11 ms·

Mozilla plans to silently update Firefox

28 points by danh 16y ago

mattmanser 16y ago
I think this is a great trend for usability and security. For software companies that can actually do it well. But at the bottom of the article it mentions that Adobe are experimenting with doing it. Argh! Flash yes, I can see it. But Reader? I don't want it to update on the rare occasions I open a pdf. Actually the only reason I oppose Adobe doing it is because I think of them as having some pretty awful programming teams. And whoever writes their updaters is one of those bloody awful teams. Certain parts of their products are very buggy compared to Google, MS or games programmers. They just do not have quality across their brand. My constant nightmares with adobe updaters across a wide variety of machines has made me believe this. When it comes to updaters Adobe have always chosen the worst paths, annoying prompts when you hadn't used readers for weeks, horrible confusing UIs and obviously not thoroughly tested. They're just not up to the task. I guess what I'm saying is this trend should be welcomed, but with a pinch of salt, some companies like Google and MS I trust to do it. Others I would not (Adobe if you hadn't guessed ;).
- CrazedGeek 16y ago
  If Reader silently updates though, the UI issues and annoying prompts are pretty much eliminated.
  - danh 16y ago
    And what could possibly go wrong?
  - ElbertF 16y ago
    It will just stop asking you if you want toolbars and desktop icons and install them anyway. For your convenience!
- daychilde 16y ago
  I definitely agree that there should be options to turn the silent updates off... There are several companies I disable: Winamp, for a while, was updating WAY too often; I used to have trouble with Quicktime - but, in my humble opinion, that software is just... ugh. bloatware and badly written. Thank goodness we've moved on from it as a standard... Adobe's updater is another one I turn off - I really dislike the companies that add a "quickstart" app to my startup - I don't need update checkers from ten different companies stealing my resources.... But there are some smaller names that I do think get it right: Filezilla - even though they tend to update more than I'd like, the update process works pretty well and doesn't take too long; uTorrent is another, as well as VLC does okay... I definitely think that different classes of users will have different experiences. For Gramma and Grampa, autoupdating is generally better, because they never will. For us geeks: well, we can turn it off for companies that don't do it right; and we talk about our experiences - companies develop reputations...
- risotto 16y ago
  Great point. I love the auto-update feature on Chrome but I share the same fear as you if Adobe was to start doing it. Only software companies with mature software, good release management and clear product vision should go down this road. Google earned their rep here. There are white papers about the binary diff algorithms they developed to push down Chrome updates as efficiently as possible. I can see Adobe trying to "silently" push Reader 10 down the pipe, with the installer weighing in at 600 megs and throwing up tons of horrible dialogs and thrashing your CPU as it's "automatically" installed and resulting in a broken Reader. Hyperbole of course, but Adobe has long been banished from my computers because of their awful updater agent and performance regression in new versions of software.
ajg1977 16y ago
Good for Mozilla, I hope this doesn't get dropped from 4.0 due to deadlines or other reasons. Making it easy and fuss free for users to get security updates for your product may not be a sexy feature but it is a great one. The reason Safari is the browser that takes the longest for users to apply security updates is because at least on the Mac, most (all?) require a reboot. I still have't updated to 5.01 because of this. Not good. Not good at all.
gaius 16y ago
So how does this work, I'm doing something in my browser and it spontaneously restarts, losing whatever I'm filling into a form? I have noticed with Firefox 3 if I ignore its updates for too long it goes to 100% CPU and stays there until I kill it in Task Manager, then on restart it installs its updates. This never happens unless there's an unapplied update waiting...
- risotto 16y ago
  If it's like Chrome, which I hope it is, it's completely transparent. Your browser session is never interrupted, and in fact no update alerts are ever shown. Just once in a while when you start Firefox it's the new version that it installed sometime during your last session.
  - SoftwareMaven 16y ago
    It doesn't sound like it will be quite that transparent. The article mentions "Unfortunately, you will still see progress bars." It makes me think it will be like the current behavior without the dialog asking to install (e.g. automatically download the update and install it when you restart your browser).
- daychilde 16y ago
  I would assume it would work similarly to how extensions update - or perhaps how the "Update Notifier" addon works. The way I configured it, it checks for updates to addons every few hours, and if it finds one, installs it silently. The next time Firefox starts, it's ready to go - basically, it does the same thing as a manual check, install updates, but instead of clicking the "Restart Firefox" button, just leaves me alone. I hope that's basically how they do it... it really would be background - except for those that don't restart Firefox every week or so... but at least for me, addon memory leaks still cause me to restart Firefox every other day or so (I have -- oh, this is great! I just counted - I have 42 extensions installed. hehe)
risotto 16y ago
This is excellent, assuming it works like Chrome. The updates are silently downloaded in the background, and applied the next time you restart the browser. This behavior can be disabled fully. It doesn't interrupt your work at all, never even alerting you that there is a new version it's downloading or a new version that's running. This is primarily for security updates where you shouldn't have an option to browse un-patched for months on end.
- DougBTX 16y ago
  From the article: "Unfortunately users will still see the updating progress bar on load"
schwit 16y ago
How will this work for Windows 7? Most user accounts will not have write access to the Firefox folder. Will the updater use the system account?
jasonkester 16y ago
One of the main reasons I stopped using FireFox as my daily browser is that it forces me to care about updates. I open FF to browse the web, and it tells me no, wait while I download and install some updates. Ok, now wait while I show you a screen telling you about those updates. If you want, you can close it and these other 5 tabs I opened, and then you can go browse the web. Total elapsed time: 1-3 minutes, all of which are spent actively hating FireFox. Compare that to the Chrome experience: click the icon, 3 seconds later it opens up ready to go, every single time. Maybe once in a while something is new, but I never need to care. Perfect.
protomyth 16y ago
I really wish they would have a better solution then Chrome. Chrome is fine for a single person, but for installing on a couple of hundred machines, the "silent" update is not silent to the network admin or anyone in a distance learning classroom. I would really like vendors to allow updates from a local web server. That way I download the update myself and have it only eating local network traffic. Also, educational vendors are notorious about having software break with updates. I really hope I can turn this off in labs where students need to take certification tests. Like others I am super worried about Adobe updating. Not only from a compatibility problem or network traffic problem, but their installer on the Mac is horrible and I really wonder will my non-admin account students have problems.
- rlpb 16y ago
  Will Chrome updates go through a caching web proxy if one is configured?
benbeltran 16y ago
I say, great solution Mozilla! Advanced users can toggle it on/off. Mortal users won't know it's there. Mortal users are the ones that regularly are better off not knowing. I on the other hand, prefer to see exactly who's updating and what for, and It's good to know that I have a choice. Giving user choice = good :)
viraptor 16y ago
There are 3 big reasons to not enable it. They depend on how you use internet of course, but I'd never use full-automatic mode: - Mozilla doesn't know what kind of link I'm using. I may be in another country on a pay-per-MB 3G, which they will not pay for. Updating a browser can actually create a really large bill, while all you want to do is open your email. - Mozilla doesn't know what am I doing with my link right now. Maybe I'm almost saturating it right now with a Video call? I don't want them to start a not requested >100kB/s transfer in the middle of my call. - Mozilla doesn't know how secure my environment is. I may be on a shared network on a security conference. Yeah... all kinds of things can happen there. That's why I'm not going to login anywhere from such place and will definitely not update my system.
- tptacek 16y ago
  If you're running an insecure version of Firefox on a shared network at a security conference, the security implications of Firefox auto-update are the least of your concerns.
  - viraptor 16y ago
    True, but it doesn't matter - here are some scenarios: - If I suspend my laptop with FF running and then restore. FF will be running / trying to update even if I don't actually use it (or try to use it explicitly). - If the upgrade mechanism is not secure, you only need to capture all the traffic and fake a new version being available. I may have the newest version X, but someone captures the updater query and returns a new version X+1 being available.
- patrickaljord 16y ago
  I think you meant connection, not link.
JadeNB 16y ago
The future tense in this article seems a bit strange—Firefox has offered behaviour something like this for quite a while. It wasn't completely silent, in the sense that it advertised once it had completed the update; maybe that's what's being changed? (It is also customisable, and I have it at what I think is a convenient level: It notifies me when an update's available (so that I don't forget that I'm running an old version), but leaves it to me to do something about it (so that I don't run into the troubles viraptor mentions (http://news.ycombinator.com/item?id=1586112 http://news.ycombinator.com/item?id=1586112).) On the other hand, maybe my perspective on Was sind und was sollen Firefox is skewed, because I always try to run the most up-to-date version (including betas); I can't remember if I started seeing this behaviour in the 3.x branch.
- SoftwareMaven 16y ago
  The difference here is you won't see the dialog saying "Do you want to update?" The update is just going to happen.
  - JadeNB 16y ago
    I'm pretty sure that the current behaviour (in 4.0b1) asks "Do you want to update?" only if "When updates to Firefox are found:" is set to "Ask me what to do" (corresponding to app.update.auto being false, probably); and that, if it's set instead to "Automatically download and install the update", then the update is still not silent—the user receives a notification after it's completed—but it doesn't prompt beforehand.
westi 16y ago
This is only useful if they don't break extensions on update. Too many firefox extensions don't survive an update. I'm happy for security fixes to get pushed out this way but normal bugfix / feature enhancement releases less so.
- ElbertF 16y ago
  Major updates will still show a prompt.
  - westi 16y ago
    Yes. But they have a habit of making non-bug fix changes in point releases and the implication is these would be installed silently.

28 points by danh 16y ago

I think this is a great trend for usability and security. For software companies that can actually do it well. But at the bottom of the article it mentions that Adobe are experimenting with doing it. Argh! Flash yes, I can see it. But Reader? I don't want it to update on the rare occasions I open a pdf. Actually the only reason I oppose Adobe doing it is because I think of them as having some pretty awful programming teams. And whoever writes their updaters is one of those bloody awful teams. Certain parts of their products are very buggy compared to Google, MS or games programmers. They just do not have quality across their brand. My constant nightmares with adobe updaters across a wide variety of machines has made me believe this. When it comes to updaters Adobe have always chosen the worst paths, annoying prompts when you hadn't used readers for weeks, horrible confusing UIs and obviously not thoroughly tested. They're just not up to the task. I guess what I'm saying is this trend should be welcomed, but with a pinch of salt, some companies like Google and MS I trust to do it. Others I would not (Adobe if you hadn't guessed ;).

CrazedGeek 16y ago
If Reader silently updates though, the UI issues and annoying prompts are pretty much eliminated.
- danh 16y ago
  And what could possibly go wrong?
- ElbertF 16y ago
  It will just stop asking you if you want toolbars and desktop icons and install them anyway. For your convenience!
daychilde 16y ago
I definitely agree that there should be options to turn the silent updates off... There are several companies I disable: Winamp, for a while, was updating WAY too often; I used to have trouble with Quicktime - but, in my humble opinion, that software is just... ugh. bloatware and badly written. Thank goodness we've moved on from it as a standard... Adobe's updater is another one I turn off - I really dislike the companies that add a "quickstart" app to my startup - I don't need update checkers from ten different companies stealing my resources.... But there are some smaller names that I do think get it right: Filezilla - even though they tend to update more than I'd like, the update process works pretty well and doesn't take too long; uTorrent is another, as well as VLC does okay... I definitely think that different classes of users will have different experiences. For Gramma and Grampa, autoupdating is generally better, because they never will. For us geeks: well, we can turn it off for companies that don't do it right; and we talk about our experiences - companies develop reputations...
risotto 16y ago
Great point. I love the auto-update feature on Chrome but I share the same fear as you if Adobe was to start doing it. Only software companies with mature software, good release management and clear product vision should go down this road. Google earned their rep here. There are white papers about the binary diff algorithms they developed to push down Chrome updates as efficiently as possible. I can see Adobe trying to "silently" push Reader 10 down the pipe, with the installer weighing in at 600 megs and throwing up tons of horrible dialogs and thrashing your CPU as it's "automatically" installed and resulting in a broken Reader. Hyperbole of course, but Adobe has long been banished from my computers because of their awful updater agent and performance regression in new versions of software.

ajg1977 16y ago

Good for Mozilla, I hope this doesn't get dropped from 4.0 due to deadlines or other reasons. Making it easy and fuss free for users to get security updates for your product may not be a sexy feature but it is a great one. The reason Safari is the browser that takes the longest for users to apply security updates is because at least on the Mac, most (all?) require a reboot. I still have't updated to 5.01 because of this. Not good. Not good at all.

gaius 16y ago

So how does this work, I'm doing something in my browser and it spontaneously restarts, losing whatever I'm filling into a form? I have noticed with Firefox 3 if I ignore its updates for too long it goes to 100% CPU and stays there until I kill it in Task Manager, then on restart it installs its updates. This never happens unless there's an unapplied update waiting...

risotto 16y ago
If it's like Chrome, which I hope it is, it's completely transparent. Your browser session is never interrupted, and in fact no update alerts are ever shown. Just once in a while when you start Firefox it's the new version that it installed sometime during your last session.
- SoftwareMaven 16y ago
  It doesn't sound like it will be quite that transparent. The article mentions "Unfortunately, you will still see progress bars." It makes me think it will be like the current behavior without the dialog asking to install (e.g. automatically download the update and install it when you restart your browser).
daychilde 16y ago
I would assume it would work similarly to how extensions update - or perhaps how the "Update Notifier" addon works. The way I configured it, it checks for updates to addons every few hours, and if it finds one, installs it silently. The next time Firefox starts, it's ready to go - basically, it does the same thing as a manual check, install updates, but instead of clicking the "Restart Firefox" button, just leaves me alone. I hope that's basically how they do it... it really would be background - except for those that don't restart Firefox every week or so... but at least for me, addon memory leaks still cause me to restart Firefox every other day or so (I have -- oh, this is great! I just counted - I have 42 extensions installed. hehe)

risotto 16y ago

This is excellent, assuming it works like Chrome. The updates are silently downloaded in the background, and applied the next time you restart the browser. This behavior can be disabled fully. It doesn't interrupt your work at all, never even alerting you that there is a new version it's downloading or a new version that's running. This is primarily for security updates where you shouldn't have an option to browse un-patched for months on end.

DougBTX 16y ago
From the article: "Unfortunately users will still see the updating progress bar on load"

schwit 16y ago

How will this work for Windows 7? Most user accounts will not have write access to the Firefox folder. Will the updater use the system account?

jasonkester 16y ago

One of the main reasons I stopped using FireFox as my daily browser is that it forces me to care about updates. I open FF to browse the web, and it tells me no, wait while I download and install some updates. Ok, now wait while I show you a screen telling you about those updates. If you want, you can close it and these other 5 tabs I opened, and then you can go browse the web. Total elapsed time: 1-3 minutes, all of which are spent actively hating FireFox. Compare that to the Chrome experience: click the icon, 3 seconds later it opens up ready to go, every single time. Maybe once in a while something is new, but I never need to care. Perfect.

protomyth 16y ago

I really wish they would have a better solution then Chrome. Chrome is fine for a single person, but for installing on a couple of hundred machines, the "silent" update is not silent to the network admin or anyone in a distance learning classroom. I would really like vendors to allow updates from a local web server. That way I download the update myself and have it only eating local network traffic. Also, educational vendors are notorious about having software break with updates. I really hope I can turn this off in labs where students need to take certification tests. Like others I am super worried about Adobe updating. Not only from a compatibility problem or network traffic problem, but their installer on the Mac is horrible and I really wonder will my non-admin account students have problems.

rlpb 16y ago
Will Chrome updates go through a caching web proxy if one is configured?

benbeltran 16y ago

I say, great solution Mozilla! Advanced users can toggle it on/off. Mortal users won't know it's there. Mortal users are the ones that regularly are better off not knowing. I on the other hand, prefer to see exactly who's updating and what for, and It's good to know that I have a choice. Giving user choice = good :)

viraptor 16y ago

There are 3 big reasons to not enable it. They depend on how you use internet of course, but I'd never use full-automatic mode: - Mozilla doesn't know what kind of link I'm using. I may be in another country on a pay-per-MB 3G, which they will not pay for. Updating a browser can actually create a really large bill, while all you want to do is open your email. - Mozilla doesn't know what am I doing with my link right now. Maybe I'm almost saturating it right now with a Video call? I don't want them to start a not requested >100kB/s transfer in the middle of my call. - Mozilla doesn't know how secure my environment is. I may be on a shared network on a security conference. Yeah... all kinds of things can happen there. That's why I'm not going to login anywhere from such place and will definitely not update my system.

tptacek 16y ago
If you're running an insecure version of Firefox on a shared network at a security conference, the security implications of Firefox auto-update are the least of your concerns.
- viraptor 16y ago
  True, but it doesn't matter - here are some scenarios: - If I suspend my laptop with FF running and then restore. FF will be running / trying to update even if I don't actually use it (or try to use it explicitly). - If the upgrade mechanism is not secure, you only need to capture all the traffic and fake a new version being available. I may have the newest version X, but someone captures the updater query and returns a new version X+1 being available.
patrickaljord 16y ago
I think you meant connection, not link.

JadeNB 16y ago

The future tense in this article seems a bit strange—Firefox has offered behaviour something like this for quite a while. It wasn't completely silent, in the sense that it advertised once it had completed the update; maybe that's what's being changed? (It is also customisable, and I have it at what I think is a convenient level: It notifies me when an update's available (so that I don't forget that I'm running an old version), but leaves it to me to do something about it (so that I don't run into the troubles viraptor mentions (http://news.ycombinator.com/item?id=1586112 http://news.ycombinator.com/item?id=1586112).) On the other hand, maybe my perspective on Was sind und was sollen Firefox is skewed, because I always try to run the most up-to-date version (including betas); I can't remember if I started seeing this behaviour in the 3.x branch.

SoftwareMaven 16y ago
The difference here is you won't see the dialog saying "Do you want to update?" The update is just going to happen.
- JadeNB 16y ago
  I'm pretty sure that the current behaviour (in 4.0b1) asks "Do you want to update?" only if "When updates to Firefox are found:" is set to "Ask me what to do" (corresponding to app.update.auto being false, probably); and that, if it's set instead to "Automatically download and install the update", then the update is still not silent—the user receives a notification after it's completed—but it doesn't prompt beforehand.

westi 16y ago

This is only useful if they don't break extensions on update. Too many firefox extensions don't survive an update. I'm happy for security fixes to get pushed out this way but normal bugfix / feature enhancement releases less so.

ElbertF 16y ago
Major updates will still show a prompt.
- westi 16y ago
  Yes. But they have a habit of making non-bug fix changes in point releases and the implication is these would be installed silently.