4 ms·

I think it would be really helpful if Google disabled automatic updates for extensions. Letting third parties to push modified code to clients without any user

by nav1 13y ago

I think it would be really helpful if Google disabled automatic updates for extensions. Letting third parties to push modified code to clients without any user intervention is just so insecure that I can't believe it actually is a feature. Just the fact that Chrome updates automatically is bad enough.

smtddr 13y ago
>>Just the fact that Chrome updates automatically is bad enough. Don't agree with that. As someone who has had the misfortune of having to support out-of-date browsers, anything that can be done to force browser upgrades is a plus in my book. I'd rather have a few people angry at me than deal with another IE update-style browser that just gets lost out there with nearly zero hope of updating. For example, I applauded Mozilla for this[1] move. 1. http://www.tomsguide.com/us/firefox-mozilla-Chistian-Legnitto,news-11209.html http://www.tomsguide.com/us/firefox-mozilla-Chistian-Legnitt... >>"We don't think self-selection will ultimately get us to the place we need to be," he said. "We will force 3.6 on 3.5 stragglers not choosing to update to Firefox 4 or 3.6 (give them the stick). We feel comfortable making the major update choice for users because a) the versions are very similar and b) we'd rather lose a small amount of miffed users than leave a large amount of users vulnerable." Keeping an old browser version is something I wish a user could not do unless they went out of their way to install a nightly by themselves and that nightly should nag them to death after 15 days to stop using it. The internet would be a much cooler & smoother place if all webapp-devs could assume that everyone is using the most up-to-date, cutting-edge browser. I wish Google would enforce this by choosing 2 saturdays every month to simply break Youtube for anyone on an out-of-date browser.
- username223 13y ago
  > As someone who has had the misfortune of having to support out-of-date browsers, anything that can be done to force browser upgrades is a plus in my book. I hope someone starts force-updating your terminal and editor/IDE, introducing all sorts of random changes. Maybe then you would understand why it is bad to make your users' lives worse to make your own life marginally easier.
  - philwelch 13y ago
    I would love if all my software autoupdated itself. Including my editor.
    - username223 13y ago
      You'll love getting new versions of the Ask toolbar every time Flash force-updates... More seriously, I have a software setup that I have configured to be secure and useful. Switching to a newer version of $whatever might help or hurt in either category, but it's a change I want to make deliberately. I don't see why changes preferred by $randomBrowserVendor or $adCompany will automatically be in my interest.
    - omaranto 13y ago
      Do you mean you wish it received just bug fixes automatically? Or are random unsolicited UI changes OK too?
      - philwelch 13y ago
        Realistically speaking, older versions aren't going to receive bug fixes and I'm going to always want the newest version anyway, so yes. But perhaps that's cheating because so far vim hasn't developed too many strange UI changes :)
      - tomswartz07 13y ago
        To be honest, we're talking about Google Chrome. the UI for Chrome hasn't changed that much (except for the Wrench/3lines menu button) since version 10.
  - comex 13y ago
    Marginally? Have you ever heard of IE6? The requirement that nearly everyone, many of whom don't know what a browser is, update theirs before most serious websites can use new features makes the positive impact of autoupdates much more than marginal.
    - 13y ago
- userbinator 13y ago
  > The internet would be a much cooler & smoother place if all webapp-devs could assume that everyone is using the most up-to-date, cutting-edge browser. I wish Google would enforce this by choosing 2 saturdays every month to simply break Youtube for anyone on an out-of-date browser. This sort of attitude really, really disgusts me, as an end-user (and webpage-writer). Many of the things that are being pushed on us, many of us do not need nor want. We want stability, not constant change. Breaking things that used to work is one of the worst things to do. Requiring users to use (and in many cases relearn) newer, more resource-consuming software just creates waste, in the physical and chronological sense.
  - smtddr 13y ago
    >>This sort of attitude really, really disgusts me The idea that you have an environment that relies on an out-dated browser really, really disgusts me! :) What if instead of actually fixing the real problem, everyone decides to just freeze on whatever version of a browser fits their needs at a specific moment? Fragmentation happens... and that's bad for everyone. I rather have people like you upset at me for forcefully upgrading your system than dealing with all the support tickets of "My IE6 and Firefox 3.5 show a blank page during checkout". There are major advances happening in webdevelopment and they'd move even faster if webdevs didn't have to worry about people who refuse to let go of some old browser. If it's an old version of TurboTax, fine. That's your thing. It only effects you. But the percentage of different browsers out there has an effect on everyone. It's like the way I was holding on to an out-dated at&t SIM card. They mailed me 4 new SIM cards but I refused to upgrade. Eventually, they just cut my service and I had to go into the shop to upgrade. When they're trying to support all the cellphones out there and upgrading the infrastructure, they can't have people dragging their feet with old SIMs they need to support. There is a very real cost to supporting old SIM cards that don't fit into the infrastructure they're trying to build out for new phones & SIMs. There is real cost in supporting old web-browsers when technology in web-development is moving ahead in leaps. I stand by what I said; if you think you've solved an issue by staying on an old browser version, you've made a mistake somewhere upstream that needs to be fixed there. If you truly can't move forward for some reason - go download some developer/nightly branch and install that. I'd want that branch to update itself to production path every month though because holding an old browser version is not a valid solution. It's just delaying the fix to whatever is really wrong in your environment.
timothya 13y ago
I agree that automatically-updating extensions has the potential to be somewhat insecure. However, I don't see how the alternative could be a better alternative. If they didn't auto-update, then the majority of users would likely never update their extensions, and the ones that do would be unlikely to audit the extensions that they update for malware. Do you audit the apps on your phone before you update them? To mitigate the problem, Chrome does have the permissions model to limit what extensions can do, and if an extension requires more permissions after an update, Chrome will give you a warning, along with an option to remove the extension. Your best defence is to not grant overly broad permissions when you first install the extension. Regarding your comment about Chrome's automatic updates being "bad", I disagree wholeheartedly - the web platform would not be able to move forward at the same rate that it can today. One of the biggest problems with IE was simply that it was updated so infrequently that it was really hard to support the large percentage of outdated versions. We'd be in the same situation with Chrome if it didn't auto-update. Furthermore, I trust Chrome to make good decisions for my security. I'd rather have my browser updated quickly so that vulnerabilities in the browser can be fixed quickly before they affect me.
jordsmi 13y ago
I would love a popup when I start up chrome that gives a prompt with which extensions need updated and if you want to allow it or not.
- higherpurpose 13y ago
  I like that, but maybe instead of several pop-ups it would be just one local Chrome page showing you the extensions that got the updates along with details. Google also needs to make developers put the change log in there, too. At the very least offer them a box for the change log, even if all they put there is "New stuff". If they do that you can decide to stop using the extension if you lose trust in them.
- tomswartz07 13y ago
  They currently 'hold' updates that have changed permissions. You must click through the menu to install them.

by nav1 13y ago

smtddr 13y ago

>>Just the fact that Chrome updates automatically is bad enough. Don't agree with that. As someone who has had the misfortune of having to support out-of-date browsers, anything that can be done to force browser upgrades is a plus in my book. I'd rather have a few people angry at me than deal with another IE update-style browser that just gets lost out there with nearly zero hope of updating. For example, I applauded Mozilla for this[1] move. 1. http://www.tomsguide.com/us/firefox-mozilla-Chistian-Legnitto,news-11209.html http://www.tomsguide.com/us/firefox-mozilla-Chistian-Legnitt... >>"We don't think self-selection will ultimately get us to the place we need to be," he said. "We will force 3.6 on 3.5 stragglers not choosing to update to Firefox 4 or 3.6 (give them the stick). We feel comfortable making the major update choice for users because a) the versions are very similar and b) we'd rather lose a small amount of miffed users than leave a large amount of users vulnerable." Keeping an old browser version is something I wish a user could not do unless they went out of their way to install a nightly by themselves and that nightly should nag them to death after 15 days to stop using it. The internet would be a much cooler & smoother place if all webapp-devs could assume that everyone is using the most up-to-date, cutting-edge browser. I wish Google would enforce this by choosing 2 saturdays every month to simply break Youtube for anyone on an out-of-date browser.

username223 13y ago
> As someone who has had the misfortune of having to support out-of-date browsers, anything that can be done to force browser upgrades is a plus in my book. I hope someone starts force-updating your terminal and editor/IDE, introducing all sorts of random changes. Maybe then you would understand why it is bad to make your users' lives worse to make your own life marginally easier.
- philwelch 13y ago
  I would love if all my software autoupdated itself. Including my editor.
  - username223 13y ago
    You'll love getting new versions of the Ask toolbar every time Flash force-updates... More seriously, I have a software setup that I have configured to be secure and useful. Switching to a newer version of $whatever might help or hurt in either category, but it's a change I want to make deliberately. I don't see why changes preferred by $randomBrowserVendor or $adCompany will automatically be in my interest.
  - omaranto 13y ago
    Do you mean you wish it received just bug fixes automatically? Or are random unsolicited UI changes OK too?
    - philwelch 13y ago
      Realistically speaking, older versions aren't going to receive bug fixes and I'm going to always want the newest version anyway, so yes. But perhaps that's cheating because so far vim hasn't developed too many strange UI changes :)
    - tomswartz07 13y ago
      To be honest, we're talking about Google Chrome. the UI for Chrome hasn't changed that much (except for the Wrench/3lines menu button) since version 10.
- comex 13y ago
  Marginally? Have you ever heard of IE6? The requirement that nearly everyone, many of whom don't know what a browser is, update theirs before most serious websites can use new features makes the positive impact of autoupdates much more than marginal.
  - 13y ago
userbinator 13y ago
> The internet would be a much cooler & smoother place if all webapp-devs could assume that everyone is using the most up-to-date, cutting-edge browser. I wish Google would enforce this by choosing 2 saturdays every month to simply break Youtube for anyone on an out-of-date browser. This sort of attitude really, really disgusts me, as an end-user (and webpage-writer). Many of the things that are being pushed on us, many of us do not need nor want. We want stability, not constant change. Breaking things that used to work is one of the worst things to do. Requiring users to use (and in many cases relearn) newer, more resource-consuming software just creates waste, in the physical and chronological sense.
- smtddr 13y ago
  >>This sort of attitude really, really disgusts me The idea that you have an environment that relies on an out-dated browser really, really disgusts me! :) What if instead of actually fixing the real problem, everyone decides to just freeze on whatever version of a browser fits their needs at a specific moment? Fragmentation happens... and that's bad for everyone. I rather have people like you upset at me for forcefully upgrading your system than dealing with all the support tickets of "My IE6 and Firefox 3.5 show a blank page during checkout". There are major advances happening in webdevelopment and they'd move even faster if webdevs didn't have to worry about people who refuse to let go of some old browser. If it's an old version of TurboTax, fine. That's your thing. It only effects you. But the percentage of different browsers out there has an effect on everyone. It's like the way I was holding on to an out-dated at&t SIM card. They mailed me 4 new SIM cards but I refused to upgrade. Eventually, they just cut my service and I had to go into the shop to upgrade. When they're trying to support all the cellphones out there and upgrading the infrastructure, they can't have people dragging their feet with old SIMs they need to support. There is a very real cost to supporting old SIM cards that don't fit into the infrastructure they're trying to build out for new phones & SIMs. There is real cost in supporting old web-browsers when technology in web-development is moving ahead in leaps. I stand by what I said; if you think you've solved an issue by staying on an old browser version, you've made a mistake somewhere upstream that needs to be fixed there. If you truly can't move forward for some reason - go download some developer/nightly branch and install that. I'd want that branch to update itself to production path every month though because holding an old browser version is not a valid solution. It's just delaying the fix to whatever is really wrong in your environment.

timothya 13y ago

I agree that automatically-updating extensions has the potential to be somewhat insecure. However, I don't see how the alternative could be a better alternative. If they didn't auto-update, then the majority of users would likely never update their extensions, and the ones that do would be unlikely to audit the extensions that they update for malware. Do you audit the apps on your phone before you update them? To mitigate the problem, Chrome does have the permissions model to limit what extensions can do, and if an extension requires more permissions after an update, Chrome will give you a warning, along with an option to remove the extension. Your best defence is to not grant overly broad permissions when you first install the extension. Regarding your comment about Chrome's automatic updates being "bad", I disagree wholeheartedly - the web platform would not be able to move forward at the same rate that it can today. One of the biggest problems with IE was simply that it was updated so infrequently that it was really hard to support the large percentage of outdated versions. We'd be in the same situation with Chrome if it didn't auto-update. Furthermore, I trust Chrome to make good decisions for my security. I'd rather have my browser updated quickly so that vulnerabilities in the browser can be fixed quickly before they affect me.

jordsmi 13y ago

I would love a popup when I start up chrome that gives a prompt with which extensions need updated and if you want to allow it or not.

higherpurpose 13y ago
I like that, but maybe instead of several pop-ups it would be just one local Chrome page showing you the extensions that got the updates along with details. Google also needs to make developers put the change log in there, too. At the very least offer them a box for the change log, even if all they put there is "New stuff". If they do that you can decide to stop using the extension if you lose trust in them.
tomswartz07 13y ago
They currently 'hold' updates that have changed permissions. You must click through the menu to install them.