Solved Vivaldi and automatic updates

oci87

Hi, in the following guide: https://help.vivaldi.com/desktop/install-update/update-vivaldi/ is indicated that the browser will alert when an update is downloaded and ready to be installed. The guide also indicate that Vivaldi will install the update on next browser restart.

Well today I received a notification about a new Vivaldi version.
I closed the browser and reopened it but no update has been installed: if I check for a new version a pop up show me there is a new version.

So how automatic update works in Vivaldi browser?

DoctorG

I tested now:

Stable is installed "For All Users"
only a Windows Toast Notification appears,
update not installed automatically, not installed even as Administrator
That is really bad!
️
Stable installed "Standalone"
Update fetched in background
Hint about Update installable in tabbar shown
Installed after closing of Vivaldi
Stable installed "For User"
Update fetched in background
Hint about Update installable in tabbar shown
Installed after closing of Vivaldi

1. is not really safe.

Now i understand what @oci87 means and what the condern is.

I never slipped into this issue as all my installs are Standalone which update in background.

DoctorG

@oci87 In a Standalone installation the Updater checks once after Vivaldi starte for a update. In a installation for All Users or a Installation for the User a Windows Task Schedule is created to check regularly with update_notifier.exe (resides in Vivaldi program folder).

The some 5.4 Stable updates the Autoupdate was temporarily deactivated because of issue in a updated Vivaldi version. You have to update by hand to Vivaldi 5.4.2753.33 Stable.

oci87

@DoctorG Users with 5.3 will be users that will be vulnerable because for some reason auto-update to version 5.4 has been disabled?

This is again a good reason, on my point of view, to leave Vivaldi.
I'm focused on security.
Vivaldi seems all good... but not for updates.

I cannot tollerate that a browser has no auto-update or that this can be disabled by the browser for some reasons.

My actual version of stable Vivaldi is 5.4.2753.28 (Stable channel) (a 64 bit)
I updated manually from 5.3 and maybe I made a mistake because I don't wanna see updated applied manually but automatically.

Now today I received a notification about a new update to the version Changelog since Vivaldi 5.4 (2753.31) but also if I close and reopen the browser no update is done.

I think I will unistall Vivaldi from all my devices and leave this browser.

I want use a secure browser who care automatically about security.
Imagine an antivirus that ask for update every time manually.

I'm sure a lot of user will not run the update and this will create a security issues on all this users.

The browser is something we use for the bank and other important and sensibile operations. I cannot imagine a browser that disable updates from a version to another or simply alert to update but never do update automatically.

DoctorG

@oci87

Users with 5.3 will be users that will be vulnerable because for some reason auto-update to version 5.4 has been disabled

Let me check my other PC. Wait

oci87

@DoctorG said in Vivaldi and automatic updates:

The some 5.4 Stable updates the Autoupdate was temporarily deactivated because of issue in a updated Vivaldi version. You have to update by hand to Vivaldi 5.4.2753.33 Stable.

Doctor I refer to this. You said auto updates has been disabled, where? From 5.3 to 5.4 or in 5.4?

Disable auto-update is like create a hole of security to users, on what I can see. If users that has a version of Vivaldi where auto-updates are disabled by default, if they will not update manually they will stay with an old browser version.

I don't like the fact Vivaldi send all time a notification when an update is available. I feel much safer seeing on Chrome and Firefox updates are done automatically, no user intervention. Maybe I suppose on Chrome and Firefox user can choose to disable temporarily auto updates but for security reason security updates must be always done automatically.

DoctorG

@oci87 said in Vivaldi and automatic updates:

From 5.3 to 5.4 or in 5.4?
(…)
Disable auto-update

Only for 5.4.2753.31

It was deactivated on server for this version, not in browser. I should have explained better!

DoctorG

@DoctorG said in Vivaldi and automatic updates:

Let me check my other PC. Wait

Works in all my "Install for User" Vivaldi 5.3. Got on all my PCs and users the 5.4.2753.33 (Win 11).

oci87

@DoctorG said in Vivaldi and automatic updates:

Only in 5.4.2753.31.

This means all user, also inexpert user that has been updated to 5.4.2753.31 if they will not update manually their browser will kept old and with security issues?

This is not tollerabile on my point of view.

I have version 5.4.2753.28 (Stable channel) (a 64 bit) and auto update seems is not working.

I think I will move to another browser that give me more security in terms of updates. Sorry.

DoctorG

@oci87 Check your Windows Task Scheduler.
Are there any entries related to Vivaldi?

oci87

@DoctorG

I get a notification that alert me an update is available.
This is not auto-update, this is a manual update that require me to click the notification an manually install the update.

If I don't do this the browser seems is not updated so this is a security issue for me.
I cannot trust a browser that never keep itself updated because this would mean ... on all parents, business PC where user don't do manually the update, they will still have an old vulnerable (maybe) browser version.

I feel much more secure on Firefox or Chrome where update is not let to the user but, as better antivirus software, the browser care about security updates and apply automatically.

DoctorG

@oci87 Vivaldi does update in background and by Windows Scheduler, this task runs every 1 hour after Windows user login!
A restart is needed when Vivaldi is running als browser process can not be upfated when running.

I do not want to be drawn in such discussion why Vivaldi's update process is insecure. I am not a developer or from QA team.

And i am not the correct person to sent complaints to for Vivaldi.

If you think autoupdate is broken, send a bug to https://vivaldi.com/bugreport/ and describe your issue.
If you dislike to do this, feel free to uninstall Vivaldi and be happy with a different product.

oci87

@DoctorG Thanks, I will check this.
If I can found Vivaldi has a good update management and there is no security issue so I can stay on Vivladi that is what I want, if not I will find another more secure option. I will fill up also a bug to see if someone can clarify and improve this to avoid such doubt of security.

Thank you!

DoctorG

@oci87 I do not see that you had checked your Windows Scheduler for existing Vivaldi schedule entries. Did you forget or not interested in help?

oci87

@DoctorG I dont know maybe how to do. My PC is in the Italian Language so I was suppose you asked for the task manager process.

DoctorG

@oci87 No, you took the wrong one.
In german it is Windows Start → Aufgabenplanung.
Sorry, i do not speak italian and all online translators failed to give me correct word.
Not your fault.

I check for the program name now.

Copy next line
taskschd.msc /s
Open Win+R
Paste into field
Hit Return

oci87

I'm running Vivaldi standard and Vivaldi developer.
On taskschd.msc /s I can see two task from Vialdi that run once a day in two different time. This is because I have two version installed on my PC so the task seems exist and is run just once for day.

This two task seems just to send the update notification and not to auto-update the browser

I create a BUG report VB-91013

DoctorG

@oci87 said in Vivaldi and automatic updates:

I create a BUG report VB-91013

Fine.

Dev and Security team will check.

oci87

@DoctorG See this:
https://www.trishtech.com/2021/07/how-to-enable-or-disable-automatic-updates-in-vivaldi/

I expect in the browser to see download and install updates automatically.

I never have this option in Vivaldi, I can see only download and alert when update is available.

To me looks like Vivaldi never support auto-updates.

I filled a bug report in any case. Thanks.

Pesala

@oci87 said in Vivaldi and automatic updates:

I expect in the browser to see download and install updates automatically.

It does, but it waits for the user to restart the browser before applying the downloaded updates. It is not good to close the browser while people are working, to install an update.

DoctorG

@oci87 If you see a notification in Vivaldi tabbar, the update_notifier already has downloaded the update, and if after you close the browser, the update gets installed.