A former community discussing the business of software, from the smallest shareware operation to Microsoft. A part of Joel on Software.
We're closed, folks!
Doug Nebeker ("Doug")
I want my apps to periodically prompt the user that an update may be available at my website. Rather than checking a remote server for it, which involves the user permitting with a firewall and then wondering what the hell else my app might be doing online, I've decided to write a temp file to the app's folder at install, which the app will check the file date of later.
I was thinking that if the file is 3 months old, I'll pop up a messagebox asking if the user wants to go to the website to see if an update is available. If they click no or hit Escape, the app won't check again for another 3 months (by recreating the "trigger" file).
My question: is every 3 months too soon? I wouldn't think so, because they just have to hit the Escape key to cancel it, less than 1 second's action, not to be bothered again for another 3 months.
Or should I do it for every 6 months? Thoughts?
Okay, I've made the choice that 6 months is probably better. That way, the user only gets asked twice a year. Here's what the prompt looks like:
Would such a quick prompt, twice a year, bother you guys?
Not exactly an answer to your question, just an opinion on the issue.
Our app checks for updates by calling home (a simple HTTP request returning the latest available version number and the text listing of changes to show to the user). Of the thousands licenses sold to tech audience we had exactly 0 complains about this behavior. Are you sure it is a problem for your audience?
As regards to firewalls, our installer adds an exception to Windows firewall since it is required for proper operation of the app anyway (it needs to accept connections). The side effect of this exception is that it can also do outgoing connections.
YMMV, of course.
"Our app checks for updates by calling home"
Definitely the preferred way to do it, if the user chooses to not allow a firewall exception and the app can function offline all the time, then allow for a manual update check instead of automatic. And don't run your update check as a service that calls home with every logon or restart, have it take place once you app has been open for long enough that every UI object is loaded and running. Nothing worse than waiting to use your machine while Adobe, Symantec, Oracle and Microsoft fight over who gets to run Automatic Updates first.
"we had exactly 0 complains about this"
It bothers me every time and I've never complained, no point in complaining, you just get snarky comments stating you're the only person complaining.
There may be thousands that don't like it. Judging by number of complaints is useless.
Some people like it others don't.
Here is the best practice.
If you have auto update checks, the first time ASK the user if it is OK. You should list EXACTLY what information is transmitted - is it the user's registration name and his computer configuration, and a list of all his installed software and his address book? Or is it the current version only, and no other info?
Options should be along the lines of:
( ) Check every startup
( ) Check every month
( ) Never check automatically / Manual check only
There should also be a [Check Now] button.
This is the way it is done in most decent software these days.
Extremely annoying is not allowing 'manual only'. Also very annoying is software by Adobe that erase your old setting and resets to "check every startup" every single time you manually install an update. Also annoying is not being told exactly what information is sent. Some really nice software actually shows you a text pane with the exact info sent before sending it.
Adding exceptions to the Windows firewall defeats the purpose of a firewall altogether, because any app can do it and let data in/out without the user knowing. A respectable firewall should always alert the user when an app is letting data in/out.
My philosophy is that my app is a guest on a PC's system, so I will ask for permission to do anything that causes concern.
"I've never had any issues with Windows Firewall"
Two possibilities: one, all communication is done over ports 80, 8080 and 25, which will be open by default unless the machine is tightly locked down. UAC is part of security settings, but not a function of Windows Firewall per se. Two, even in corporate settings, users are typically (90%+?) created as administrators on a local machine. To avoid excessive support tickets, those same "local administrators" will be given lots of privileges for domain logons as well. It's not ideal, but it's life.
>> I've never had any issues with Windows Firewall. Even on a fresh VM. Is it because it's a signed app?
On a fresh Windows install nothing outbound is blocked by Windows Firewall. It is fairly difficult to setup and manage outbound blocking so most people that are interested in doing that would be using a 3rd party program, either a separate firewall or one that manages the Advanced Windows Firewall settings.
I agree with Scott's suggestion. You should get permission the first time or at least have a way to disable automatic updates.
But once you get permission, you should actually perform the update check. As a user, being told there *might* be an update available is not very helpful. Is there or isn't there? If there isn't an update, then don't interrupt me.
This might be beyond the scope of your question, but how does your update mechanism work? As a user, I really want it to be one-click, otherwise there's no point in having an automatic update check. For one thing, I'm too busy actually using your software that I don't want to be interrupted with an update. If it's fast and easy, then I'll do it. The most annoying thing is when an updater simply takes me to the download page of the vendor's website and I have to manually download and install the new version. Not only do I not want to be bothered with all that, but I have questions about the process that usually go unanswered. Can I install the new version over the old version? Do I have to remove the old version? What's going to happen to my data? And so on.
Monday, February 11, 2013
The best update strategy is a silent update (see Chrome). Don't tell, don't ask. Software takes care itself, users are happy, etc. That said there should be a choice: do nothing, inform about latest version, silently download and update. Of course it should be performed in the background so if "home" is not responding or firewall is blocking the app remains responsive.
Monday, February 11, 2013
Maksym Sherbinin: 'The best update strategy is a silent update (see Chrome). Don't tell, don't ask. Software takes care itself, users are happy, etc. That said there should be a choice: do nothing, inform about latest version, silently download and update. Of course it should be performed in the background so if "home" is not responding or firewall is blocking the app remains responsive.'
The best update strategy depends on the situation. I definitely do not want my software auto-updating. You could be breaking my setup by doing it. I have three systems that I keep in sync. One of them is never on the Net.
Gene Wirchenko: "The best update strategy depends on the situation."
I agree. This is why I don't auto-update (silently or not) server side components. On the other hand if app is 100% client-based why not? Customers are getting updates promptly and you can gather some useful information in the process. Of course there should be a way to turn auto-update off completely.
Wednesday, February 13, 2013
This topic is archived. No further replies will be accepted.Other recent topics
Powered by FogBugz