Microsoft is auguring that taking the responsibility out of the hands of users will keep the Web safer. This is not a new procedure for browser companies, but is an acknowledgement that Google’s model is proper methodology.
"It's the future ... for all software," said Andrew Storms, director of security operations at nCircle Security. "At this point, at least in the consumer space, people are expecting software to be up to date, and for it to do it itself."
Beginning in January it will roll out automatic upgrades of IE to the newest version suitable for a user's version of Windows. Windows XP users still on IE6 or IE7, for example, will be updated to IE8; Windows Vista or Windows 7 users running IE7 or IE8 will be pushed to IE9.
Previously, Microsoft has asked for user permission before upgrading IE from one version to the next, even if Windows' automatic updates are enabled.
The company will debut the new practice in Australia and Brazil next month, then expand the program gradually to other markets. Microsoft has not set a timetable for U.S. users.
While Chrome is the only browser that currently upgrades to the next version without asking users for permission, Mozilla is working on doing the same with Firefox. Mozilla has pushed back its schedule to release its auto update feature in Firefox 12, which is scheduled for April, 2012.
Microsoft will allow Users to retain control over when they want to update to new versions. So don’t worry about that. Enterprises using WSUS (Windows Server Update Service), or other patch management systems will not be affected. Microsoft is basically saying that if you set group policies through WSUS [to block automatic upgrades] that they are not going to override that.
Companies and individuals can also deploy the blocking toolkits that Microsoft had previously crafted for both IE8 and IE9 to stymie any auto-updating. Those kits can be downloaded from Microsoft's website. In future editions of IE -- meaning IE10 and beyond -- Microsoft will include an opt-out setting that users can select to disable automatic upgrades. While Chrome does not have such a setting, Firefox will when it eventually launches silent updates.
This seems to be a good balance between Microsoft’s desire to get consumers on the newest IE and retain its traditional conservatism where enterprises are concerned.
IE security updates, which are delivered every other month through Windows updates, will not be affected, as they are already silently downloaded and applied if users opt in to automatic updates.
Overall I view this turn of events as positive. Most of the work we do with systems these days are still cleaning systems of Malware, usually caught from visiting websites. So forcing an update to your browser only makes sense in the ongoing battle against the Malware creators. I applaud Microsoft for finally taking this approach.