The Inside Track on Firefox Development.
« Deer Park Alpha 1 | Main | We will miss you »
June 6, 2005
Software Update Progress
Darin, Benjamin and I are making good progress on Software Update for Firefox 1.1. Darin and Benjamin have been looking at patch downloading and application and I have been working on the Update Manager and notification UI. I've just landed some of the manager/UI work on the trunk (Darin's incremental download utility has been in for a little while). Here's a screenshot of a preliminary notification UI:
This is built out of the Software Update User Interface wiki page.
Posted by ben at June 6, 2005 2:21 PM
Comments
Shiny!
Posted by: Chase at June 6, 2005 5:12 PM
IMHO the theme/extension notice gets way to much attension. At quick glance, I'm prone to not upgrade so I don't break anything.
I think it should be done in a way that's not so alarming so people will actually upgrade.
Don't scare the kids! ;-)
Posted by: Robert Accettura at June 6, 2005 5:12 PM
"This update will cause some of your extensions and/or
themes to stop working unil they are updated."
i agree with Robert this message feels too strong especially considering extensions don't always upgrade with Firefox. Also think there should be some kind of option for newbie users who maybe don't have extensions, to not have to worry about such things as updates just make it happen automatic like windows updates in the background?
Posted by: Tobias at June 6, 2005 5:39 PM
If possible, get rid of the "Show List" button and just list the extensions (in a scrollable box if the list is huge). Make the caution icon smaller or get rid of it so it doesn't scare folks away from installing.
Posted by: Greg at June 6, 2005 6:31 PM
The more complicated these messages are, the more users will ignore them. Destroy all unnessesary text. Towards that end:
1. Delete "It is strongly recommended that you upgrade Firefox as soon as possible by clicking Download & Install »." By labeling the update as "important" in red text on a yellow ground, you have made this clear. Also, it is obvious how to accomplish the update (by clicking the button).
2. Change the second button to "Install". Two verbs are more frightening than one. Users who don't know it's going to have to download a binary don't need to know it.
3. Remove the /!\ graphic. Robert is spot on when he says "the theme/extension notice gets way to much attention".
I like the yellow background, though. And, of course, the functionality behind the UI. :)
Posted by: VillageIdiot at June 6, 2005 6:46 PM
The whole idea behind this is a good one. What scares me is what happens when someone decides to make a pop-up that looks just like this window, and a bunch of dumb users begin to click on it, thinking the browser has determined an update was needed? Heck, the mock-up above could be whipped up in less than 10 minutes as a pop-up... I smell a lot of bad-press for Firefox once people get fooled into clicking fake 'update windows'...
We need an update mechanism that can't easily be 'faked', and as such, be the cause of a spread of trojans and viruses. The IE camp will jump on just such a case and burn Firefox into the ground with bad press... I think we need to develop something which can't easily be 'drawn' using web elements...
Posted by: Vapor8 at June 6, 2005 7:42 PM
I like the idea behind this. With a bit of cleaning up for the release, this will be a darged good way of doing it.
Posted by: jordan at June 6, 2005 8:23 PM
I completely agree with VillageIdiot: "What scares me is what happens when someone decides to make a pop-up that looks just like this window [...]". Even more, at first sight I have thought that the window is one of this crazy web-advertisings for some new "security"-product, that have flooded the web for years.
You perhaps should give the User-Interface a bit more serious and not so blatant look!
Posted by: e|vo at June 6, 2005 8:35 PM
Sexy.
However, never pleased, I'd like to suggest adding an "OK then, get on with it, but let me go back to surfing porn and don't interrupt me" button. Your choice of wording.
Posted by: Greg K Nicholson at June 7, 2005 12:20 AM
Firstly I agree with the comment about making it 'install' as it's simpler.
Also I think the text should be changed to:
"It is strongly recommended that you upgrade Firefox as soon as possible to protect your computer by clicking 'Install'".
I.e. adding in the 'protect your computer' wording something like that which Microsoft uses.
Posted by: Ian at June 7, 2005 1:58 AM
If you give a list of things you break, give a list of things you fix? I'd appreciate an educated decision on both parts, if I have to make one.
I'd recommend to give the actual download size, too. This gives users an idea of how long that download may take on their connection, and how to act during that time (if they are told about the security alerts).
Posted by: Axel Hecht at June 7, 2005 3:38 AM
Axel, the things that are fixed can probably be seen in the "click here for more info" link.
I agree with the rest, the broken extensions notice might be scary to those who aren't computer savvy.. although the more advanced people will like it.
About faking this with a popup.. You have a point.. a fake critical update popup is easily done.. but what can be done about it ?
Posted by: Caleb at June 7, 2005 4:11 AM
Fix release notes to point to an auctual page that exists or check one in.
Posted by: David B. Haun at June 7, 2005 5:44 AM
I like the functionality behind this, as it is very necessary. But I do echo what all others have said.
This warning about the extensions/themes, does it only come up when Firefox detects that it will break some extensions, or does it come up at all times? If it comes up at all times, then the wording needs to be changed. But, if it comes up when there actually is a problem with the extension install, then I think that this treatment is OK. On a side note, I hope that the Show List button will actually show you the suspect extensions. Another button called Check Now would also be convenient, so that you can take care of the problem right within this dialog.
Later should say Remind Me Later.
Posted by: T at June 7, 2005 5:53 AM
Here's an idea: make the update window use transparent XUL (i.e. non-rectangular window) and position it in the bottom-right of the screen. That would be impossible to fake using DHTML.
Posted by: ant at June 7, 2005 6:53 AM
Just get rid of all the UI stuff and make the updates install automatically in the background.
I've installed Firefox a douzen times on different PCs which all belong to newbies. And I always see the update icon on the top right corner, which has never been clicked on since the final release in November '04.
I ask them: "Didn't you notice the update button?"
Noob's answer: "Button?"
You should place the 'install automatic updates' function in the settings, so users can decide whether they want to activate it or not.
If you choose not to install automatically, then a window like that one above should appear.
And only in that case. Because most noobs try to press any warning messages away without reading them first, whether it's a firewall, a browser or whatever.
Firefox has been designed to ease peoples life. So why should it be made unnecesserily complicated?
Posted by: MAD'S evilution at June 7, 2005 9:18 AM
"You should place the 'install automatic updates' function in the settings, so users can decide whether they want to activate it or not."
Under the Advanced tab in the Options window there is an "automatically download updates..." with a selector for "and install them" or "prompt me when ready to install". This should allow downloading and installation to take place completely in the background without any noticeable interruption for the browser user whilst keeping it up to date.
Posted by: Chris Blore at June 7, 2005 10:07 AM
when the list of extensions and/or themes that need the upgrade is displayed, will the user see what has an available upgrade? If so, would it be possible to automaticly select those items to be upgraded and warn about those that will not be upgrade friendly?
Posted by: mike katip at June 7, 2005 5:45 PM
The spirit & function behind this is an excellent addition, especially the non-UI portion that allows for binary patches! Hurrah.
As many of the comments here notice, the rough UI is ... well ... rough. Is there a bug in which suggested changes can be tracked? Throwing in my $0.02 as a HCI guy:
- a bunch of stuff on the page is competing for the attention of the user: red text, boldface button, warning icon, branding image
- as others have mentioned, it's hard to see what the default / recommendaed action is
- the boldtext for the product name works nicely for "Firefox 1.1.4", but might not work so well for something like "All In One Mouse Gestures 3.121"
- not exactly sure what happens with multiple update results; multiple popups?
- I'd suggest reducing the amount of information in order to allow the user to focus on the primary choices in front of him/her: What's available, and should I download it now or later? I'm not even sure the warning about theme/extension bustage is important to tell users about right up front, as opposed to after downloading the patch; giving them the choice before applying means that they have less to think about before the "download" choice.
Posted by: Mike Beltzner at June 7, 2005 8:07 PM
I think the initial notice should come in the form of a word-baloon message that points to the existing update icon at the top-right corner. Make the baloon at least partly overlap the chrome area at the top of the browser window, rather than the web page area, as this would be much more dificult to fake. Give it a message like "A new Firefox update is available, click here for more info." When they click that message they'd be taken to a window similar to the one above.
Still, even that wouldn't completely solve the problem. A user could see a spoofed update window and think that a real update window 'just came up on its own.'
Posted by: Toe at June 7, 2005 9:22 PM
I'd suggest a similar mechanism to the "Additional plugins are required to display all the media on this page" thing, and that window would appear after clicking the button.
Posted by: Andrew at June 7, 2005 10:12 PM
Hmm... "Click Here"?
Posted by: Doug at June 8, 2005 4:58 AM
You might want to change "will" in "may" when warning for broken extensions, because a security update doesn't mean all extensions break and there will be people (now and in the future) that don't have extensions.
Furthermore, I'd like to see a page instead of a pop-up when I mistype an URL. But that's just what I prefer, my way of doing that is through firetune.
Thank you, and o yeah, the yellow corresponds fine with the yellow when visiting https-pages.
Posted by: max at June 8, 2005 5:30 AM
I would strongly vote for automated download/install with the possibility to turn either part off in settings.
Once the upgrades are patches instead of full version downloads, the bother of automated download will be hardly noticeable even to modem users.
Firefox could then a) offer to close, patch and restart immediately b) patch automatically on the next restart.
This would solve the problem of fake pop-ups - along with telling users that firefox will NEVER open a pop-up requesting an update :).
Have a nice day.
Posted by: coyot at June 8, 2005 5:55 AM
The two main point that commenters have made so far, I totally agree with. The message itself needs to be clarified/simplified. How about something as simple as: "A new version of Firefox is available. [More Info] [No thanks] [Install]" or something like that. The user could go to the More Info button and find out what's being changed and what might break.
The other really important thing is to make it hard or impossible to spoof. The suggestion that the popup only show if the user clicks a button of some type is a decent idea, but has its flaws. For one, you're going to lose a lot of people who don't know to click the button. I think that's the problem with the current version isn't it? The second, smaller, problem is that if it's only the second or third time someone has seen it, they're not going to remember that it should only show up if they click somewhere (this has been said before, but it's important).
The solution? Embed the notification in part of the UI that can't be changed by a website. Going with the single line of text that I suggested above, you could probably insert an "update" bar right below the menu bar that only shows up when an update is available. You'd have plenty of room to get the basic message across, and people would have a hard time ignoring it. It would also be nearly impossible to spoof.
Please get this right in 1.1. We don't need the update mechanism changing every other release.
Posted by: Aaron at June 8, 2005 7:25 AM
To avoid the update dialog from being faked, maybe have the current update icon, the one that shows up when there is an update, flash (slowly) when this box is up. Also, it's important to have a link, such as "How to tell if this is a true update?", that leads to a page somewhere on mozilla.org explaining how to spot a true or counterfeit update request box.
Posted by: Frank at June 8, 2005 9:07 AM
In my opinion the UI isn't the best. It should be something like Install UI
Posted by: M at June 8, 2005 9:12 AM
I have Firefox 1.1 already. You can read my review here. This is my blog.
Posted by: Alex at June 9, 2005 1:00 PM
This simply shouldnt appear on top of the browser window unless it is 100% sure that it can NOT be faked. This will be a big security risk similar to ActiveX with users clicking blindly on fake Firefox security updates. Besides, can Firefox be updated at the same time its running?
I'd suggest some kind of UI similar to Install UI should popup after updates are downloaded on next browser launch. I suppose download system would use some kind of system similar to BITS service where only unused connection is used.
About the amount of info shown in the dialog box, only the bare minimun should appear, and additional info should be accesible under maybe a dialog box that expands and collapses to show the requested info (like, what fix is this, what files will be update, version changes, extensions broken, known issues).
Posted by: PA at June 10, 2005 11:42 AM
Just to clarify:
- Firefox will check for available updates automatically on a specified interval.
- If updates are found they should be downloaded automatically in the background.
- When all needed files are completely downloaded Firefox should "mark himsef" as "I need to be updated" on next launch.
- When that mark is found the Install UI should be triggered instead of the normal browser window with all the required info that was specified to be shown on the popup window.
- The user should be given the choice to install or not the downloaded updates. If updates are declined they shouldnt be re-downloaded again. Also an option to download the file manually, maybe providing a direct link to mozilla's site where the relevant patch can be located could provide an additional security layer (i.e. for paranoid users they wouldnt install the automatically downloaded updates).
Posted by: PA at June 10, 2005 11:50 AM
Many great ideas, though the ones suggesting upgrade upon restart of firefox has one flaw as i can see it.
My computer is up almost 24/7 and there's almost always an active firefox window, so i (or someone a little less literate) could go on for a week or more without updating.
In addition to a lot of the ideas here, couldn't there be a message in the same yellow bar where the popup blocker informs you of blocked popups?
I know this isn't perfect either, since it's still in the content window, but i think the problem is worth considering.
By the way, really slick back-end =)
Cheers!
Posted by: Petter Karlsson at June 12, 2005 1:40 PM
I like the idea behind this. With a bit of cleaning up for the release, this will be a darged good way of doing it.
---------
Posted by: morrers at June 14, 2005 7:24 AM
I think nightlies could be used test the function out as alpha 2 approches.
Posted by: David B. Haun at June 18, 2005 6:07 AM
Using a balloon alert coming from the standard red update button in the corner of the Firefox window would be the best way of alerting users that a new update is available. Then, this window would come up when the balloon or the red update button are clicked. As long as this window NEVER pops up by default, there will be no easy way of tricking people with malicious pop-ups. My $0.02.
Posted by: C Snover at June 18, 2005 10:45 PM
I would like to see software update finished go with a simple user interface. I think fastback should be a no go.
Posted by: David B. Haun at June 19, 2005 12:04 PM
Keep in mind guys that website popups all have an unremovable location bar at the top of the window. That decision was made primarily to make spoof attempts more obvious.
Posted by: Ryan VanderMeulen at June 20, 2005 4:57 PM
Concentrate on Firefox Trunk software Update feature.
Posted by: David B. Haun at June 21, 2005 12:27 PM
©1997-2006 Ben Goodger. All Rights Reserved.
Opinions expressed here are my own, and not those of any organization that I may be affiliated with.
Reload icon is © Stephen Horlander;
Firefox logo is by
Jon Hicks, and is a
trademark of The Mozilla Foundation.
GetFirefox buttons are from rakaz
