Solved Vivaldi and automatic updates

[oci87]

@Pesala It never result to me that Vivaldi apply auto updates.
As I told, when I close the browser and re-open it no updates are installed.

This is the first test that let me think Vivaldi never update itself without user intervention.

The second point that let me understand Vivaldi never support auto-update is what I find in the settings under general than update settings: there is no settings like download and install update automatically as showed in the article above.

The only existent settings active is to receive a notification when a new version is ready to be installed.

Also surfing Vivaldi community and the web I find that Vivaldi never support auto updates

[oci87]

@DoctorG said in Vivaldi and automatic updates:

@oci87 If you see a notification in Vivaldi tabbar, the update_notifier already has downloaded the update, and if after you close the browser, the update gets installed.

Not works for me.

[Pesala]

@DoctorG Is this an error in the Italian UI?

Scarica automaticamente gli aggiornamenti e avvisa quando sono pronti per l'installazione

Automatically download updates and notify when they are ready for installation

English UI

Automatically Download and Install Updates

[DoctorG]

@Pesala Wait i check

5.4.2763.3 Snapshot:

5.4.2753.33 Stable

[oci87]

As you can see my stable Vivaldi is not appling updates automatically.
This is a bad security issue for me and I will leave this browser.

The developer version has this settings that work see:

So for me Vivaldi is not secure enough.

[DoctorG]

@oci87 Had you installed the Vivaldi Stable with Installer → Advanced for "All Users"?
Where is the program folder?

[oci87]

@DoctorG C:\Program Files\Vivaldi\Application\vivaldi.exe

[Pesala]

@DoctorG My Stable version is installed for All Users, but my Snapshot is installed as a Standalone version.

Perhaps this accounts for the difference in the Update method?

[oci87]

First of all I think is very bad that Vivaldi is never supporting auto update even if only on my installation or in a specific case. This is a security weakness.

I don't know why I only know in Vivaldi having two version is hard.
I need have the stable and the Standalone installed so I worked hard to have this working and now I discover that auto update are not working on the stable version.

There is no instructions on how to fix this, I need uninstall the browser and loose all session?

I'm very deluded by that.
I was thinking Vivaldi was good for security but this let broke all my good things.

My stable Vivaldi version is never self updating and allow me to just receive a notification when a new version is available. That's all and is enough to say: bad work.

[DoctorG]

I tested now:

1. Stable is installed "For All Users"
   only a Windows Toast Notification appears,
   update not installed automatically, not installed even as Administrator
   That is really bad!
   ️

2. Stable installed "Standalone"
   Update fetched in background
   Hint about Update installable in tabbar shown
   Installed after closing of Vivaldi

3. Stable installed "For User"
   Update fetched in background
   Hint about Update installable in tabbar shown
   Installed after closing of Vivaldi

1. is not really safe.

---

Now i understand what @oci87 means and what the condern is.

I never slipped into this issue as all my installs are Standalone which update in background.

[Pathduck]

@DoctorG said in Vivaldi and automatic updates:

update not installed automatically, not installed even as Administrator

Yes, this is because updating the "All Users" install requires UAC elevation, as it's (by default) installed in Program Files, not writeable by users. In Windows, even members of the Administrators group cannot write to Program Files without UAC elevation (unless UAC is disabled, which is very bad). The only way someone can write directly to protected directories is by signing in as the "Administrator" user, which by default is disabled. Note also that "Run as Administrator" is not the same as signing in as Administrator, it just gives the user process elevated permissions.

How Opera handles it is downloading the update in the background, then after close of browser, it will prompt user to update Opera, giving UAC prompt during install.

For Chrome, Google installs a bunch of helper services running with SYSTEM permissions (which is really bad!), allowing it to silently update any Google software. Personally I strongly dislike this kind of "invasion" of the system just to allow updates for a single program, and would not like it for Vivaldi.

For instance the "Vivaldi Elevation Service" installed in recent Snapshots was a leftover from Chromium code that Vivaldi did not use.

That is really bad!

I don't think it's that "bad" and it makes sense technically. The default install is "Per User" and most users are expected to install Vivaldi as such.

But maybe one day Vivaldi will do as Opera and prompt user to update after browser close. But then of course, not all users close the browser at all... it's the same for Chrome, if users runs the browser 24/7 and never reboots their system, it will never be updated.

[oci87]

Unistalled Vivaldi and installed as for user only. This seems fix the issue.
I think Vivaldi setup is the problem.

Vivaldi allow in the setup to select settings that will broke auto-update if, for example, all user is choose.

Another things that looks not good to me is allow the final user to decide, during the setup but also on the browser settings to disable updates.

Imagine I want hackerate a PC in a office or in a friend PC.
I have just to enter the browser settings and disable updates or disable notification of updates if Vivaldi is installed for all user.

Works done now user browser will be not updated anymore and maybe vulnerability found in next months can be used to attack this specific installation.

Chrome, Firefox, Edge allow user to completely disable updates?
If not maybe there is a reason for that. I'm asking if is good just easily allow the user to disable security updates.

[DoctorG]

@oci87 said in Vivaldi and automatic updates:

Unistalled Vivaldi and installed as for user only.

That is the way i install a Stable for regular user.

And for web development, for me in this case when i need some Snapshots, they are a Standalone install.
This all made no trouble for updates.

[Pathduck]

@oci87 said in Vivaldi and automatic updates:

Vivaldi allow in the setup to select settings that will broke auto-update if, for example, all user is choose.

The default choice is "Per User" and that's what users should stick with. In fact they have to explicitly click "Advanced" and choose another install to get any other option.

Auto-update is not "broke" it just does not auto-update in the background for "all user" installs. Something working differently than what you expect is not "broken".

Another things that looks not good to me is allow the final user to decide, during the setup but also on the browser settings to disable updates.

Again, user has to choose "Advanced" to get this option.
And Vivaldi is about giving users options, not taking options away from users like other browsers.

Chrome, Firefox, Edge allow user to completely disable updates?

Yes, all these browsers can have automatic updates disabled by "advanced" users.

It's not really more to discuss. Now you know how Vivaldi works, and also why it does it (permission issues) and maybe one day they will make auto-updates also work simpler for "All Users" install. But right now user has to explicitly allow update to happen. And I'm fine with that.

[oci87]

Here I'm.
I finally found this:

Vivaldi seems a good browser but with some issues that let me move to another browser;

1. User can decide to not apply updates during the setup. This can be used to installa browser and let them to be vulnerable. I don't see any other browser that allow this: Firefox, Edge, Chrome. A reason will be for that. Let user choose is good but not maybe in terms of stop security updates.
2. Vivaldi let disable update in the settings of the browser. This can be used for manumit a friend or a business PC that will be vulnerabile with time because no update are apply.
3. If Vivaldi is installed for all user no automated update will work just a notify that require to been seen and to take a manual action to follow all wizard update procedure. If the user never do the update the browser can have vulnerability.

This three reason move me to choose maybe in next hours a different browser.

Based on personal or business use a browser should be at maximum secure.
Allow to disable security update, never do automatic update when the browser is installed for all users, allow easy to deactivate updates and notifications about new updates in the settings can be weakness that can be used, on my opinion, for bed attack.

I'm sure for Vivaldi all this is not an issue, is for me.
Seems is a Vivaldi choice let user disable updates in the settings and during the setup. Also having a setup that never made auto update working if the browser is used for all users.

I don't like this choice and I see a security weakness on all those.

[DoctorG]

@Pathduck said in Vivaldi and automatic updates:

And auto-update is not "broke" it just does not auto-update in the background for "all user" installs.

Well, on Linux i can set all Vivaldi channel to be updated by root with progarms of package unattended-upgrade. That is the only way for me to get a secure browser.

The solution for Windows with forced Administrator interaction is not what i really would call secured update.
But i fortunately use "Install for User" which are safe, since yerars.

[oci87]

@Pathduck said in Vivaldi and automatic updates:

Yes, all these browsers can have automatic updates disabled by "advanced" users.

Great this is true, I never considered that today. Other browser doesn't simply have a friendly settings in user settings but the way to disable update are almost present, need just to do a search on Google. Vivaldi make just more easy to deactivate updates.

Good to know and to consider this. Made my idea of weakness on the browser less strong. Is just more easy in Vivaldi, that's all.

Thanks for pointing this out. I never considered this update argumentation because Vivaldi is the fist browser that notify me when an update is available. This was caused because I installed it for all user so is not so a rare case that the browser is installed for all user. This is maybe the main issue where all this discussion start and feel Vivaldi was not auto-updating.

@Pathduck said in Vivaldi and automatic updates:

But maybe one day Vivaldi will do as Opera and prompt user to update after browser close. But then of course, not all users close the browser at all... it's the same for Chrome, if users runs the browser 24/7 and never reboots their system, it will never be updated.

True, another good point.
Thanks

[DoctorG]

Perhaps it could be nice to have a Windows Group Policy to disable change of Vivaldi update settings for more security.

What do you think? Useful idea?

[DoctorG]

Read/discuss and upvote my Feature Request if useful https://forum.vivaldi.net/topic/78379/windows-group-policy-to-force-or-protect-update-settings/1

[Aelius]

@Pathduck said in Vivaldi and automatic updates:

Again, user has to choose "Advanced" to get this option.
And Vivaldi is about giving users options, not taking options away from users like other browsers.

So why did they take away the option to be notified of updates?