Firefox 4 to introduce silent, behind-the-scenes security updating

[noaccount]

Computerworld - Taking a page from rival Google's playbook, Mozilla plans to introduce silent, behind-the-scenes security updating to Firefox 4.

The feature, which has gotten little attention from Mozilla, is currently "on track" to make it into the final of Firefox 4, the major upgrade slated to ship before the end of the year. Mozilla has released two beta previews of Firefox 4 in the last four weeks, and has set a third beta for next week.

Firefox 4's silent update will only be offered on Windows, Mozilla has said.

Most updates, including all security updates, will be downloaded and installed automatically without asking the user or requiring a confirmation, said Alex Faaborg, a principal designer on Firefox.

"We'll only be using the major update dialog box for changes like [version] 4 to 4.5 or 5," Faaborg said in a late July message on the "mozilla.dev.apps.firefox" forum. "Unfortunately users will still see the updating progress bar on load, but this is an implementation issue as opposed to a [user interface] one; ideally the update could be applied in the background."

Unlike Google, Mozilla will let users change the default silent service to the more traditional mode, where the browser asks permission before downloading and installing any update.

Chrome is the poster boy for automatic updates. Google's browser kicked off in September 2008 with a then-controversial mechanism that removed the user from the update equation. Chrome continues to rely on an automated service that updates the browser in the background, and can't be switched off.

Taking updates out of the hands of users keeps them safer, Google has claimed. A May 2009 paper co-authored by a Google engineer argued that, "Any software vendor [should] seriously consider deploying silent updates, as this benefits both the vendor and the user, especially for widely used attack-exposed applications like Web browsers and browser plug-ins."

According to "Why Silent Updates Boost Security" (download PDF), 97% of Chrome users were running the latest version of the browser within 21 days of the last update's release. By comparison, 85% of Firefox users were up-to-date in the same span, while only 53% Safari users could say the same.

Faaborg and Robert Strong, the Mozilla engineer who has been writing the behind-the-scenes updater, defended the move toward a Chrome-like service.

"I think the majority of users would prefer an application that doesn't bother them with what they view as little details, where a little detail is a minor update," said Faaborg. "We get a lot of complaints that Firefox updates too often, people can't see the difference with the new version (it was actually a security patch), that we change our mind too much and should just ship one version (it was actually a security patch), etc."

"There are people that don't like being notified of updates," Strong said on the same Mozilla discussion group. "There is 'no one size fits all' behavior for this that will please everyone."

Strong also took exception to the use of the term "forced" to describe how Firefox would keep users up-to-date. "As for 'forced' update ..., Chrome accomplishes this in part by forcing the install of Chrome into the user's profile which has a set of issues associated with it that we don't want to have, so we aren't taking that route," he said.

Mozilla isn't the only major developer toying with changing how its users receive patches: Adobe has added a silent updater to Reader and Acrobat, for instance. At the moment, users must manually switch on the new tool, and Adobe has said it has no plans to enable fully-automated updates without some kind of user permission.

[url=http://www.computerworld.com/s/article/9180272/Mozilla_plans_to_silently_update_Firefox?source=rss_security]Mozilla plans to silently update Firefox

[hellnoire]

They should set it by default to be updated manually, and that you'd have to change it manually or via a first install option if you ask me.

Make the user decide, rather then worry about becoming the next Chrome.

[SomeOne]

Affirmative. I have the same opinion that silent-updates should be enabled by default while users can still change it to traditional mode whenever they want. This way, happy ending to both parties.

[FunkY]

NO, no, no...... My personal opinion about silent updates are
I wanna ABSOLUTELY know what is happening at my computer at all the time

[princeaniket]

I wanna ABSOLUTELY know what is happening at my computer at all the time

exactly.. i also want to know what is happening behind the screen.. i think there should be an option like " windows update"
" let me choose whether to install it or not "

[johnshaw1917]

I "despise" auto updates, because I want to know whats being installed on my PC before hand.

[sujay]

I totally agree with SomeOne, silent update is necessary for common users as they always wants everything to be done automatically. But there should be an option to manually install items for our GEEK friends...

[one111]

in the final analysis the user must always have the choice and option
to negate the service if he wishes

[noaccount]

in the final analysis the user must always have the choice and option
to negate the service if he wishes

yep in Mozilla's best tradition

For Firefox 4 minor updates will occur automatically. Users can change the
setting in Options > Advanced > Update. We'll only be using the major
update dialog box for changes like 4 to 4.5 or 5. Unfortunately users will
still see the updating progress bar on load, but this is an implementation
issue as opposed to a UI one (ideally the update could be applied in the
background). We will also be able to prompt the user if they haven't
restarted in a very long time and there is a particularly bad security
vulnerability that need to be patched.

-Alex

[Neo]

user should have choice abt what he want :

for me : no silent updates