Firefox >=v134 for linux: update check broken - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: February 13, 2025, 06:16:27 pm
content: Starting with v134 the linux version of Firefox can't check for updates when run as normal user. When run as root the update check works fine. It's a regression: Firefox 134.0 on Ubuntu About Firefox shows "Firefox is being updated by another instance" (https://bugzilla.mozilla.org/show_bug.cgi?id=1940481). Let's see how long they will need to fix that bug.

author: ataradov
author_rank: Super Contributor
timestamp: February 13, 2025, 06:40:54 pm
content: I just have their PPA configured as a source, so updates are coming as part of the normal OS update. I never felt the need for FF to check that on its own.

author: SiliconWizard
author_rank: Super Contributor
timestamp: February 13, 2025, 11:09:46 pm
content: On my distro Firefox is a package and updated with the package manager. From what I can find, updating and even checking for updates is disabled in the Firefox build.I don't use Ubuntu, so I don't know how they handle Firefox. Or if you have installed it via a flatpack or some such.

author: Nominal Animal
author_rank: Super Contributor
timestamp: February 14, 2025, 01:09:13 am
content: I consider any application being able to update itself or modify its own binaries or scripts, a gaping security hole.That antipattern and user expectation needs to be killed with napalm, fire, and ridicule, if we care about software security even a little bit.(I don't mind a check and a notice that a newer version is available, as long as the phone-home check can be disabled. It can be disabled in Firefox.)

author: radiolistener
author_rank: Super Contributor
timestamp: February 14, 2025, 07:45:53 am
content: I don't see any issue with firefox update with apt upgrade, current version is 135.0.If your one trying to update it self bypassing your package manager, I suggest to block it and replace with normal one.As mentioned above, software update which is not requested by user is a big security hole.

author: madires
author_rank: Super Contributor
timestamp: February 14, 2025, 11:13:52 am
content: Yep, if you get firefox updates via your distribution's update channel or some PPA you aren't affected much. For those who update manually it's quite annoying as firefox won't notify you about a new version. BTW, firefox can be configured to do nothing about updates, to check for updates and notify the user, and to auto-update. Auto-update usually doesn't work for normal users because of the lack of necessary file access permissions.

author: radiolistener
author_rank: Super Contributor
timestamp: February 14, 2025, 01:13:25 pm
content: Quote from: madires on February 14, 2025, 11:13:52 amOn the contrary it would be very annoying if it will notify about new version. I can check it manually when I need it.And by the way, installing the most fresh version as it appears is a bad idea, because it may have some serious backdoor or bug, or can works much worse. For example, the last few updates of firefox have become slower and slower and lags more and more with every update. Another example a new version can block your ad/script blocker like ublock origin and you will be flooded with tons of ad-garbage and zombie-propaganda.So, this is definitely not a good idea to update browser with no check review from other users who installed it, with no testing update on sandbox-ed machine. And without waiting in case a serious security hole or bug will be discovered in the new version...

author: madires
author_rank: Super Contributor
timestamp: February 14, 2025, 01:58:49 pm
content: As I wrote above, you can disable update checks if you prefer that. And it's up to you how and when you update. However, you missed one important aspect in your personal risk assessment. Some updates include fixes for security issues actively exploited.

author: radiolistener
author_rank: Super Contributor
timestamp: February 18, 2025, 11:19:39 am
content: Quote from: madires on February 14, 2025, 01:58:49 pmThis don't works in that way, because you can't to check and disable update checks setting in every software installed on your computer - it's just nightmare for the user. And there is a risk that software still can check its update even if you disable that settings (due to mistake, or just due to the hidden intention of the manufacturer). For example, just try to disable self-update and telemetry of Windows with disable setting...So, any software which self checks for updates bypassing your package manager should be immediately removed from computer in order to avoid high security risks.Quote from: madires on February 14, 2025, 01:58:49 pmSome of them also include trojans, viruses, ransomware and other malware. This is much more dangerous than have some security issue in software, because such security issue is not malware, but when you enable self-update it can deliver real malware to your computer.For example well-known ransomwareNotPetya(the most devastating cyberattack in history) was distributed through self-update of M.E.Doc which is a widely deployed accounting software. The update servers was hacked and infected. And it leads to a mass spreading of ransomware, because this software was installed on large amount of business computers...This is what happens when you use software with self-update...

author: bigendian
author_rank: Regular Contributor
timestamp: February 18, 2025, 11:26:09 am
content: The most high security risk in linux is that you damage the os by yourself.

author: madires
author_rank: Super Contributor
timestamp: February 18, 2025, 03:04:49 pm
content: Quote from: radiolistener on February 18, 2025, 11:19:39 amFollowing your train of thought, that would include the package manager too. Many linux distributions come with auto-update enabled and you might not know how well their update channel is protected. If you're so concerned about specific applications you should be also concerned about the OS/distribution itself. There are multiple cases of misusing those update channels. Just hinting at the contratictions in your argumentation.

author: radiolistener
author_rank: Super Contributor
timestamp: February 18, 2025, 06:20:56 pm
content: Quote from: madires on February 18, 2025, 03:04:49 pmYes, it is very important to disable any auto update in package manager. The update should be done by user request only. But there are too many users who don't understand how to do it, so some distributions have such bad option enabled and it is enabled by default. This is very dangerous. So, its important to check and disable any auto-update.

author: Nominal Animal
author_rank: Super Contributor
timestamp: February 18, 2025, 10:57:18 pm
content: Quote from: radiolistener on February 18, 2025, 11:19:39 amIt is not the check that is a security risk in itself, it's just the software phoning home.The security risk is software that updates itself.The cultural anti-security risk is to teach users to expect that software can and should update itself.Software phoning home is only an annoyance when unneeded, and a possibly privacy risk/violation, depending on what information about the user it provides to the vendor and how the vendor uses that information.Quote from: bigendian on February 18, 2025, 11:26:09 amI'm not so sure of that. If we modify the statement into ".. is that you are fooled by bad advice into damaging the os by yourself", then I'd agree.As an example, a couple of decades ago the standard recommendation to "fix" Apache (HTTP server) permissions issues was to do "chmod 0777 -R /var/www/". It's like combating burglaries by leaving all doors always open.I think damaging typos do occasionally occur, but statistically, they're much rarer than that caused by bad advice.

author: nctnico
author_rank: Super Contributor
timestamp: February 23, 2025, 04:26:09 pm
content: Quote from: Nominal Animal on February 14, 2025, 01:09:13 amAgreed. I have firefox installed in a directory only root has write privileges to. The downside I have to do update manually.

author: eutectique
author_rank: Frequent Contributor
timestamp: March 09, 2025, 12:00:20 am
content: Damn Firefox (Ubuntu) has just auto-updated itself. Pissed me off. Extremely.I've done the following to prevent it from happening in future.1. Find the FFdistributiondirectory, mine is/usr/lib/firefox/distribution2. Create the policy file/usr/lib/firefox/distribution/policies.jsonwith a single entry:Code:{"policies": {"DisableAppUpdate": true}}3. Save, restart FF4. Check about:policies5. Calme-toiHope not to see this fucking blank "restart you FF to enjoy the new version" window ever again.We'll see.

author: amyk
author_rank: Super Contributor
timestamp: March 09, 2025, 05:09:32 am
content: Maybe another reason not to let it auto-update:https://www.eevblog.com/forum/general-computing/firefox-mozilla-is-doing-bad-things-again/

author: madires
author_rank: Super Contributor
timestamp: April 22, 2025, 02:20:26 pm
content: The bug is still not fixed (current version is 137.0.2) and version 138 won't get fixed either. At least there's a confirmation (yes, it's a bug) and the intention to fix the issue, but no idea when that will happen. It's quite disappointing to see such poor commitment from the Firefox developers.

author: eutectique
author_rank: Frequent Contributor
timestamp: October 02, 2025, 01:18:10 pm
content: Quote from: eutectique on March 09, 2025, 12:00:20 amA few months later ...For those interested, thisDisableAppUpdate:truepolicy has cured the Firefox's itch to surreptitiously update itself.

author: SiliconWizard
author_rank: Super Contributor
timestamp: October 02, 2025, 05:52:23 pm
content: I think most major distros have an official Firefox package and as some of us have stated before, it's way more secure to update it via the package manager anyway.Self-updating apps are more a thing for Windows.It can be convenient if your Linux distro doesn't have it as a package (which should be a rare thing?) but I would not recommend it anyway.