Closed Bug 1582427 Opened 6 years ago Closed 6 years ago

Never check for updates option

Categories

(Thunderbird :: Preferences, enhancement)

Product:
Thunderbird
Component:
Preferences
Type:
enhancement
Priority:
Not set
Severity:
normal

Tracking

(Not tracked)

Status:
RESOLVED WONTFIX

People

(Reporter: anjeyelf, Unassigned)

References

Details

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0

Steps to reproduce:

Windows 10 OS
Thunderbird 68.1.0

If wanting to stop checking for further updates:
Menu icon > Options > Options > Advanced > 'Update' tab

Actual results:

Options:
'Authomatically install updates (recommended: improved security)'
'Check for updates, but let me choose whether to install them'

Expected results:

Expected a third option:
'Never check for updates (not recommended: security risk)'

This third option is not available.
This is also the same for 'Firefox'

It is almost as if the same code has been just copied into Thunderbird without regarding user choices.
Why has this option been removed?
Request this option is reinstated as soon as possible before users start complaining in the Support forums.

Its very possible that it was copied from Firefox as we share the same code base. Is there a reason why the third option would be advantageous?

Type: defect → enhancement
Component: Untriaged → Preferences

We use the Mozilla update service. Mozilla removed the "never check" function and showing a not working option is senseless.

The only possibility to block update checking is through the policies.

Status: UNCONFIRMED → RESOLVED
Closed: 6 years ago
Resolution: --- → WONTFIX

re :"We use the Mozilla update service. Mozilla removed the "never check" function and showing a not working option is senseless."
Does this also effect versions prior to version 68 ?
Those older versions do have the option, but are you saying that selecting that third option is futile as it will be ignored ?
This is important as I'm already getting people who want to stop updates due to lack of Addon compatibility.

re"The only possibility to block update checking is through the policies."
Could you please supply full instructions on how to do this. Thanks.
I am going to be asked at some point.

(In reply to Anje from comment #3)

re :"We use the Mozilla update service. Mozilla removed the "never check" function and showing a not working option is senseless."
Does this also effect versions prior to version 68 ?

The service is built-in in the binary. TB 60 isn't affected by this.

re"The only possibility to block update checking is through the policies."
Could you please supply full instructions on how to do this. Thanks.
I am going to be asked at some point.

A quick Google search showed this for example (for FX but can be applied to TB too): https://winaero.com/blog/disable-updates-firefox-63-above/

re:The service is built-in in the binary. TB 60 isn't affected by this.
That sounds good, because I'm sure people are going to want to downgrade and stop upgrading to 68.

Many thanks for link...I thought it might have been something else new hidden within Thunderbird files etc
HKEY is easy enough to alter, although I feel many users baulking at the very idea as this is going into unknown territory; beyond the fringe and boldly going where they've not gone before. Hardly user friendly. I do hope that is not Mozilla intentions in general as what might be ok for Firefox is not necessarilly ok in Thunderbird.

Anyways..cheers for info. Reasons understood, but not, as yet, convinced Mozilla is correct.

The missing option is to check for updates manually right now.
Setting the never check for updates by policy disables that.
That is wrong. There should be an option for the user to check for update and install if desired, because Mozilla is about empowering the user, not jamming something down everyone's throat. If we wanted that we would use Microsoft products.

So the problem to be solved is to disable the update nag, and disable the automatic updates, but allow the user to do what he wants.
This bug and the discussion above is nonsense and should be fixed.

Steve
If a person wants to check for updates manually, usually it is because they have intentions of updating - use 'Help' > 'About Thunderbird', click on 'check for updates' button. This option has always been available.
OR check on the website https://www.thunderbird.net/en-US/thunderbird/all/ for latest release download, system requirement information and release notes. You would discover whether a new release has occurred.

If you have selected the option: 'Check for updates, but let me choose whether to install them', then you would be informed when an update is available with the option to update at the time of the prompt or later on when it suits you via 'Help' > 'About Thunderbird' and click on the update button.

The problem occurs when you do not want an auto update nor check for update and a desire to go back to a previous release and never check for update. Each time they go back to previous install, it auto updates before they can switch it off, so it needs switching off in version 68 achieved by altering a specific HKEY because it cannot be done via Thunderbird because the option has been removed by people who think Thunderbird operates in the same way as Firefox, which of course is untrue.
The code to prevent users from choosing not to update did not need to be used.
Have you not noticed the recent changes in Menu and windows that open within and confined within a tab or the change to the Thunderbird icon itself. Those changes have not enhanced Thunderbird, they have made it difficult to use and significantly increased the risk of RSI. Those parts are rarely used in Firefox, but used a lot more in Thunderbird. It is obvious that either Firefox developers are being used to update Thunderbird or allowing code to be used because it's cheap.
Since version 68 Thunderbird is not as good and a pain in the proverbial to navigate. It would have been more helpful to include code offered by many most used addons than waste time putting eg: Options in a tab.

In a nutshell, no one is going to fix the issue in this bug nor the blatant problem with the Menu nor removing Options back to a window so it functions properly. There is no desire or will to fix. So you have to use the options provided and find ways to work around the situation.

Yeah, I wish Eudora had been supported still.
I had an email arrive at all my eudora installations that in some way corrupted all my .mbx files, and I couldn't recover it. Nor could I find the bad email. Probably spam or a virus. So I was off Eudora after that.

I had long used Thunderbird for a couple of accounts, mailing lists that benefited from the threaded mail.
After Eudora became hosed I just went on Thunderbird, but as a lot of software done by committee it shows signs of wrong directions taken.
I was involved in a discussion of that in a bug I reported in Firefox years ago and some guys argued tirelessly for an approach that would have broken the system.
But I think the goal is to keep the system working.

This is total bs to enforce auto-updates

It turns out what Anje said above is not true.
I did the registry setting to disable updates and now, when I click about the box says

Updates disabled by your system adminstrator.
So my position is still the same. The registry setting to disable updates indeed disables updates, manual or otherwise.
This should be addressed. This is wrong.

Steve, it appears you have not understood what I said. Perhaps it seemed ambiguous.

For Clarity...Setting the registry as described will stop updates. This means that whilst you have a registry setting on your computer that stops updates in Thunderbird, then you cannot update.
Use this option only if you do not want to update; you want to permanently say on the version you are already using.
Do not use this option if you want to update at a time of your choosing as there are better options or you would need to remove the registry setting in order to update.

Anje,
Perhaps I did not understand your statement.
I am currently getting update nags, since I have said to notify me of updates.
The other alternative is automatic and I found that unsatisfactory.
So I set the registry setting to stop the check for updates, but it apparently does not stop check for updates, it instead blocks updates.
Even a manually submitted update from the about box.
That is wrong.
That is subject to revision since the blocking of updates, though that might be fine for some, is pretty serious.
That I cannot manually update without incessant update nags is a big defect, and subject to being addressed by the developers.
Which is why I filed the bug, and why on the other bug I disputed the stuff over there.
This is not the mozilla way, which has always been to empower the user. Between me and my computer I am the only one with an actual brain and I will decide when and if I want to update something and nags are not appropriate, unless they can be dismissed permanently which this one cannot. It's not right and should be fixed.

As you can see at the top of this bug report, I filed this bug and therefore I agree that the user should be allowed to choose, so we are on the same page and fighting the same corner.
But, Richard Marti made a comment that made it very clear so we understood why the option no longer shows: "We use the Mozilla update service. Mozilla removed the "never check" function and showing a not working option is senseless. The only possibility to block update checking is through the policies."
So it is not a simple case of making a provision as Thunderbird users may desire. We have to work around the problem and the biggest problem was for those who never wanted to update. The provided info to alter the registry resolved that partiticular issue. We have to accept the situation.

Yeah, I read all that and I disagree with that.

If the mozilla update service uses an inappropriate architecture because of a ridiculous decision that was made by committee that is still subject to correction. And this is that, it should be corrected. I do have the update nags on Firefox and they bug me there too.

I mostly use Chrome today. So maybe the firefox nags are not bothering me as much. So these problems should still be addressed by the powers that be.

I was involved in a bug as a reporter some years ago, and I experienced exactly what went on here. a couple of developers who demanded things be done a certain way for security purposes and though that was valid at the time it would have broken the entire system. And they argued with me tirelessly that it should be broken! I wouldn't have it and finally some guy with a mozilla email came in and made the decision, and I won. The system eventually got fixed as I suggested, but if I hadn't been there those other guys would have broken the system worldwide for hundreds of millions of users. It was ridiculous. Same as this. A totalitarian attitude. "We know better what's good for you." No, you don't!

Some guys demanded that the system update automatically but the others wouldn't buy it. So they got a nag that cannot be dismissed. If it were able to be dismissed until the next update this would be fine. "Ok, Ok, there's an update, go away and I will decide whether I take it or not."

These are people who because they are developers and not politicians are not actual totalitarians, and I am glad they are developers. But any developer who wants to jam their ideas down everyone's throat is going to hear about it from me.

I have dealt with lots of people who think they know better how things ought to be and I do confront them. The other developers are often not able or willing to confront things that are wrong, it's the psychological makeup of their personality. I was the manager so I always had to confront things. Heh. I call out things that are wrong. See how different that is than what you just said "There is no possibility to correct this."
Yes, there is! If the problem is the Mozilla update service that is broken, that should be fixed.

I still don't understand how to actually disable the auto-updates... Thunderbird always shows a popup with a message "Thunderbird can't update to the latest version". Of course it can't! Thunderbird is located in system dirs and started with user permissions. A package in Linux should only update via package manager.

So sad that nowadays obvious bugs won't be fixed at all.

(In reply to Richard Marti (:Paenglab) from comment #2)

We use the Mozilla update service. Mozilla removed the "never check" function and showing a not working option is senseless.

TB is not a browser like Firefox.
For security reasons, I want to allow TB internet connections only to the accounts mail servers. That's all it needs to and I want it to.
So I set proxy to 1.2.3.4(dead end), with exception of the accounts mail servers, for which connections go without proxy (and therefore are the only ones possible).

So, TB is incapable of looking for or fetching updates.

Now, since I currently do not use the TB from Debian Distro, I every day I get an error message about TB not being able to check for updates.
This is senseless.

The only possibility to block update checking is through the policies.

I use Linux so I guess there are not such policies.

Why Not to Use Automated Nagware/Hammerware to Beat Users into Submission

Automatic updates provide a necessary service for users (like my sister and mother) who have no interest in, or knowledge of, PC internals. But forced automatic updates and/or unstoppable nagware popups are wrong for several reasons.

Firstly, expert users expect to have complete control over what does/doesn't get installed on their PC. Thwarting this need produces negative psychological (and physiological) impacts. Providing users with the "choice" between automatic updates and nagware popups is like giving them the right to vote in a one-party state. It is no choice at all. People like me -- who live on their computer, and who have invested decades of their life mastering its controls -- resent having their PC nag at them. Freedom is the illusion of having control over the things that matter -- and having control over their PC matters a lot to me (and to most expert users).

Secondly, automatic updates violate proper update procedure. The correct way to update an app is:

(1) Create a full-system backup (if you don't have a recent one).
(2) Download the app into your download directory (as defined in your browser).
(3) Use VirusTotal to test your download for malware. Run it only if it looks safe.
(4) Save the app into an "Apps_Save" folder in case you need to re-install or re-test it.

I have more than 60 apps installed on my system, and most of them want to auto-update. How can I control what's on my system if all of those apps can auto-update whenever they please? Here's how I actually actually update my system.

(1) Every few months I make a list of apps that I want to update.
(2) I update them in bulk using the previously described update procedure.
(3) I try the updates out for a few weeks and watch for unwanted system behaviors.

If I find unwanted behaviors, I reinstall saved versions until the problems (if any) go away. When I am content with my updates, I revert to my last full-system backup, reinstall the updates that I want to keep, and then create a new full-system backup. The resulting system has only a few hours of internet exposure -- in total. Now that's the safe way to update your system!

Newer isn't always better. Automatic updates and online installers are dangerous. Why? Because you can't test an auto-updated app with VirusTotal, and you can't revert to a previous version if the updater doesn't save one. Moreover, auto-updating forcibly exposes users to zero-day exploits. See the following link for the sad story of users who got infected in early April 2020 after FireFox auto-updated their system.

https://threatpost.com/firefox-zero-day-flaws-exploited-in-the-wild-get-patched/154466/

(In reply to twathle from comment #20)

Why Not to Use Automated Nagware/Hammerware to Beat Users into Submission

Automatic updates provide a necessary service for users (like my sister and mother) who have no interest in, or knowledge of, PC internals. But forced automatic updates and/or unstoppable nagware popups are wrong for several reasons.

Firstly, expert users expect to have complete control over what does/doesn't get installed on their PC. Thwarting this need produces negative psychological (and physiological) impacts. Providing users with the "choice" between automatic updates and nagware popups is like giving them the right to vote in a one-party state. It is no choice at all. People like me -- who live on their computer, and who have invested decades of their life mastering its controls -- resent having their PC nag at them. Freedom is the illusion of having control over the things that matter -- and having control over their PC matters a lot to me (and to most expert users).

Secondly, automatic updates violate proper update procedure. The correct way to update an app is:

(1) Create a full-system backup (if you don't have a recent one).
(2) Download the app into your download directory (as defined in your browser).
(3) Use VirusTotal to test your download for malware. Run it only if it looks safe.
(4) Save the app into an "Apps_Save" folder in case you need to re-install or re-test it.

I have more than 60 apps installed on my system, and most of them want to auto-update. How can I control what's on my system if all of those apps can auto-update whenever they please? Here's how I actually update my system.

(1) Every few months I make a list of apps that I want to update.
(2) I update them in bulk using the previously described update procedure.
(3) I try the updates out for a few weeks and watch for unwanted system behaviors.

If I find unwanted behaviors, I reinstall saved versions until the problems (if any) go away. When I am content with my updates, I revert to my last full-system backup, reinstall the updates that I want to keep, and then create a new full-system backup. The resulting system has only a few hours of internet exposure -- in total. Now that's the safe way to update your system!

Newer isn't always better. Automatic updates and online installers are dangerous. Why? Because you can't test an auto-updated app with VirusTotal, and you can't revert to a previous version if the updater doesn't save one. Moreover, auto-updating forcibly exposes users to zero-day exploits. See the following link for the sad story of users who got infected in early April 2020 after FireFox auto-updated their system.

https://threatpost.com/firefox-zero-day-flaws-exploited-in-the-wild-get-patched/154466/

re :"We use the Mozilla update service. Mozilla removed the "never check" function and showing a not working option is senseless."

showing a not working option is senseless - I totally agree.

I am still getting loads of people in Support forum asking about how to stop updates, so I advise on setting Policy settings. But, some people do feel it is a bit beyond them.

I run two versions of Thunderbird, one of which is the 68.12.1 which I do not want to update and the other is 78.5.1 which I do want to be informed about updates. So I'm constantly and repeatedly clicking 'not now' for the update request. In other words, I really empathise with users who are pestered by this constant annoyance.

Is it not time to have words with Mozilla about reinstating the "never check" function?
Or considering how Thunderbird can use a method that is not reliant on Mozilla for this?

No one has explained the rational reasoning why the 'never check' option was removed in the first place nor whether the voice of Thunderbird users was even considered by 'Mozilla' at the time of making a decision that impacted users who may not even use Mozilla Firefox.
Based on that it is difficult to explain to users why anyone would impose updates or subject them to constant reminders.

Yep, this is a serious bug that was introduced with the Mozilla update service and that needs to be fixed. As Mozilla always said, they are about empowering the user. Sending me senseless update nags is just inappropriate and they should stop. There are lots of reasons automatic, or even latest version updates are a bad idea, and jamming it down our throats is just wrong.

Hi Richard Marti
Idea:
Could there be an option similar to the other 'warning' pop ups. Which allows user to say, do not repeatedly tell me about the same update? This does not mean 'never check for updates', it is more like a 'check for updates, do not install unless say so, but stop telling me about this particular update. So basically, you are told 'once' about the available update and that's it.
I could accept that as an improvement.
Is that something which is doable?

Can someone tell me where the Thunderbird 68 policy editor is, please? I don't mind tinkering, but need to know where to look.

Thanks in advance!
Dax.

dax
(In reply to dax from comment #25)

Can someone tell me where the Thunderbird 68 policy editor is, please? I don't mind tinkering, but need to know where to look.

Thanks in advance!
Dax.

comment 4 did provide information on policy setting, but this question has an answer in the Support forum with clear instructions, so here is a link:
https://support.mozilla.org/en-US/questions/1320445

You need to log in before you can comment on or make changes to this bug.