X
Tap here to go to the mobile version of the site.

Support Forum

Why in the world was the option to disable update checks removed in Firefox Quantum?

Posted

It's one thing to change the default state of the option but to remove the menu option altogether is a slap in the face and very worrying. Does Mozilla have their sights set on becoming as disrespectful and untrustworthy as Google?

It's one thing to change the default state of the option but to remove the menu option altogether is a slap in the face and very worrying. Does Mozilla have their sights set on becoming as disrespectful and untrustworthy as Google?
Quote

Additional System Details

Application

  • User Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0

More Information

Chris Ilias
  • Top 25 Contributor
  • Moderator
336 solutions 1895 answers

Helpful Reply

Hi JuzBeKind, The reasoning stated in the issue tracking is: "The "Never check for Updates" option is easy to enable and forget about. Once enabled this exposes users to severe security issues and it seems unwise to expose this feature in the preferences? This also contributes to orphaned users."

A little later, that is extemporized with: "...it makes it much more difficult to strand people, deliberately or accidentally, on insecure and outdated versions of Firefox. Because this can happen via either user action or malicious software, and has been allowed to stand for as long as it has, this has become a significant issue for the Firefox user population, and we need to address it.

The nature of the internet - in particularly, the nature of risk on the internet - has changed dramatically since the Phoenix and Firebird days when early design decisions like this one were first implemented. Today, we need to balance the freedom of our users to configure Firefox as they see fit with an equal right to participate in the world free from harassment, exploitation and the rest of the carnival of malfeasance that makes up the background noise of the modern internet."

Is there a specific reason why you don't want to update Firefox? Maybe we can pass that reason on to the product team, and get that addressed in a future version, so you'll get the latest secure version and not be unhappy with it. ☺️

Hi JuzBeKind, The reasoning stated in the issue tracking is: "''The "Never check for Updates" option is easy to enable and forget about. Once enabled this exposes users to severe security issues and it seems unwise to expose this feature in the preferences? This also contributes to orphaned users.''" A little later, that is extemporized with: "''...it makes it much more difficult to strand people, deliberately or accidentally, on insecure and outdated versions of Firefox. Because this can happen via either user action or malicious software, and has been allowed to stand for as long as it has, this has become a significant issue for the Firefox user population, and we need to address it.'' ''The nature of the internet - in particularly, the nature of risk on the internet - has changed dramatically since the Phoenix and Firebird days when early design decisions like this one were first implemented. Today, we need to balance the freedom of our users to configure Firefox as they see fit with an equal right to participate in the world free from harassment, exploitation and the rest of the carnival of malfeasance that makes up the background noise of the modern internet.''" Is there a specific reason why you don't want to update Firefox? Maybe we can pass that reason on to the product team, and get that addressed in a future version, so you'll get the latest secure version and not be unhappy with it. ☺️
Was this helpful to you? 1
Quote

Helpful Reply

Chris Ilias said

Because this can happen via either user action or malicious software

1. If it's happening because of user action, the solution would be to bury the option in an advanced settings menu. The fact that Mozilla has has not only failed to do this but also removed the entry from about:config tells me that this is likely a false reason presented to placate. Also, I'd love to hear how Mozilla went about determining whether a given user left update checking disabled intentionally or accidentally.

2. Malicious software can do virtually anything. Once a user has malicious software running on their computer, it could replace the entire browser if so desired. Nobody in the sorted business of distributing malware is going to design their malware so that it simply disables the the browser's ability to check for updates, and if that really was their goal, they absolutely will accomplish that goal regardless of whether or not the menu option or about:config option is still present. This too sounds like a false reason presented to placate.

I've been watching over the years as user options continue to be removed with increasing frequency; with increasing disregard for user preference/control. This is a hallmark of software that has been ethically compromised; a hallmark of a development team that has chosen to (or is being pressured to) take on a daddy-knows-best mentality in which the software ceases to simply meet the needs and interests of the user and instead begins taking on the role of shaping the needs and interests of the user to fit someone's cookie cutter ideal.

Chris Ilias said

Is there a specific reason why you don't want to update Firefox

I just want the option to disable update checks. It should be up to me to decide if Firefox is allowed to make automatic background contact with Mozilla servers (or any other servers) from my computer. If I want Firefox to only communicate with the servers that I request communication with during web browsing, I should have that choice. That choice should be present in an advanced settings menu, or at the very least present in about:config.

Note: I'm not accusing you of being dishonest. You answered my question perfectly and, I believe, honestly. I do not think you personally are choosing to take Firefox further & further away from the ethical, respectful, empowering browser it used to be. I don't think you personally are taking Firefox down the path of Google Chrome (and other similarly compromised daddy-knows-best software).

''Chris Ilias [[#answer-1195746|said]]'' <blockquote> Because this can happen via either user action or malicious software </blockquote> 1. If it's happening because of user action, the solution would be to bury the option in an advanced settings menu. The fact that Mozilla has has not only failed to do this but also removed the entry from ''about:config'' tells me that this is likely a false reason presented to placate. Also, I'd love to hear how Mozilla went about determining whether a given user left update checking disabled intentionally or accidentally. 2. Malicious software can do virtually anything. Once a user has malicious software running on their computer, it could replace the entire browser if so desired. Nobody in the sorted business of distributing malware is going to design their malware so that it simply disables the the browser's ability to check for updates, and if that really was their goal, they absolutely will accomplish that goal regardless of whether or not the menu option or ''about:config'' option is still present. This too sounds like a false reason presented to placate. I've been watching over the years as user options continue to be removed with increasing frequency; with increasing disregard for user preference/control. This is a hallmark of software that has been ethically compromised; a hallmark of a development team that has chosen to (or is being pressured to) take on a ''daddy-knows-best'' mentality in which the software ceases to simply meet the needs and interests of the user and instead begins taking on the role of shaping the needs and interests of the user to fit someone's cookie cutter ideal. ''Chris Ilias [[#answer-1195746|said]]'' <blockquote> Is there a specific reason why you don't want to update Firefox </blockquote> I just want the '''option''' to disable update checks. It should be up to me to decide if Firefox is allowed to make automatic background contact with Mozilla servers (or any other servers) from my computer. If I want Firefox to only communicate with the servers that I request communication with during web browsing, I should have that choice. That choice should be present in an advanced settings menu, or ''at the very least'' present in ''about:config''. '''Note:''' I'm not accusing you of being dishonest. You answered my question perfectly and, I believe, honestly. I do not think you personally are choosing to take Firefox further & further away from the ethical, respectful, empowering browser it used to be. I don't think you personally are taking Firefox down the path of Google Chrome (and other similarly compromised ''daddy-knows-best'' software).

Modified by JuzBeKind

Was this helpful to you? 1
Quote
Chris Ilias
  • Top 25 Contributor
  • Moderator
336 solutions 1895 answers

Hi JuzBeKind, From your wording, I get the impression that you think you are directly contacting developers or Mozilla employees. You are not. This is a community support forum. The people that answer questions here are users just like you, volunteering their time.

If you want to leave feedback for Firefox developers, go to the Help menu and select Submit Feedback.

But I can still offer a workaround. ☺️

You could try an enterprise policy. For instructions, see Customizing Firefox Using policies.json From there, use the DisableAppUpdate policy listed at https://github.com/mozilla/policy-templates/blob/master/README.md#disableappupdate

Hi JuzBeKind, From your wording, I get the impression that you think you are directly contacting developers or Mozilla employees. You are not. This is a community support forum. The people that answer questions here are users just like you, volunteering their time. If you want to leave feedback for Firefox developers, go to the '''Help''' menu and select '''Submit Feedback'''. But I can still offer a workaround. ☺️ You could try an enterprise policy. For instructions, see [[Customizing Firefox Using policies.json]] From there, use the ''DisableAppUpdate'' policy listed at https://github.com/mozilla/policy-templates/blob/master/README.md#disableappupdate
Was this helpful to you? 1
Quote

Question owner

.....

.....

Modified by JuzBeKind

Was this helpful to you?
Quote

Question owner

Chris Ilias said

I get the impression that you think you are directly contacting developers or Mozilla employees.

I know the answers on this site come from volunteers. With that said, I also know that there is at least one dev who volunteers here and I have no way of knowing how deeply involved with Firefox any one person here may be.

Chris Ilias said

You could try an enterprise policy...

To be clear, I didn't come here for a work-around. I came here out of concern for the direction Firefox is headed in; I came here to find out why in the world Mozilla would ever remove that option from the menu and about:config, and you already answered that nicely. Thank you for the tip though. It's a much cleaner work-around than the one I had previously resorted to. Adding the following to the .json file appears to stop the update checking:

{

   "policies": {

"DisableAppUpdate": true

   }

}

''Chris Ilias [[#answer-1195765|said]]'' <blockquote> I get the impression that you think you are directly contacting developers or Mozilla employees. </blockquote> I know the answers on this site come from volunteers. With that said, I also know that there is at least one dev who volunteers here and I have no way of knowing how deeply involved with Firefox any one person here may be. ''Chris Ilias [[#answer-1195765|said]]'' <blockquote> You could try an enterprise policy... </blockquote> To be clear, I didn't come here for a work-around. I came here out of concern for the direction Firefox is headed in; I came here to find out why in the world Mozilla would ever remove that option from the menu '''and''' ''about:config'', and you already answered that nicely. Thank you for the tip though. It's a much cleaner work-around than the one I had previously resorted to. Adding the following to the .json file appears to stop the update checking: <code> { "policies": { "DisableAppUpdate": true } } </code>
Was this helpful to you?
Quote
the-edmeister
  • Top 25 Contributor
  • Moderator
5387 solutions 39986 answers

Here's a tip that I have used for years to shut off access to the Firefox update server that still seems to work.

In about:config find the pref app.update.url and null the URL value. That will stop Firefox from getting to the update server.

I use a user.js that I place in every new Profile that I have created for the last 10 to 12 years; it includes this line along with all the other about:config changes that I routinely use, and I provide comments about each line of code and the version number I started using the line of code in or for.

user_pref("app.update.url", " ");

Here's a tip that I have used for years to shut off access to the Firefox update server that still seems to work. In '''about:config''' find the pref '''app.update.url''' and '''''null''''' the URL value. That will stop Firefox from getting to the update server. I use a '''user.js''' that I place in every new Profile that I have created for the last 10 to 12 years; it includes this line along with all the other about:config changes that I routinely use, ''and I provide comments about each line of code and the version number I started using the line of code in or for''. '''user_pref("app.update.url", " ");'''
Was this helpful to you? 1
Quote

Question owner

the-edmeister said

In about:config find the pref app.update.url and null the URL value.

I actually had tried this. I didn't null the value but I prepended garbage characters to the beginning of the url to make it invalid. Firefox was somehow still checking for and finding updates but that might be because I'm using Firefox Portable and it's using a different system for updating.

''the-edmeister [[#answer-1195848|said]]'' <blockquote> In '''about:config''' find the pref '''app.update.url''' and '''''null''''' the URL value. </blockquote> I actually had tried this. I didn't null the value but I prepended garbage characters to the beginning of the url to make it invalid. Firefox was somehow still checking for and finding updates but that ''might'' be because I'm using Firefox Portable and it's using a different system for updating.
Was this helpful to you?
Quote
the-edmeister
  • Top 25 Contributor
  • Moderator
5387 solutions 39986 answers

JuzBeKind said

... Firefox was somehow still checking for and finding updates but that might be because I'm using Firefox Portable and it's using a different system for updating.

I can't answer that, Portable Firefox is a 3rd party version, and I haven't used a recent version of 'Portable' to see how it works for updates. The last Portable version I used was 41.0.1 .

''JuzBeKind [[#answer-1195980|said]]'' <blockquote> ... Firefox was somehow still checking for and finding updates but that ''might'' be because I'm using Firefox Portable and it's using a different system for updating. </blockquote> I can't answer that, Portable Firefox is a 3rd party version, and I haven't used a recent version of 'Portable' to see how it works for updates. The last Portable version I used was 41.0.1 .
Was this helpful to you?
Quote
Ask a question

You must log in to your account to reply to posts. Please start a new question, if you do not have an account yet.