4 ms·

IMO this is the correct behavior. Programs should never bother the user with prompts or interruptions of any sort unless absolutely necessary. "Do you want to i

IMO this is the correct behavior. Programs should never bother the user with prompts or interruptions of any sort unless absolutely necessary. "Do you want to install this security-critical update to your computer's largest attack surface?" does not rise to that level. The answer is obviously yes, so just do it and don't bother the user. There's probably an advanced setting buried somewhere if you _really_ want to turn that behavior off, but why would you?

y7 5y ago
> but why would you? Because updates can introduce breaking changes. And potentially new security vulnerabilities.
- ruined 5y ago
  while technically true, updates seem to introduce fixing changes and close confirmed security vulnerabilities at a much higher rate. but you can flip the switch if you really must.
- kaba0 5y ago
  So you prefer old and known/already exploited security vulnerabilities?
  - anonymousab 5y ago
    Foregoing security updates to avoid breaking changes and severe functionality regressions is a completely valid choice that should be wholly left up to the user.
    - RussianCow 5y ago
      It is left up to the user—you can disable auto-updates if you so wish. But it seems completely reasonable to have them be enabled by default.
  - dotancohen 5y ago
    Yes! Linus calls this trading old bugs for new bugs, and is vehemently against introducing commits that may introduce new bugs, no matter the severity of the bug that the commit squashes.
    - kaba0 5y ago
      Linus is known to have strong opinions and he can be often very wrong. Also, linux is not the epitome of security, so I don’t see how it applies here — I would much prefer if half of all computers wouldn’t turn into a giant bot net.
deleted 5y ago
[deleted]
legrande 5y ago
> There's probably an advanced setting buried somewhere if you _really_ want to turn that behavior off, but why would you? You can create a policy for it { "policies": { "DisableAppUpdate": true } } Create a JSON file called `policies.json` and paste the above code into it. Then place that JSON file in a folder called `distribution`. Then make sure to place the `distribution` folder in the application folder of the browser. Not sure why you want to do that, as updates are essential for security. Apparently it's for 'enterprise organizations' who probably want to limit the chatiness of their network and reduce latency. You could also install Firefox ESR which doesn't ping Mozilla for updates nearly every 10 seconds.
- PennRobotics 5y ago
  One reason---rare but existent---for disabling these update agents and background services is if someone is using their mobile hotspot to connect their computer and wants to limit all unnecessary data transfer. There's an economically powerful EU country that has a lot of train travel and not so many trains having great internet access. This was my commute life for a few years.
  - vlovich123 5y ago
    Usually these kinds of things are configured to not run on metered connections. Some times of course the API can’t detect it but it works the vast majority of the time.
- gmadsen 5y ago
  typically because its possible these "security" updates will break something unintended. IT teams usually locally test any updates before deploying to an entire infrastructure
hulitu 5y ago
Do you want to install this backdoor ? No, installing the so called updates in background will not be alowed.
- lvh 5y ago
  How do you validate Firefox updates?
  - BiteCode_dev 5y ago
    Did you validate Firefox updates before? Most people don't. For the rare people that do (probably 100 on the entire planet), they can disable the automatic updates and do it manually. I have no problem with automatic updates I can disable.
Minor49er 5y ago
There are many reasons why someone would not want this behavior, including: - Browser updates often carry more than just security fixes, which may or may not be wanted by the user - Background updates make it less likely for the user to know why their software is being updated - The user may have a legitimate reason for sticking with an older version of a piece of software - Most browsers already show the user when a new update is available. For users interested in all of the latest security updates, they can read about what these are and simply download the update right away
- nuerow 5y ago
  > There are many reasons why someone would not want this behavior It's a good thing that this feature can be configured. https://www.ghacks.net/2021/04/28/mozilla-is-working-on-firefox-background-updates-on-windows/ https://www.ghacks.net/2021/04/28/mozilla-is-working-on-fire...
  - Minor49er 5y ago
    Indeed it is, though this wasn't what Ajedi32 was arguing
- Ajedi32 5y ago
  Unfortunately, the realities of modern software development make it very difficult to separate feature patches from security patches. Maintaining an ever-increasing number of older versions of the same software indefinitely just isn't feasible. "Bother the user with a dialog that lets them shoot themselves in the foot every time there's an update." isn't a good solution to that problem. Firefox's Extended Support Release[1] is a better one, but even with that users will need to accept a feature update eventually. There may be legitimate situations where it does make sense to turn off automatic updates (that's why the option is there), but they're very niche and require a lot of expertise to pull off without compromising security. Well designed software should intentionally make it hard to disable critical security features without knowing what you're doing. I also don't think informing users about the contents of an update usually meets the bar where it is "absolutely necessary" to interrupt them just for that. Unless your update is about to break something important (which you should certainly avoid if at all possible) patch notes shouldn't be required reading. [1]: https://www.mozilla.org/en-US/firefox/enterprise/ https://www.mozilla.org/en-US/firefox/enterprise/
throw10920 5y ago
I don't buy the claim that "Programs should never bother the user with prompts or interruptions of any sort unless absolutely necessary." because there are many different ways that you can spin "absolutely necessary" that end up being harmful to the user, and lots of things that aren't "absolutely necessary" that I still want my computer to interrupt me for. I'd stop right at "auto-installation of updates with security fixes is the correct default", because that's very solid.
- ryanianian 5y ago
  The key annoyance is FTUEs for updates. Mobile apps are terrible about this. And updates that don't install until you open the program. Sparkle apps on macOS do this and it drives me nuts. If you're going to update or want my attention about a new thing, have a red dot somewhere that is not conspicuous. Don't get in the way of a user trying to be a user. This is one thing that the Slack app gets absolutely right. Firefox toes the line. New versions occasionally pop up a new window. It's easy to close but jarring. At least the updates happen mostly transparently and tend to not radically change appearance or behavior. They're bringing this experience to Windows now.

y7 5y ago

> but why would you? Because updates can introduce breaking changes. And potentially new security vulnerabilities.

ruined 5y ago
while technically true, updates seem to introduce fixing changes and close confirmed security vulnerabilities at a much higher rate. but you can flip the switch if you really must.
kaba0 5y ago
So you prefer old and known/already exploited security vulnerabilities?
- anonymousab 5y ago
  Foregoing security updates to avoid breaking changes and severe functionality regressions is a completely valid choice that should be wholly left up to the user.
  - RussianCow 5y ago
    It is left up to the user—you can disable auto-updates if you so wish. But it seems completely reasonable to have them be enabled by default.
- dotancohen 5y ago
  Yes! Linus calls this trading old bugs for new bugs, and is vehemently against introducing commits that may introduce new bugs, no matter the severity of the bug that the commit squashes.
  - kaba0 5y ago
    Linus is known to have strong opinions and he can be often very wrong. Also, linux is not the epitome of security, so I don’t see how it applies here — I would much prefer if half of all computers wouldn’t turn into a giant bot net.

deleted 5y ago

[deleted]

legrande 5y ago

> There's probably an advanced setting buried somewhere if you _really_ want to turn that behavior off, but why would you? You can create a policy for it { "policies": { "DisableAppUpdate": true } } Create a JSON file called `policies.json` and paste the above code into it. Then place that JSON file in a folder called `distribution`. Then make sure to place the `distribution` folder in the application folder of the browser. Not sure why you want to do that, as updates are essential for security. Apparently it's for 'enterprise organizations' who probably want to limit the chatiness of their network and reduce latency. You could also install Firefox ESR which doesn't ping Mozilla for updates nearly every 10 seconds.

PennRobotics 5y ago
One reason---rare but existent---for disabling these update agents and background services is if someone is using their mobile hotspot to connect their computer and wants to limit all unnecessary data transfer. There's an economically powerful EU country that has a lot of train travel and not so many trains having great internet access. This was my commute life for a few years.
- vlovich123 5y ago
  Usually these kinds of things are configured to not run on metered connections. Some times of course the API can’t detect it but it works the vast majority of the time.
gmadsen 5y ago
typically because its possible these "security" updates will break something unintended. IT teams usually locally test any updates before deploying to an entire infrastructure

hulitu 5y ago

Do you want to install this backdoor ? No, installing the so called updates in background will not be alowed.

lvh 5y ago
How do you validate Firefox updates?
- BiteCode_dev 5y ago
  Did you validate Firefox updates before? Most people don't. For the rare people that do (probably 100 on the entire planet), they can disable the automatic updates and do it manually. I have no problem with automatic updates I can disable.

Minor49er 5y ago

There are many reasons why someone would not want this behavior, including: - Browser updates often carry more than just security fixes, which may or may not be wanted by the user - Background updates make it less likely for the user to know why their software is being updated - The user may have a legitimate reason for sticking with an older version of a piece of software - Most browsers already show the user when a new update is available. For users interested in all of the latest security updates, they can read about what these are and simply download the update right away

nuerow 5y ago
> There are many reasons why someone would not want this behavior It's a good thing that this feature can be configured. https://www.ghacks.net/2021/04/28/mozilla-is-working-on-firefox-background-updates-on-windows/ https://www.ghacks.net/2021/04/28/mozilla-is-working-on-fire...
- Minor49er 5y ago
  Indeed it is, though this wasn't what Ajedi32 was arguing
Ajedi32 5y ago
Unfortunately, the realities of modern software development make it very difficult to separate feature patches from security patches. Maintaining an ever-increasing number of older versions of the same software indefinitely just isn't feasible. "Bother the user with a dialog that lets them shoot themselves in the foot every time there's an update." isn't a good solution to that problem. Firefox's Extended Support Release[1] is a better one, but even with that users will need to accept a feature update eventually. There may be legitimate situations where it does make sense to turn off automatic updates (that's why the option is there), but they're very niche and require a lot of expertise to pull off without compromising security. Well designed software should intentionally make it hard to disable critical security features without knowing what you're doing. I also don't think informing users about the contents of an update usually meets the bar where it is "absolutely necessary" to interrupt them just for that. Unless your update is about to break something important (which you should certainly avoid if at all possible) patch notes shouldn't be required reading. [1]: https://www.mozilla.org/en-US/firefox/enterprise/ https://www.mozilla.org/en-US/firefox/enterprise/

throw10920 5y ago

I don't buy the claim that "Programs should never bother the user with prompts or interruptions of any sort unless absolutely necessary." because there are many different ways that you can spin "absolutely necessary" that end up being harmful to the user, and lots of things that aren't "absolutely necessary" that I still want my computer to interrupt me for. I'd stop right at "auto-installation of updates with security fixes is the correct default", because that's very solid.

ryanianian 5y ago
The key annoyance is FTUEs for updates. Mobile apps are terrible about this. And updates that don't install until you open the program. Sparkle apps on macOS do this and it drives me nuts. If you're going to update or want my attention about a new thing, have a red dot somewhere that is not conspicuous. Don't get in the way of a user trying to be a user. This is one thing that the Slack app gets absolutely right. Firefox toes the line. New versions occasionally pop up a new window. It's easy to close but jarring. At least the updates happen mostly transparently and tend to not radically change appearance or behavior. They're bringing this experience to Windows now.