Notes & Commentary

From CNET:

Without a manual check, Chrome will update itself automatically, Google said. “Google Chrome will automatically checks for updates approximately every five hours. If an update is available, it will be downloaded and applied at the next browser restart,” Google said.

Google believes it’s best if Chrome applies security updates not only without a description of what’s changing, but also without an opportunity for users to decide whether to accept the patch.

“Users do not get a notification when they are updated…When there are security fixes, it’s crucial that we update our users as quickly as possible in order to keep them safe. Thus, it’s important for us to not require user intervention,” the company said in a statement.”There are some security fixes that we’ll keep quiet because we don’t want to disclose security vulnerabilities to attackers.”

I can understand not wanting to advertise to attackers what’s been fixed, but not prompting the user for updates is just wrong. Even Apple – king of the user experience – lets the user decide to download and install an update, even when the description is as simple as “bug fixes“.

Do I think Google would push malicious or privacy invading updates to Chrome? Probably not. Not yet anyways – but Google shouldn’t even have that opportunity – that option shouldn’t even exist. Opportunity is the first step for bad behavior. Ten years from now the last thing I want is for this sort of auto-updating practice to become the standard.

Tweet This