as the browser asks for permission

[Toonol]

That pretty much defuses my complaints. I'll turn it off, of course; but for the majority of nontechnical users, it's probably a good thing. Mozilla has been going down a route over the last year or two of FORCING change on the users (damn Awesomebar). I'm glad to hear it sounds like they'll at least give you the OPTION of turning it off this time.

Re:As long as the browser asks for permission

[MechaStreisand]

I couldn't. I had to switch to AMSN because Microsoft wouldn't release updates for XP-64 anymore, and Messenger refused to function without updates. Assholes.

Re:As long as the browser asks for permission

[maestroX]

There is a potential security issue too: what if someone manages to hack Mozilla's DNS to point to a malicious site pretending that there is an update (which introduces malware)? I hope they are planning on properly signing and verifying updates to deal with this possibility.

Unlike many others, Mozilla already does sign it's updates.

ftzz .. as if you know what you're installing anyway. Oh, and the private cerficate is locked away in a secure location with no internet .. right ... someone has to sign those Windows binaries and post them remember..

Choice vs. Sleek

[Amorpheus_MMS]

I like that a lot of what makes Firefox different from Chrome is due to the "we'll let users decide how they want it" approach instead of just telling them how it's going to be done.

Re:Choice vs. Sleek

[Nerdfest]

It does sound like there will be a setting that can be changed, but the default is silent install.

Re:Choice vs. Sleek

[onefriedrice]

I like that a lot of what makes Firefox different from Chrome is due to the "we'll let users decide how they want it" approach instead of just telling them how it's going to be done.

Yeah, like how Chrome insists on being a fast browser without letting the user decide. Just watch; the next version of Firefox will finally give us the option: "Do you want a slow, bloated experience, or do you want a slow, bloated experience?" Mozilla: different because we give you options!

Okay calm down FF fanboys; it's just a joke... kinda.

Re:Choice vs. Sleek

[Amorpheus_MMS]

Then it should have been funny. The thing about speed is something I never understood... it's a browser. I mostly care about it working the way I want it to, not if it can render some JavaScript gizmo at 35 FPS instead of 20. The smoother interface is nice, but what does loading a webpage 20ms faster buy me? Not much at all.

Re:Choice vs. Sleek

[onefriedrice]

Then it should have been funny.

That's why I said it's only kinda a joke. After I wrote it, I realized that mostly it was just a sad truth. You're being disingenuous if you think 20ms is a reasonable measurement of the overhead of the Firefox bloat, but you probably know that. Regardless, we're just fortunate that there are now better free options waiting to catch the collateral damage after Mozilla cannibalizes the once-great browser.

Re:Choice vs. Sleek

[Amorpheus_MMS]

20ms was just to say "not a whole lot" - all the small differences amount to nearly as much as when you have dedicated benchmarks showing how Firefox is particularly slow in certain aspects. I tried Chrome for a few weeks recently and the only two things it did noticably better was UI smoothness and web apps like Google Maps. Other than that I was mostly annoyed at many little things that I couldn't adjust, like forcing "new window" links to open in the current tab. And the extensions barely deserve to be called that.

It's nice if Chrome suits you, but get off that high horse.

OMG!

[pushing-robot]

Mozilla is stealing our freedoms with communist security updates!

...Seriously, folks, they're just automating the updates that everyone installs already. It saves us time, which last time I checked was a valuable commodity.

Re:OMG!

[siride]

If you read the damn summary, you'll see that you can turn off silent updates.

Re:OMG!

[noidentity]

Seriously, folks, they're just automating the updates that everyone installs already. It saves us time, which last time I checked was a valuable commodity.

Except those people who don't. Next you'll be telling me that everyone always uses the latest version of everything, since the latest versions never have bugs or problems that previous versions had, and are never slower, etc.

Re:OMG!

[Anonymous Coward]

My computer, my rules: no automatic updates, and especially not silent ones. I want to know when software is updating, I want to know how it is updating (which process in the task list is responsible, so I can kill it if desired), I want to know why it's updating, I want to do it on *my* schedule, and I want the option of refusing to update. For me there's nothing more annoying than forever-resident background programs that are hogging memory and CPU for no reason other than checking "is there an update yet?", or having them decide to download while you are already using the machine for other things.

Apparently they've done the right thing and made a switchbox to go back to the regular behaviour. Good. I wasn't relishing the thought of going through the same kind of nonsense as I did with Adobe Reader to kill it's update program (Adobe Update / Adobe Application Manager). Had it been anything like that (for gods' sake how hard is it to allow "Never update" and "Disable/uninstall" in a switchbox????) I would stick with v.3.

Oh, and if Windows vendors could get together and come up with a single automatic update program, rather than reinventing the wheel over and over so that I have half a dozen of the stupid things running at once, one for each product/vendor, maybe I might leave that one program on. I could set my preferences for automatic updates and leave it. This is something that Linux does *SO* much better.

Re:OMG!

[apoc.famine]

Being able to deny an update adds another layer of security to users' computers...

No, it does not. At least not on the net average. For you or I? Sure. But my mom and dad, my sister and her boyfriend, the kids I used to work with all use Firefox. And their reliability is nonexistant. If it asks them for permission, half the time they say ok. If it pops up when they're trying to type something, they close it and ignore it.

If Firefox never pops anything up, but stays updated, that's a huge step up in security for the majority of users. If they can be trained NOT to just click 'OK' on dialogs and read them, even better. And the first step in doing that is having less dialogs pop up. If dialog boxes are rare, they are much less likely to get ignored. Vista showed us the best way to get them ignored...

Personally, I'm not happy with this at all. I'm on a pretty wimpy connection, and when 10-20mb comes thumping down the pipe, I notice. I'd also rather read my updates and decide whether or not to install them. But overall, considering all users, this is a HUGE step up in security. If it results in even some small percentage less zombified computers, I'm all for it. And I think it will.

Re:OMG!

[basotl]

Read the last line of the summary.

Re:OMG!

[Miseph]

Communism and capitalism are two sides of the same coin, and the whole coin is morally neutral. The problem comes when you let greedy, sociopathic tyrants flip the coin... then it becomes a matter of which terrible outcome you get, not whether you get one.

Re:OMG!

[Indigo]

+1 Insightful

Re:OMG!

[pushing-robot]

The communist fingerpointing is getting old

Well, for a while I had to switch to terrorism for my scare-mongering, but last time I checked everyone was back to socialism. It's hard to keep up with the neoconservative fear-of-the-month club.

Silent updates are not ideal.

[aussersterne]

I get more complaints from family and friends about "slow computers" than anything else, and usually these are all about silent background updates in the end. It's damned near impossible to explain to someone that's not computer literate what and update is, how it's affecting their computer, why it's necessary that the update gets installed, etc. They don't even know what Firefox is ("You mean my Internet?") much less any of the other things. Even my wife struggles to comprehend why there's always an update running; she tends to think I'm lying or dismissing her concerns. Every single application running on her computer does silent background updates:

Windows
Office
AntiVirus/Firewall Software
Adobe Flash Player
Adobe Reader
Sun JRE
Nero
Skype
etc.

Even tiny little apps from the vendor do this... Volume control, display control, trackpad control, blah, blah...

Another background process running automatic updates each and every icon in the tray and for each and every folder and application in the Start menu, as well as for browser plugins, third party configuration tools/extensions, drivers, etc.

At the very least they should try to display a notification somewhere on the screen saying "Updating XYZ, may slow your computer..." each time they do this, rather than silently saturating an internet connection (as 10 different updaters are in competition with one another), a CPU, and/or a hard drive's activity.

Re:Silent updates are not ideal.

[tcdk]

I've a older (winXP) notebook that I use sparsely, if it's been off-line much more than a week, it needs about 15-20 minutes on first boot for updates, before I can use it.

Re:Silent updates are not ideal.

[fearlezz]

I installed the nvidia driver on my Linux system from the rpmfusion repository. When I run "yum update", yum updates both normal Fedora updates and nvidia driver updates. I could even configure yum-updatesd to update all packages without me even noticing.

Why can't it be this simple on windows? Windows update on Vista/Win7 is okay for updating microsoft software. Now if only third parties could add their own 'repositories' to windows update, this would make updating a lot easier, and computing a lot safer.

Re:Silent updates are not ideal.

[evanspw]

most of those can be set to manual update, or at least a notification that an update is ready to download. i know that's got it's downside too.

Re:Silent updates are not ideal.

[Jorl17]

You forget that browser updates matter. And, in theory, OS security updates should as well. So let's not say that silent updates are not ideal for all cases. They're not ideal for stupid and silly apps that you shouldn't be supporting any way (woops, broke the rule of not bashing useful but bloated apps -- kill me!; woops, did it again!)

Re:Silent updates are not ideal.

[at_slashdot]

Hopefully Windows (Microsoft) will implement a repository system like in Linux distros. There's no reason to have EACH program run an updater for itself. Or, if you don't like the Linux example think of Apple app store....

Re:Silent updates are not ideal.

[Anonymous Coward]

This is why i hate that OSes... well, Windows, hasn't got a decent package manager.

Auto updates could easily be handled through a single program for the entire OS.
All you do is just add to a file or registry item where the URL is, current version number, date / frequency of check and an optional "where to extract this to" for non-install archives.
Then you can make whatever damned EXE you need to make for doing updates then, whether it is Chromes silent updater or a Windows updates.
Windows Task Manager != an updater system. It is a hack, and it still requires a separate EXE to check anyway.

But it is Microsoft, they never do anything good for anyone.
They deliberately make their OS stupid and cumbersome, lock the SHIT out of it and throw a crappy shiny sub-standard wasteful copy of contemporary UIs of the latest OSes.
MICROSOFT, MAKING YOUR LIFE EASIER.

Re:Silent updates are not ideal.

[Anonymous Coward]

That's one major disadvantage of using Windows.

I can boot my GNU/Linux (Debian) machine after a month of not using it, run apt-get update && apt-get -u dist-upgrade as root, walk away to make a coffee, and when I return 5 minutes later, everything is up to date again and I can start working.

I can boot my Windows machine, and after I log in as Administrator, I have to wait 5min until the system is usable because every Application starts it's own update-agent and tries to find out whether there is an update for it or not. Then I get various annoying update pop-ups. And I have to click through at least 5 "wizards" to update my system, I takes an awful lot of time, and, worst of all, I have to constantly sit there and watch it, because I have to click on "next" for downloading the update, then again for extracting it, and finally for installing it. And even after that, my system is not up to date, because I don't have automatic updates turned on for every application (that would really kill the system), only for very important ones from a security point of view (OS, Browser, E-Mail client, Adobe Reader, Adobe Flash and a few others)

Re:Silent updates are not ideal.

[hedwards]

Linux can do that because virtually all the software is free either pricewise or GPLed. In which case most of those people are thrilled to have somebody else picking up the tab on the distribution and advertising. In the Windows world, that's not really the case. Much of it is commercial software and the freeware and opensource stuff is so numerous that I doubt MS is interested in taking on the responsibility and cost of hosting those files.

Re:Silent updates are not ideal.

[at_slashdot]

Two words: App Store. Apple can do it. They even make money out of it. GPL and free software is a red herring.

Re:Silent updates are not ideal.

[siride]

It doesn't need to have a repo system. It just needs to have a standard protocol for installation and update. Programs, once installed, can register with the update service, point Windows to the update URL source and then when there's an update, Windows can do it all in one batch.

Re:Silent updates are not ideal.

[tepples]

Now if only third parties could add their own 'repositories' to windows update

How much would Microsoft and Microsoft's certificate authority partner (that is, VeriSign) charge third-party application publishers for such a service? And how would developers of Free applications for Windows be able to afford it?

Re:Silent updates are not ideal.

[apoc.famine]

What the hell are you talking about? OSX does NOT have a central repository for updating programs. I get spammed only a bit less than windows for updates to the various programs I have installed on OSX. If you're talking iPhone specifically, then you're talking about programs which Apple distributes being updated by Apple. This is not what is being talked about here - these are programs that are distributed by a large number of companies, being updated by those companies specifically. And that's the problem. Is your solution to have Microsoft distribute all the windows programs in the world?

Re:Silent updates are not ideal.

[at_slashdot]

Is your solution to have Microsoft distribute all the windows programs in the world?

No, but it could distribute or _facilitate_ the distribution for the most common programs. I don't expect my Linux distro to distribute all the programs available on Linux but I'm happy with the 20k+ that it does distribute, among them Firefox and Chrome, neither has to use computer resources to check separately if there's an upgrade available. I get Chrome as soon as is released, Firefox usually takes a while until is packaged for my distro.

But I hope you realize that having each program check independently if it has an upgrade does not scale.

And yes, I was talking about iPhone, that's another example of good model of application distribution (it sure can be improved, but it's better than Windows or even Mac way).

Re:Silent updates are not ideal.

[dbcad7]

Poor, poor, pitiful Microsoft.. can't be bothered with the cost of maintaining a repository of trusted and tested programs, like the fat cat big spenders on the Linux distro world.. but it's ok, their other approaches to security are working so well.. Don't kid yourself, that it's a "cost" issue, or am issue of "too many" applications.. The REAL REASON they don't follow suit with a repository system, is that there are whole industries built around the system they have.. Thousands of little Dutch boys would have to find new uses for their fingers, and be out of work.

Re:Silent updates are not ideal.

[bhtooefr]

There is a solution to that, but the Windows implementation that I've seen was downright dreadful. (Well, the one that works for third-party software...)

Have all applications register with an updater program that checks for updates when the machine is idle.

The problem is, there's two choices I've seen: Windows Update, which is really just for Microsoft software (but works fairly well for that,) and InstallShield Update Manager, which is great in theory... but in practice, it doesn't respect settings to not GET IN YOUR FACE with a window every week, and when you tell it not to update ANYTHING, and to never even ASK about updating... every week, the pile of crap comes up to say, "Please check for updates to the following products... InstallShield Update Manager"

Re:Silent updates are not ideal.

[vlueboy]

Firefox updates require the most current full installer to be run, and most corporate users have no access rights for that. I am surprised that nobody on the dev forum mentioned this issue; they all assume a home machine with full admin right accounts is the only environment for Mozilla Firefox deployment. In Windows, updates only work when the binary protected by System Folder rights negotiates an independent daemon that triggers elevated-privilege installs in the background, like you mention. Firefox does not use this option. Firefox also does not set up the main browser engine under the User-writable profile; Chrome doing this means more seamlessness than Mozilla's current design choice.

I'm mentioning all that because geeks and on the FF forum seem oblivious to this simple and pervasive problem:
Non-admin rights usually fail to permit installs and updates.. Firefox's shameful reality is that since Version 2.0 or earlier, the default is for the software to update everything automatically. Any failures seen by all of us are caused by rights problems.

I have built windows environments for kids and mom/pop users. Just like corporations, I give them a "Limited User" account to keep their machine secured. They cannot install system-wide software without my Admin password. The result is that firefox just pops up notifications stating that an update is available but cannot be installed. That's all fine on single user computers, and FF being the grassroots software, geeks tend to install on HOME machines or machines where users have special rights. The result is that we have a reality distortion field on what it means to have updates be automatic.

Remember how people have been clamoring for Mozilla to add Group policy and Windows-server distribution / control to Firefox. That's because nobody wants manually log in as admin on hundreds of machines and initiate a manual install.

Re:Silent updates are not ideal.

[Rich0]

All MS needs to do is set up an API for software to register itself for updates. System owners could have full visibility into what is going on, and OK only security updates, or functional updates as well, etc.

MS doesn't need to host any files to do it. Software could just register a URL to obtain updates from, maybe using RSS/etc. MS could also centrally host the update data stream, but not the actual files. They could even charge for the privilege, maybe offering different levels of service (host nothing, host update RSS feed/etc, host it all).

Bottom line is that Windows could certainly use a package manager. Many linux distros create packages even for proprietary apps - they just don't redistribute the actual copyrighted code (prompting for CDs, or having users put the installer in a given place, etc).

This is problematic and I hope it can be disabled

[Anonymous Coward]

This is problematic on slow links where every byte is precious (dial-up)

This is problmeatic on expensive links where every byte costs money (satellite, cellular)

This is problematic in managed environments where the end user does not have write-permission to the filesystem containing the software

I hope it can be disabled.

Re:Really?

[fearlezz]

If the software is installed with the privileges to install system-wide, it think can install an service with privileges to update as well. So that shouldn't be a problem.

A feature to disable

[Crock23A]

While I usually install all updates for firefox, and Windows, for that matter... I keep both update mechanisms disabled. I update my PC when I choose to and more often than not, i read changelogs and release notes. This feature is probably best for the average Joe type of computer user who doesn't know or care about updates.

I agree

[Jorl17]

At the risk of being /. assassinated, I have to say that I agree with this. Particularly because it is possible to disable such a feature.

Non-techie people don't get a thing about browsers, updating, security, etc. The medium-techie usually want to be all updated, so will update to even RCs and Betas if they find them out. Techie guys, us, do whatever they want, but I believe that they want to be in control and know what's going on -- thus, they'll disable such feature.
But especially for the non-techies, this is a way of getting free security upgrades. The upgrades will probably be carefully chosen so that there are no compatibility issues -- and if there are, non-techie to medium-techie users won't care that much.

All in all, it is good for people who don't care, and enables us who care to keep things the way we want it.

Re:I agree

[Nerdfest]

I won't disable automatic updates, but I will disable silent automatic updates. When something stops working, I generally look at what has changed. If I don't know what to look at, it makes things very difficult to debug.

Re:I agree

[syousef]

Yeah it's all sugar and cream till a silent update breaks the browser or worse.

There's a reason people don't update. Some updates are a cure worse than the disease.

I see the Firefox team pushing things that some users will despise more and more. Where I come from that's called arrogance. If this browser goes the way of Netscape this is the most likely reason.

Re:I agree

[Jorl17]

"The upgrades will probably be carefully chosen"(...)

I said that foreseeing answers like yours. They're bringing in SECURITY updates. Besides that, I think they're smart enough to do some private testing before sending them to the wild. Additionally, they give you the chance of disabling that feature. Do you actually think that a security update is going to break that much? And don't bring me old examples, because those are, as it says, "old". Now that the team has made this decision, them they will surely think carefully before sending out updates. And if a bug does come out on the wild, it won't be that much of a deal, as an update is sent to fix a security bug. I'd rather not have a browser running because it had a faulty updated than browsing with known security "breaches".
Sure, I'd be pissed off that they let something like that out, but that could happen with anything I own and I want to be as safe as possible. Besides, as I said, you can disable it if that pisses you off that much, get over yourself.

Re:I agree

[syousef]

"The upgrades will probably be carefully chosen"(...)

No body plans for a catastrophe.

I said that foreseeing answers like yours. They're bringing in SECURITY updates.

Yes because they are magical and never break anything. Nor could such a mechanism ever be targeted for an exploit itself, could it/ Hackers must be wetting themselves. Updates you can't turn off.

Besides that, I think they're smart enough to do some private testing before sending them to the wild.

Smart doesn't mean infallible. Testing can't ever guarantee you've missed nothing. Did the Firefox team intend to introduce the vulnerability in the first place? No. Well if not what makes you think this process will fare any better?

Additionally, they give you the chance of disabling that feature.

I'm reading that this won't be allowed. If it is allowed I don't have as big an issue, though it is still one more thing I could forget to turn off - out out sucks - and I would want to be able to configure it before first automatic update.

Do you actually think that a security update is going to break that much? And don't bring me old examples, because those are, as it says, "old".

You want me to bring you examples from the future? Fucking hell.

Now that the team has made this decision, them they will surely think carefully before sending out updates.

Are you implying they were careless before?

And if a bug does come out on the wild, it won't be that much of a deal, as an update is sent to fix a security bug.

...if it hasn't broken the browser or allowed malicious code by mistake...

I'd rather not have a browser running because it had a faulty updated than browsing with known security "breaches".

I'd rather have the browser *I* have tested on my system running.

Sure, I'd be pissed off that they let something like that out, but that could happen with anything I own and I want to be as safe as possible. Besides, as I said, you can disable it if that pisses you off that much, get over yourself.

Well I was being sarcastic, but trying to avoid getting personal. But as you've let that slip, why don't you fucking get a clue. All this is going to do is make more IT departments ban Firefox, and the first slight issue will turn users off the browser. It is a browser that targets advanced users. The main reason to use it has always been extensions. Advanced users don't like being opted into shit.

User Account Control

[Crock23A]

I wonder how this will get around UAC, a substantially annoying feature of Windows Vista/7. Will they be installing firefox to the user's home directory? Will it be sand-boxed from the OS? I admit I haven't done much looking into the pre-release so I apologize for any ignorance I might be showing.

Re:User Account Control

[Rockoon]

I also thought about this almost immediately. You cant silently do anything under /Program Files/ or /Program Files (x86)/ without administrator rights.

Is it their intention to install the binaries/etc some place that doesnt require admin rights to modify them? How could that possibly be safer/better?

Maybe instead they intend to install a service set up with admin privileges. How is an extra service, with admin and network access rights and intent on modifying /program files/, safer/better?

Updates should be noisy anyways, regardless of the increased risks this sort of thing creates.

Re:User Account Control

[TheSeer2]

You obviously haven't actually used 7 (though your criticisms are somewhat more valid for Vista) if you think there's too many UAC prompts. :P

Re:User Account Control

[sadler121]

Chrome has it's exe in APPDATA, that is how they get around UAC.

Re:User Account Control

[cbhacking]

NEWS: Mozilla today announced that they were also going to be adding the automatic silent updater to Linux builds.
Slashdot reader Crock23A was quoted as asking "I wonder how they're going to get around the fact that only root can write to /bin, a substantially annoying feature of Linux.

Seriously, people like you are what's wrong with computer security in the world today. There will always be bugs in code, that's inevitable. It takes true stupidity to think that running with full permissions is a good idea.

In answer to your question, there are plenty of ways to fix this. The simplest are to install to a user-writable location, or to modify the ACLs on the install location so that it is user-writable. This isn't exactly rocket science, people.

Restart after update?

[hcdejong]

Until now, FF updates require a restart. The update may be silent, but the restart is still going to require user notification. So what's the advantage here?

Re:Restart after update?

[PRMan]

I imagine it would wait until the user restarted Firefox...

Re:Restart after update?

[tepples]

I imagine it would wait until the user restarted Firefox...

Which gets into cases where a user leaves Firefox open for days, putting the computer to sleep instead of shutting it down.

Re:Restart after update?

[apoc.famine]

Adobe has created a fix for this...just install flash...

You thought you'd sneak that by me?

[bursch-X]

Nah, little Snitch will tell me. I really do hate that Google Chrome feature; just when I least expect it one of the Google background processes is for no apparent reason trying to connect to certain sites. Makes me wary, even if for the right reasons some software tries to sneak in any update without telling me. Even Apple gives me more freedom there.

Re:You thought you'd sneak that by me?

[dzfoo]

Unless the connection is through HTTP and--in an inspired moment of sanity--you decided to allow your web browser to use that port freely.

Seriously, I thought the same thing, and then I realized that I already gave Firefox access to port 80 and 443, specifically because it was insanely annoying to be prompted for permissions per host. Damn!

I just won't upgrade. I personally mitigate my risks with additional factors, such as not surfing into strange sites and using a combination of additional security layers. I also seem to be using Safari more often recently, ever since I was able to set up AdBlock in it.

          -dZ.

Oops

[Anonymous Coward]

So much for rolling out Firefox for Enterprize.

Re:Oops

[eliphalet]

My employer blocks the Firefox install and update sites. The want us to use only their outdated and crippled version, which is "approved" but not "supported".

Re:Oops

[dzfoo]

They don't use Firefox in the Enterprise, silly. The Computer has a direct connection to the Federation Network through a specialized protocol.

        -dZ.

Re:Really?

[DrSkwid]

I have installed by the Administrator account and then Unpriv users can't do updates, it requires manual intervention.

So instead we'll get "couldn't silently update" dialog boxes !

Re:Leave the question!

[the_other_chewey]

Maybe a user doesn't like the new 4.0 look and wants to stay at 3.5? Give the user a box and ask. Do not change this behavior!

Congratulations for not even reading the summary: They will only do silent updates for
minor versions, i.e. security and stability updates.

The question will be kept for major updates, like 3.x to 4.

Re:Leave the question!

[Dunbal]

The beauty of open source - you don't like it, fork it.

More Mozilla Fail

[duffbeer703]

I'd love to be able to actually deploy and maintain Firefox in the large enterprise that I work in. Users want it. Unfortunately, users don't have admin rights, and Mozilla makes applying updates and configuring the browser from a central location difficult and has a history of not thinking about and actively shooting down any proposals which would potentially benefit system administrators trying to support Firefox.

I don't get why they don't get it.

Re:More Mozilla Fail

[Anonymous Coward]

i guess you need this "The CCK Wizard can be used to create an extension that customizes Firefox. To access it, after installation, select Tools->CCK Wizard. " https://code.google.com/p/ff-cckwizard/

Re:More Mozilla Fail

[Anonymous Coward]

Look up FrontMotion Firefox. I've been using it for about six years now with little or no problems in a school enviroment (500 machines). It even comes with an ADM template so you can set some control in your network. They also disable any type of auto update by default. Pretty sure they will do the same in version 4 as well.

Re:More Mozilla Fail

[Anonymous Coward]

I don't get why they don't get it.

They get it, but it's an ego trip for many of the module owners. What they have decided is best and there's no possible way that some imbecile on the outside could possibly have a suggestion worthy of their consideration. Were you around when Stuart Parmenter removed support for MNG from Mozilla under the auspices of saving download time? That seriously was his argument. Then, when someone optimized the code to add less than 20k to the download, he still refused to add it back. It was an ego contest at that point and there was no way he was going to add MNG support back even if it saved space. It wasn't until years later that we learned Stuart was actually developing a pet project that was direct competition to MNG.

Re:More Mozilla Fail

[Ant P.]

I saw the whole trainwreck (bugzilla bug 18574) unfold over several years. The libmng developers deserve medals for their effort - every time the goalposts were moved and they were ordered to make the library fit into an (intentionally) impossible small size, they actually did it.

Thanks for another useless, proprietary format that none of us can use, Mozilla. Open Web my fucking ass.

Re:More Mozilla Fail

[JeffAtl]

The parent's comment certainly deserves modding up. This is the first I had heard of this and after checking out Bugzilla found out it is a 10 year old battle where the powers that be refuse to budge because the module owner seems to be well connected.

Sadly, this just illustrates that open source projects, just like governments and corporations, can fall prey to giving power to a well connected, self-serving person who wants his own private kingdom. The organization then jumps through hoops making idiotic excuses in an attempt to justify the actions that person makes.

Ten years is still a long time though - this module owner must be very well connected within Mozilla.

Re:More Mozilla Fail

[duffbeer703]

No, I don't need one of the many 3rd party hacks that have been built due to Mozilla's insistence on developing software like it's still 1996.

Why not?

- Users don't have admin rights. They cannot write to the registry. They cannot write to program files.
- The nice folks at Mozilla break these 3rd party packages every few months. (Ask the Debian/Ubuntu folks -- this isn't just a Windows problem)

The authors of trivial software packages have been getting this for a long time. Even Apple Safari on Windows is better than Mozilla. And Apple doesn't give a hoot about anyone! Mozilla doesn't care, and yes, I've worked with people in the past willing to write code and put up cash to get work done -- we were rebuffed and called a bunch a newbie idiots for daring to make a contribution.

Guess what? The 45,000 people I provide services to are not using Firefox, and are not clicking on Adsense while using the Firefox search box. This is one of the top 3 reasons we didn't deploy desktop Linux to a subset of users as well. We're on IE and doing proof of concepts with Chrome.

Re:The biggest issue with auto-updates...

[MysteriousPreacher]

That and these hidden updates could cause problems in the corporate world. Normally when browsers are updated I see vendors advising users to wait until the browser has been tested. That mostly applies to major updates, but any kind of update could patch a hole that a web application relied on - or introduce a new bug.

Re:Leave the question!

[capebretonsux]

Give the user a box and ask.

Good luck with that. I'm still using firefox 2.0.0.20 simply because the awesome-bar was a dealbreaker for me since day one. And no, the 'oldbar' addon just makes it look the same, when the old behaviour is what I want most. What makes it even more depressing is how every other browser on the face of the earth which supports ad-blockers and noscript add-ons have followed mozilla over that cliff.

Lynx is looking more and more attractive by the day.

Re:Do not want.

[RabbitWho]

It says right there you have the option to turn off silent updates.

Why not...

[johosaphats]

Why not ask whether you want to be notified once it gets ready to update for the first time? This way, people who don't want to be notified in the future can elect not to (make this the default choice), and those that do can uncheck to box easily. Everyone's happy.

silent update will only be offered..

[tirnacopu]

on Windows, Mozilla has said.

Nothing to see here, move along..

Egad. Use intelligent defaults.

[ccady]

How stupid! Show the user the dialog box, and put a checkmark on it which says (approx) "Don't notify me of these updates anymore, just do them."

Signed with what certificate?

[tepples]

The protocol could also require signed updates

Signed with a certificate issued by whom, purchased with what money? A company like Mozilla Corp could afford it, just as it can afford the Authenticode certificate to digitally sign Firefox Setup, but individual hobbyist developers of freeware and free software likely can't spare 200 U.S. dollars per year plus whatever their state charges to form a business entity.

How to disable updater only on pay-per-bit?

[tepples]

Anonymous Coward wrote:

Disable the update if you don't like it.

Can you recommend an easy-to-understand user interface to configure the updater to disable itself when on a pay-per-bit connection to the Internet yet reenable itself when on a less strictly metered connection (such as a home LAN or a restaurant hotspot)?

Re:Egad. Use intelligent defaults.

[genner]

How stupid! Show the user the dialog box, and put a checkmark on it which says (approx) "Don't notify me of these updates anymore, just do them."

What's an update?
Son quick get in here, I got a virus!

Updater need not have network access

[tepples]

How is an extra service, with admin and network access rights and intent on modifying /program files/, safer/better?

The updater service can be audited separately because it is a much smaller program than Firefox itself. After the main app has finished downloading the update package to the Local Settings folder in the user's home directory, it starts the updater service. The updater service itself does not connect to any network; all it does is verify the digital signature of the update package and then replace the executable with the updated copy. I don't know how Windows ACLs work in depth, but if the updater runs as a user that can't write outside /Program Files/Mozilla Firefox, that's another way to limit the damage it can do.

Re:Updater need not have network access

[Rockoon]

I don't know how Windows ACLs work in depth, but if the updater runs as a user that can't write outside /Program Files/Mozilla Firefox, that's another way to limit the damage it can do.

It can't if it runs as a regular user. Thats sort of the point.

The article summary claims silent updating, so the service can't run as the logged in user.

Re:Updater need not have network access

[tepples]

the service can't run as the logged in user.

That's why it runs as a different user with appropriate permissions. Or does Windows require a regular user to elevate just to wake another user's service?

Re:Updater need not have network access

[Rockoon]

That's why it runs as a different user with appropriate permissions.

Go back to the first post of mine that you replied to. How is having such a service safer/better?

Re:Updater need not have network access

[tepples]

How is having such a service safer/better?

I'll rephrase my earlier post to number my points so that we can refer to the numbers in further discussion:

1. The service is a smaller chunk of code than the browser itself, meaning it can be audited more closely.
2. The service does not have network access; all the downloading is done by the browser.
3. The service cannot write to the file system outside the specific application's folder in Program Files.

Re:Updater need not have network access

[Rockoon]

1) How is someone auditing the code for the updater more closely going to change anything?

Updates are already digitally signed. What further advantage does this system offer to offset the disadvantage that a service can silently alter at least one previously trusted binary on my system?

What, am I supposed to pray to god that (A) the browser cant be fooled into downloading a bogus update, and (B) that the mozilla boys remain vigilant about protecting their private key, and that (C) nobodies botnet with more computing power than the #1 supercomputer on the planet cracks the key anyways?

I dont think that you understand real security methods, or what the real dangers are.

How is it SAFER, or BETTER? This is no better than The Same as Now, only with dangerous silent updates added.

Re:Updater need not have network access

[tepples]

What, am I supposed to pray to god that [the publisher's signing key isn't discovered]

Do you have the same objections to the Automatic Updates feature in Windows? When you perform manual updates, how do you verify those?

nobodies botnet with more computing power than the #1 supercomputer on the planet cracks the key anyways?

Distributed.net isn't making noticeable progress cracking a 72-bit RC5 symmetric key. What makes you think a black-hat botnet will be any more efficient?

How is it SAFER, or BETTER?

It's safer in the case where a computer's administrator may be physically absent for substantial periods of time. Say Mozilla Corp learns of a defect in the browser that allows compromise of a user account, and its developers fix the flaw and issue an update. Under the current system (user installs), the user has to wait for the computer's administrator to come back, during which time the user's account is vulnerable to exploits of this defect. But with a service, if the administrator chooses to trust Mozilla Corp and enable silent updates, the update gets installed, at which point the hole gets closed.

Re:Updater need not have network access

[Rockoon]

Do you have the same objections to the Automatic Updates feature in Windows?

yes. end of story.

Distributed.net isn't making noticeable progress cracking a 72-bit RC5 symmetric key. What makes you think a black-hat botnet will be any more efficient?

You mean besides the fact that each time mozilla ships an update, there is more information available to crack the private key?

It's safer in the case where a computer's administrator may be physically absent for substantial periods of time.

The absolute last thing an administrator does when (s)he leaves for "substantial periods of time" is leave any sort of automatic updating enabled. If the automatic update breaks something, thats the end game nightmare of zero uptime "for a substantial period of time." With firefox this problem is confounded by the fact that it isnt easy to remotely manage the installations (Active Directory) so they couldn't reliably and easily disable such silent updating prior to leaving for that "substantial period of time."

The 'Administrator Isn't Around' card doesnt apply here because of thats the case, the administrator is a fool if he lets things update at all, let alone silently do so.

Re:Do not want.

[siride]

Dude, you can turn off silent updates. I know nobody reads the article, but at least read the summary before frothing at the mouth about a non-problem.

It has my vote

[Skythe]

I like how Chrome updates silently - if anything the additional thing I'd like is to see a changelog of what has been updated; not because I want to scan it for government spy code, but out of curiosity/new minor features. As for the updates in terms of less computer literate users, I'd rather it update silently for them. Having worked at an ISP, I know the frustrations of having to deal with someone using a horridly outdated browser. If not for the features and to make their browsers more usable, then for the security updates of which they wouldn't even really realize the implications of.

Re:I hope this can be disabled...

[ThePhilips]

They have essentially reached the point of time when there was no competition (technologically, *) left, and interpreted the achieved stability as a stagnation. And that freaked them out and they set out to destroy themselves by screwing up what was working perfectly before.

Kidding. FireFox's focus was always a grandma type of user. The moment when they say goodbye to their tech savvy audience was ought to come and I believe it is upon us. It started in 2.x with some enhancements one couldn't turn off (and had to install couple of add-ons to disable stuff), further expanded in 3.x and I think might peak in 4.x.

I'm already searching for a FireFox' replacement on Windows... IE is too dumb and arrogant (+ poor extensions + idiotic security). Chrome's too primitive (+ constant quirks due to forced updates). Opera is way too feature overloaded and cluttered.

(*) Except for the further development of HTML itself.

Re:I hope this can be disabled...

[Khuffie]

Opera is cluttered? Any extra features you don't use are disabled (ie, if you don't use the built-in mail client, it's not running).

Re:This is problematic and I hope it can be disabl

[FooBarWidget]

"And I hope it can be disabled"

Read the summary.

What if I'm not an administrator?

[wiredlogic]

I don't normally run as administrator on my computers. I have installed Firefox as an admin., though, and I must use that account for updates. This is slightly annoying with Firefox because I get update nag notifications under my user account which can't be used to perform the updates. I don't always want to go through the hassle of shutting down my current session and switching accounts for the latest update. I hope this new feature can be turned off to avoid additional problems with the update process.

Re:What if I'm not an administrator?

[cbhacking]

This is exactly why UAC exists... if you're not running an OS with UAC, your OS is at least 7 years old since its last major update (and I doubt you're running Server 2003). Maybe you should upgrade to an OS with a modern featureset, including security features (ASLR, for example) that are completely unavailable on your current OS?

Re:This is problematic and I hope it can be disabl

[MpVpRb]

This is problematic on computers used as digital audio workstations, where background processes can cause glitches in playback

Re:This is problematic and I hope it can be disabl

[webheaded]

It can be disabled. It says that right there in the summary. Geez dude, did you just read the title and call it a day? :p

Re:Do not want.

[siride]

I assume that if it bothered you that much, you'd probably search for a way to turn it off. The summary did say that you will still know when the updates are being applied with a progress bar, it just doesn't ask you or go through a whole hullaballoo to install updates.

Bad Move

[JeremyGNJ]

Wow, these companies are really shooting themselves in the foot when it comes to corporate adoption.

No right-minded SysAdmin would want this sort of thing in their environment. While I understand that you CAN turn it off, Im willing to bet (without caring enough to actually look), that they have neglected to add any security features that would prevent an end user from turning the "auto update" back on.

Re:Really?

[Tubal-Cain]

Who exactly is running their web browser with the privileges required to install an update?

Virtually everyone.

Re:This is problematic and I hope it can be disabl

[Nemyst]

RTFS please, even if you don't read anything else.

Unlike Google, Mozilla will let users change the default silent service to the more traditional mode, where the browser asks permission before downloading and installing any update.

Why is this even modded Insightful?

Re:Egad. Use intelligent defaults.

[Nemyst]

People ignore update dialogs. Why do you think they wouldn't ignore that, too?

please let me just use the stupid browser

[Ndkchk]

So with this new silent update process, half the time when I start Firefox it'll have to update before I can use it? And this is something that just happens? Mozilla, you should stop worrying about browser cold start time and start worrying about update time. I just want to be able to open a web browser and use the internet; I don't need any more progress bars before I can do so.

Re:This is problematic and I hope it can be disabl

[basotl]

From the summary:
"Unlike Google, Mozilla will let users change the default silent service to the more traditional mode, where the browser asks permission before downloading and installing any update."

Re:Do not want.

[Teknikal69]

I'll not be updating either but mostly because I just don't like the new chrome like GUI, this is another minus point however I like to see what's happening on my own PC it helps me troubleshoot if nothing else.

I have to say no to this

[Stan92057]

I have to say no to this, It should not be on by default. As much as everyone loves foxfire they make mistakes updates brick computers and so on. If we have no clue there was an update before the computer acts up this is a bad thing. We all ask what was the last thing you did? correct? It can be an option but thats it, an option.

Standalone

[EnsilZah]

As a windows user I'd like to see a big player like Mozilla release a standalone updater that all the other software can use so every app doesn't have to check for updates on its own and use its own halfassed update method.

Re:This is problematic and I hope it can be disabl

[Anonymous Coward]

"Unlike Google, Mozilla will let users change the default silent service to the more traditional mode, where the browser asks permission before downloading and installing any update."

Re:Do not want.

[siride]

Because it still tells you that it's updating...

Re:Do not want.

[siride]

A one-time problem, easily fixed. If you really want to be safe, unplug your internet connection. Maybe go outside, talk to some real women, something like that.

Of course Opera's cluttered

[billstewart]

When I first used it, the distribution fit on half a 3.5" floppy drive. It's rather larger than that now...

its only a browser???

[nurb432]

The browser is the most important app for most people. Its the front door to most viruses ( ok, trojans techincally ) and is their window to the world.

It should be taken more seriously.

Why the secrecy?

[Kazymyr]

"Unfortunately users will still see the updating progress bar on load"

I don't understand this. Why is that unfortunate? Why would they want the browser update to happen completely out of the user's awareness?

My paranoia kicks in.

Re:This is problematic and I hope it can be disabl

[Ant P.]

Because illiteracy isn't just for ACs, it extends to people with mod points too.

30 euro phone bill in a sort time

[El_Muerte_TDS]

Silent updates is the reason why I received a 30 euro phone bill for a few minutes.

I was on holiday, and let a friend use my laptop and telephone to send an important email (it was party invitation, nothing more important than that). And of course... I forgot to displace all things that would silently try to update whatever they could when a network connection was found. Withing a short time, a few megabyte was downloaded. And mobile data from a foreign country is more expensive than HP ink.

So please mozilla, provide a nice toggle though the preferences screen to change this, an not through a about:config option.

Re:I hope this can be disabled...

[Peach Rings]

The moment when Firefox jumped the shark for me was when I went to about:config and got some snarky anti-grandma click-through.

Re:This is problematic and I hope it can be disabl

[Christopher_Wood]

I hope so too. Will I have to chmod -R -w /path/to/firefox-dir?

Re:I hope this can be disabled...

[ThePhilips]

But not everything now has an option in about:config.

Tab tear off cannot be disabled at all. (Happens all the time - accidentally - when one opens lots of tabs, e.g. when searching through with bugzilla.) And there is no option for it at all - request on bugzilla was denied.

For faster start-up FireFox loads initial tabs from cache. And there is no option to tell it to fetch the pages from net instead.

The about:config might remain, but its usefullness sunk in the 2.x/3.x times - and I do not expect that to improve in 4.x.

Re:This is problematic and I hope it can be disabl

[Ksevio]

No problem. Firefox is opensource so you're free to edit it to do whatever you want.

So no FF4 for me.

[SharpFang]

So no FF4 for me. At least on the netbook...
I can use my mobile connection responsibly and the 500MB limit will last me a month. But at some $0.25/500K above limit, if Firefox decides to download 15MB of updates, sorry, no deal.

Re:So no FF4 for me.

[xSander]

Read the summary. It can be disabled.

Re:I hope this can be disabled...

[cbhacking]

I realize this may seem like sacrilege on /. but IE8 plus an extension called IE7Pro (which despite its name works great on 8) gives Firefox a good run for its money. It's actually more secure in some important ways (sandboxing, ASLR), includes ad-blocking out of the box (set the registry key to enable InPrivate Filtering on every startup) and Flash filtering (under the Flash add-on options, delete the Use on sites: *.* then you can manually add sites when they request it) and while its JS engine is weak compared to Firefox, it works fine on 99.9 percent of the sites I've seen (Acid3 being pretty much the other 0.1%). Plus, call me weird but I actually find its Accelerators feature handy, and feel its tabbed browsing is a lot better than Firefox's.

IE7Pro ( http://ie7pro.com/ ) gives you more ad-block and flash-block options, spell checking, a download manager, user agent switching, customizable mouse gestures and keyboard shortcuts, fast proxy switching, pre-fetching options, GreaseMonkey-style user scripts, and a lot more.

Firefox still wins on JS and HTML5, but I find the advantages worth it.

Re:This is problematic and I hope it can be disabl

[BZ]

> This is problematic on slow links where every byte is precious (dial-up)

How is it more problematic than the default setup today, where the updates are downloaded automatically, but not applied automatically?

> This is problematic in managed environments where the end user does not have write-
> permission to the filesystem containing the software

Not any more so than the current behavior.

> I hope it can be disabled.

Reading comprehension?

Re:Egad. Use intelligent defaults.

[Webz]

Showing the user something he probably doesn't need* to see undermines what could have been an automagical experience.

* for varying definitions of need. Slashdot users, in all their technical glory, sure love talking about edge cases that wouldn't apply to the vast majority of people out there...

Chrome

[Acecoolco]

I would switch 100% to Chrome... if it worked... Anytime I click a link that opens the default browser (set to chrome), chrome opens up and shows an error dialog. Chrome will then not load any pages. You have to close Chrome, and reopen it with the desktop shortcut in order for it to work properly. Win 7 64, 4gb, 8800gt oc, quad q6600 2.4 running at 3.0ghz, Asus P5K

Re:I hope this can be disabled...

[Peach Rings]

The most ridiculous option to be absent from about:config is the option to ignore the no-password-saving flag set on login forms by "super secure" sites, used for everything from online banks to Exchange webmail logins.

IIRC the justification was (and is, as the bug is WONTFIX) that banks would blacklist firefox and that - and I closely paraphrase - "The success of the project takes precedence over the experience of the users." Meanwhile, seamonkey supports the option with no problem, and so does every sane browser.

Re:I hope this can be disabled...

[Tacvek]

You do realize that Firefox already has the feature in question? Look in Firefox's setting window, in the "updates" tab of the "advanced" pane. In there is the option to prompt or to automatically install updates.

If you do the latter, they will download in the background when you browse, and the next time you start the browser, it will show a progress bar for a bit, and then the browser will open. I have the option set, so on occasion I see this.

All Mozilla is doing is changing the default for this setting. You can change it back if you want.

Re:Leave the question!

[TubeSteak]

They will only do silent updates for minor versions, i.e. security and stability updates.

And no company has ever screwed over millions of users with a bad automatic/mandatory security or stability update.

Re:No money required

[tepples]

GnuPG, like a many other FOSS programs, is simply signed by the developer's signature key. If you have once obtained said key over a secure channel

What channel is secure, other than a channel established with the aid of a face-to-face meeting known as a key signing party? I, for one, don't fly often enough to attend those.

or verified it by other means (like having downloaded it 15 years or/and having cross-verified it over various different channels)

A developer who is new to a particular web of trust won't have a 15-year track record like the GnuPG team. So to which "various different channels" are you referring?

a bogus SSL/TLS root certificate

Which is why Authenticode, for example, uses a different set of root certificates from TLS in part because TLS is such a juicy target.

Moreover, the PKIs you're referring to are partially based on DNS

To break HTTP, you'd have to bypass DNS. To break HTTPS, you'd have to both bypass DNS and either fool a CA or fool the user into installing a root certificate.

Re:I hope this can be disabled...

[enoz]

For faster start-up FireFox loads initial tabs from cache. And there is no option to tell it to fetch the pages from net instead.

This annoys me to no end.

Re:Do not want.

[wbo]

Yes, an individual user can turn off silent updates but is there a setting that turns off silent updates for all users on a system? On Windows at least, Firefox update settings are stored per user, making it difficult to manage in a multiuser lab environment.

Re:I hope this can be disabled...

[Tacvek]

I quote from the summary: "Unfortunately users will still see the updating progress bar on load, but this is an implementation issue as opposed to a [user interface] one".

They want to make it totally invisible, but it does not sound like they have gotten there yet. It does not chane the fact that it will still use the same setting underneath.

Re:I hope this can be disabled...

[cbhacking]

Oh, also: if you're interested in a highly customizable browser, Konqueror can run on Windows these days. It's not a small install footprint (KDE base libraries are required) and it still has some quirks to iron out, but it works as a day-to-day browser.

Security

[anguirus.x]

It's only a matter of time before someone figures out how to send data which tricks Firefox into believing it's time to update and installing malware.