Mozilla Maintenance Service - a security issue?

I have been using a slightly older version of Mozilla mainly for browser testing. There is still a significant userbase for Mozilla 28 out there and people familiar with the complaints about the 28/29 upgrade will know why. I therefore had auto-updates turned off.

And when I restarted my test browser it was now running Firefox 31. I assumed initially I had hit the wrong button and updated by mistake. Still, this was useless for testing. I rolled it back to 28 by uninstalling and reinstalling, set every about:config update setting to false, blocked updates on the Options tab, and even tweaked user.js, because I didn't want to do the job twice.

Next day? Firefox 31 again. I rolled it back, hit all the update switches to off - again - and turned the antivirus (Avast) to paranoid before connecting to the web again. And if I hadn't been in processexplorer I would not have seen it start the update. It was something on my system calling out, not an intrusion.

This was when I searched on the web and found more people with the same problem, most of whom were appalled that their settings had been overridden. Mozilla were less than helpful, repeatedly saying people should not be using an outdated browser, and neatly ignoring the issue that they were changing settings on user's computers without consent, and in some cases against their expressed wishes.

This is just one of the user threads:

• https://support.mozilla.org/en-US/questions/1001740

Put very simply, the Mozilla Maintenance Service was meant to be LiveUpdate for Firefox: a program that runs in the background and keeps your browser patched and up to date. It sounds simple, so how controversial can this be?

• It installs without requesting consent or informing you that it is being installed
• It creates no shortcuts or updates to let you know it has been installed
• It performs updates silently, without letting you select or decline patches
• It ignores the previous user settings on downloads - you can have the standard settings to only download with permission checked and it will ignore them
• It does not come with an uninstaller.
• It downloads and executes code on your machine as Administrator without your knowledge.

For me, none of these are really acceptable, but the last one is the huge problem. That can be very badly misused, and the safety precautions in most LiveUpdates to prevent malicious code execution are turned off by default. The fact it runs as Admin bypasses many security procedures and even some anti-virus programs.

For example, a few years back there was a problem with a Windows XP update that conflicted with the Zonealarm firewall. Users could simply skip that update and wait for the patched one, which came out a few days later.

If this had been Firefox's Mozilla Maintenance Service, machines would simply have stopped working the moment they were connected to the web, and users would not have known why, or been able to stop it.

There are reasons to run an outdated browser, even some to run it as your main browser as long as you have taken security precautions with secondary programs including firewall and anti-virus.

1. Compatibility testing - not all users update regularly (see how many XP users there are out there?) and if you are building a website it is as well to make sure it can run in all browsers. Not all browsers interpret even basic HTML the same way.
2. An add-on not supported by later editions of the browser - For example the very popular ForecasterFox (https://addons.mozilla.org/en-US/firefox/addon/forecastfox-weather/reviews/) is not supported in later versions.
3. Look and Feel - Mozilla's main suggestion is that refusal to upgrade is purely about how Firefox looks. If this is your reason, then the classic theme restorer, available from https://addons.mozilla.org/en-US/firefox/addon/classicthemerestorer/  will provide an older look and feel.
4. Objecting to MMS - yes, objecting to the updating service is a reason not to update your browser.
5. Personal Preference - it's a reason, not necessarily a good one, but it is still a reason.

There are two ways to do this.

1) Turn it off.

Caution. the standard about:config settings do not work - they can all be set to false and the MMS will still update your machine. Instead go to:

Tools>Options>Update

There is a new checkbox here saying "Install using background service". Uncheck it.

This description is misleading, because even if you have "Check for updates, but let me choose when to install them" checked, the MMS will simply silently install the updates. As long as that box is checked, the MMS will download and run files when Firefox runs.

2) Remove It

To my great irritation, it does not come with an uninstaller, or create a desktop or startup shortcut. Worse, it is not uninstalled when Mozilla is removed. I uninstalled Firefox twice and the service remained on the PC until manually removed.

Depending on your OS, the procedure varies. Here are three links to how to remove a program on common versions of Windows

Windows XP: http://support.microsoft.com/kb/307895

Windows 7/Vista: http://windows.microsoft.com/en-us/windows7/Uninstall-or-change-a-program

Windows 8:  http://windows.microsoft.com/en-us/windows-8/uninstall-change-program

You will need to look for the Mozilla Maintenance Service on the list. It is normally right below Mozilla Firefox.

I hope this has been an informative article, and helped you get an idea of why silent auto-updates can be considered a security problem. Rather than saying that people should remove it, I simply want to make sure that people know they can, and how to do it. It's not what you choose - it's about knowing you have a choice.