Yeah, the alternative is running a system with a ton of outdated software, with known bugs and active exploits while casually surfing the "oh-so-cosy-and-entirely-harmless" WWW...
The goal is not to ostracize automatic updates, but to have faster fixes.
Or to separate security updates from feature updates, but I think this ship has long sailed for modern browsers.
The goal is to fully control your environment and not to expecting some unexpected updates.
User is the one who must choose update policy. If user is choosing to not update then it's their own problem and no manufacturer has the right to deside otherwise.
You... do understand that that's self-contradictory, right? It's impossible for both parts of that sentence to be true.
If telemetry really had "nothing to do with" the bug, then the fact that telemetry "just happens to be one of the first services with H3 load balancer" wouldn't trigger the bug.
Good question. Because for security reasons you want to stay up-to-date on software that connects to various websites. At the same time, from a functionality point of view I wished I'd never have to update anything.
It's not a question of avoiding updates altogether, but the sad reality that it always seems to choose the most inconvenient and/or expensive time to do it. If they'd just do as Thunderbird does -- notify me that there's an update and ask me what action I'd like to take -- there'd be no problem. As it is, being unable to choose when the update happens is unacceptable.
FWIW I've tried every documented setting, "enterprise" policies, etc. to prevent automatic updates in FF, but nothing seems to stick.
It's not happening to me with Firefox 95.0.1 on Ubuntu 20.04. I'm disabling http3 anyway. Re-enabling it when Mozilla will explain what's going on.
Edit: reading further comments it occurred to me that maybe I'm not affected because I'm not sending any data to Mozilla so I don't hit their HTTP3 load balancer.
Disable telemetry while you're at it: "Firefox Data Collection and Use" in settings. It seems to have re-enabled itself on some silent update. Sneaky bastards.
I was surprised to find I had telemetry enabled. I could have sworn I disabled it, but it would have been a long time ago, so I was thinking maybe I remember it wrong.
I would like to see any source that may exist on it having been silently re-enabled. I know telemetry is anonymized and totally harmless or whatever, but re-enabling it behind my back would feel like such a breach of trust.
I keep a careful log of such stuff and I'm 100% sure that I disabled it on all machines here. This definitely got re-enabled silently at some point, I am trying to figure out when. Not having such crap is the reason I use Firefox so it is hard to express my disappointment at this.
