He first describes how Firefox is currently applying updates to the browser. Updates are downloaded into a special directory during runtime. The browser on next start up will check for updates in that directory and if any are found, will apply them to the browser. This process is visualized to the user with the dreaded Firefox Update: Firefox is installing your updates and will start in a few moments message.

The updater restarts the browser after the update as been completed.

The new idea is not fundamentally different. Updates will be applied to a copy of the browser files in the background while the browser is running. When the user restarts the browser the updated version is copied over the old version of the browser, a process that is noticeably faster (as there are no prompts and copying is faster than applying those updates during browser start).

Now, the reason that this approach fixes the problem is that swapping the directories, unlike the actual process of applying the update, is really fast. We are effectively moving the cost of applying the update to right after the update has been downloaded while the browser is running. This leaves only the really fast copy operation to be performed the next time that the browser starts up.

A long document is available here that details the background updates process.

• Firefox finds an update
• The update is downloaded
• Updater is launched in the background with the UI disabled
• The existing installation will be copied to /firefox/updated/
• The patches are applied to the copied version of Firefox
• Update will be aborted if errors are encountered, e.g. read write errors, running out of disk space

What about changes that you make to the browser in that time? What about add-ons that you install or configuration changes? Those in theory should not be a issue as they are stored in the profile directory and not in the Firefox directory on the system.

I can still see issues here, like high cpu, ram or disk usage when the updates are applied.

What’s your take on the new updating proposal?

Brian Bondy addressed one of the issues in a post entitled “Mozilla Firefox and silent updates” on his personal blog. In it he mentions that Windows’ User Account Control is a minor annoyance for Firefox users considering that the prompt will be displayed whenever the web browser is updated.

His plan is to find a way to bypass UAC prompts during updates after it has become clear that the user has enough permissions on the system to install and update the web browser.

Mozilla is currently experimenting with a Windows service approach. According to Brian, the Mozilla Application Updater service would be an “optional component” that users of the browser could install to automate the “software update process better”.

Those of you who follow the development of the Chrome browser may now think that this is exactly what Google is doing to update their web browser. And while both techniques have similarities on first glance, there are fundamental differences under the hood. The Firefox service for one is an optional component which Firefox users can uninstall or disable at any time. Firefox will receive updates in the future even with the service uninstalled, stopped or disables. The browser will simply switch to the old way of updating.

Mozilla tries to tackle the frequent update fatigue issue from other angles as well. The organization plans to make add-ons default to compatible during updates in the first quarter of 2012. This basically means that Firefox will no longer assume that add-ons do not work with an updated version of the browser. The benefit here is that fewer users will see the update prompt. Firefox for some time now downloads new versions of the web browser in the background and will install them as well unless add-ons are found to be incompatible. This can be changed under Firefox Options > Advanced Update.

Other methods include showing the What’s New page less frequently, increasing the time it takes before users receive notifications that an update has been downloaded and needs to be installed and to apply updates on shutdown.

If you read the comments under Brian’s post you will notice that nothing’s set into stone yet. The basic idea behind all proposals and plans is to make the updating process more comfortable to the user.

What’s your take on the development? Would you install a Firefox service on Windows for the updating of the browser?

The major advantage of silently updating Firefox with security fixes is an accelerated deployment of those patches in the Firefox community, which in turn reduces the number of Firefox users who work with insecure or instable versions of the browser.

Alex Faaborg, Mozilla user experience designer, added more details about the planned Firefox 4 feature:

[..] I think the majority of users would prefer an application that doesn’t bother them with what they view as little details (where a little detail is a minor update, major updates that include UI changes are different).

We get a lot of complaints that Firefox updates too often, people can’t see even see the difference with the new version (it was actually a security patch), that we change our mind too much and should just ship one version (it was actually a security patch), etc.

For Firefox 4 minor updates will occur automatically. Users can change the setting in Options > Advanced > Update. We’ll only be using the major update dialog box for changes like 4 to 4.5 or 5. Unfortunately users will still see the updating progress bar on load, but this is an implementation issue as opposed to a UI one (ideally the update could be applied in the background). We will also be able to prompt the user if they haven’t restarted in a very long time and there is a particularly bad security vulnerability that need to be patched.

Unlike in Google Chrome, where users have no choice, the Firefox developers are implementing an option to turn off silent updates in the browser. Good news for users who prefer to – or have to – research updates and their impacts on the browser and system before deploying them.

Robert Strong, the Mozilla developer working on the implementation of the feature in Firefox mentioned that Mozilla is well aware of the controversy surrounding silent or forced updates, stating that “there is no one size fits all behavior for this that will please everyone just as the current behavior doesn’t please everyone.”

He added that silent updates “might not make Firefox 4″, even though the goal is to release the updating mechanism with the Firefox 4 final.

Several researchers discovered that Microsoft was actually updating nine files in Windows Vista and Windows XP SP2 without the users consent and with automatic updates turned off. The nine files in question are not the same and they seem to the update mechanism itself.

It still raises the question if Microsoft should be allowed to update files on your system without asking for your permission instead. While the updates this time did not seem to be critical or change functionality it could very well be that Microsoft decides to do so the next time. I’m thinking of DRM and anti-piracy measures for instance.

The changed files in Windows Vista are:

• wuapi.dll
• wuapp.exe
• wuauclt.exe
• wuaueng.dll
• wucltux.dll
• wudriver.dll
• wups.dll
• wups2.dll
• wuwebv.dll

The ones in Windows XP are:

• cdm.dll
• wuapi.dll
• wuauclt.exe
• wuaucpl.cpl
• wuaueng.dll
• wucltui.dll
• wups.dll
• wups2.dll
• wuweb.dll

Computerworld article
Zdnet blog entry