Why Silent Updates Boost Security
📜 Abstract
Security fixes and feature improvements don’t benefit the end user of software if the update mechanism and strategy is not effective. In this paper we analyze the effectiveness of different Web browsers update mechanisms; from Google Chrome’s silent update mechanism to Opera’s update requiring a full re-installation. We use anonymized logs from Google’s world wide distributed Web servers. An analysis of the logged HTTP user-agent strings that Web browsers report when requesting any Web page is used to measure the daily browser version shares in active use. To the best of our knowledge, this is the first global scale measurement of Web browser update effectiveness comparing four different Web browser update strategies including Google Chrome. Our measurements prove that silent updates and little dependency on the underlying operating system are most effective to get users of Web browsers to surf the Web with the latest browser version. However, there is still room for improvement as we found. Google Chrome’s advantageous silent update mechanism has been open sourced in April 2009. We recommend any software vendor to seriously consider deploying silent updates as this benefits both the vendor and the user, especially for widely used attack-exposed applications like Web browsers and browser plug-ins.
✨ Summary
Overview
The paper evaluates how effectively different browser update mechanisms move active users to the latest minor release. The authors analyze anonymized HTTP user-agent logs from Google’s globally distributed Web servers, deduplicate visits using Google PREF cookies, and compare version adoption during the first 21 days after release. The analysis is restricted primarily to minor-version updates within the same browser major version; Microsoft Internet Explorer is not included in the main comparison because its user-agent string did not expose minor-version information. (tik-old.ee.ethz.ch)
The central finding is that update design strongly affects security exposure. Among the browser releases studied through mid-April 2009, Google Chrome’s silent updater achieved approximately 97% adoption after 21 days, Mozilla Firefox reached approximately 85%, Apple Safari approximately 53% for its best-performing release, and Opera approximately 24%. Firefox had the fastest initial uptake during the first five days, but its adoption curve flattened below Chrome’s eventual level. The authors attribute Chrome’s performance to background discovery, download, and installation with minimal user interaction, while Safari’s weaker results were partly associated with operating-system eligibility requirements and Opera’s results with a manual reinstallation process. (tik-old.ee.ethz.ch)
The paper identifies several residual causes of incomplete Chrome adoption: updates took effect only after browser restart, users were not initially prompted to restart, some installations used read-only images, insufficient privileges or network filtering could block updates, and modified clients could report stale user-agent strings. It therefore recommends silent updates as a default for widely deployed, attack-exposed software, while suggesting a non-disruptive restart notification for security updates. It also argues that highly exposed applications such as browsers and plug-ins should generally receive security patches as soon as they are available rather than being delayed solely to fit predictable enterprise patch schedules. (tik-old.ee.ethz.ch)
Subsequent influence
The paper’s measurement approach and conclusions were carried forward by the authors in the later publication Web Browser Security Update Effectiveness, which extended the browser-update analysis and is listed in subsequent scholarly bibliographies alongside the technical report. Later work on software-update behavior, including studies of smart-device updates, user update messages, operating-system upgrades, and system-administrator practices, cites the report as an early empirical source connecting update ergonomics and automation with security outcomes. (researchgate.net)
The findings also received contemporaneous industry and operational attention. Ars Technica reported the Chrome–Firefox advantage over Safari and Opera, while CERT-FR referenced the report in guidance discussing update procedures and the Google Omaha updater. The evidence therefore contributed to the early public and research discussion of background or silent updating as a security mechanism, although the sources located here do not establish that the report alone caused any particular product-policy change. (arstechnica.com)