9 ms·

>On Windows, there will now be fewer interruptions because Firefox won’t prompt you for updates. Instead, a background agent will download and install updates e

• nikbackm 5y ago
  They've had the MozillaMaintenance service for several years on Windows already, what has changed now?
  • testplzignore 5y ago
    Based on my reading of https://support.mozilla.org/en-US/kb/what-mozilla-maintenance-service https://support.mozilla.org/en-US/kb/what-mozilla-maintenanc..., the current behavior is that Firefox checks for updates only when the app is open, and then only briefly starts the MozillaMaintenance service to avoid the UAC dialog. The MozillaMaintenance service isn't what is responsible for checking for updates. It's not clear to me if MozillaMaintenance is the service that will be checking for updates, or if there is a new service.
  • hilbert42 5y ago
    I don't know about this version but at least one could uninstall the maintenance service. It was the first thing I'd nuke before allowing my PC to reconnect to the internet, the second was to nuke every talk-home-Mozilla link that about:config would allow to either be changed or deleted. This worked, as updates wouldn't even work when clicking 'updates' in the menu. Mozilla has a damned hide to automate updates, not to mention gathering data about users' habits without telling them what's been gathered, and also not allowing users to turn off that collection if they wished. (BTW, we know the depth of this surveillance just by looking at Mozilla's comments on v94's webpage. There's no way Mozilla would know that data unless Firefox's surveillance of its users had been all-pervasive.) By going the way of the rest of the industry, Mozilla is shooting itself in the foot. People who've used Firefox in the past have done so because they want an alterative - not more of the same. I expect Mozilla will go defunct soon, it's now been on its self-destruct path for too long for it to be rescued.
    • hilbert42 5y ago
      P.S.: it would be nice if down-voters had the guts to say why they disagreed. But then, perhaps that's a bit too close for comfort if you work for Mozilla.
      • Taywee 5y ago
        Assuming everybody who disagrees with you is some sort of Mozilla inside agent is really getting off on a bad foot, and sabotages any hope of productive discussion before it even starts. Don't assume bad faith in everybody who doesn't think the same way that you do.
        • hilbert42 5y ago
          What I think is irrelevant, I can echo my disgust here out of frustration, but I know that in the grand scheme of things it will amount to nought. Bad faith or just plain stupidity, you cannot escape the fact that Firefox is on a fast slippery slope to obivlion and that Mozilla personnel have done nothing to arrest the process in recent years. Why not? What's driving them to continually implement features and policies that clearly turn users off using Firefox? "Don't assume bad faith in everybody who doesn't think the same way that you do." I usually don't, in fact I always welcome a solid debate but there comes a time when things go so wrong or turn so bizarre that one has to look to offtrack ideas for an explanation. If you've a better rational reason (or perhaps inside knowledge) for why Mozilla continually shoots itself in the foot then many of us would like to hear it. Edit: I usually use the Firefox fork Palemoon to get around many of Firefox's most egregious features but I'd prefer not to do that as it increases my vulnerability to browser fingerprinting,etc., as such, I have to take additional remedial action such as spoofing the user agent for a more common one - and frankly it's a damn pain having to do so. You ought to be able to at least understand why many of us are so annoyed when essentially the last independent browser manufacturer is seemingly (willingly) attempting suicide .
    • huhtenberg 5y ago
      > People who've used Firefox in the past have done so because they want an alterative - not more of the same. Exactly! Despite of all the telemetry Mozilla still has absolutely zero clue who their core audience actually is, because they sure as hell are set on decimating what's left of it.
  • dblohm7 5y ago
    (I used to work on the team that owned this) The maintenance service is used to prevent the need for UAC prompts during upgrades. That's it. No background update functionality.
• _jal 5y ago
  Applications that feel entitled to resources after you tell them to go away lead me to move them into a VM just to contain all the crap and sprawl and bullshit. The number of apps in this category just keeps on growing. I'm starting to feel like I should just run Qubes.
  • LogonType10 5y ago
    I'm also planning to make the switch. Do you know anyone who's tried Qubes? The finicky hardware requirements are intimidating.
    • aaomidi 5y ago
      I use qubes for work. I don't like it.
      • LogonType10 5y ago
        What don't you like about it? I'd like to experience the drawbacks firsthand, but I don't have the hardware yet and Qubes can't be demoed in a VM.
        • assbuttbuttass 5y ago
          I ran qubes for a while. I found it to be slow and inconvenient. The idea is nice, but practically it's like running fedora except everything takes twice as long to start up.
        • aaomidi 5y ago
          It's inconvenient as fuck with a very specific security model that makes sense for my use case, but doesn't for most. But generally it's just annoying.
    • yiukufkdu 5y ago
      I've used Qubes at home and at work for about a year now. I like it. It definitely requires thinking differently and sometimes simple things are less simple, but overall I feel it's worth it. It's rewarding to feel that you're in control. Some things I like: - Having password manager in a Qube(/VM) that cannot access the internet (and the VMs that can, are of course isolated from the password VM). - Logging out of your bank, and when they tell you to "clear your cache and cookies", you do one better and actually destroy the whole OS, because you opened the browser in a disposable VM. - Needing to attach the microphone (or camera) to a VM before it can be used. - Ability to have specific VMs' network go through a VPN/Tor. edit: oh yeah, and consider trying Qubes 4.1 release candidate, which could possibly have better hardware compatibility.
• gpm 5y ago
  I'm sympathetic to this, and usually find these sorts of things annoying, but in this case I'm not so sure. If there is any application I want to autoupdate, it's my web-browser. It's a giant bundle of security vulnerabilities whose main purpose in life is to hit untrusted servers that might be sending me malware, and when an update is available to me, the list of security fixes is also available to attackers.
  • dncornholio 5y ago
    It's only a vulnerability when you have the browser open though.
    • earthscienceman 5y ago
      If that were the case, then people would complain about how stupid it was that the browser updated and needed to be restarted every time you opened it.
  • tut-urut-utut 5y ago
    If you already read HN, why would you need an update reminder? Using HN I was able to find out about a new Firefox release sometimes even before "Check updates" feature was able to find one ;)
    • nightpool 5y ago
      Not every patch-level security update makes it to the front page of HN, for one thing
    • ognarb 5y ago
      Because not everyone read HN
      • throwamon 5y ago
        whoosh
    • 5y ago
• ape4 5y ago
  I assume there is an option
  • lemoncookiechip 5y ago
    There is under Settings General FF Updates.
  • kibwen 5y ago
    Yes, you've been able to disable auto-updates for as long as auto-updates have existed.
• dartharva 5y ago
  Turning background updates off is the first thing I do after installing FF
• Raphael 5y ago
  It's especially strange to be constantly avoiding auto-updates when I'm trying to update everything with winget.
• BitwiseFool 5y ago
  I had to resort to using policies.json in order to disable updates completely. I'm on Firefox 88.0.1 and have zero plans to update and take proton/photon or whatever they are calling the new design.
  • amluto 5y ago
    If you’re lucky, some friendly malicious website will compromise you for the sole purpose of updating your copy of Firefox before someone else compromises you for a more nefarious purpose.
    • BitwiseFool 5y ago
      It is a risk, but one I have chosen to take in the short-term. I really dislike the direction Mozilla is going and I will probably have to switch browsers in 2022.
      • tut-urut-utut 5y ago
        Which browser vendor goes to a direction you'd like? I'm just curious because as much as I disagree with many of Mozilla decisions, I still can't honestly compare it to other browser vendors like Google, Apple, and Microsoft.
        • BitwiseFool 5y ago
          Truthfully, I'm starting to feel browser-homeless, for lack of a better term. I'm using FF because I don't want to be on Chrome. I don't have a problem with Chromium based browsers, though, so I gave Edge a try. Turns out, Edge really really REALLY wants me to be logged into my Microsoft account and I am weary of just how tightly Microsoft's products are integrated to the browsing experience. So that's a no-go. Safari's UI is just not for me and it has atrocious plugin/extension support. I'll probably just find some fork of Firefox or a Chromium based browser and just make-do.
• kd913 5y ago
  I am glad Windows is moving to a package manager esque system. It would be nice if rather than reinventing the wheel for the billionth time, apps could just use the OS based update mechanisms where possible. (i.e. App calls apt, or snap, or winget, or windows store, which updates Firefox). Whether that be store based or packaged based. It really sucks both in resources and UX when apps bundle their own update/install mechanism.
• Ajedi32 5y ago
  IMO this is the correct behavior. Programs should never bother the user with prompts or interruptions of any sort unless absolutely necessary. "Do you want to install this security-critical update to your computer's largest attack surface?" does not rise to that level. The answer is obviously yes, so just do it and don't bother the user. There's probably an advanced setting buried somewhere if you _really_ want to turn that behavior off, but why would you?
  • y7 5y ago
    > but why would you? Because updates can introduce breaking changes. And potentially new security vulnerabilities.
    • ruined 5y ago
      while technically true, updates seem to introduce fixing changes and close confirmed security vulnerabilities at a much higher rate. but you can flip the switch if you really must.
    • kaba0 5y ago
      So you prefer old and known/already exploited security vulnerabilities?
      • anonymousab 5y ago
        Foregoing security updates to avoid breaking changes and severe functionality regressions is a completely valid choice that should be wholly left up to the user.
        • RussianCow 5y ago
          It is left up to the user—you can disable auto-updates if you so wish. But it seems completely reasonable to have them be enabled by default.
      • dotancohen 5y ago
        Yes! Linus calls this trading old bugs for new bugs, and is vehemently against introducing commits that may introduce new bugs, no matter the severity of the bug that the commit squashes.
• nanis 5y ago
  Is there no one with a clue at Mozilla? How much worse can they make this browser? If I wanted an auto-updating key-logging tool on my systems, I'd have sold my soul to Chrome already. I had upgraded before seeing this ... In preferences, you have the following options: > Allow Firefox to: > -------------------------------------------------------- > [x] Automatically install updates (recommended) > [ ] Check for updates but let you choose to install them > This setting will apply to all Windows accounts and Firefox profiles using this installation of Firefox. > -------------------------------------------------------- > [x] Use a background service to install updates How about "don't ping home"? For some double-speak, read the Manifesto: https://www.mozilla.org/en-US/about/manifesto/ https://www.mozilla.org/en-US/about/manifesto/ In a sense, they are very open about their goals, if you have read the classics by Kafka, Orwell, and Bradbury.
  • ruined 5y ago
    if you want a vision of the future, imagine a background service updating a web browser, forever
  • suprfsat 5y ago
    Is it actually key-logging or are you just making things up
    • Taywee 5y ago
      There is no key-logging, but there is some keystroke leaking in particular circumstances (specifically, typing in the unified address bar, by default, leaks the first word by pinging DNS repeatedly when you don't have spaces). Unfortunately, taking things completely out of context and editorializing the facts is par for the course. Discourse is getting very disingenuous.
    • nanis 5y ago
      Version 92[1] got one step closer. Extrapolating current trends, I shudder to think what will be in version 99. > Firefox will send Mozilla search queries (what you are typing into the address bar), and city-level location (what's nearby and relevant, determined from your IP address). Firefox also informs the service if you click on a provided suggestion. Combine this with "studies" which were never made public, extra avenues of telemetry that one finds out about waaaayyy after the fact etc, the last couple of years have seen Firefox become increasingly hostile to users. [1]: https://support.mozilla.org/en-US/kb/navigate-web-faster-firefox-suggest https://support.mozilla.org/en-US/kb/navigate-web-faster-fir...
• signal11 5y ago
  Firefox has had a Mozilla Maintenance Service[1] (essentially a daemon) on Windows since 2012 or so. I'm guessing they are improving it so the UX for updates involves even less effort for users. [1] https://wiki.mozilla.org/Windows_Service_Silent_Update https://wiki.mozilla.org/Windows_Service_Silent_Update
• namero999 5y ago
  To remove this task, open Task Scheduler, you will find a new Mozilla folder under "Task scheduled library" where you can disable or delete it. Will probably come back next update.
• jabroni_salad 5y ago
  I think we can thank Microsoft for this, leaving us without a decent package manager for decades. Here's to hoping that Winget is the panacea.
• giancarlostoro 5y ago
  I think the sweet spot would be for minor updates that fix security issues, but for MAJOR version updates, no tell me what you're doing. How sure are you that I didn't intentionally install an older version to figure out a bug on an older variant of the browser.
• hbn 5y ago
  For a probably over a year now I've been using Edge because I was making a half-hearted attempt to de-Google myself where possible (yes I know it's Chromium, but it's a start) Finally yesterday I got so sick of Microsoft's incessant prompts to try Bing, and shoving news and ads in the new tab page, and integrating Bing rewards, etc. that I said I was done and moved back to Chrome. First thing I did when I opened Chrome was to go into the settings and update it since I hadn't opened it in I-don't-know-how-long and I was surprised to see it was already on the latest version. Great to know it was wasting system resources to update itself without me knowing even though I wasn't using it, and don't even have a process indicator for Chrome in my system tray
• nuerow 5y ago
  > How considerate of them, I felt I didn't have enough auto-updating background agents yet. I'm not sure you are aware that this feature is toggled in Firefox's settings. You can get a glimpse of the settings panel in the following link: https://www.ghacks.net/2021/11/02/firefox-94-0-release-here-is-what-is-new-and-changed/ https://www.ghacks.net/2021/11/02/firefox-94-0-release-here-...
• BiteCode_dev 5y ago
  The problem here is windows not providing an open way to update things from an external repo easily like Linux does. The end game, I assume, is that updates eventually come through the store. But that effectively prevent updates unless they agree to it.
• weberer 5y ago
  This is a Windows problem, not a Firefox problem.
• dang 5y ago
  "Don't be snarky." "Please don't post shallow dismissals, especially of other people's work. A good critical comment teaches us something." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
• dblohm7 5y ago
  Actually way the background updater is done is much better than most. eg Instead of running its own downloader process, it uses the Windows BITS service to download updates. People often confuse this feature with the Mozilla Maintenance Service, the latter has shipped with Firefox for more than a decade and is used to avoid UAC prompts during updates. (I used to work at Mozilla and at one point also worked on the team that owns install/update.)