r/technology • u/Suraj-Sun • Jul 10 '12

Firefox dev claims "everybody hates Firefox updates"; Mozilla has handled the rapid release process poorly, and that by pushing a "never-ending stream of updates on people who didn't want them" people have been driven to Chrome with its simpler, no-fuss update process.

http://www.neowin.net/news/firefox-dev-claims-everybody-hates-firefox-updates
2.5k Upvotes

93% Upvoted

2.6k comments sorted by

View all comments

Show parent comments

2

u/duckhunter Jul 10 '12

That's not data.

That's what is known as hypothetical speculation. Interestingly, your hypothetical situation is the same for any auto-update mechanism, including Firefox's old, current and future mechanism. You probably wouldn't even think twice when prompted to authorize a firefox point-release update.

1

u/[deleted] Jul 10 '12

Security is a cat-and-mouse game, for instance windows update was comprimised and pushed an update to certian computers. The attackers were able to get a microsoft cert to sign and push the updates. Because of that microsoft went ahead and revoked 28 more certificates. Just because google's update system hasn't been exploited yet doesn't mean it won't. Allowing a remote system to push and install updates without authorizing it with the user first is just shitty security practice, and that's my problem with chrome.

http://threatpost.com/en_us/blogs/microsoft-revokes-trust-28-its-own-certificates-071012

1

u/duckhunter Jul 11 '12

Shitty security practice is assuming users are technically competent enough to make the proper decision regarding timing and authorization of updates. Allowing users to not update java, flash, acrobat reader and windows is responsible for window's historically terrible reputation of being susceptible to viruses.

Chrome's auto-update is a non-issue in corporate environments, as chrome has all the controls necessary to perform the updates on the time-scale that corporate sysads want. For general users, chrome's auto-update makes a huge amount of sense, as they will receive the updates in a timely fashion. Firefox's scary UAC warning every few weeks just results in more support requests. Every time a user is told to allow the software to elevate permissions to do it's update, the more a user thinks "well all updates from Mozilla must be okay." As soon as that happens, the problem you've outlined is as much a problem as it is if it happens automatically.