Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

If firefox is installed from a system package, or installed by another user, it can't really update itself¹, and updates are not legitimately necessary.

¹ except of course any updates and binaries that firefox downloads and gobbles up behind the users back.



If Firefox is installed by another user (or even by yourself) on Windows, the Mozilla Maintenance Service is installed to automatically update Firefox without requiring you to personally elevate the installer.

I'd argue updates are legitimately necessary for 99% of users (automatic updates are a huge reason why 90% of home PCs aren't in a botnet, and were a big reason why Chrome more secure in the old days vs IE/Firefox), and if you want to disable them it's very easy to do (about:config -> app.update.auto = false). But I don't know why you would, if the browser is changing too much for you you can change to ESR which is security updates only to older versions of Firefox.

https://wiki.mozilla.org/Windows_Service_Silent_Update


I'm on linux.

Yes, automatic updates are pretty much necessary for about 90-99+% of users, but many lot of them are using system packages (which again, should not be able to update isself), and it is still not a reason why there shouldn't be a way to disable random background connections.

One could argue a silent browser is legitimately necessary for security research/operations, or just severely data-constrained networks, but I have yet to find a way to make firefox quiet.

Will app.update.auto disable all updates (browser, search engines, safe-browsing, user-test, blacklists.. there was at least a dozen features)? Last time I tried disabling almost everything suspicious, yet firefox wouldn't respect half of the settings.


Linux distros don't handle all of the updates, such as add-ons or tracking protection blacklists.

Having an option to disable them would be a footgun. Such "radio silence" serves no useful purpose to normal users, but can make the browser appear buggy, e.g. if tracking protection broke a site, and you wouldn't get a fixed blacklist in a timely manner.

Someone has to host these dynamic components, and the browser has to get them somehow. IMHO it's way better if they're fetched straight from Mozilla that has strong privacy policy and a good reputation to uphold, rather than from some rando free distro mirror.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: