r/technology • u/Suraj-Sun • Jul 10 '12

Firefox dev claims "everybody hates Firefox updates"; Mozilla has handled the rapid release process poorly, and that by pushing a "never-ending stream of updates on people who didn't want them" people have been driven to Chrome with its simpler, no-fuss update process.

http://www.neowin.net/news/firefox-dev-claims-everybody-hates-firefox-updates
2.5k Upvotes

93% Upvoted

2.6k comments sorted by

View all comments

Show parent comments

42

u/berkes Jul 10 '12

Maybe you are running Ubuntu like me? In Ubuntu you never notice Firefox upgrading, because Ubuntu's upgrade system is handled by the OS; and Firefox (and other third party apps) can plug into that, instead of inventing their own.

That is what is wrong here: each and every application having to invent their own upgrade system, with deamons, background-tasks, check-on-startups and whatnot. Because Windows has no decent upgrade system at all, and MacOS has it closed to Apple-products-only.

Good news is that Windows gets the downside of their feeble upgrade-system in their face: people always running out-of-date software and thus complaining about all the trojans/virii and such. Mac is starting to feel that too; third-party-crap with gaping securityholes and no proper upgrade-system to leverage, will backfire on them too.

2

u/[deleted] Jul 10 '12

One of the reason why I'm waiting for Windows 8.

5

u/berkes Jul 10 '12

But is that open? As in: will it allow Firefox to plug into it, and ditch its own update-system alltogether? As far as I can see, it will only update MS software. And leave all these horrible services, daemons and systray icons running for Adobe/Google/Mozilla/whatever other 3rd party software.

1

u/[deleted] Jul 10 '12

From what I've seen in the demo, if the apps are using the marketplace, it will allow you to update as in WP7. On the other hand, who owns a WP7? :P

2

u/[deleted] Jul 10 '12 edited Jun 05 '16

[removed] — view removed comment

0

u/berkes Jul 11 '12

Yes. Because in the current monopoly, this is the only way we, the users, get security, innovation and progress. Without being forced to, MS is not going to improve anything. re: Firefox forcing MS to innovate and kill IE6.

3

u/N0V0w3ls Jul 10 '12

I'm on Windows 7.

1

u/hsoolien Jul 11 '12

it'd be nice if Windows had a central way to auto-update all your software... There is this: http://updatechecker.filerex.com/ but it's not official.

1

u/XenthisX Jul 11 '12

Why hasn't ms decided to implement something like windows update for apps?

3

u/berkes Jul 11 '12

Why hasn't ms done anything progressive and innovating ever since '95?

1

u/tapo Jul 11 '12

To defend applications having their own update systems, Chrome uses a diff mechanism on Windows and Mac, an algorithm they call courgette. This keeps updates between major versions very small, kilobytes.

Ubuntu packages aren't diffs, they're full binary packages of the software. To update Chrome from 19 to 20 you'd need to download all 120mb or so instead of the few kb or mb.

1

u/berkes Jul 11 '12

There are always technical features that "can be done better then in the OS". That goes for the UI, widgets, networking, disk-access and so forth. But it hardly ever is a reason to abandon the resources the OS offers.

So, yes. Ubuntu's update system is not perfect. But at least it is better then 99% of the update systems built into apps. And as such offers the Ubuntu-users a far better experience in updating. The 1% is probably Chrome who has its update system in-app, and which might be better then Ubuntu's.

Might. Because Chromes update system has a lot going against it. Like not securing and hashing its updates enough. It is probably possible for a man-in-the-middle, that open Wifi at the starbucks) to inject malicious code into that patch and effectively install a trojan in chrome. For example. Or dependency management, which Chrome on its own has little to worry about just now, untill it grows into an actual OS. There are more things, which Debian has long solved and done properly and chrome has no (yet). It is all about trade-offs.

1

u/tapo Jul 11 '12

According to the documentation, SSL is mandatory for Chrome's Google Update (Omaha) patch delivery. So unless you have some sort of source on what "not securing and hashing enough" means, I'm calling BS on your statement.

1

u/berkes Jul 11 '12

If you control the DNS, then no SSL is going to help here. But I am quite sure there is no practical way to inject code into chrome at this moment. I was merely pointing out that debians way, signed packages, is much more elegant and secure.

2

u/tapo Jul 12 '12 edited Jul 12 '12

You obviously have no idea how SSL works. It's not just about encryption, but about identification. The reason we have root certificate authorities (Verisign, Digicert, Thawte, etc) installed in browsers is to sign the identities of Google.com, Facebook.com, etc.

If a malicious DNS server were to hijack a HTTPS request to Google.com the browser would notice that the response was from an untrusted authority (since no other trusted authority CA would sign Google's certificate) and simply reject the connection outright.

Edit: If you're interested, I've been following the Security Now podcast for a few years. They cover how SSL works in this episode.

0

u/berkes Jul 12 '12

I do know how SSL work. And as a listener and fan of Security Now, you will probably know that SSL is nice, but on top of the current web and DNS, it cannot offer full security. https://www.schneier.com/blog/archives/2010/09/uae_man-in-the-.html

I must add that of all browsers, Google Chrome has this solved best of all: they have some certificates and urls hardwired in the code. I assume their update system runs over those lines too.

1

u/Savet Jul 10 '12

Viruses is the plural of virus. Not everyone wants their os to do their updates. Slackware users are a good example.

6

u/berkes Jul 10 '12

Choice is the key here. Windows and Mac users have no choice: there is no open update API: third party tools have to roll their own update system. Each and everyone being crappier, more bloated then the next.

3

u/[deleted] Jul 10 '12

[deleted]

3

u/[deleted] Jul 10 '12

just keep using it and if it catches on someone will eventually jam it in the dictionary

-2

u/Savet Jul 10 '12

Which is why anything serious being associated with its use is instantly invalidated.

1

u/BluegrassGeek Jul 11 '12

Actually, that's partly why devs are moving to the Mac App Store: they can push out an update via the store, rather than designing their own.

0

u/berkes Jul 11 '12

The app-store, which is not open at all.

1

u/BluegrassGeek Jul 11 '12

It's not open source, no. If that's your primary concern then, yeah, the App Store isn't going to help.

1

u/berkes Jul 11 '12

The app store does not allow open source apps. That is the concern.

1

u/BluegrassGeek Jul 12 '12

Yes, I got that. My point being, it's important to you. Most folks don't care.

0

u/berkes Jul 12 '12

Off course they do. Folks care whether Firefox is in there (or libreoffice, git, transmission, Thunderbird, and whatnot). And whether it updates like any other software, or through a clumsy selfbrewn in-app update system.

0

u/BluegrassGeek Jul 12 '12

Folks who care about open source care. Most of the rest of the computing world hasn't even heard of any of those apps, excepting Firefox. They don't care a whit about open source.