How to permanently disable FireFox updating... - Page 1
Forum section: electronics / general

author: BrianHG
author_rank: Super Contributor
timestamp: October 14, 2023, 02:48:47 am
content: How to permanently disable FireFox updating...For those of you who just need it that badly, follow these instructions:QuoteFinally, some peace...Here is a .zip of a firefox auto-update ON and OFF reg files I created (IE: they automatically perform the registry addition you see in the above quote.):https://www.eevblog.com/forum/chat/how-to-permanently-disable-firefox-updating/msg5113854/#msg5113854

author: joeqsmith
author_rank: Super Contributor
timestamp: October 14, 2023, 03:19:02 am
content: Mozilla Firefox/distribution/policies.json{"policies": {"DisableAppUpdate": true}}

author: The Electrician
author_rank: Frequent Contributor
timestamp: October 14, 2023, 05:21:42 am
content: Quote from: joeqsmith on October 14, 2023, 03:19:02 amCould you explain a little more how to do this>

author: nctnico
author_rank: Super Contributor
timestamp: October 14, 2023, 09:02:22 am
content: Go into the settings menu of Firefox and set the updates to manual.

author: tridac
author_rank: Regular Contributor
timestamp: October 14, 2023, 10:08:09 am
content: Thanks, will give that a try. Problem is that later verisions of FF no longer have the ability to disable updates, which is why i'm still on 114.0.2. That does keep nannying with an update box, top right, several times a day, but at least it can be ignored. Would be good to get rid of that as well...

author: SiliconWizard
author_rank: Super Contributor
timestamp: October 14, 2023, 08:18:41 pm
content: Quote from: tridac on October 14, 2023, 10:08:09 amUse Linux.

author: MrMobodies
author_rank: Super Contributor
timestamp: October 14, 2023, 11:24:15 pm
content: The last version in 2020 Firefox 80 I think had lots of popup messages (about the browser) with dimming overlays more than chrome (which hurts my eyes and p*ss me off) and I gave up on it because of the dimming overlays.I opened a thread on the Firefox forum explaining the issue and a suggestion but it got deleted.I still feel bitter about it. I wonder if it is someone's ego who decided they wanted it like that and don't want to hear the impact it has by constantly dimming the screen with dialogues and offer messages from Firefox.

author: JeremyC
author_rank: Regular Contributor
timestamp: October 15, 2023, 12:15:22 am
content: Quote from: SiliconWizard on October 14, 2023, 08:18:41 pmIt's not OS issue. Using Linux will not resolve OP's problem... he must disable auto updates...

author: Monkeh
author_rank: Super Contributor
timestamp: October 15, 2023, 12:33:05 am
content: Quote from: tridac on October 14, 2023, 10:08:09 amYes, they do. Same setting - it notifies you, but doesn't force you.Perhaps you should just update and move on with your life.

author: BrianHG
author_rank: Super Contributor
timestamp: October 15, 2023, 02:20:21 am
content: After my posted reg patch:No more update interruptions.

author: BrianHG
author_rank: Super Contributor
timestamp: October 15, 2023, 02:26:01 am
content: Here, I've attached a .zip of 2 reg files which will allow you to turn on and off firefox's updates.Just double click on the reg file you want and click yes/yes.If you do not trust me, you can inspect the reg files with any text editor and see it matches the reg settings I quoted in my opening post.In the .zip, you have these 2 files:FireFox_updates_off.regFireFox_updates_on.reg

author: SiliconWizard
author_rank: Super Contributor
timestamp: October 15, 2023, 05:15:41 am
content: Quote from: JeremyC on October 15, 2023, 12:15:22 amThere is no auto-update in Linux versions.

author: mwb1100
author_rank: Frequent Contributor
timestamp: October 15, 2023, 06:05:39 am
content: Quote from: The Electrician on October 14, 2023, 05:21:42 amSee:-Firefox policy-templatesThat page also documents the registry settings in @BrianHG's original post. There are at least two advantages to the policies.json file:1. it's easier to backup/restore2. it's cross platform (of course, that doesn't matter if you're running only Windows)

author: rdl
author_rank: Super Contributor
timestamp: October 15, 2023, 08:27:45 am
content: I'm pretty sure auto updates are possible, since they're disabled.

author: rdl
author_rank: Super Contributor
timestamp: October 15, 2023, 08:40:15 am
content: It's kind of ridiculous but probably 80% or more of the updates that come through the package manger are Firefox updates. I hardly use it anymore because it won't keep running. It constantly wants to be restarted and the way I do things that gets to be annoying.

author: tom66
author_rank: Super Contributor
timestamp: October 15, 2023, 10:38:49 am
content: So... this is why we have massive bot-nets! People willingly disabling security updates.

author: Gyro
author_rank: Super Contributor
timestamp: October 15, 2023, 12:26:52 pm
content: Quote from: MrMobodies on October 14, 2023, 11:24:15 pmWhy don't you just switch to the Extended Support Release (ESR)? Then you only get security updates, not new features.

author: nctnico
author_rank: Super Contributor
timestamp: October 15, 2023, 01:55:13 pm
content: Quote from: SiliconWizard on October 15, 2023, 05:15:41 amThere certainly is. At least in version 114 (downloaded from Mozilla directly) which I'm using right now. But I have Firefox installed in a place where only root can write so it can't update / overwrite itself. Maybe packaged versions from Linux distributions have the updates disabled to make sure Firefox is updated throuhg the OS native update process.

author: joeqsmith
author_rank: Super Contributor
timestamp: October 15, 2023, 04:22:42 pm
content: Quote from: The Electrician on October 14, 2023, 05:21:42 am

author: BrianHG
author_rank: Super Contributor
timestamp: October 15, 2023, 04:43:24 pm
content: Quote from: rdl on October 15, 2023, 08:40:15 amNot exactly true. I'm using an old ESR with NoScript and even the latest updates slowed down my laptops loading of firefox 4 fold.It also eats 50% more ram when just viewing youtube videos and with my 4gb system, this means a bunch of low computer memory warnings and crashes.Warning: The latest firefox ESR update also triggers the youtube adblocker warning.Uninstalling and downgrading needs to now be done offline, otherwise, firefox auto-updates before your your first run, of by the second run.

author: HighVoltage
author_rank: Super Contributor
timestamp: October 15, 2023, 05:31:35 pm
content: I had so many problems with the latest update and it slowed down my system so much, that I went back to an older Firefox version.This older version runs so smooth and fast that it was a big positive surprise. I will update manually from now on.

author: BrianHG
author_rank: Super Contributor
timestamp: October 15, 2023, 05:46:49 pm
content: Quote from: joeqsmith on October 15, 2023, 05:40:41 pmYou need to go into the bookmark manager an export your bookmarks.Then full uninstall firefox.The go into all your 'documents and settings' folders hunting down all the Mozilla/firefox folders and delete everything. (Careful if you use Firebird, keep those folders or loose your emails.)Then disconnect from the internet installing an old firefox. switch to manual updates, then reconnect to the internet.Import bookmarks & re-install your adblockers/noscript.Doing all this will reverse all the new garbage.

author: BrianHG
author_rank: Super Contributor
timestamp: October 15, 2023, 05:55:28 pm
content: firefox 102.4.0esr seems not to be too bloatty and no youtube warnings.Firefox 91.1.0esr seems to use even less resources and the webpages scroll much smoother on my older systems.

author: rdl
author_rank: Super Contributor
timestamp: October 15, 2023, 05:57:02 pm
content: On a Linux system that updates Firefox with the package manager the problem comes from updating while Firefox is running. That gets it bent out of shape and it will refuse to open new pages or tabs until it's restarted. You just have to watch what you're doing. But on MX the updates are all or nothing (as far as I can tell) and I don't like to put off system updates just because Firefox is in use and some Firefox update is included. The easiest solution is to just use Firefox as little as possible.It's different on Windows because Firefox handles its own updating and you can set it to just get the updates and defer the installing until later. On my windows computer , literally the only thing Firefox is used for is watching YouTube and I've had zero problems. But I have no account, never sign in, and block just about everything I can and still have YouTube work. I don't even allow their cookies.

author: BrianHG
author_rank: Super Contributor
timestamp: October 15, 2023, 06:38:37 pm
content: One of my PCs seems to trigger Youtube ADBlocker warning even though it has an old firefox.Not sure why my other PCs seem immune.My guess is different Noscript permissions. I'll try eliminating everything except for the absolute necessary to see a video.

author: rhodges
author_rank: Frequent Contributor
timestamp: October 16, 2023, 12:11:43 am
content: Quote from: JeremyC on October 15, 2023, 12:15:22 amPlease state how a user software without root authorization can write (replace) system software. This is software that is NOT writable by any random user.I use FreeBSD, and nothing changes until I ask for an upgrade. Then I see the list and I choose whether I want to upgrade or not. The last two times, the answer was NO.

author: coromonadalix
author_rank: Super Contributor
timestamp: October 16, 2023, 02:12:26 am
content: the json method is known for a long time ...use firemin to drop memory leak / consumptionin some case, many website(s) now can detect the adblocks etc .... there's some docs about thisyes older fire#$%$ are less bloathed, the esr version can help, but some websites still push the latest web browsers, and some esr are sometime blockedevery firefox core based variantsevery chrome based variantsopera maxthonursome very good now "old" pluggins who never got converted to the new standards are lost etc ...and the list goes on and on, a never ending battle that i'm tired to fight

author: tom66
author_rank: Super Contributor
timestamp: October 16, 2023, 08:55:12 am
content: With DDR3/4 being cheap again, I solved the memory leak problems of my various use cases by just throwing more memory at the problem. My desktop system has 64GB and my laptop has 32GB (upgraded from 16GB stock). A 4GB system in 2023 is rare, so I can imagine the Firefox chaps are not all that concerned with optimising for that use case. They probably suggest a minimum 8GB nowadays.

author: thm_w
author_rank: Super Contributor
timestamp: October 16, 2023, 10:01:21 pm
content: Quote from: tom66 on October 16, 2023, 08:55:12 amFirefox doesn't really give a good recommendation, but recommended RAM for windows 10 is 8GB. You can get a 16GB SODIMM for <$30.Using a 4GB system is straight up masochism.

author: BrianHG
author_rank: Super Contributor
timestamp: October 16, 2023, 10:43:56 pm
content: Quote from: thm_w on October 16, 2023, 10:01:21 pmOk everyone, understand carefully.One of my main laptop systems has 4gb running win7. I use it for my older Protel 99se projects, Quartus compiling, music editing, web browsing which consists of mainly Digikey, datasheets, youtube viewing and other sound/video playback. Until the newer Firefox accidentally got in, it has been in use for 6 years now an has crashed once in those 6 years. It would be a waste of my time just to see if I can add ram or change the HD to an SSD as I know it will open up a can of worms where I have had a near 6 year run of perfect function.Just buying a new laptop, having to setup windows the way I like, installing all my software and license files and getting everything functional is a slow month long ordeal. I don't have the time or patience to go through this. locking down firefox so I don't accidentally upgrade it once again is the best solution.(I mean, will Protel99se even install and network license on Win10)

author: thm_w
author_rank: Super Contributor
timestamp: October 16, 2023, 11:26:48 pm
content: Backing up that HDD to a SSD would probably be worth it as an insurance policy alone. You'd also save time in the long run waiting for things to load.If you can't be bothered to check, post the laptop model number here and someone else can look it up.Yes protel works in windows 10, as per your own thread:https://www.eevblog.com/forum/eda/patch-for-protel99se-sp6-for-win7810/Whether its worth the time to set up, or a VM makes more sense, I don't know.

author: BrianHG
author_rank: Super Contributor
timestamp: October 16, 2023, 11:33:27 pm
content: Quote from: thm_w on October 16, 2023, 11:26:48 pmI am not an amateur. I do have network backup at 2 external locations and have an emergency external mirrored drive on hand. I've been around.

author: soldar
author_rank: Super Contributor
timestamp: October 17, 2023, 04:32:20 pm
content: Quote from: JeremyC on October 15, 2023, 12:15:22 amI don't think so. I use Linux Mint and have the OS to only update manually and it will offer Firefox updates but I can install them whenever I want. I do not think it can do it without me inputting the password.My gripe is that some software, like Firefox, Thunderbird and others do not offer small updates but they try to pretty much reinstall the whole thing which means 60 or 80 or 100 or more MB each time which for someone with limited bandwidth is a PITA so there are several programs I only update very infrequently. And then they mess up my settings so I decide to not update them at all.And I do not see why they need to update cajillions of GB so often. They could start by making software safe from the start instead of doing a shoddy mess and then letting others discover discover holes. Most of the time they are just playing with new "features" while they introduce vulnerabilities.I have not updated Firefox in a long time and have no intention of doing so any time soon.

author: SiliconWizard
author_rank: Super Contributor
timestamp: October 17, 2023, 10:24:48 pm
content: Quote from: soldar on October 17, 2023, 04:32:20 pmOf course it can't, unless the application was running as root. If you use Linux and you use root as your user account - or set up a user account with equivalent rights - you just deserve what you get.Another possibility would be if the application was installed not "system-wide" but locally. That would be relatively uncommon, especially for an application that has a distro package on all distributions that I've ever run into.For people with such a setup, I'd be curious to know the details, please.Note that on Windows, Firefox (and Thunderbird) resort to an awful trick to allow self-updating (whether automatically or not) *without asking for an admin password*.They install a service (by default) that basically allows bypassing UAC for the Mozilla products. How sweet.So If you have ever wondered why Firefox was one of the very rare apps that never asked for a password for updating, now you know.This service can be disabled of course, but you have to go to the administrations tools and manually disable it.How sweet from Mozilla, they probably wanted to "lower any friction" to the use of their web browser, as they say in marketing.I'm personally a long time user of Firefox because it just works for me and is still one of the best for privacy. Also I want to encourage alternatives to the Chrome monopoly.But the attitude of the Mozilla foundation, unfortunately, I find more and more unacceptable.

author: kjpye
author_rank: Contributor
timestamp: October 18, 2023, 08:13:16 am
content: Quote from: soldar on October 17, 2023, 04:32:20 pmThe problem I have with Firefox on Linux (provided by the distribution) is that even when Firefox is not updated, if you are patching a live system, and there should be no reason not to, is that it often will decide to stop working and require you to restart it. If you fire up a new tab and try to open something in it, Firefox will give you an error message and prompt you to restart. In existing tabs it may just stop working with no indication of why.While the restart will remember what you had open, any entry into a tab will be lost. If you have live windows of some sort you will lose whatever state they had, and whatever you had tried to open will be forgotten, even if it's some sort of complicated URL or query.Most annoying.

author: AnnaWatts
author_rank: Newbie
timestamp: October 19, 2023, 12:05:46 pm
content: Ohh thx for sharing with this. Needy for me

author: tridac
author_rank: Regular Contributor
timestamp: October 19, 2023, 01:52:01 pm
content: Works perfectly, thanks...

author: lezginka_kabardinka
author_rank: Regular Contributor
timestamp: October 19, 2023, 02:39:57 pm
content: No one uses Firefox 🤣Registry? Gosh you guys are trapped in 1998

author: tridac
author_rank: Regular Contributor
timestamp: October 19, 2023, 11:57:09 pm
content: Windows is here on sufferance, but still needed for some apps and the server versions have far better system management tools the the domestic versions...

author: Davy
author_rank: Regular Contributor
timestamp: March 03, 2024, 07:34:53 pm
content: Rather than try a new thread thought I'd ask here since it's related-:I've done the registry hack and in the update window it say's Firefox updates disabled by your administrator, so all appears well and good here in my application. My question is-:I still get update download in the hidden Firefox datafolder, can I forget about these and can you confirm they will not be applied? There's usually a Update lock, the update file and a profile file.... deleting the entire lot stopped me from getting the update.Can I forget about these files now I've applied the registry hack, they won't start filling the folder will they? I've been deleting them since I applied the registry hack.Thanks Dave

author: tom66
author_rank: Super Contributor
timestamp: March 04, 2024, 11:17:46 am
content: Quote from: Davy on March 03, 2024, 07:34:53 pmPlease ... why are you disabling updates. Just don't. There are huge security implications.

author: soldar
author_rank: Super Contributor
timestamp: March 04, 2024, 02:17:21 pm
content: Quote from: JeremyC on October 15, 2023, 12:15:22 amNope. Here is the screen capture of three programs I do not update with Linux Mint. Every update needs my authorization and is done whenever I choose.EDit: I just realized it is an old thread and I had already responded.

author: Davy
author_rank: Regular Contributor
timestamp: March 04, 2024, 07:48:06 pm
content: Oh dear...... I'll try asking elsewhere!@Tom66I'm not asking about Firefox updates I want to STOP THE DEVIL! I am not wanting to be a guinea pig for Firefox for starters, I do have 'MY' reasons.Dave

author: m12lrpv
author_rank: Regular Contributor
timestamp: March 04, 2024, 08:23:05 pm
content: Quote from: tom66 on March 04, 2024, 11:17:46 amNo there aren't. The days of serious exploits are long gone. Take the hysteria elsewhere.Even the minor security holes that do exist aren't genuinely exploitable to the degree you imply. Security updates just appear so companies can claim they're looking after your security.The constant updates BS comes from dev companies not wanting to support lots of different versions which in all fairness as a dev for 30 plus years it's understandable.Quote from: Davy on March 03, 2024, 07:34:53 pmThey won't apply... or at least they never have for me.

author: Monkeh
author_rank: Super Contributor
timestamp: March 04, 2024, 08:50:42 pm
content: Quote from: m12lrpv on March 04, 2024, 08:23:05 pmAnd energy is free and world peace has been achieved.

author: soldar
author_rank: Super Contributor
timestamp: March 04, 2024, 11:41:28 pm
content: Quote from: m12lrpv on March 04, 2024, 08:23:05 pmI am with you on this. There are three programs I do not update any more and have not updated them in years.Firefox, Thunderbird and Brave. All three(1) want to update way too frequently,(2) are massive, not just a small patch, they reinstall the whole thing and I am on a metered data connection with several computers, no way and(3) they change things in the GUI and often cause other problems or annoyances.Nope. I am not updating.I see no need to change things in the GUI and I get the impression this is pretty much all they are doing to justify their existence.If they need to patch security holes every few days it means it is really crappy software and software writers. Screw them.I have never had a malware issue. I'll take that risk.I will continue to not update.

author: tom66
author_rank: Super Contributor
timestamp: March 05, 2024, 09:30:18 am
content: Quote from: m12lrpv on March 04, 2024, 08:23:05 pmNot even slightly true. CVE-2023-4863 was released only out about 6 months ago, and that allows for heap buffer overflow, which allows for session keys, credit card info, saved passwords etc to be stolen from a running browser by using a modified WebP image! (This impacts all browsers.) It also allows for malicious code to be embedded into your browser creating the possibility of exploits like stealing bank details by forging a login page and SSL authentication.https://nvd.nist.gov/vuln/detail/CVE-2023-4863There will be others, humans are not infallible when it comes to software. If you do not keep your software up to date, you are explicitly acknowledging that you will be vulnerable to third party attack from sophisticated organisations. Now, if you think that is an acceptable risk, that is YOUR risk, but others should not do this unless they are absolutely certain they can tolerate this risk.You can use an Extended Support Release from Firefox if you are concerned about appearance changes to the software but still need to maintain security updates.

author: EPAIII
author_rank: Super Contributor
timestamp: March 05, 2024, 01:21:50 pm
content: I don't understand. I have used Firefox and Thunderbird for years and have had almost no problems.What is everyone doing that causes such a ruckus?

author: soldar
author_rank: Super Contributor
timestamp: March 05, 2024, 04:33:34 pm
content: Quote from: EPAIII on March 05, 2024, 01:21:50 pmWhile I am with you in principle I find your argument, which is widely used, to be quite poor. It is the same as "I have never made backups and I have never had a problem".We need a bit more profound risk analysis.What is the cost (effort, etc) of implementing security measures?What is the cost if the bad things happen?What is the probability of those things happening? Etc.There is always an element of prevention, an element of risk, etc and you have to weigh everything.I have used PCs since before the Internet days. I have never, ever, used any kind of antivirus software. I have never, ever, had any malware. I have been very careful with my practices. I have always been reasonable good at having backups.When software is released so full of vulnerabilities and has to be updated so frequently to me it means the makers are being very careless and maybe should be subject to civil liability when their software causes damages. That would probably change things for the better. It is very shoddy software if it has to be updated so often for security.In my case I have decided to not update the browsers for the reasons I have stated above. The risk for me is minimal and the hassle is just not worth it.But maybe for someone with nuclear codes which could start WW3 in their computer the case is different. It's not my case though.

author: tom66
author_rank: Super Contributor
timestamp: March 05, 2024, 05:41:28 pm
content: Quote from: soldar on March 05, 2024, 04:33:34 pmI disagree with this statement. If you look at what a web browser did 20 years ago, that was...* decode SGML markup* maybe parse basic CSS* limited or no JavaScript support* limited image file formats* only HTTPNow what does a web browser have to do?* XHTML + HTML 4.0 support + SVG, XSL, JSON and others* video decoding in multiple formats (YouTube, Netflix, etc.) (WebM encapsulation, codecs AV1, VP9, H264/H265... up to 4K rendered on graphics cards directly)* multiple types of new file formats, such as WebP, JPEG2000, MNG/APNG...* support a vastly more complicated HTML and CSS standard* support complex JavaScript environments including JIT compilation* support vastly more protocols such as HTTP2.0, HTTPS, multiple new forms of SSL (TLS 3.0), async HTTP requests and so onThere is a much larger attack area. This is necessary to support the modern web. If you do not want these features that is fine, but you would need to disable them or find a very old secure build of Firefox or something that did not have them. This would probably break most of the things you use on the internet.Many older browsers did have serious security flaws. For instance, IE5.5 had a bug in it which allowed remote code execution via a maliciously crafted PNG image. It took Microsoft ages to patch that. Companies, including Microsoft, are far better now. For instance in shared libraries they cooperate to disclose a fix at the same time to avoid an attacker having the opportunity to exploit one system before others have had a chance to patch it.The modern way is not to necessary exploit your system to put an annoying virus on it, either. Some exploits can be essentially hidden and be used to exfiltrate data such as passwords or CC data to a server somewhere.The idea of attaching any civil liability to free open source software is laughable in the courts. If you read the GPL, the "No Warranty" part is very clear, it is literally in all caps. Nonetheless, even commercial software usually excludes liability for losses. Only in B2B services do you tend to find liability put on the supplier, but you can bet that will be baked into the cost of the software and service.

author: soldar
author_rank: Super Contributor
timestamp: March 05, 2024, 07:00:52 pm
content: Quote from: tom66 on March 05, 2024, 05:41:28 pmWell, there would be a lot that could be said and discussed.I would put security first. If you cannot do it securely then don't do it. And this goes not only for the browsers but for the web sites and servers themselves. Do not use unsafe technology until proven it can be used safely.The legal aspect of liability is complicated. First because different countries have different legal systems that work in different ways, based on different principles.In general terms, just because a product is free does not mean it is free from all liability. In America, under contract law, there has to be consideration for there to exist a contract so, yes, you cannot sue for contract. But there may be other avenues. Even with no contract between parties there may exist a Duty of Care the breach of which is the tort of negligence which creates a cause of action for remedy. If I invite a person onto my property, for free, I have a duty of care and if this person suffers an accident which the courts determine to be caused by my negligence then I would be liable. Negligence and liability would probably be construed even more strictly for a commercial product than for a home owner. Note that even uninvited persons and even burglars can sue for damages. If I have a swimming pool I have the duty of preventing accidents and if the neighbor's child falls in and drowns, even though I did not invite him, I would be found liable for not taking measures to prevent it.Also I would be liable for any damages caused by my automobile even if I am not driving it, even if it was stolen from me. The fact that I had no contract with the person who suffered the damage does not absolve me from liability.I would allege that the maker of software, even if given for free, has a duty of care to the user, maybe not of great care but of ordinary care and the software manufacturer does indeed bear responsibility and liability if the user suffers damages in the ordinary use of the product. The fact that the user does not pay them directly but indirectly, as a class, does not diminish the fact that they are making money by providing a product to the public and they have a duty of care.It is not as simple and easy as simply putting a disclaimer in the conditions. Those have been held to be invalid many times and on may grounds.In Spain it is much simpler. The law is whatever the judge says it is and whatever the judge interprets. It is a lottery where anything can happen depending on the point of view and sympathies of the judge. Expensive lawyers can most often make the judge "see things my way" but some times a judge will just take pity on "the little guy" and rule in his favor even if it makes no sense in legal terms.It's complicated and that's why lawyers make good money.

author: tom66
author_rank: Super Contributor
timestamp: March 05, 2024, 07:33:16 pm
content: Quote from: soldar on March 05, 2024, 07:00:52 pmSecurity is paramount in the development of modern software. Most of the unit tests done on software today are intending to detect crashes and security violations. Nonetheless, there are still areas that are missed, because developers are not infallible. Bugs are found in old software all the time.Do be aware that the organisations that are finding these vulnerabilities are often nation-states or large criminal gangs. Think about Stuxnet, it used four zero-day attacks to get into Iranian systems in an attempt to damage centrifuge hardware. It was likely developed by the US and possibly Israel. A zero-day, if you were not aware, is a vulnerability not previously disclosed to the public, so developers have no time at all to fix it before it is exploited. These are very rare (and extremely valuable to bad guys); most bugs *are* caught before they are actively exploited, but once they have been patched, all systems must be updated in order to protect them against exploitation of thenow publicvulnerability. Attackers will start as soon as a patch is dropped, which is why coordinated disclosure is such a big deal, so all systems can be patched as quickly as possible. It is literally an arms race.Now, you could ask: should we never disclose source code so vulnerabilities cannot be discovered? This has long been an argument against open source software but it is unconvincing. Windows has as many if not more severe bugs than Linux does yet the source is proprietary. There are many other examples and in general open source software is regarded as at least as secure if not more so than closed source software. Many friendly eyes and a few bad eyes are better than no friendly eyes at all and someone who is dedicated enough to reverse engineer software to exploit it.Quote from: soldar on March 05, 2024, 07:00:52 pmIt really isn't that complicated. The GPL and other free software licenses are quite clear. Here is the GPL 3.0's section on warranties and liability:QuoteAs far as I am aware, no one has ever successfully sued a free software developer for a defect in their software, even without clauses disclaiming liability.As for commercial software you may be correct as to there being liability. In the past this has resulted in class action suits where the supplier might end up refunding the cost of the software to users. Microsoft for instance has lost a number of those class action suits. I don't think it has substantially improved their security approaches.Quote from: soldar on March 05, 2024, 07:00:52 pmIn this case, you have placed a vehicle onto the public road and are legally responsible for it.It is your decision to use open source software and no one is forcing you to use it, so I cannot see how this argument can apply.Quote from: soldar on March 05, 2024, 07:00:52 pmMost open source developers work on software as a hobby. What you are suggesting would kill open source software for good. It would create a chilling effect since no one would want to risk being sued because of buggy software. The author of the code that introduced the Heartbleed vulnerability, Robin Seggelmann, was just a PhD student at the time; senior reviewers for the software package, and many others, missed the bug for years to come. It is not reasonable and fair to place the burden on any particular individual, especially given these guys are almost always unpaid.