Do you use Google's Chrome browser? Did it silently update to the new version on your computer?

[thewayne]

It did on mine. I installed it two months ago to check it out. I went back to using Firefox because there were a couple of behaviors in Chrome that I didn't care for, so today I decided to update it and see if those behaviors had changed.

I opened Chrome and it was already at the latest version. With no interaction from me.

I do not allow ANYTHING to update software on my computer without my explicit approval. I'm not happy at all that Google would silently update their browser without my permission.

If I don't get a satisfactory answer from them soon on how I can turn this off, I'm ripping it out by the root and possibly canceling my Gmail accounts.

Comments

[kylejcrb.livejournal.com]

I know for Windows, GoogleUpdater.exe starts automatically and there is a Google Updater service that has to be disabled to get it to stop. It is fairly irritating.

[thewayne.livejournal.com]

I can't find any such option within the program and I can't find any such service running on my Mac.

Not happy.

[silveradept]

That's good to know. Although, I seem to remember somewhere Google saying explicitly that they would push silent updates to Chrome, because they didn't want people to be running old versions that might be vulnerable to exploits, like people do on Other Browsers.

Researching...ding!

Here's an article from ZDNet Australia explaining the philosophy of updating.

I don't know if they're going to give you an option, short of removing the updater services by the root and then possibly having to manually redownload each new version and then rip out the silent updater again.

[thewayne.livejournal.com]

Unacceptable. That justification could be used for anything. I have no objection to reminders that a new version is available and that the old version has known vulnerabilities, but I will not allow silent updates of my system.

I found some pages re: disabling it for Macs, and I'll probably implement it. There's an issue with certain Google software that tries to re-enable the silent update functionality every time you run them, but someone found a way to monkey wrench it by creating a file with a certain name that could not be overwritten, thus defeating the re-enabling.

[silveradept]

Agreed. We should not be willing to cede control of our machines to others and certainly not to do it in such a way that doesn't tell us they've been doing things.

It should also not take a system hack to turn off a feature you don't want.

[thewayne.livejournal.com]

It should also not take a system hack to turn off a feature you don't want.

Firefox tells me when a new version is available. While I can appreciate the mind set behind silent updates, and for some people silent updates are appropriate, Google above all should recognize individuality and make it easy to turn off such a "feature".

I had to enable the root password on my computer in order to do the hack. I haven't done the hack yet, but I had not enabled root. On a Mac, by default, you can't access root even with sudo. It's an interesting process to turn it on, but at least now I have it and can do other weirdness on my system!

[silveradept]

Weirder still that OSX doesn't seem to follow the sudo protocol. I thought it was implemented specifically for the purposes of not needing to do things with the root account.

While I agree that it should be easy to turn off, I wonder whether Google has hit on something about user behavior - for a lot of them, they don't want to care about whether their software is up-to-date or not, they just want it to work. Maybe Google's silent auto-update is something that people actually want.

[thewayne.livejournal.com]

I meant to reply to this a long time ago, obviously I did not.

Regarding OS-X not following sudo, they do at the GUI level. Ever since my experience of having my XP machine compromised, I've never since run an admin-level account. On my Mac, I have an admin account, and I run as a user. If I need to install a program or perform system updates, the OS will prompt me for admin credentials and will continue whatever process once authenticated.

There's sort of two administrator levels in OS-X. There's a user/GUI level as previously described, and then there's true root. For example, if I wanted to edit my hosts file to filter out some obnoxious ad companies, I couldn't do it via the GUI (IIRC: it was three OS versions ago that I tried this and failed and it might be different now), I needed sudo. But I didn't know that there's a specific process that you have to go through to set the sudo password, so I was unable to do it.

I'm guessing that the OS-X GUI filters out the root and some other service accounts, so all a user or admin sees are the user accounts. The OS is apparently sufficiently well-integrated so that it is not an issue. I have been running Macs for almost three years without having needed the sudo functionality, so it's definitely well-integrated.

[silveradept]

Ah. So they do sudo, just not the way I'm used to thinking about it. Well, then, good for them for implementing something right.

[ferragus.livejournal.com]

Lots of good comments here, and while I agree with you, let me toss out a devil's avocoda here.

One of the reasons I'm stuck using Internet Exploder 6.oh-my-god-why-are-we-using-this-junk is that work says they can't keep up with fixes for a multitude of browsers. (which becomes immediately laughable when you think about how broken IE6 is, but stay with me a moment).

If Chrome does auto-updates, that negates the primary objection to corporations (and government agencies) worry about them not knowing that some of the user base is running old insecure versions.

Having said that, I agree, it's a major reason for me to rip it out of my systems, but I can see where Google has positioned themselves to market to clueless but concerned pointy-haired bosses.

Thanks for pointing that out, I hope you'll let us know if Google provides you a way of disabling it!

[thewayne.livejournal.com]

Pluses and minuses from a corporate/government viewpoint on auto-updates. As a programmer who's been in the biz for over 25 years, I find it kind of funny about how programming paradigms change over the years. Browsers were supposed to set us free with people able to write code that was machine independent, so it didn't matter if the PC ran Windows or Mac or *nix, but then everything was written in OCX and required Internet Exploder and thus excluded everything non-MS and people got stuck with OCX. They then found that the code wasn't that easy to maintain, especially with MS revising their development tools every 2-3 years and totally rewriting the framework every decade. Updating your code from something old to the new stuff became a nightmare.

Same thing can be said for Java. Both browser-based and Java have their applications, but it seems to me that writing it for the particular OS and ignoring the browser would result in fewer security problems.

But I'm blathering. Very tired, it's late and I need to be up in 2 hours.

My point is that I wouldn't have a problem with auto-update IF I could turn it off. I wouldn't have a problem with it being turned on by default and requiring a specific action by me to confirm that I don't want it updating by itself. I just don't like them doing "what's best for me."

I'm a big boy, let me screw up my system on my own. I'm not in a corporation, I don't need a nanny like that environment requires.


Not that I'm opinionated or anything (yeah, right) but there's a famous story of a company whose main line of work was manufacturing guitar strings. Someone sent the BSA after them. And the BSA responded with Federal Marshals raiding the place with guns drawn, the intent to make an example of them. They were was found to have non-compliant licensing, inadvertently, and paid a big fine. But because of the heavy-handed, no negotiating possible, nature of the raid, the owner told his IT department to rip out all of the commercial software. They went to Sun servers running Linux (Red Hat, IIRC) and open source software throughout the company.

Costs for IT support went down, productivity went up. The reason? The shipping department had the apps that pertained to shipping, no internet browsing. Each department had the apps that they needed to do their job, and that was it. The computers couldn't be used as recreational toys during business hours.

Personally, I think that's a good thing. I work in city government, and when they installed an internet filter/firewall device, they put it in passive mode and just listened to what connections were being made. Lots of ESPN live game streaming in addition to the porn, Facebook, etc. And quite a bit of howling when a lot of those got blocked (except the porn, I don't think the person who was accessing it said a word when it went away).

But again, I am blathering.