Mozilla will start Firefox silent updates in June

Discussion in 'other software & services' started by ronjor, Mar 15, 2012.

Thread Status:
Not open for further replies.
  1. xxJackxx

    xxJackxx Registered Member

    Joined:
    Oct 23, 2008
    Posts:
    8,625
    Location:
    USA
    Is this update service supposed to be in Firefox 12? I do not have the service nor did I notice it prompting during the update installation.
     
  2. kupo

    kupo Registered Member

    Joined:
    Jan 25, 2011
    Posts:
    1,121
    Odd, according to the attachment above it should prompt you. Maybe you didn't choose custom install?
     
  3. Escalader

    Escalader Registered Member

    Joined:
    Dec 12, 2005
    Posts:
    3,710
    Location:
    Land of the Mooses
    Well thanks guys. :D

    There are other browsers I can use you are right. :thumb:

    I'll get by somehow!:'(
     
  4. NGRhodes

    NGRhodes Registered Member

    Joined:
    Jun 23, 2003
    Posts:
    2,381
    Location:
    West Yorkshire, UK
    Most users accept automatic updates from Microsoft (as configured by default in windows), so why not Firefox ?
     
  5. vasa1

    vasa1 Registered Member

    Joined:
    May 1, 2010
    Posts:
    4,417
    Just something to go on about. A non-issue if there ever was one.
     
  6. xxJackxx

    xxJackxx Registered Member

    Joined:
    Oct 23, 2008
    Posts:
    8,625
    Location:
    USA
    Because this update service has no proven track record so we have no idea if it can be hijacked to install other software. Time will tell how reliable and secure it is.
     
  7. HAN

    HAN Registered Member

    Joined:
    Feb 24, 2005
    Posts:
    2,098
    Location:
    USA
    I just updated on XP via the regular updater. The option to choose (or not) the auto update service was not offered. It just installed it.

    I run MJ Registry Watcher so I know where it went. Namely:

    Launched updater.exe[2648]
    Low-level Drivers and Services
    Registry Key hkey_local_machine\system\CurrentControlSet\services
    Subkey MozillaMaintenance has been added

    Launched firefox.exe[3128]
    Low-level Drivers and Services
    Registry Key hkey_local_machine\system\ControlSet001\services
    Subkey MozillaMaintenance has been added


    For now, I have chosen to manually disable the service. We'll see if I want to do it differently than that down the road...

    **EDIT**

    Here is a screen capture of the update choices currently available in FF 12.0. The choices indicated are what I decided to do.
     

    Attached Files:

    Last edited: Apr 24, 2012
  8. allizomeniz

    allizomeniz Registered Member

    Joined:
    Aug 23, 2009
    Posts:
    943
    Patches are great, my only issue is with automatic patches and especially silent ones. If you have ten programs all with silent updates and one day you turn on your computer and it goes haywire, where do start? This becomes a bigger problem if you don't know what you're doing, i.e., 99% of end users who use silent updates. So it's off to the tech shop to fix something that could have easily been fixed by rolling back or uninstalling the update that caused the problem. So yeah, security patches great, silent ones not so much.

    The problem with what Mozilla's proposing is once they're allowed to bypass UAC, all a hacker has to do is disguise himself as Mozilla and it's a free ride. So you are less secure if you choose that option, in my opinion.
     
  9. NGRhodes

    NGRhodes Registered Member

    Joined:
    Jun 23, 2003
    Posts:
    2,381
    Location:
    West Yorkshire, UK
    So no different to any other new software then.
     
  10. HAN

    HAN Registered Member

    Joined:
    Feb 24, 2005
    Posts:
    2,098
    Location:
    USA
    My screen capture above shows that this initial release of FF's auto updater allows the auto update to be defeated. If it stays this way, I'll be ok with it (I will also kill the service too.) Unlike Chrome, which makes killing auto updates much more difficult, this method is better IMO.
     
  11. mantra

    mantra Registered Member

    Joined:
    Jan 25, 2005
    Posts:
    6,167

    thanks a lot Han :thumb:
    you use MJ Registry Watcher to monitor the registry
    and what do you use to monitor folders and files?
    thanks
    cheers
     
    Last edited: Apr 24, 2012
  12. JRViejo

    JRViejo Super Moderator

    Joined:
    Jul 9, 2008
    Posts:
    97,440
    Location:
    U.S.A.
  13. TheWindBringeth

    TheWindBringeth Registered Member

    Joined:
    Feb 29, 2012
    Posts:
    2,171
    Thanks for the link JRViejo. FWIW I clicked through to the maintenance service Wiki page at http://support.mozilla.org/en-US/kb/what-mozilla-maintenance-service and found a few bits that might interest some:

    "The service is currently only used on Firefox, but we do plan to allow other products to use the service. Only one service will exist across all channels, and once other products are allowed to use the service they will likely also share the service."

    "If the user is running on an x64 computer with a native x64 build, then the service will not be installed nor used by that build. If the user is on an x64 computer with an x86 build, then the service will be used and installed by the build as an x86 process. Future versions of Firefox will support native x64 builds with the service."

    "Other commands being considered include clearing prefetch for faster startup, defraging user profile data, and other actions not yet discussed."

    "Another bug which is not part of this task plans to move updates away from on startup, and to perform them to an alternate directory in the background."
     
  14. xxJackxx

    xxJackxx Registered Member

    Joined:
    Oct 23, 2008
    Posts:
    8,625
    Location:
    USA
    Exactly. :thumb:
     
  15. xxJackxx

    xxJackxx Registered Member

    Joined:
    Oct 23, 2008
    Posts:
    8,625
    Location:
    USA
    Good catch, I was looking for something named "Firefox...", and not "Mozilla Maintenance Service". It does auto install with no mention if you are not doing a custom install. Not sure how I feel about that. :doubt:
     
  16. BlitzenZeus

    BlitzenZeus Security Expert

    Joined:
    Feb 11, 2002
    Posts:
    451
    Location:
    Oregon, USA
    Just copying what Google has been doing, and many 3rd party installers, along with new package systems come with a Chrome installed for all users, not just to be updated in the standard user account.

    I don't have it installed at this point, but you can easily remove it from the control panel, which is more obvious than Google's way of hiding theirs in the scheduled tasks.

    I realize this will help prevent security problems in the browser, but like many others I don't have have updates for windows on automatic either. I just want to be notified of updates.

    Many other software programs have done something similar, even video card drivers, however even Nvidia's updater is still optional also.
     
  17. guest

    guest Guest

    "once they're allowed to bypass UAC"

    Sounds like a windows 7 hack to meo_O o_O o_O
     
  18. JRViejo

    JRViejo Super Moderator

    Joined:
    Jul 9, 2008
    Posts:
    97,440
    Location:
    U.S.A.
  19. BlitzenZeus

    BlitzenZeus Security Expert

    Joined:
    Feb 11, 2002
    Posts:
    451
    Location:
    Oregon, USA
    Seems some people here have never heard of programs running as a service, which is very necessary on operating systems which provide more than one level of user for security reasons. You cannot run all the software you need at the level of limited user account, therefore some software must be ran as a service, and it's not a good idea to run all software as root/administrator.

    This is not a hack, and I'm quite sure you have at least a couple third party programs on your computer already doing this, you may not even realize it. This is besides all of the windows services which you already had running in the background before your user account was even loaded.
     
  20. kupo

    kupo Registered Member

    Joined:
    Jan 25, 2011
    Posts:
    1,121
    I agree with this. People really overreact, it's not like the update is secret, it's all over the blogs.
    EDIT:
    I've read it in the Pale Moon forums, what do you guys think?
     
  21. dw426

    dw426 Registered Member

    Joined:
    Jan 3, 2007
    Posts:
    5,543
    If you're alright with Windows itself doing everything it is known to do, you should be alright with your browser keeping itself updated. You guys that want so much control, you're the "one percenters". For everybody else who tends to either forget or are lazy, stuff like this is beneficial. I keep seeing arguments also basically boiling down to thinking if Chrome does it, it's great security. If Mozilla does it, it's an annoyance and Mozilla doesn't care about user decision.
     
  22. kupo

    kupo Registered Member

    Joined:
    Jan 25, 2011
    Posts:
    1,121
    So true! :D
     
  23. xxJackxx

    xxJackxx Registered Member

    Joined:
    Oct 23, 2008
    Posts:
    8,625
    Location:
    USA
    I keep seeing it too but it is not the same thing so the argument is not valid. Chrome installs to the user profile where it does not need elevated permission to update. Firefox installs in "Program Files" where it does. As long as the service does not needlessly consume extra resources or introduce any extra vulnerabilities then I have no problem with it. I guess we'll see in 6 weeks how well it works. :ninja:
     
  24. BlitzenZeus

    BlitzenZeus Security Expert

    Joined:
    Feb 11, 2002
    Posts:
    451
    Location:
    Oregon, USA
    Wrong, chrome is not just user installs. System wide installs are provided by 3rd party software from pay referrals, and Chrome is included as a system wide install in new computers so don't you dare tell me that chrome only installs to the users account.

    A popular free av bundled the system wide install of chrome recently, and it had a bug in the installers that actually installed chrome to systems without giving people a chance to uncheck it. Go buy a new computer, and depending on the company you buy it from it will have the system wide installation of chrome.

    The system wide install has the exact same behavior, and will update chrome for all the users of the operating system.
     
  25. HAN

    HAN Registered Member

    Joined:
    Feb 24, 2005
    Posts:
    2,098
    Location:
    USA
    If you have installed the auto update service but want to remove it, I learned you can do so without the need to remove FF and start completely over.

    Just go to C:\Program Files\Mozilla Maintenance Service and run Uninstall.exe (If you run x64 Windows the path needs to be adjusted to the x86 Programs Files folder.

    I did it on my XP box and it worked fine. Gone until the next time I manually update via the FF internal updater. ;)

    (Thanks to Midknyte from another board for the info!)
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.