dhouwn wrote:Tom T. wrote:MZ would release decimal-point bumps pretty much whenever a critical vuln was discovered/reported, verified, and the patch was ready.
I read on a blog from a Mozilla release engineer or so that internally they worked with 6-week timeframes before the introduction of the rapid releases. Still, like MS they would do out-of-band releases if they considered it necessary. They still have the concept for out-of-band updates in the rapid release model, it's called "chemspill"s. 6.0.1 and 6.0.2 were such releases where security problems were solved (in that particular case because of the DigiNotar certificate fiasco).
They don't have dates on the
Fx 3.6 Security Updates page, but it does seem that they would issue a decimal update for even a single issue. There were 27 updates in the 27 months of support, which averages one per month, but unless my memory is really bad (it's possible
), I do seem to remember security updates at shorter intervals then that -- with others at longer intervals. Still averages more than once every six weeks.
Tom T. wrote:Why no F 11.0.1, .0.2, etc.?
dhouwn wrote:To get adequate testing of up-to-6 weeks or even more if they defer it? Though with more transparent updates they certainly could do more low-risk out-of-band updates and don't have to fear about users being upset about too many update prompts (remember how it was before the introduction of dev versions of NoScript?).
There was a 10.0.1 and a 10.0.2 also, so perhaps they were chemical spills... they were critical. I guess my wish is that when there is a
critical issue, you patch, test, and release ASAP, regardless of "cycles". Is this unreasonable? ... I can understand batching less-critical fixes.
Tom T. wrote:Back to the main point: If Fx adopts MS policy, or worse: Critical fixes only on major version bumps every six or eight weeks when the new Rapid Release comes out, then evildoers should have a field day on the new ones.
dhouwn wrote:I don't quite get what you are talking about, are you talking about the problem of the timeframe between updates being released (at which point the baddies might have gotten a hint about a potential exploit, hopefully not before) and being applied widely? Exactly this was one of the reasons why Patch Tuesday was introduced, to coordinate with system admins in order to minimise this window (but don't ask me why they chose Tuesday).
Not quite. Patch Tuesday creates that 27-day window of opportunity. (They chose Tuesday because Mondays suck for everyone.
) Let's say 12.0 is released, and bad people know that F13 won't be released for six weeks (at least). They can hunt actively for flaws in F12 and exploit them. If MZ isn't committed to fixing any exploit as soon as there is evidence of it in the wild *or* reported responsibly, then there is the same window of opportunity. And what is reported responsibly by Mr. Whitehat may be discovered an hour later by Mr. Blackhat, who has 5+ weeks to have fun and tell all his haxxor fr13ndz about it.
If MZ *is* committed in such cases, that would be good to know, and to see documented. The feeling is that they're more driven by dates than by events.
In a different field in which I once worked, it was considered inferior to focus more on the process than on the results. Work should be results-driven, or problem-solving driven, rather than issue releases on some fixed schedule. Still set goals, of course, but if something happens tomorrow...
Tom T. wrote:But as said, if I'm doing online banking, I don't want some b/g service doing stuff in the, uh -- background.
Thanks for that, unless they change it to the bad way. Any idea whether they will?
Anyway, we are here talking about the defaults for the average user, the average user
doesn't wants to read no release notes, damn computer should just let him do his/her work.
Some average users I've heard from don't want to start their browser and find out that it's different from the last time they started it, with no notice.
Recall that IIRC, geolocation was default-enabled until enough people screamed. OK, "we'll always ask". What about the MS Update that installed .NET add-on for Fx, without user knowledge? People were rightly upset. That wasn't MZ's fault, but now MZ is doing the same thing as MS did there.
To save work and interrupt for average user, I say: Default to auto-notify of new release or update; ask user "Install now? Later?", and include a box:
"In the future, go ahead and update Firefox for me automatically."
This is the same issue as with cookies and many other things:
"Change from opt-out to opt-in".
So long as John and Jane Average have knowingly opted in to this, cool. It bothers them only once.
Tom T. wrote:There is no excuse for hiding from me the fact that you've made a major change to my software,
The excuse is transparency for the average user, see above.
See above.
Tom T. wrote:and I expect the default setting is to "Auto-update in b/g."
You do, then where is the issue?
(typo?)
No, no typo. I expect them to default to what I don't like, at least without notice: The silent update, with *maybe* notification *after* install, as per
DJ-Leith's link. I want them to do what's said above: Default to notify/ask, and offer opt-in to future silence. (With a clear setting to opt back out at any time.)
Tom T. wrote:I've realized that I have very slow flash drives
You sure? You benchmarked it? Otherwise, you could try
http://usbspeed.nirsoft.net/
Mine looks pretty good there, but as they say:
The test is made by writing a large file (named $speed_test_nirsoft$.dat) into your USB flash drive, and then reading it back for testing the read speed. Be aware that you need at least 100 MB of free disk space in order to successfully make this speed test.
Also, be aware that this test is made with sequential read and write operations. When using multiple small files, the read/write performances are usually much lower than sequential read/write.
I did already know that. Portable browser entirely on flash would make many small writes, not one large one. Empirically, the portable is very slow compared to native install.
The guy at the local factory-authorized service center did say as you did, that the potential throughput of the USB ports themselves is quite high, faster than the HD (which has a mechanical search arm, etc. -- if I had the money, I'd have accepted his offer to replace my HD with a SSD. Less heat, less weight, longer battery life.). But if my particular flash drive fares less well on many small read/writes...
ServiceDefinition wrote:It's the "Background Service" (what exactly *is* that? Will my firewall detect it as separate from firefox.exe?) that appears to be a novel introduction.
It's a Service in the Win admin area. It runs either manually or automatically, same as all other Win services.
OK, like Windows Background Intelligent Transfer Service. Got it, thanks.
ServiceDefinition wrote:If it's on a permanent Win install, it will now have that service listed and running either as auto or manual, depending on how the config item is toggled. The service name is "Mozilla Maintenance Service".
Good, then it can be disabled like any other Win service.
If you run portables, you won't have equivalent services, will you.
No, which is why I had to ask -- didn't see it anywhere.
While your annoyance is justified about having something run automatically without your being alerted, I can't understand why so *much* noise here..
Because my annoyance was justified...
.. and if you've followed the thread, you'd know I'm not speaking just for myself. See the ref to my friend who wrote security-clearance type stuff for the US Gov, but never for Windows, and doesn't follow browser issues, etc. And thought this idea was horrible.
This is a Windows-specific enhancement that is sensible for the majority of those still trapped in Win land.
Somehow, they survived F2 and F3, with a "notify me", so they could install when convenient, and not necessarily in the middle of a session.
That may not be instantaneous, but it's still better than waiting until next Patch Tuesday or next MZ calendar-marked Rapid Release.
The browser has reached as much importance as systems have in these times, and security updating is more important for most than you with your much greater familiarity with your own system appear to understand.
On the contrary, and I hate to repeat myself, IRL I deal almost exclusively with non-tech users. It's the hard-core techies, at MZ or MS or Mac or wherever, who hang only with other hard-core techies, and cannot relate to novices.
I've observed this in other fields in which I worked, ranging from sports coaching to the business world. The cognoscenti can't empathize with the noob.
Would you condemn the novice to zero-days if it could be helped?... Would you condemn the community to more bot nets than necessary as a result?
Of course not. This is why I object to the every-six-weeks update schedule vs. fix everything as soon as you can, even if you just issued a patch yesterday for something else.
A notification screen, perhaps with a special screen for in-the-wilds --
"THIS UPDATE FIXES AN URGENT SECURITY FLAW" -- but don't cry wolf when it doesn't. For less-urgent, the prompt lets the user update at their earliest convenience.
And as said above to
dhouwn, if they would like to
opt-in to silent auto-up, fine.
Cheers.
versions of Fx had this huge regression in easy user access to these GUI elements.
