Hacker News new | ask | show | jobs
by aj 5738 days ago
Yes, that is a feature that Google has hardcoded into Chrome. You CANNOT disable auto-updates or even make it so that you are asked for confirmation.
4 comments

Of course you can (disclaimer edition note: but it's not necessarily for the faint of heart, and isn't officially supported. On their updater and update policy, Google manages to be worse than Apple on Windows, which is already pretty fucking bad).

1. On Windows and OSX (at least), the actual updating is performed by a single service running in the background for all Google applications (the Google Updater). This service is installed and/or activated by all Google applications, every time you install them (or run them, in OSX, not sure for Windows). I'm sure you can find how to do the same in Windows but my know-how is not good enough, but in OSX you can disable GUS forever by uninstalling it, emptying its directory and then setting it write-only. This way, it's not possible for GUS to be reinstalled.

2. A good enough outbound firewall (I'm partial towards Little Snitch on OSX) will allow you to block connections to the update server, and make GUS unable to query it, and therefore to update Chrome without your consent.

On Windows, Autoruns from SysInternals (http://technet.microsoft.com/en-us/sysinternals/bb963902.asp...) works fairly well for finding out about these things that happen automatically, and disabling them, as easy as unchecking a checkbox. There's at two categories relevant to googleupdate: CurrentVersion\Run, and Task Scheduler.
Too late to edit: there's a third one, in Services, on my machine gupdate1ca54[more hex digits] - it also links to googleupdate.exe.
Ugh, of course, there are work-arounds. But if you re-read my comment, I said it is hardcoded in Chrome. I was talking about Chrome.

Another point: Your method will disable all google updates (google toolbar, google talk etc) which is a good side effect imo but not necessarily desirable by all.

It's not hardcoded in Chrome, at least on Windows it's not. I'm currently running 4.1.249.1045, which I gather isn't particularly recent, because I seldom use it except for Facebook and other sites I don't trust to be logged in to for general browsing.
Please do check and tell if you have the Google Updater service running and that it is working fine?

Else, please tell how you managed to turn off automatic updates in Google Chrome?

Google Updater is not running. I turned it off with Autoruns, like I said in my other comment.
Then how is that NOT a workaround? You are simply putting forth an argument which does even pertain to the point I was making.
That's a very bad "feature". On some connections I pay for every MB downloaded.
I agree it's questionable from a money standpoint, but not updating your browser is questionable from a self-preservation standpoint, as well.

(But I also agree that should be your decision to make.)

The compression Chrome uses on the diffs is pretty hardcore:

http://www.chromium.org/developers/design-documents/software...

So you can at least be reasonably certain that your browsing bandwidth dwarfs the Chrome updates, FWIW.

I don't understand why they're taking that decision away from me. They could just enable auto update by default so most users would always be up-to-date unless they have a reason for disabling it. There are some good reasons other than money as well, such as privacy and security. I don't want my computer updated in any shape or form when I'm on an airport or in an authoritarian country for instance.

I don't know whether a Chrome update is dwarfed by regular browsing. The link you posted shows the size of one particular diff update they did. That's a completely worthless measure. The worst case, no doubt, is that everything has to be replaced and that would be 10MB.

Security-wise I'd be very surprised if Chrome updates weren't signed; MITMing of auto-updates isn't exactly new (see EvilGrade). So I doubt it's an issue there.

That said, I agree that there should be an option (not a prominent one) to switch it off.

Fortunately, the auto-update feature doesn't work on my Linux machines.
Chrome's auto-update feature on Debian-based distributions at least consists of it installing its apt repository in your sources.list. Which is fine by me.
Same here. Everything is managed via Synaptic update manager and Chrome gets updated only after I hit the button 'Install updates'.
Then why is my Chrome still on version 3?