Hacker News Reader

Comment by jacquesm | Hacker News Reader

I was perfectly happy with the one that didn't support this 'feature', and automatic updates are what brought it to my system.

View on HN

Yeah, the alternative is running a system with a ton of outdated software, with known bugs and active exploits while casually surfing the "oh-so-cosy-and-entirely-harmless" WWW...

The goal is not to ostracize automatic updates, but to have faster fixes.

Or to separate security updates from feature updates, but I think this ship has long sailed for modern browsers.

> Or to separate security updates from feature updates, but I think this ship has long sailed for modern browsers.

That would be my preferred solution. But yes, as you say, that ship has sailed. No reason why it couldn't sail back though.

> No reason why it couldn't sail back though

Maintenance cost.

> No reason why it couldn't sail back though.

Multiplying the number of parallel maintenance tracks and associated support costs is not “no reason”.

The goal is to fully control your environment and not to expecting some unexpected updates.

User is the one who must choose update policy. If user is choosing to not update then it's their own problem and no manufacturer has the right to deside otherwise.

Automatic updates are a good default, you can always disable them if you don't want them.

Good default is to ask users about their preferences explicitly and not to hide that kind of settings anywhere.

Most users are computer illiterate, so they would choose to not auto-update to skip the hassle, and then never manually update anyways.

Every FireFox install comes with auto-update enabled.

Nope, mine on linux doesn't auto-update itself, though I update it diligently, but manually

In the past I would have agreed with you. Sadly there are "updates" which remove functionality.

In the case of Firefox, there's also the Extended Support Release. Security updates without the UI change every 4 weeks

https://support.mozilla.org/en-US/kb/switch-to-firefox-exten...

In this case, ESR was also affected.

https://bugzilla.mozilla.org/show_bug.cgi?id=1749910

Http3 has existed in ff for a while. What triggered this was some back end service switching to http3, triggering the bug.

Even if you don't update your browser, the world updates around it

My browser isn't supposed to have any 'backend services'. Especially not backend services that I did not explicitly opt in to.

It's not a backend service on your browser, it's on whatever webpage you tried to visit.

This bug can be triggered without visiting any webpage at all.

No, it's in the browser. Turn off all data collection and the bug disappears.

https://bugzilla.mozilla.org/show_bug.cgi?id=1749908#c10

lower in the linked thread:

> Telemetry has nothing to do with this, it just happens to be one of the first services with H3 load balancer.

You... do understand that that's self-contradictory, right? It's impossible for both parts of that sentence to be true.

If telemetry really had "nothing to do with" the bug, then the fact that telemetry "just happens to be one of the first services with H3 load balancer" wouldn't trigger the bug.

I think he means you that you couldn't eliminate the bug by disabling telemetry. It just will be triggered by something else later.

Sure. But the thread is in reply to this post: https://news.ycombinator.com/item?id=29918998

The question isn't whether "backend services" forms the conceptual essence of the problem - I think we all agree it doesn't.

The question is whether it "happens to be" triggered by backend services.

I really don't get this comment after a whole thread full of good information on this.

Why don’t you just disable automatic updates?

Good question. Because for security reasons you want to stay up-to-date on software that connects to various websites. At the same time, from a functionality point of view I wished I'd never have to update anything.

Yes it has its pros and cons like everything. But as a default for the average user I think auto update should be enabled

It's not a question of avoiding updates altogether, but the sad reality that it always seems to choose the most inconvenient and/or expensive time to do it. If they'd just do as Thunderbird does -- notify me that there's an update and ask me what action I'd like to take -- there'd be no problem. As it is, being unable to choose when the update happens is unacceptable.

FWIW I've tried every documented setting, "enterprise" policies, etc. to prevent automatic updates in FF, but nothing seems to stick.

Hmm, works for me (Firefox ESR) under Preferences > General and there "Allow Firefox to" ... "Check for updates but let you choose to install them"

That's s private installation, a company-wide centrally managed might work differently ... but companies normally want to control updates too.

Reply on news.ycombinator.com