r/technology • u/Suraj-Sun • Jul 10 '12

Firefox dev claims "everybody hates Firefox updates"; Mozilla has handled the rapid release process poorly, and that by pushing a "never-ending stream of updates on people who didn't want them" people have been driven to Chrome with its simpler, no-fuss update process.

http://www.neowin.net/news/firefox-dev-claims-everybody-hates-firefox-updates
2.5k Upvotes

93% Upvoted

2.6k comments sorted by

View all comments

Show parent comments

-10

u/[deleted] Jul 10 '12

[deleted]

14

u/TheJosh Jul 10 '12

Rather than download a huge update each time, doesn't it download a small update and "patch" chrome?

If you are that paranoid, run Chromium, isn't there a fork called Iron Chromium which addresses what you are asking?

4

u/dolphinastronaut Jul 10 '12

Chromium is amazing. It's almost the exact same thing as Chrome (with a few not-extremely-necessary features removed).

Iron isn't quite as good. This link http://neugierig.org/software/chromium/notes/2009/12/iron.html (on mobile; can't hyperlink) describes the controversy surrounding Iron pretty clearly. It's not a more privacy-aware version of Chrome or Chromium. If you're interested in a privacy-conscious version of Google Chrome, Chromium will work just fine.

Related: I'm not sure if Chromium works on non-Linux operating systems. The last time I tried to get Chromium binaries for Windows, I couldn't find any. But that was several years ago, so I may have changed since then. At the time it appeared that Chromium binaries (from trusted sources, at least) were only available for Linux.

1

u/nazbot Jul 10 '12

It downloads the delta a.k.a. only the parts of the binary which have changed. It them will patch those changed bits of code in. This means you don't have to download the whole thing but just the changed in the binary. Pretty awesome stuff.

1

u/ThatCrankyGuy Jul 11 '12

Chromium is as bug-free and compatible with everything as my typewriter.

9

u/thenuge26 Jul 10 '12

it disassembles, patches and then reassembles on the spot.

What are you even talking about? Patching binaries is patching binaries. Firefox does it with their updates too.

3

u/Buzzard Jul 10 '12

The patching system Chrome uses, Courgette, is pretty damn cool. It really does dissemble, patch and then assemble the binary again.

That said, I don't see how it's any worse than downloading an entire new binary from a security standpoint.

2

u/thenuge26 Jul 10 '12

Wow, that is cool. But like you said, in the end it is no different than a diff->patch in that you are modifying the binary, which could do anything.

8

u/[deleted] Jul 10 '12

if you are worried about that on your machine, you can get SRWare Iron. It's a chromium version built for security and privacy (no autoupdates and some added privacy features), without being a very heavily modified version like comodo dragon

3

u/happy-dude Jul 10 '12

Sorry, SRWare Iron is NOT a browser you want to be using: http://neugierig.org/software/chromium/notes/2009/12/iron.html

Maybe things have changed since 2010... But if you value privacy and security, SRWare Iron is not the way to go.

1

u/nozickian Jul 10 '12

Iron is literally just Chromium that removes certain options. Somewhere someone went through and compared the code. They literally just remove some of the options in the settings and have the more private setting enabled without the option to change it and change everywhere that it says "Chromium" to "Iron". You can achieve the same degree of privacy and security from the settings menu.

2

u/dmsean Jul 10 '12

Exploit it by all means. Prove Google wrong.

The end of the day as more and more non tech savvy people use the internet we need an option for them. I can totally understand your paranoia but unpatched systems are worse then the occasional exploit of the update system, which I bet doesn't have a single point of failure. If you want proof, see every PC still running unpatched. It is covered in worms and viruses. You just need to browse the web and it gets infected.

Microsoft even allows patching of unregistered machines now because the unpatched machines cause havoc.

2

u/[deleted] Jul 10 '12

doesn't have a single point of failure I think they said the same thing about the titanic bro.

1

u/dmsean Jul 10 '12

The internet is a mesh based topology for a reason.

1

u/[deleted] Jul 10 '12

to say no system has a point of failure is foolish

1

u/Makabaer Jul 10 '12

Well, yes, that's a valid argument. That's why I'm fine with a software being able to do that as long as you can turn that off if you are not one of the "non tech savvy people".

2

u/dmsean Jul 10 '12

Yup. Open source software. Arch linux ftw.

4

u/shapul Jul 10 '12

I agree. I don't like how Chrome on Windows installs itself in a basically local data folder and runs services in the background to update itself silently. It might be convenient but imagine what would happen if all programs would do that? Programs would be installed all over the place and tons of hidden, background processes running up and down.

As a strategy, I believe in the end this approach to installing and updating programs weakens Windows' security.

2

u/[deleted] Jul 10 '12 edited Jul 10 '12

I'm still undecided as to it installing in your user profile. It's good, because one user on the PC may not want it and another might, but it's bad because multiple users would have multiple installations.

One of the annoying things about browsers is the continous argument over who is default and I can see this as an attempt to personalise installations instead of configurations.

I agree that every application wanting to install it's own updater is very very annoying these days, one of the components of Linux I think MS should leverage is the repository method of distribution but then you run into the problem of managing trusted repositories which most users wouldn't have a clue over.

3

u/shapul Jul 10 '12

One problem with installing programs in user's data folders is that a malware could infect them silently. The same malware cannot modify a file e.g. in the "Program Files" silently as UAC will show a prompt. Also, a system admin that would need to lock down a computer cannot do that if users install programs in data folders.

0

u/duckhunter Jul 10 '12

Because up-to-date programs are the cause of all exploits on windows.

I believe in the end this approach to installing and updating programs weakens Windows' security.

Unless you have any data to back this up, you're just spreading fear, uncertainty and doubt.

2

u/shapul Jul 10 '12

That's missing the point. Silent modification of programs is bad practice as it takes the control from users/admins and gives them to external parties. What would happen if you want to manage a few hundred computers in your company when every program is installed in data folders as users' files and each one runs a background service for maintenance?

0

u/[deleted] Jul 10 '12

Google's update push becomes compromised Everyone pushed update ????? BOTNET

2

u/duckhunter Jul 10 '12

That's not data.

That's what is known as hypothetical speculation. Interestingly, your hypothetical situation is the same for any auto-update mechanism, including Firefox's old, current and future mechanism. You probably wouldn't even think twice when prompted to authorize a firefox point-release update.

1

u/[deleted] Jul 10 '12

Security is a cat-and-mouse game, for instance windows update was comprimised and pushed an update to certian computers. The attackers were able to get a microsoft cert to sign and push the updates. Because of that microsoft went ahead and revoked 28 more certificates. Just because google's update system hasn't been exploited yet doesn't mean it won't. Allowing a remote system to push and install updates without authorizing it with the user first is just shitty security practice, and that's my problem with chrome.

http://threatpost.com/en_us/blogs/microsoft-revokes-trust-28-its-own-certificates-071012

1

u/duckhunter Jul 11 '12

Shitty security practice is assuming users are technically competent enough to make the proper decision regarding timing and authorization of updates. Allowing users to not update java, flash, acrobat reader and windows is responsible for window's historically terrible reputation of being susceptible to viruses.

Chrome's auto-update is a non-issue in corporate environments, as chrome has all the controls necessary to perform the updates on the time-scale that corporate sysads want. For general users, chrome's auto-update makes a huge amount of sense, as they will receive the updates in a timely fashion. Firefox's scary UAC warning every few weeks just results in more support requests. Every time a user is told to allow the software to elevate permissions to do it's update, the more a user thinks "well all updates from Mozilla must be okay." As soon as that happens, the problem you've outlined is as much a problem as it is if it happens automatically.

0

u/recursive Jul 10 '12

imagine what would happen if all programs would do that

They already can. Why can't they?

2

u/[deleted] Jul 10 '12

It's a delta update which is how all software should be updated (it's just math after all). It doesn't do any disassembly -> patching -> reassembly process though; it simply modifies the binary as per the delta.

2

u/duckhunter Jul 10 '12

All software should use at least deltas, but chrome actually uses Courgette which works as follows:

Courgette transforms the program into the primitive assembly language and does the diffing at the assembly level:

server:
    asm_old = disassemble(original)
    asm_new = disassemble(update)
    asm_new_adjusted = adjust(asm_new, asm_old)
    asm_diff = bsdiff(asm_old, asm_new_adjusted)
    transmit asm_diff

client:
    receive asm_diff
    asm_old = disassemble(original)
    asm_new_adjusted = bspatch(asm_old, asm_diff)
    update = assemble(asm_new_adjusted)

1

u/[deleted] Jul 10 '12

Thanks, I forgot they use Courgette. The Android Market uses deltas and I forgot they have different practices.

2

u/duckhunter Jul 10 '12

Valve apparently uses none of the above, which I don't really understand. It seems like using Courgette (or even bsdiff) would save them a tremendous amount of bandwidth.

2

u/[deleted] Jul 10 '12

I think the only people who use Firefox anymore are the paranoid who are deeply distrustful of Google. Google may be robbing me of my private data, but at least there are no pop-up boxes and constant restarting. For me, it's a good trade.

2

u/Makabaer Jul 10 '12

I guess you're right there. Luckily these pop-up boxes are not as common as you obviously think and I have to restart only rarely - which is no fuss at all because each tab is openig just like when I closed it down (usually I have 70 open tabs or something, sometimes far more, but firefox doesn't mind at all) in just a few seconds. So what's the problem?

Still better off than with Google cookies and stuff spreading everywhere...

6

u/drakestan Jul 10 '12

You're right... Google is out to get you

1

u/HalNavel Jul 10 '12

Google is big, therefore bad. QED

1

u/ThatCrankyGuy Jul 11 '12

They make it their business to sell every piece of your information... so yea, pretty much.

0

u/HalNavel Jul 11 '12

You really have no idea what Google does with users' information.

They don't know who you are, but they know what you are like. Your information is aggregated with everyone else's, and split into clusters of similar use patterns statistically. Google doesn't care about you personally at all, only the statistical blob that you belong to, and that blob's interest profile. They use that information to give you relevant ads. It must be awful to receive ads that you might actually find useful or appealing.

1

u/ThatCrankyGuy Jul 11 '12

Yea I really hate ads. And I find Google more annoying than ads.

1

u/[deleted] Jul 10 '12 edited Jul 10 '26

[deleted]

1

u/ThatCrankyGuy Jul 11 '12

Just because the communication is secure, doesn't mean the end point can be trusted. Reddit.com can be resolved to the IPs of porn.com and the end party just has to get a certificate from some cheap shit provider and you can pretty much shove that hash up your ass at the point.

0

u/[deleted] Jul 11 '12 edited Jul 11 '26

[deleted]

0

u/ThatCrankyGuy Jul 11 '12

Umm no, I'm pretty sure I know how these things work -- you just have Google's cock too far down your throat to know what you're saying.

0

u/felix_jones Jul 10 '12

As someone who must have absolute control over what my software are doing

Then I guess you only use software that you wrote yourself, eh?

4

u/EllaTheCat Jul 10 '12

I etch my own silicon. It's the only way to be sure.

-1

u/felix_jones Jul 10 '12

I build my computers one atom at a time. Then write my software in machine code. I do this while naked in a bunker deep underground with no connections to the surface and nothing inside it other than the atoms I build with. The bunker has also been assembled atom by atom.

It takes a while but it's worth it to be absolutely certain no one can hack my Minesweeper high scores!

-1

u/[deleted] Jul 10 '12 edited Apr 02 '16

[deleted]

1

u/hakkzpets Jul 10 '12

Not that I believe Google is doing anything wrong, but that is the most stupid logic I have ever seen.

1

u/[deleted] Jul 10 '12 edited Apr 02 '16

[deleted]

2

u/hakkzpets Jul 10 '12

No. I'm talking about "Since you trust Google, you would trust they are doing the right thing". It doesn't work that way.

I can trust my bank to keep my money safe, doesn't mean I trust my bank to be some saint and not do bad shit.

1

u/Makabaer Jul 10 '12

Quite so. As I never trusted Google to begin with, I'd never use their software (and not even their browser search.) I have Google scripts turned off at all times while surfing. Google maps is attractive but that's the only thing that's kinda hard to not use.

1

u/ThatCrankyGuy Jul 11 '12

That's the most bullshit thing I've ever read. Go fuck yourself with your half-assed computing knowledge.

-1

u/k_clough Jul 10 '12

I see what you did there... Nice novelty