3 ms·

> Orion is zero-telemetry by default so auto-updates are disabled by default This is a very surprising choice. I'm also leaning towards the side of irresponsib

> Orion is zero-telemetry by default so auto-updates are disabled by default This is a very surprising choice. I'm also leaning towards the side of irresponsible. Web browsers are probably the biggest attack surfaces users have. They are running untrusted code thousands of times a day. That isn't even counting all of the other attack surfaces such as HTML rendering, media decoding and playing, WebGPU type stuff and more. The stream of vulnerabilities has been constant so far and there is no evidence that the stream is over. If this was my product I would disable everything but auto-updates, and make a clear policy about what data I track on update downloads. Trading security for privacy likely results in less privacy once you get pwned.

galleywest200 4y ago
I have used Orion to test it out and it prompts you if you want to update when a new update is available. Coming from a Unix background I prefer this method over a forceful update.
- kevincox 4y ago
  Hmm, something is wrong with their wording then. > The way we measure this is through auto-update “pings” to our updates server. > This measures only users who have enabled auto-updates > auto-updates are disabled by default This seems to say that they won't do auto-update checks by default. But I guess they are doing auto-update checks but not tracking the checks, just a "ping" (whatever that means if it isn't an update check).
  - freediver 4y ago
    We are not doing auto-update checks by default (as that would be a form of telemetry). The pings we count will originate only from users that manually enabled them.
throw10920 4y ago
> This is a very surprising choice. I believe that it's not too surprising if you know that most of their users are from HN. The HN comments on every telemetry-related post that I've seen have been violently, overwhelmingly, religiously against telemetry (not tracking - telemetry proper) in any form. Even if those comments aren't representative of the views of the readers as a whole, if you're building a company and those comments are your biggest insight into your users' feelings - you're going to do stuff like this. (and yes, it shouldn't have to be said that this inhibits security, but then again most of the anti-telemetry HN commentators are fine with that)
- account42 4y ago
  > and yes, it shouldn't have to be said that this inhibits security, but then again most of the anti-telemetry HN commentators are fine with that The end result of security at all costs is zero user agency so this is not at all surprising. Like anything, auto updates are a tradeoff that is neither without cost nor provides 100% protection.
freediver 4y ago
The choice to enable auto-updates is prominently present to users on onboarding. So while default off, it is one click away from being turned on for every new user using Orion. Also there is a question of the real risk. WebKit and macOS are generally very secure. We had to intervene only once in the last 4 years with a (medium) security related WebKit update (and we shipped it a week sooner than Apple did with Safari). We believe that the two facts highlighted above minimize any security risk. On the other hand every telemetry, including auto-update pings, sends personal information (at the very least user's IP address) to the browser vendor. Almost every other browser on the market is ad-supported (directly or indirectly). Telemetry and ad-supported businesses can be a problem. We do believe that browsers do not have the right to do this (at least if they want to call themselves privacy-respecting). In our view it should be on users to decide if they want to trust the browser (browsers are "user agent" after all) and every telemetry, including this, should be opt-in. Simply put, if a browser is not zero-telemetry it can not be called privacy respecting, and any browser using telemetry by default should at least disclose it to users on the first run.

galleywest200 4y ago

I have used Orion to test it out and it prompts you if you want to update when a new update is available. Coming from a Unix background I prefer this method over a forceful update.

kevincox 4y ago
Hmm, something is wrong with their wording then. > The way we measure this is through auto-update “pings” to our updates server. > This measures only users who have enabled auto-updates > auto-updates are disabled by default This seems to say that they won't do auto-update checks by default. But I guess they are doing auto-update checks but not tracking the checks, just a "ping" (whatever that means if it isn't an update check).
- freediver 4y ago
  We are not doing auto-update checks by default (as that would be a form of telemetry). The pings we count will originate only from users that manually enabled them.

throw10920 4y ago

> This is a very surprising choice. I believe that it's not too surprising if you know that most of their users are from HN. The HN comments on every telemetry-related post that I've seen have been violently, overwhelmingly, religiously against telemetry (not tracking - telemetry proper) in any form. Even if those comments aren't representative of the views of the readers as a whole, if you're building a company and those comments are your biggest insight into your users' feelings - you're going to do stuff like this. (and yes, it shouldn't have to be said that this inhibits security, but then again most of the anti-telemetry HN commentators are fine with that)

account42 4y ago
> and yes, it shouldn't have to be said that this inhibits security, but then again most of the anti-telemetry HN commentators are fine with that The end result of security at all costs is zero user agency so this is not at all surprising. Like anything, auto updates are a tradeoff that is neither without cost nor provides 100% protection.

freediver 4y ago

The choice to enable auto-updates is prominently present to users on onboarding. So while default off, it is one click away from being turned on for every new user using Orion. Also there is a question of the real risk. WebKit and macOS are generally very secure. We had to intervene only once in the last 4 years with a (medium) security related WebKit update (and we shipped it a week sooner than Apple did with Safari). We believe that the two facts highlighted above minimize any security risk. On the other hand every telemetry, including auto-update pings, sends personal information (at the very least user's IP address) to the browser vendor. Almost every other browser on the market is ad-supported (directly or indirectly). Telemetry and ad-supported businesses can be a problem. We do believe that browsers do not have the right to do this (at least if they want to call themselves privacy-respecting). In our view it should be on users to decide if they want to trust the browser (browsers are "user agent" after all) and every telemetry, including this, should be opt-in. Simply put, if a browser is not zero-telemetry it can not be called privacy respecting, and any browser using telemetry by default should at least disclose it to users on the first run.