Future Firefox to slurp updates silently Mozilla is changing the way Firefox installs on computers in an apparent concession to enterprise users it previously ruled were irrelevant. Future versions of the open-source browser will download and install silently on your machine, saving you the bother of downloading and authorising the update. It is hoped switching to …
'The Firefox team is testing a "Windows service approach" to get around the UAC issue; the service would install an optional component that would automate the update install without giving the UAC prompts, Bondy said.'
Chrome gets around this by running with user privileges in the user folder. What Mozilla are suggesting seems to punch a hole right through a rather important security layer. One small coding bug now makes the entire Windows platform vulnerable to malware, all to prevent a pop-up every 6 weeks.
Something tells me that this would NOT be the preferred solution for Enterprise. The preferred solution for Enterprise would be a pre-packaged MSI update that they could control the deployment of.
Chrome is running as a user and is only installed in the user folder using user rights. This is the decision they made to allow for rapid updates. Sure, it breaks standards a little but it keeps the security layer intact.
Chrome does offer an Enterprise installer that installs to the Program Files folder but sticks with UAC for updates.
UAC is there for a reason - to alert the user to programs that require elevated and potentially dangerous permissions. Such as installing new programs. While it may be Google (and Firefox) think they're doing this for good reasons, the reality is if they subvert the UAC mechanism they are undermiming the reason it is there in the first place.
It's also not hard to envisage the dangers of having multiple stealth updaters floating around in the background. While one would hope that Google / Firefox have the sense to verify signatures and other precautions, that doesn't mean their implementation is bug free. I can imagine the fun and games that would happen if someone managed to DNS poison their update sites and use an exploit to install trojans through these backdoors.
Maybe this shows limitations in the Windows way of storing data. Effectively saying that AppData is the only place a user can write, and should not be used for executables is saying that ordinary, non-privileged users should not be using programs other than what is deployed system wide.
In an older multi-user model (I'm sure you can guess the one I'm talking about), one of the normal conventions is a bin directory under a user's home directory. User written scripts, locally compiled software and trusted executables from other sources can live there. Add it to the path, and users can then effectively extend the OS to do what they want, rather than being limited by what the system provides. And in a homogeneous networked computing environment, this scales to network computing as well!
Windows has no such convention. Shame MS could not learn from history.
Actually, this convention is nowhere near universal in the UNIX (and UNIX like) world. MANY of us recognize that allowing users to install executeables is a risk. many of us mount /home with noexec to combat this.
Users should NOT install apps. Shame some self-declared admins couldn't learn from history.
It has been a convention since UNIX made it outside of Bell Labs, which I can testify to since 1978 when I first used UNIX version/edition 6.
I agree that this does not suit all organisations or even all users in the same organisation, and the flexibility of UNIX allows this *convention* to be controlled where it is necessary. That does not alter the convention, merely the implementation.
Your statement that "Users should NOT install apps" is as blunt as me saying that they should. Neither can completely cover all situations. I also wonder whether you differentiate between locally written tools, and applications from external organisations, and also whether you also differentiate between compiled code and such things as shell scripts or other interpreted code (which actually can be run as long as you can run the interpreter, even if the noexec flag is set!). Do you also prevent shell access or disable aliases and functions?
Where I currently work, if the users were not allowed to compile and execute code, they could not work. But that is because our users are scientists who are working on creating computing models. There is no one-size-fits-all model for all organisations.
I'm not sure if that statement about 'self-declared admins' was aimed at me. If I am not a UNIX system admin (30 years looking after UNIX systems from many vendors in lots of industries, including writing some of the security standards and many operational procedures at some organisations), then I don't know what I am, or what a UNIX sysadmin should look like.
Believe me, I have been involved in enough hardened UNIX installations to know exactly what you are saying, and the convention stands.
Actually, as of Windows 7, the correct location for per-user applications that don't require elevation is a Programs subdirectory under AppData. Windows Installer was even modified to offer an auto-mapping of "Program Files" for per-user installations that would write to this location.
is silently updating going to help corporates test the update centrally, before allowing it to be installed on the network?
And I agree, Barry, punching a big security hole in the middle of the OS, to get around UAC is just damned foolishness!
Rewriting it to work with WSUS or something similar, so that it can be pushed out to computers, once tested, would be a much better idea!
The best solution would be MS allowing hooks into Windows Update for 3rd party programs, it's something they should really should have got round to by Vista's release.
Barring that, if Mozilla do it like Windows Update does (which also uses a service), arguably it's the correct approach. And if they have a group policy that allows you to push out Firefox updates when you want to from a local server of your choosing, even better (it's like WSUS and enterprises like WSUS).
"Something tells me that this would NOT be the preferred solution for Enterprise."
Well, in all fairness it wasn't that long ago when some Mozilla employee stated that "the company wasn't concerned with Enterprise customers and probably never would be". (seen in an previous article on El Reg).
So in that context changes like these make sense... sort off... Personally I think Firefox is really going downhill these days.
I have my XP users logged in as Restricted and can't install software (which has helped against malware). Auto updating has to be manually disabled, else it blindly downloads the update, then can't install.
Releasing new versions of Firefox & Thunderbird with random version numbers is regularly breaking essential plugins that would otherwise work if the old major.minor numbering scheme had been adhered to. Causing me & my customers unnecessary grief.
Yep. And I don't see anything about being able to point local FF installations to an alternate server hosted within the organization-- now that would be nice but, of course, FF doesn't have Group Policy tools for stuff like that. Fortunately *nix orgs can change repo lists, but, as usual, Win users are SOL.
Yes, I know there are third-party tools for FF. If your org lets you use whatever you want, fantastic. Unfortunately a LOT of orgs require a painful approval process (or refuse to approve other software) which makes using them unlikely or flat out impossible.
Baker said that Mozilla "erred on the side of caution".
No, Mozilla didn't err at all. Users err on the side of "What the fuck is that annoying dialogue box doing. Oh fuck, I'll just click it to make it go away. Why do these software companies insist on making me think about important things when all I want to do is update my status on Arsebook?"
My firewall will still detect that the program has changed and will ask if I want to give it access to the interwebs...
FAIL, I'll still be asked
FAIL, what if I'm using <insert name of browser> but I don't have internet access, support will still have to push the update to users
Well, actually I too thought that would be problematic as every time Firefox updates I get the pop up warning from Zonealarm warning me that the program has been changed.
However... this does not happen on Nightly 10, which updates by itself with no pop ups either from Windows UAC or from Zonealarm.
So I think they may have solved it...
I am assuming they will give you the choice to be either automatic or notify only. I downloaded 7 the day it came out, only to find out it broke noscript and adblock. I ended up rolling back to 6.02, waiting a few days, and then trying again. Certain addons are a requirement, and if they break, I will not update.
"At least the current cumbersome method of updating FF gives the user to stick with the version that actually supports their plug-ins"
That's as maybe but Mozilla stop issuing security updates for old versions of FF with undue haste. So by sticking to a version that supports your pluging you could end up with a browser full of holes. A rock and a hard place?
Its seriously intensely irritating.
They're more needing to fix their sync issues -- hasn't been working at all for quite a few days now (the last time it ate everything -- bookmarks, the lot then returned them all fucked up and broken). And THIS message if you try to delete your sync account (which you currently can't):
"Oh dear. Looks like one of the dinosaurs escaped again. We keep them away from the data, so that should be safe. Please try again later when we've wrestled him back onto the treadmill."
Seriously. What do they think they are playing at?
They're still not taking the enterprise seriously. How many corporate users do they suppose have admin rights at all? Many don't. If they want to give FF a chance in the enterprise then they need to come up with a corporate admin tool for the browser so that adminstrators can manage the installation of and upgrades to Firefox.
How a about some sort of plugin for SCCM?
What is the definition of a program that :
installs itself as a "chron/scheduled" task
installs itself as a service
installs itself as a startup program
re-install itself in those locations each time it is started
Download stuff silently from the internet
Send stuff silently to central servers ?????
For me that was the very definition of a malware and that is exactly what chrome does. And the fact that the installer is "open sourced" is a big lie since I don't control what is really bundled with the chrome installer.
And now Mozilla want to do the same thing ?
As for prefetching it is again a very bad decision that means longer boot and startup times (loading potentially never used DLLs), more memory consumed, more caches misses, it is dumb and I go all the way to remove each of such pre-fetch / fast load programs (adobe, office, open office, and so on and so on ):
And as mentioned above by others, I don't want downloads to happen "silently", sometime I am on a bad link, a costly one or whatever, as far as i know Mozilla, Google and al don't PAY for my net BILLS
At some point I just want to say "HEY GUYS YOU DON'T OWN MY COMPUTER !!!!"
And playing copycat is always a loosing game, the chrome interface is a fail and forcing it to the gut of users in FF6 infuriated me to no end ....
I still like the browser and its add-on mentality, but Mozilla has lost touch with reality.
So, some innocent text extension can go insane and let you send $100000 instead of $100 at your BANK WEBSITE.
Do you really use Firefox? They check compatibility for a reason: It is very, very, very powerful extension scheme. Even the browser UI itself can be classified as extension in major scheme of things.
Firefox extension mechanism is massively powerful and they try to find a way to make it lighter, safer without making developers mad.
It is comparable to OS X Input Manager mechanism where Apple had to take serious steps while retaining compatibility. Mozila isn't Apple though so it will take a while.
IE guys code it in a way that whatever runs in IE 7 (for example) keeps running in IE 9. That even includes web pages, extensions and interaction with web pages.
Without a official MSI, official "administrator guide", active directory etc. flawless support, "enterprise" is no go.
First they have to respect the installation system of the OS they ship to. It is .pkg for OS X (not drag) and MSI for Windows. OS X happens to accept drag&drop (thanks to launch services etc) but really, accepted method for OS X is .pkg
As pointed out above, this may well have an impact on add-ons that don't work on more recent versions. What happens if I want to roll back to a previous compatible version of FF?
Also, Chrome does this by having a resource-hungry background process constantly checking for updates (I think?) - on a work system already overloaded with firewalls, anti-malware and various scans, this is not a desirable attribute!
This post has been deleted by its author
I wasn't 100% sure which version I was on whilst reading this article, so I had a look in help->about, as you do.
"DOWNLOADING UPDATE 5.4MB of 17MB
You are currently on the <b>release</b> update channel."
Wait, what?! What are the odds that an update would come down just as I was reading about FF updates? Apparently 1:1
It upgraded me from 6.0.2 (or 6.2 can't remember now) to 7.0.1 and I didn't get a choice in the matter.
It kindly offered to look for updated plugins for the ones that broke in the new version (it didn't find any).
FF is fast becoming dead to me, and there'll be no going back I tells ya! Christ, when I occasionally have to fire up IE8 I can hardly tell the difference. If the colour schemes matched I probably wouldn't know which one I was using at first glace.
blooming FF updated itself automatically the other day to v7.0.1 and promptly borked the java-script that i have to use with Juniper Networks and citrix to login to my corp server.
No big deal, i understand these things happen, so i down graded and specifically told the "new" old version i had just installed to NOT update unless i told it to.
Two hours later and FF updated and is back to v7.0.1.. WTF?!
its alive i tells ya!
Due to being nailed to IE7 for back-end-system compatibility, I had to get FF added to the student labs image where I work, so students could actually use modern course-necessary web-standard content. FF has been a huge headache for me and our IT people from about a week after it went in.
I am actually looking forward to the IE8 upgrade this break (we only upgrade teaching labs between academic sessions to avoid disrepencies with in-use teaching materials) in the hope that we can get FF off the systems for next year. That just says it all, really!
It took to version 8 to figure out that a service would be the best way to maintain updates in a system protected area?
I fear that their solution would just run as Local System, or they would create a new service account and grant it administrator privileges - instead of just ACL'ing the Firefox folder to sandbox any changes should the service account get owned...
"One niggle for customers using Firefox with Windows is that they must update their User Account Controls (UAC) preferences in the Microsoft desktop with each new version of Firefox."
Well, I've never needed to update UAC preferences on any Windows Mozilla update I've done. but then, I run XP....
Please Mozilla, don't be fool and don't add another useless service just using system resources waiting for an update. There are already too many of those silly services. I no longer install Google Earth because of what it installs.
Windows is not a bad operating systems, but there are too many developers who didn't undertand how to code properly under Windows and think their software is the only one running there.
There are far better ways to update - and if the user has no rights to change its configuration there could be very good reasons, especially in a corporate environenment. I deployed a logon script that deletes any executable in appdata, for example...
Googles' 'solution' chokes big time, I hate it and their crappy service, because I keep having to find the folder to delete the previous version which it failed to delete, which makes Secunia PSI unhappy! The service and the User data approach are big fat fails of ideas!
1. Updates MUST have options like: ignore, notify, download and notify, download and install. No silent install and definitely not by their own unsafe service!
2. Stop with the brain fart major version increment chaos, it keeps breaking extensions with max versions sensibly set to the current major version number; this is a regular annoyance for the WebRunner extension and many other extensions, and is soooo... retarded! Use minor versions for feature updates, and revisons for patches, leave major version increments ONLY for really BIG stuff not the current hacking.
3. Provide MSI files with a silent install option for corporate uses, to keep them happy; this is the ONLY way! The MSI could even just be a wrapper around a suitably enhanced Mozilla installer.
This lot should be easy for a organisation like Mozilla; so get cracking!
I have been a Firefox user since the days of 1.0, and I am not too pleased about some of the comments coming from (and actions taken by) Mozilla these days.
OK, I see why Mozilla went to a faster schedule, because BIG version jumps were always running late. The problem usually was that some feature blocked the release, causing delays. This 'faster release' schedule is an attempt to get finished features out the door as they are completed. The whole number version jump causes serious problems for some addons; which should work, but do not because they are 'max version limited'. As previous poster pointed out, install addon compatibility reporter to get around this.
The comment that Asa Dotzler made about 'enterprises not being ""worthy"" ' (my words) of Mozilla's efforts must have been received with enormous amounts of laughter in Redmond. I would not doubt that Stevie B even had a chuckle or two; and he may even had verbally expressed what he thought of that decision. (I will leave it up to the reader to characterize what Stevie B may have uttered.)
Mozilla seems to have back peddled a bit, because there has been some recent discussions about an 'extended support release'. I bet 'enterprise' customers most certainly offered their 'feedback'.
Perhaps Mozilla should approach this quandary, with an option for the user, a sort of "one time choice", along the lines of:
( ) I do not know my ass from a hole in the ground; I am too stupid to give a shit about keeping my computer up to date, and therefore, I WANT YOU TO KEEP FIREFOX UP TO DATE!
or
( ) WHO the fuck do you think you are?? This is MY COMPUTER, I KNOW what the fuck I am doing, so LEAVE THE GOD DAMMED THING ALONE!!!!!! Assholes.
Once this choice is made, never ask for it again (but allow the user to change their mind at a later date).
At least this is primarily a WindoZE issue, because any real Linuxer allows the package manager to deal with updates.
Enterprise is one thing … what about us Linux distribution developers that keep having to download new releases, compile, test, patch if necessary, then release new packages?
Anyone noticed that Firefox on Gentoo/MIPS hasn't been available since v3.0?
Anyone noticed that Thunderbird on Gentoo/MIPS hasn't been available since v1.5?
The speed of the hardware I work with, and the free time I have these days, means I typically don't get around to testing and patching (and invariably they do need patching) packages for user consumption, which is why some Linux distributions (us included) are lagging behind.
While leaving things sit for 5+ years (e.g. IE 6) isn't acceptable, nor is releasing 86400 new revisions a day. We need a happy medium fellas, give us a break!
The only reason Firefox is any use is because of adblock and flashblock- the two most useful addons around - otherwise it's a PITA.
As regards to the enterprise - I've blocked installation of Firefox on our company computers and I'm not turning that around any time soon. Mozilla wants to say F-U to the enterprise? Well, then it can slowly disappear from the day-to-day awareness of the users.
Now here's just hoping for adblock and flashblock add-ons for IE9...that would be ideal.
I hope Firefox make sure this service approach is optional. I hated UAC in Vista but in Windows 7 it makes entire sense and I'm all for the odd (and it is odd) UAC prompt.
If Mozilla really must follow Chrome's (and now Spotify) approach, for Christ sake install into AppData. It's certainly better than installing a service of all things!
Given how often Firefox is actually updated, are UAC prompts really that annoying? Are the "masses" really annoyed at how often often Firefox is now updated? I seriously doubt it. So a Firefox prompt appears once or twice every 6 weeks (taking into account point updates). So what?
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
