Last time I took apart the Google Chrome setup experience and came away disappointed that the Google Updater got left behind. This morning the Google Updater had another surprise. Well, it isn't so much a surprise as it is a departure from the norm and I'm curious what you all think about it.
The background.
The story actually starts a few days ago when there was a discussion on some mailing lists about the easiest way to crash Google Chrome. All you had to do was type ":%" into the address bar and the whole thing would blow up. However, this morning someone noted that the crash no longer happened but was baffled since nothing had changed. It turned out that Google Chrome had been updated silently.
The details.
It turned out that ZDNet Australia had already run down the story that included a couple nice quotes from a Google representative:
Google knows best
Without a manual check, Chrome will update itself automatically, Google said. "Google Chrome will automatically checks for updates approximately every five hours. If an update is available, it will be downloaded and applied at the next browser restart," Google said.
Google believes it's best if Chrome applies security updates not only without a description of what's changing, but also without an opportunity for users to decide whether to accept the patch.
"Users do not get a notification when they are updated ... When there are security fixes, it's crucial that we update our users as quickly as possible in order to keep them safe. Thus, it's important for us to not require user intervention," the company said in a statement.
My reflection.
Clearly fixing any security issues in the browser is paramount. But does the need for distributing security updates and bug fixes trump the user control over the software? The Google Chrome EULA grants Google the right to do just that. In fact, the update clause has its own top level number. Number 12:
12. Software updates
12.1 The Software which you use may automatically download and install updates from time to time from Google. These updates are designed to improve, enhance and further develop the Services and may take the form of bug fixes, enhanced functions, new software modules and completely new versions. You agree to receive such updates (and permit Google to deliver these to you) as part of your use of the Services.
But just because Google says, in an electronic document that most users never read, that they may push new software to your computer does that mean they should do so without informing the user?
I can tell you that no Microsoft legal representative I've talked with has ever allowed such a clause in a Microsoft product. By default, the user must always be notified that an update is available and/or required. The user must also accept the update before it can be applied. If the user chooses not to accept a required update then the product may choose not start but a silent update is never an option.
But I've argued (unsuccessfully) that updates should be automatic and silent by default. Of course, users should be provided the option to opt-out and require notification/approval of updates. And, of course, group policy should be respected so that businesses can manage their desktops.
Personally, I think that Google has gone a bit too far requiring silent and automatic updates. I think their current outlook will slow their adoption in enterprises (if that was even a goal for Google Chrome). Time will tell if anyone really complains about the updates. My prediction is there won't be unless Google silently updates to a bad/broken behavior.
My question.
So, what do you think about this automatic and silent update behavior?
RobMensching.com LLC
84 Comments
Comment by Koby Kahane on Thursday, September 11, 2008 12:02 AM
Comment by Kevin on Thursday, September 11, 2008 12:29 AM
Undo is much more valuble. If what worked yesterday is broken now, show my what changed and let me undo until I'm fixed. The next auto update may be better, if not I'll undo that too.
Comment by Rik Hemsley on Thursday, September 11, 2008 12:44 AM
Comment by Cronan on Thursday, September 11, 2008 1:46 AM
Comment by Lex Y Li on Thursday, September 11, 2008 1:56 AM
Yes, I feel really good unless Google delivers me a broken Chrome some day. :)
Comment by Stefan Krueger on Thursday, September 11, 2008 3:32 AM
BTW there's one exception at Microsoft: the Windows Update client automatically updates itself without asking the user even if that option is selected (http://blogs.technet.com/mu/archive/2007/09/13/how-windows-update-keeps-itself-up-to-date.aspx)
Comment by Magnus Mårtensson on Thursday, September 11, 2008 3:42 AM
Now I see the true strategy behind this since (if you click into my post on this matter) Chrome installs outside of the Program Files folder! This is to avaid the UAC feature and enable silent updates without running as admin! This is DANGEROUS!
(Hey your blog looks just like mine!)
Cheers,
/Magnus
Comment by Matt Lacey on Thursday, September 11, 2008 5:22 AM
There's only ever one version! it's called current!
Development gets easier, for Google. (they only ever have to work on one version at a time)
Development gets easier, for developers creating web sites (no need to detect and account for browser version)
Support is easier. (You never have to ask what version someone is using, just get them to reboot and you will know.)
Imagine if there was (and only ever had been) a single (auto self updating) version of IE. How much time and effort would that have saved you? the world?
Comment by Neslekkim on Thursday, September 11, 2008 5:36 AM
(That is, I choose to let windows update download its things, but I want to select what an when to install, but defender things, and antispam updates, no way, I want those to go in un-noticed, just as my anitvirus software updates itself..)
Comment by Erv on Thursday, September 11, 2008 7:14 AM
Comment by Martin on Thursday, September 11, 2008 7:45 AM
Comment by Håkan reis on Thursday, September 11, 2008 8:18 AM
To silent update without first informing about it, I would call irresponsible as well.
However, its all things together that worries me. They circumvent safeguards that MS sets up and by doing so the open up parts of the system for attacks.
Comment by Andreas Warberg on Thursday, September 11, 2008 8:24 AM
I received a warning from Symantec Endpoint Protection (SEP) that chrome.exe had changed since last time I ran it.
I hadn't received any notifications from chrome so I wondered about it and eventually found your description - thanks! Great info on the install procedure too.
Btw. SEP is not on friendly terms with Google Chrome. SEP will block a system call from chrome.exe, causing a crash see eg. http://sonicko.com/online-marketing/google-chrome-crashes-and-burns/.
Comment by Grover Franklin Casey on Thursday, September 11, 2008 11:45 AM
Comment by Martino Sabia on Thursday, September 11, 2008 3:31 PM
If Google, or anybody else, wants to have only 1 current version of it's software it can be without silent auto updates. It's sufficient that a not opt-in installation block himself on opening when a new update is available, saying that to use the software you've to update it first.
It's radical but it's clear and clean.
If a user opted-in the auto update, the software have to notify the user that an update occurred and let user know what the update is all about.
If really Google wants to not be evil, I think that this kind of behavior begins to brake this tagline...
BTW i continue to use it ;) [it's way more fast on my machine that others]
Comment by Robert on Thursday, September 11, 2008 6:02 PM
Comment by Ross Bradbury on Friday, September 12, 2008 6:18 AM
True, some sites offer the previous version for a while, or a preview of the next version, but you still can't run an arbitrarily old version.
Just didn't see this viewpoint mentioned yet.
Comment by Erik G. on Friday, September 12, 2008 12:48 PM
What’s the point of providing users with an option to update without providing them all the details and information required to judge for themselves whether or not it’s in their best interest?
Comment by jhayes on Friday, September 12, 2008 3:25 PM
Though I really like Chrome, I would never allow it's use in my environment in it's current state. However, since it's open-source, if some corp DID want to use it, it could easily be customized for any environment.
So, like many things, it depends on your needs.
Comment by David on Monday, September 15, 2008 9:37 AM
I work in a variety of environments [development / testing & at customer sites] and NONE of them would allow an app like this in to their environments.
Comment by Philip on Tuesday, September 16, 2008 11:26 AM
I'm not saying its right, but its allowed.
Comment by Jack on Thursday, September 18, 2008 6:29 AM
Comment by Robin on Friday, September 19, 2008 3:21 AM
At some point Google will put out a buggy update and everyone will howl. Also some users will have a dilemma if they haven't restarted their browser by then....
Comment by Bryan on Friday, September 19, 2008 12:46 PM
This behavior isn't dangerous because it's a per-user installation. The application installs to a location that doesn't require admin privileges, so there's no elevation to be had.
Even if a virus or something happened to get in via this vector, it doesn't have permissions to do anything meaningful (linux argument), so the concern is void.
Comment by Mike on Friday, September 19, 2008 2:43 PM
It's debatable whether or not one-sided EULA's are even legal (check the late Ed Foster's Gripelog), buuut, I let my firewall decide what gets through & what doesn't. I only allow Chrome to update when I know there's an actual update. Otherwise, the installer is blocked.
And
Comment by Dan Roberts on Saturday, September 20, 2008 8:28 AM
I would really prefer to know exactly is being downloaded and installed onto my own, rather precious PC. I also hate the fact that there is a Google Update service doing its own thing in the background of Windows taking away my choices and control of my own computer not to mention using resources and bandwidth.
Comment by katy on Monday, September 22, 2008 8:13 AM
Comment by TaranQ on Tuesday, September 23, 2008 4:14 AM
Comment by Sushobhan Sen on Tuesday, September 23, 2008 12:11 PM
Comment by Dale Davies on Wednesday, September 24, 2008 12:33 PM
The question is, how much do you trust Google?
Comment by Jason on Thursday, September 25, 2008 6:45 AM
Comment by Brandon on Saturday, September 27, 2008 6:17 AM
Comment by Christopher on Monday, September 29, 2008 12:02 PM
Comment by Dhiraj Kumar Bharali on Tuesday, October 14, 2008 12:05 AM
Comment by R Davoes on Saturday, October 25, 2008 7:59 AM
Comment by Joseph O gardner on Friday, October 31, 2008 8:52 AM
Comment by Psymiley on Saturday, November 1, 2008 10:15 AM
And this has worked perfectly for the past 10 years.
And with hundreds of instances of the app at any one time, it's important that everything works perfectly. If something is wrong, an update can be rolled out in minutes, allowing anyone needing the newer version to simply run another instance.
It's primarily down to code discipline. From obvious things like coding properly, debugging and comments. Comments make the world go round! Comment the faulty code, explain why and the changes made. That way you can a) revert if theres a problem, b) prevent similar errors and c) keep the other programmers in the loop incase they notice patterns with data feeds, etc.
I'd hazard Google are already pretty up-to-scratch with running-updates for inhouse systems. Having hundreds (thousands?) of servers crunching away, any updates will need to happen with virtually no intervention.
Maybe more experienced than Microsoft in this field?
Comment by Tim on Saturday, November 8, 2008 3:01 AM
Its not just an upgrade silly! its an upload! Yes Google is supplying all your activities to the US government, they have a database, with all of you featuring in it, they have an image of your profile if you use a web cam, your eyes from your photos, your voice from your IM chat and all linked to your IP address.
When you hear that crunching noise since your chrome install, your hard disk is actually being scanned, you will notice that this doesn't show on you CPU usage, and you don't notice the silent upload which takes place while you are browsing the web.
People should write to their MP's and demand an explanation for your privacy theft, your government knows it's happening but won't make a move until you do.
It won't be long until you are arrested for something that you didn't do because someone else put something on your pc or borrowed your IP address.
Comment by Reasamp on Sunday, November 9, 2008 8:06 PM
Moreover, I live in a country where 8KB/s internet connections are common, and internet is expensive (often not 24hrs cable but dialup over phone). So an update is *never* silent for us. Even if the internet is on 24 hours, you definitely notice the internet pathetically slowing down if a background process is downloading something that big.
I download at 2mins/MB, and internet connection is a precious resource that I need to be in control of.
Comment by Manu on Tuesday, November 25, 2008 9:16 AM
Imagine if Microsoft (the big bad wolf) does this at the moment. I'm betting all my money that people all over the net will curse and swear at Microsoft, hoping that it'll die a terrible death.
But, hey, it's Google, the good guy, remember? That makes it okay....... I guess :)
Comment by Dave on Sunday, December 21, 2008 4:18 AM
http://dev.chromium.org/getting-involved
Comment by gary on Tuesday, December 23, 2008 9:58 PM
Comment by Volter on Thursday, January 1, 2009 1:09 AM
If the same type of thing is allowed here with chrome, then many people will have bad things to say about chrome simply because they're refusing to patch, and having the typical problems that come with not patching.
And, to sum up a question that the OP made, i'd like to point out the invalidity of the question.
"But just because Google says, in an electronic document that most users never read, that they may push new software to your computer does that mean they should do so without informing the user?"
NO, they shouldn't do it without informing the user, but they DID inform the user, upon installing the software, in the EULA that they were sure to provide, and some users were too lazy to read.
But YES, putting it in the EULA in plain text gives them the right to do all of this, it's a legal agreement, and just because people are too lazy to read them doesn't mean that it's shady behavior.
Imagine for a moment, if you turned in a resume` for a job, and the employer hired you without reading it, and then later tried to reprimand you because you didn't have training on the standard machinery for the trade. If you didn't lie in your resume`, and the employer didn't bother reading it, then did you lie/scam?
Would it be fair for the employer to reprimand you?
In summary, all i have to say is, Seriously? google rolls out this nice new peice of software, and doesn't lie to us like some companies have been known to do, and all you can do is complain about how you can't use unstable/unsupported/insecure versions?
wake up, see what google's doing here, and if you don't like it, don't use it, just be glad they aren't lying to us.
Comment by Adam P on Thursday, January 8, 2009 11:40 AM
I have to say that I absolutely love it. For example, the bookmark bar is something I use a lot. One update made it so the bar disappeared after you loaded a website in the tab. This annoyed me a little but it must have annoyed a lot of other people because another update put it back to the old way. The fact was I didn't have to touch a single button and the problem sorted itself out. Magic!
In contrast to this, I love iTunes but I hate updating the software. Updates happen infrequently but frequently enough to annoy. I open the program to listen to music, get an update message, click yes, wait for the update to download and install (which takes time), wait to restart iTunes, then I can finally listen to music. It's not the worst thing in the world but it's not exactly fun either.
The fact is Chrome simply works. I spend less time waiting for updates to download and more time just browsing the web. Isn't that a step in the right direction?
Comment by Rob Loach on Tuesday, January 13, 2009 2:09 PM
Comment by liozzi on Wednesday, February 11, 2009 5:05 PM
Comment by Manish Mittal on Thursday, February 12, 2009 12:00 PM
Comment by user on Monday, February 16, 2009 4:16 AM
Comment by Web girl on Tuesday, February 17, 2009 10:53 PM
Comment by Corbey on Monday, March 30, 2009 7:12 PM
Comment by ej- on Tuesday, April 7, 2009 3:22 AM
Comment by Cowplater on Thursday, June 25, 2009 12:29 AM
Comment by The Beerslayer on Tuesday, July 14, 2009 4:38 PM
Not everybody has broadband. My dial-up connection gives me maybe 5kbit/sec and bandwidth is very precious to me. If Google decides to start downloading a 13MB update in the background, believe me, I will notice. If I have no other way to gain control over the process, I will force-quit the application and uninstall it immediately. As someone remarked earlier, there are no silent downloads on a low-bandwidth connection.
Comment by BM on Thursday, July 16, 2009 8:02 AM
The internet is about interconnectivity. When some people have an outdated or vulnerable browser, it slows the development of innovative websites for everyone. Moreover, it also increases the risk of everyone catching viruses because vulnerable browsers can be exploited to attack other websites and networks. By allowing quick, automated updates, Google can keep the internet progressing and help reduce the risk of viruses and hackers.
I understand what Beerslayer says about dialup users. However, Chrome updates are usually very small and nowhere near 13MB in size. I understand what others have said about secure corporate environments. I'm sure managed IT environments could find a way to work around the automatic updates just like they find ways to work around other features they don't like. (In fact, I know there are ways to modify Chrome's pref file to change this update.)
I've found Chrome to have the least intrusive update system of any software I've other used. It just works, period. I don't need to deal with nagging dialog boxes, I don't need to restart my computer, I don't need to decide whether a particular update is worth it... In fact, I don't even notice when an update is happening. That sort of seamlessness is the way computers should work. Please, Google, don't change a thing!
Comment by Sioc on Monday, August 31, 2009 8:55 AM
Moreover upgrading something that works flawlessly may only cause a nonzero probability of something not working flawlessly anymore.
That's the reason why I disable the automatic update feature of Chrome. Otherwise, Chrome is a truly fantastic browser.
Comment by Bdubs on Thursday, September 10, 2009 6:48 PM
Unlike Firefox I wasn't able to get (after the crashes) my windows to open back up. So i had to go extensively digging through the history and wasted a lot of time getting going again.
I began to wonder if i needed updates or why (all of the sudden google was crashing so much on me... I guess it's their tool and they just let us play with it. I'd like the option to decide. I LOVE firefox 3.5, but I liked the workings of firefox version's 1 - 2 especially their bookmarking and longer tab designs far more than the current firefox. If it weren't for security vulnerabilities i'd far prefer to use it.
Take IE6 to IE 7 & 8. I lost the ability to hover over a picture and snag it without having to right click / which is sometimes disabled on some sights with code so then I have to get all criminal and find a hack around it. I mean sometimes the old products just work better. I'm behind (3) firewalls of sorts and a robust AV/Malware protection setup. If I want to use an older "riskier" browser who cares?
If they want to update the unknowing, hazardous users out there automatically that's fine, but I'd like a heads up.
It may be a finite or useless point to argue, but google sometimes acts more imperialistic than M$. And while at heart I LOVE google. I have a growing distrust for all their data gathering and heavy handedness. I'll take them 3:1 over the EMPIRE everyday, but lets just hope LUKE doesn't grow up to take over the world with HAN & LEAH> while we mop up the remains of the declining/crumbling empire!!
=OR= at least let me know so I can move over to or at least open my windows up in Firefox as a back up so I don't keep losing my work while you tweak something in the background google.
Comment by AnonymousM on Wednesday, September 16, 2009 1:53 AM
Comment by Alex on Saturday, September 19, 2009 7:25 AM
Comment by Venkateswara Rao on Saturday, September 19, 2009 11:16 PM
Comment by Armon on Tuesday, September 29, 2009 6:33 AM
Comment by Matthew on Tuesday, December 15, 2009 2:46 PM
FireFox was always my main browser anyway. I only had Chrome installed to check compatibility when I was doing some web development. Well, like I said, screw Google. If someone isn't using FireFox, IE, or Opera then I don't care about them anymore.
Comment by Bill Shirley on Monday, December 28, 2009 6:19 PM
I should be able to opt out of the group collective update as well.
I'll be deleting Chrome soon, I didn't see any magical speed improvements either.
Comment by mark on Thursday, January 7, 2010 4:29 PM
Comment by Bob on Wednesday, January 27, 2010 11:29 AM
Seen any Black Helicopters lately?
“Paranoia runs deep, into your life it will creep…”
Comment by Patareco on Sunday, February 7, 2010 12:28 PM
Just my 0.02$ as a web developer!
Comment by nick on Wednesday, February 24, 2010 10:01 PM
Comment by Dwight Stegall on Monday, March 1, 2010 2:59 PM
Comment by Unicorn250 on Monday, March 15, 2010 7:37 AM
And, no, Mr. Stegall, you are not an idiot for not enjoying auto updating. You are an idiot for saying that someone else is an idiot for not agreeing with you.
Comment by Kirk Davis on Thursday, March 18, 2010 7:21 AM
Comment by bob on Friday, April 23, 2010 1:11 PM
Google makes millions for a reason, and I can't say its because they're always being forthright with their practices. Free browser?
No, thats Firefox - a browser I trust.
Granted, I really like Chrome. Is it enough for me to stop using Chrome? If I really knew what Google knew about me, I'd probably never use the internet again. Will I stop using Google Chrome? Well, that would then imply I care deeply about my online rights - but since I really don't know what they are, and I can't even delete an old MySpace page - I think it makes little difference. They're out to collect info and make money.
In other words, you're damn right I want a choice. It gives me the illusion of control.
Comment by anonymousmagic on Saturday, September 11, 2010 1:45 AM
Also, Windows is very bad with automated updates. I almost had my system crash once because apparently, Microsoft doesn't check you have the required harddrive space before applying an automated update... that's possibly the stupidest thing I've ever seen them do.
Comment by wwvvw on Friday, December 17, 2010 5:51 AM
how i wish there are more active developments on other chrome derivatives, i just want what chrome offers, minus the google brand name.
Comment by j on Thursday, December 23, 2010 11:32 PM
Comment by The Masked Commenter on Tuesday, January 4, 2011 9:50 PM
Comment by WantsTheComplainingToEnd on Monday, January 31, 2011 1:23 PM
It's funny how people never spend the time to look for such things and prefer to complain first.
For those that are over protective should use the link to get peace of mind don't curse the program spend the time to realize there are always ways to disable things like this and for gamers its nice because then you can control when it updates.
For people that don't have that much bandwidth can disable it to save them but it doesn't use all that much but this is for them too.
There are plenty of other people that this link will help look at it before thinking that "OH NO SILENT UPDATE BAN FROM PC".
here is the link to how to shut off auto-update you can still update it when needed just by opening up the "About Google Chrome" button under the menu.
http://www.chromium.org/administrators/turning-off-auto-updates
(don't know if linking is allowed but its needed)
Comment by Bill Kelly on Tuesday, March 8, 2011 6:30 AM
Comment by Raphael on Saturday, March 19, 2011 4:49 PM
Anyway, you can turn it off easily if it bothers you.
Comment by Deon on Sunday, May 29, 2011 10:23 AM
Im no longer using chrome, moved to opera. Much better if you ask me.
Comment by Charles on Wednesday, February 8, 2012 12:22 PM
Comment by Mauricio Sánchez S on Friday, February 24, 2012 12:42 PM
For web developers like me is the ideal scenario, in the production procces it is a waste of time making our sites to correctly work in each version of browsers in the market, several times we cannot use new and fantastic features that comes with latest versions of html and css coding, that becouse the bunch of user using out of date browsers, we can't construct a clean code either, have to use third party packages often, and sometimes violating the standars is the way.
I understand people is worried about software installing into their hard drives without knowing, but many users are not aware about the importance to have an updated browser, and they just don't do it by themselves. I see sometimes friends still using browser from 8 to 10 years ago and I said, hey why you still using IE6, why you don't update it?, the answer ranged from "I don't know how to do it" to "I don't care about that, it works for me". Here in my city there is a lot of local business that provide computers with internet services, cybercafe, many of them still using very old browser versions, most of them IE and Firefox, when I ask, hey why don't you update your software?, the answer is "naaa, I don't have time for that, you know, I have 20 computers, I can't lost my time updating all of them"... If just those web browsers do the same Google Chrome does.
PD: When you click in "I Agree" in terms and conditions window when installing the software, implied you read the contract and is fine for you, the fact people don't do it, does not remove the validity of the document and the action you'r performed when clicking in "I agree".
http://www.msanc.com.
Comment by pabb on Friday, March 23, 2012 4:11 PM
Comment by yoan06 on Thursday, July 12, 2012 9:20 AM
Updates let user choice to refresh or not shortcuts
and
Not refresh Registry !!!
example:
im using SSD drive
my temps drive is on another
Chrome have no persistent parameter like Ffox to move his temp and profile folder
so i use
--user-data-dir="D:\Temp\Chrome\User Data" --disk-cache-size=10000000
each update needs to change all shortcuts again and browse the registry to update all
shell/open/command key with
"C:\Documents and Settings\user\Local Settings\Application Data\Google\Chrome\Application\chrome.exe" --user-data-dir="D:\Temp\Chrome\User Data" --disk-cache-size=10000000 -- "%1"
just let me say : on this leak off flexibility
Google real su...ks
Comment by Josué Martín on Thursday, August 16, 2012 8:21 AM
Comment by Daniel on Wednesday, March 6, 2013 10:53 AM