Tech: Firefox Update Policy

Subject: Tech: Firefox Update Policy
From: JohnInKansas
Date: 17 Mar 12 - 03:45 AM

Not an earthshaking development, but a new update policy for Firefox may be something users should be aware of.

Firefox to add silent software updates, Mozilla says

It will take responsibility away from end users, ensure most up-to-date version being run

By Matt Liebowitz
Security News
16 March 2012

Firefox fans will soon experience the security benefits of silent software updates, the Web browser's maker, Mozilla, announced Thursday.

In a post to its Hacks Mozilla blog, Mozilla "technical evangelist" Robert Nyman discussed a host of new features the company will incorporate into Firefox in 2012. Chief among those are silent updates, which will update the browser's software in the background, without notifying the user with an update dialog box and without requiring a lengthy delay upon restart.

This new feature is designed "to cater to update fatigue," Nyman wrote. Like Google Chrome, the only other Web browser currently running silent updates, Mozilla will take the responsibility to update away from the end users, and ensure they are always running the most up-to-date version of the Web browser.

*****

There's a little more at the link, although the whole article is fairly brief.

While the "problem" may have faded, I believe I recall some people here asking how to get an "older versions" of Firefox due to problems they'd found when they picked up the latest release. It would appear (?) that this new policy may preclude choosing what version you prefer to use, since updates will be unannounced and no choice of whether to accept them will be permitted. I'll leave it to those who might be affected to determine whether the new practice is a problem for them.

John

Subject: RE: Tech: Firefox Update Policy
From: Ole Juul
Date: 17 Mar 12 - 07:04 AM

There's already been a howl from the security world about inviting security breaches. If you allow Firefox (who _is_ that?) to install things on your computer when you're not watching, who else might like to do that? I do believe this is a Windows problem because Linux or BSD will not allow security breaches of that kind. My guess is that you can turn it off in Windows if you want. It would certainly be a security nightmare for administrators of larger systems if you couldn't.

As for old versions. I installed FF 1.5 recently on some old kit. Version 3.6 is still a good choice. Get that here. If you want old versions of many other browsers, including FF, get those here.

Subject: RE: Tech: Firefox Update Policy
From: Don(Wyziwyg)T
Date: 17 Mar 12 - 07:26 AM

I'll simply set my firewall to ask permission.

Don T.

Subject: RE: Tech: Firefox Update Policy
From: GUEST,PeterC
Date: 17 Mar 12 - 09:15 AM

Mine already does as default.

Subject: RE: Tech: Firefox Update Policy
From: Sandra in Sydney
Date: 17 Mar 12 - 10:16 AM

are Mac's affected?

sndra (not a geek)

Subject: RE: Tech: Firefox Update Policy
From: JohnInKansas
Date: 17 Mar 12 - 10:39 AM

From the article, the usual way that Firefox updates is when you open the browser Mozilla detects that you're online and insists that you install any available updates before you can begin browsing.

(Note that I don't really know if that's how it works, but that's what the article implies.)

There has apparently been a lot of complaining about the delays when updates are available (usually once every 6 weeks).

The article implies that beginning soon for the latest version, and shortly later for all versions, updates will download to your machine (with no notice to you). It's quite likely that the download can take place as a "background process" invisible to you.

The article isn't clear about when/how the actual installation of the update will take place, but if the intent is that use of the browser won't be affected, it might be assumed that the actual installation could take place when you close the browser (???).

The INTENT, stated in the article, is to assure that everyone uses ONLY the latest version of the browser and that the latest updates are installed promptly. This would appear to preclude using an older version, since the automatic silent upgrade would (eventually) replace any old versions.

If you've installed version 1.5 or 3.6, your installation will be upgraded to the current one (I think I saw ver 12 or 13 is current now?), if the article means what it says.

This may not really be what they meant, and those more familiar with how Mozilla does its business may be able to make a better interpretation of what the Mozilla übermeisters are saying, but that's the way I read it. (It's also possible that the writer of the article may have "slightly misquoted." My respect for tech writers doesn't necessarily extend to an "automatic assumption of absolute accuracy.")

John

Subject: RE: Tech: Firefox Update Policy
From: artbrooks
Date: 17 Mar 12 - 11:18 AM

FF is on V.11, as of yesterday.

If you don't want automatic updates, go to Options > Advanced and unselect 'automatic updates". You can select 'inform me of updates but don't install w/o permission' or 'never check for updates' instead.

Subject: RE: Tech: Firefox Update Policy
From: JohnInKansas
Date: 17 Mar 12 - 12:03 PM

Sandra in Sydney - The article (which you can read at the link in the first post) made no distinction for the OS the browser is running under. If Mozilla makes it, and it's named Firefox, the implication is that it's affected.

Artbrooks - I believe Firefox rolls the version number for each update, and the next one scheduled must be V.12 perhaps.

The real question is not what you can choose now. The article implies a change, and the statement about "takes control from the user" suggests your choices may not continue to be as many as you now have.

I can't tell from the articles (there have been a couple since the one linked, but they didn't clarify anything) whether you will continue to have the option to refuse - or postpone - an update, and that's the uncertainty I thought Firefox users might be interested in checking up on.

John

Subject: RE: Tech: Firefox Update Policy
From: Bonnie Shaljean
Date: 17 Mar 12 - 12:23 PM

Well, I've just updated to FF V.11 and guess what: After it was finished installing I got a little grey box on my desktop blithely informing me that the Zone Alarm "security engine" (I think that's what they called it) is not compatible with this version of Firefox so it would not be functional until something-or-other was updated. WHY in eff's name can't they warn you BEFORE you commit yourself? Fortunately, I use Safari as my main browser so will just leave the Fox in its den for now. I ticked that tell-me-first box that Art mentioned above, and suggest that everyone else does too.

In the immortal words of Billy Connolly (anybody else know that sketch?): Well, ya %$!!??*&&$!-ing know now!

Bonnie in a bad mood :-(

PS: John, am I right in thinking that disabling Zone Alarm's "security engine" means that the damn thing won't work in the new Firefox? Please say No. (But if you say Yes I'll still love you anyway...)

Subject: RE: Tech: Firefox Update Policy
From: Mick Pearce (MCP)
Date: 17 Mar 12 - 12:40 PM

I've had a quick look at the article (I'm running Firefox 11 under Ubuntu 11.10). The change is to do with a change in their release schedule. New releases of Firefox are being planned for 6 week intervals and the silent updates feature is to minimize interruption to users work as the updates are installed. (There will be some kind of Extended Support release for longer term stability in organizations, similar in concert to Ubuntu LTS releases I imagine). It's also not clear from what I've read what will happen if you want to run earlier versions; it probably says somewhere, but not in the bits I read. (They also claim v11 is up to 7 times faster than v3.6 and memory usage in v11 was reduced by 50%. So you'd need a good reason to go that far back!).

The feature is described in more detail here: Silent Update. A quick summary is:

1) There will be no user dialog for the update (it's not clear if you'll be able to turn off updates completely).

2) Update will be in background and (I think) is going to happen when you shut Firefox and before the next restart.

3) Add-on compatibility checks (which generally cause a pause when Firefox restarts after an update) will be modified; I think they will be assumed to be compatible unless they are definitely known not to be or are blacklisted. If they are used later and found to be incompatible a user dialog will appear then.

4) The What's New tab will not appear so frequently and may be moved somewhere else, possibly Tools menu.

5) In Win7 and Vista UAC they are looking to bypass the dialogs ie you won't be prompted to permit continuation.

6) The changes are planned to be introduced from v12 (maybe staged).



I don't think I have any problems with these changes.

As regards blocking the updates in firewall I imagine you'd have to find out how the updates are being done and either block the updating service or ports it might be using.

The changes will affect all platforms (though obviously with a few minor changes of detail).


Mick

Subject: RE: Tech: Firefox Update Policy
From: Bill D
Date: 17 Mar 12 - 03:26 PM

My firewall AND my watchdog.. WinPatrol... inform me that a program change has happened and whether I wish to accept it. I have no idea what happens if I'd say no to Firefox.

My preferred behavior is to be asked, and to personally control how & when I update programs.... I'll have to think about this.

Subject: RE: Tech: Firefox Update Policy
From: Ole Juul
Date: 17 Mar 12 - 05:12 PM

"If you've installed version 1.5 or 3.6, your installation will be upgraded to the current one (I think I saw ver 12 or 13 is current now?), if the article means what it says." - John

It may well mean what it says, but it is from an uneducated source, and in this case is wrong. :)

There may be a lot of MS-Windows users here where that could be true in some instances because of configuration choices. I am not very educated on Microsoft operating systems. However, the machine that I installed 1.5 on did not have the resources to run even 3.6 so an "upgrade" cannot be done without rendering the machine useless. Also, I run FF 3.6 on this very capable machine here and it will not be changed without me doing it. The reason is that another user (Mozilla) does not know my password and I don't run as root. We run *NIX systems here (lots of them) but I'd be surprised if any of the Windows OSs could not be made secure as well - at least to the point of preventing outsiders from installing software without the user's consent. Simply put, that would just be inviting malicious employment.

Apart from hardware capabilities, I think the main choice of version would be dictated by whether or not you need Adobe Flash for things like YouTube. Of course, there are dozens of other browsers one could chose. I have FF, Dillo, Chrome, Epiphany, and Galeon running 24/7 on different desktops for different purposes and if one was to lose my favour it wouldn't be a big deal to just blip it. Anyway, all this talk reminds me of why one might want to run Opera. They don't espouse the same shenanigans that FF seems to enjoy.

Subject: RE: Tech: Firefox Update Policy
From: GUEST,David E.
Date: 17 Mar 12 - 07:59 PM

Speaking as an old "if it works, don't fix it" fuddy-duddy who hates change and bells and whistles I just wanted to mention that just today I re-downloaded the old (it worked fine) Firefox version I had previously (3.6.2) and got rid of (hopefully forever) the "latest version" I was told I just had to have. This latest version, at least on my computer, came with slow loading pages, freezing and a suddenly mucked up Norton's Anti-Virus program, so I really don't fancy newer versions and the constant barrage of "updates" "fixes" "patches" etc etc etc that swallow up the free space on my hard drive. (grumble grumble)

David E.

Subject: RE: Tech: Firefox Update Policy
From: Bonnie Shaljean
Date: 18 Mar 12 - 03:52 AM

My only worry about sticking to the old tried-&-true's (about which I agree: I hate all this constant changing) (especially when it disables Zone Alarm) but I'd be worried about security flaws in the past versions. Firefox (and Adobe Reader and every other widely popular app/site) is a magnet for hackers seeking to exploit any flaw they can find, and they've had a lot of time to manipulate the weaknesses in the old FF; so I suppose this is as much about keeping a step ahead of them as anything else. It's still a drag, tho...

Subject: RE: Tech: Firefox Update Policy
From: GUEST,SRD
Date: 18 Mar 12 - 06:27 AM

As I understand it it's only the bit of ZoneAlarm that checks out websites before you go to them that is incompatible with the latest FF.
But I'm not happy that the last time the damned thing upgraded itself I was in the middle of downloading something large and the added load caused my link to crash, if I'd been able to hold off the upgrade I'd have been Ok.

Subject: RE: Tech: Firefox Update Policy
From: Newport Boy
Date: 18 Mar 12 - 06:40 AM

The Firefox release situation is much more complex than the discussions so far. There are a number of 'release channels' for Firefox, and most of the above refers to the standard release channel. It may be that on some Windows systems the standard channel is set for automatic updates (I don't know) but that would be a function of Windows, not Firefox, and you should be able to change that in Windows.

Normally it's only the Firefox Beta channels that update automatically, but you can change that if you wish (again I don't know about Windows, but it should be possible).

I'm currently running Firefox Nightly 14.0a1, which I updated this morning. I also have Firefox 9.0.1 installed, in case I have a problem with Nightly, which is experimental. (I've had no problems since I started using Nightly some months ago.) BTW, this morning's update took about 5 seconds, including shutting down and restarting Firefox on the same webpage.

There is also a Extended Support channel which gets updated less frequently than standard, and is intended for deployment by system admins with large networks.

Phil

Subject: RE: Tech: Firefox Update Policy
From: Bonnie Shaljean
Date: 18 Mar 12 - 06:51 AM

Just to recap what Art Brooks wrote yesterday:

If you don't want automatic updates, go to Options > Advanced and unselect 'automatic updates". You can select 'inform me of updates but don't install w/o permission' or 'never check for updates' instead.

Subject: RE: Tech: Firefox Update Policy
From: Don(Wyziwyg)T
Date: 18 Mar 12 - 07:17 AM

And if that doesn't work, or is removed, Zonealarm users can go to Zonealarm Programs, select Firefox and change the settings to ?

Then ZA will request permission whenever FF tries to connect, and if you didn't initiate the connection you can refuse.

I imagine most other firewalls will do the same.

Don T.

Subject: RE: Tech: Firefox Update Policy
From: Mick Pearce (MCP)
Date: 18 Mar 12 - 08:18 AM

Phil - I think most people will be interested only in the standard release channel. The Aurora (pre-beta), Beta, and Nightly(testing only) channels are more likely to be of interest to system admins (or users who like to be at the cutting - and possibly blunting - edge).

I've just had a look at the update settings on my v11 (Ubuntu 11.10) and update control seems to have gone for me already. The Edit/Preferences/Advanced/Update menu shows only the option to update search engines automatically. There is no option to turn off updates. I've never bothered to look in the past (since I was quite happy with the behaviour it was exhibiting), so I don't know if or when it went from previous versions I've used. (I've also got a verson running under XP but I don't use it a lot, so I've never looked at the settings there. Strangely, although it been perfect for me on Ubuntu, I've seen people have problems with the Windows version, especially on the memory usage by it's sandbox feature (keeping tabs separate so that a catastrophic failure in a tab affects that tab only and doesn't shut down everything else)).


Mick




Mick

Subject: RE: Tech: Firefox Update Policy
From: Bonnie Shaljean
Date: 18 Mar 12 - 08:54 AM

I've updated to v.11 on both my machines, a Windows-7 PC and a MacBook running OSX 10.6.8 and on both of them the "Check for updates but let me choose whether [not 'when'] to install them" option is still there (you need to remember to click the "Update" tab at the top of the Advanced menu to get to it).

I do notice however then the "Update add-ons" option is no longer there, and the only other tick-able box is the "Update search engines" one.

Subject: RE: Tech: Firefox Update Policy
From: Newport Boy
Date: 18 Mar 12 - 08:54 AM

Mick

I agree that the standard channel is for most people. I would put myself in that category, but a friend recommended I try Nightly and it's certainly worked for me. No crashes, no other problems and it is significantly faster than the earlier versions I was using.

Re updates - my Edit/Preferences/Advanced/Update shows:
Automatically install (recommended)
Check for updates but let me choose (I use this)
Never check (not recommended - security risk)

Phil

Subject: RE: Tech: Firefox Update Policy
From: Mick Pearce (MCP)
Date: 18 Mar 12 - 10:49 AM

Bonnie and Phil - those are the options shown on Mozilla's site for the tab. I'm running the Ubuntu distributed version (11.0 Mozilla Firefox for Ubuntu canonical - 1.0), so perhaps Ubuntu chose to remove the choices for updating in their distro. Next time I power up my XP machine I'll try and remember to see what I've got there.

Mick

Subject: RE: Tech: Firefox Update Policy
From: Newport Boy
Date: 18 Mar 12 - 11:10 AM

Mick - sounds like Ubuntu choice. I'm running Mepis (Debian stable based).

Phil