Anyone Having Odd "Critical Update" Warnings When Using Firefox?

Gort · 05 Nov 2017

bo elam said:

I dont agree, I think my suggestion is a good suggestion, you might not like it but it is a clear cut solution. Bigfoot was confused when she saw the update message, disabling automatic updates completely gets rid of any doubt if and when she sees again any message about a Firefox update.

You are taking for granted that she is not aware of Firefox's update schedule. I bet she knows that in mid November, Firefox 57 is going to be released. Most people who come to forum, know in advance when their browser is going to be updated. You just know, and I am pretty sure she does. After the update is released, you update manually via the internal updater.

Bo

Sorry, but I still don't think your advice fits the OP's best interests. All that's needed in this situation is to tell the OP that when Firefox is set to automatically install updates that it doesn't give any messages whatsoever that it's going to do so or requires user intervention. Firefox set to automatically update itself is set and forget it. The OP just needs informing that any update messages do not come from Firefox and can be safely ignored. Doing so will not cause an infection and will give the OP the latest security updates. All that's required here is to give the OP the knowledge that all these messages are bogus. No settings changes are required here.

Your advice might well be OK for a savvy user who wants to stall updates for feature or bug reasons, but it's not good advice for someone who doesn't feel confident in their abilities and wants to stay secure. That the OP is asking about these messages and their validity does tend to suggest that they just want assurances that the messages are bogus and can safely be ignored.

Caledon Ken · 05 Nov 2017

My two cents and not taking any sides.

I always set updates to automatic for all my clients. MS has also taken that approach as has Adobe, Chrome and others.

I always tell my clients if you are concerned take a screen shot and email mail me. It may be unfortunate but most of this technology requires the user to have some understanding of what is going on. Folks that are part of this forum can always do the same, post.

It's evident by all the posts there is a ton of knowledge and members always willing to help.

The reality is any message that uses fear to get you to react is likely a scam.

bo elam · 05 Nov 2017

Guys, just recently there was the CCleaner infection, this infection affected users who were using Windows 32 bits, had the paid version and set the program to update automatically. So, setting programs to update automatically is not the most secure way for handling updates. What happened to CCleaner, can happen with any software, including Firefox.

Gort, Bigfoot might not be as savvy as you regarding security, but I believe anyone can learn how not get infected, I did, and I am not a computer guy or a geek. There is a first step any user can take to start building their own security strategy. I did that 9 years ago and haven't looked back. The process of learning computer security was so easy is unbelievable, all I had to do was take that first step, the rest was like learning to drive a bicycle. Perhaps, Bigfoots first step can be not setting programs to update automatically and doing the updates at her own pace. In my view, no one who regularly comes to forums should be getting infected at all. After a while, you should start getting a good sense on what to do and how to build your strategy and tailor it according to what you do with the computer and who uses the computer.

Thats what I did, I built my own strategy which consist of using almost nothing but NoScript and a sandbox program called Sandboxie. I use no antivirus or scanners or any anti anything. It works for me. One thing I learned is that getting away from being conventional regarding security, is what works. Thats what has to be done to be in the path of secure computing. People who make those changes, leave infections in the past. That should be everyones goals.

People using the paid version of CCleaner got infected despite using antivirus and setting the program to update automatically. Thats conventional. Thats what most people do, right? So, maybe it is better to get away from doing what everyone does. When I did that, I stopped getting infected. Ten years ago, I used to get infected once or twice a year, that repetitious cycle came to an end the day I decided to do something about. And that was learning and building my own personal strategy. Bigfoot and anyone else can do the same. :)

Bo

Gort · 05 Nov 2017

Well, at the risk of labouring the point, I still think, that in this case, the advice to disable automatic updates is problematic.

The initial question was about some popup that spoke of the need to install a critical update, in which the answer should have been to ignore it, because Firefox won't, in its default automatic update state, popup such a request; such a thing is bogus. You then suggested that in order to always be clear that a message to update is fake, to disable automatic updates in Firefox, because then there'd never be a message if Firefox wasn't updating. Problem is that that is still giving the popups some implied credence rather than ignoring them for what they are. The important thing to make clear to the OP was that such popups should be ignored, not that you change settings to make ignoring them supposedly moot.

BTW, Mozilla tends to turn back on automatic updates now and then, in order to ensure that people do get security updates and are not stuck on old and insecure versions. Many savvy and self-proclaimed power users complain of this hand holding, yet Mozilla will, now and then, change the settings despite complaints, unless you add a line to a user.js file in your profile, etc to stop it from doing so.

You cite the recent CCleaner exploit and then use that to justify turning off automatic updates in Firefox. OK, that thing did happen and a few of CCleaner's users were caught out. However, the amount of people out there that uses that "cleaning" tool is fairly niche and not that widespread. You'll say that an exploit of that kind could affect more popular software, and you'd have a point, but I'll wager that thousands times more people have been bitten by exploits in out of date software and plugins over the years.

In the last two decades I've had the experience to witness and help to fix so many users who either didn't keep up with software updates or chose not to do so, then get infected and wonder why. They'd say that they wanted to keep some feature that had changed or gone missing in future versions or that they plain forgot. Some of these users would consider themselves savvy, too. Why do you think that Mozilla forces the automatic updates back on now and then? Sure, it could be because they want you to play with their new features, but it's also because of the amount of times people have been found wanting due to old and insecure versions that they've doggedly or unwittingly kept to, which has led to exploits spreading.

Now, as you say, an experienced user can weigh the risks and if they're on the ball all the time, they can manually update. Sure, that I can agree with with caveats. But we don't know at what level the OP or other users who read your post are at or how determined they'd be in future to keep up with every update of software that's on their device. Great if the OP ends up like you or other forum members here, but right now we don't know if that'll be the case.

So for now, I'd advise that the OP sticks to keeping automatic updates on, ignores such alarming update messages and tries to learn through experience. Over time, they might well decide to disable automatic updates, but for now I'd advise against it.

Anyway, it seems that we're coming at this issue from different directions. I suppose it's a case of agree to disagree. Plus, I worry that I'll be boring the OP, yourself and other forum members with my ramblings.

bo elam · 05 Nov 2017

Lets agree to disagree, but I like to quick comments on 3 things you said before I am gone. :)

Gort said:

BTW, Mozilla tends to turn back on automatic updates now and then, in order to ensure that people do get security updates and are not stuck on old and insecure versions.

I been disabling automatic updates in Firefox for 9 years, never seen that happen. If you disable automatic updates, stays disabled.

Gort said:

Now, as you say, an experienced user can weigh the risks and if they're on the ball all the time, they can manually update. Sure, that I can agree with with caveats. But we don't know at what level the OP or other users who read your post are at or how determined they'd be in future to keep up with every update of software that's on their device. Great if the OP ends up like you or other forum members here, but right now we don't know if that'll be the case.

To have a safe computing experience, you have to know what you install in the computer, and keep up with the programs you install. Knowing your programs and tracking their development is part of learning security.

Gort said:

So for now, I'd advise that the OP sticks to keeping automatic updates on, ignores such alarming update messages and tries to learn through experience.

The only issue I have with you advise is that you have basically been saying don't do nothing. Stay the same.

But at least now, you modified that view and added "learn through experience." And that is basically my point. Experience gives you knowledge and the power to become a safer user. Later.

Bo