Signal-desktop: Allow users to control the frequency of updates

[nrrkeene]

• [ X] I have searched open and closed issues for duplicates. The only duplicates have been closed or ignored for years.

---

Bug Description

Signal Desktop bothers users every single day or multiple times per day to update by entering an admin password. Users should have control over update frequency.

My personal experience is that of all the software on my computer, Signal generates 95%+ of the demands for entering admin passwords. This alone is a significant security failure in addition to being annoying.

Steps to Reproduce

1. Launch Signal Desktop
2. Wait for a few moments or minutes
3. Via the OS, Signal will ask for an admin password to update itself
4. If the user goes through with the update, a new one will appear minutes or hours later -- maybe a day at the most
5. If the user presses cancel, the dialog box will either reappear immediately repeatedly, or soon thereafter

Actual Result:

In no event does Signal actually cancel the update forever, as the user instructed. Nor does installing an update provide reprieve from being asked again shortly after.

Expected Result:

Like all modern software, Signal should have a user control to set the maximum frequency at which users wish to be bothered to update. Users who fail to install critical updates should be notified that their software is no longer compatible with the wider system if and only if that is verily true.

Discussion

I understand why Signal developers feel their software is important -- because it is. I understand why updates might be critical -- because sometimes they are. I sympathize that every line a programmer writes feels super important for every single user -- because I write code and have the same feeling.

But the end result in this software is that the user experience is so annoying that users are forced to take their own steps such as blocking the URLs that Signal looks up to perform its updates. This must be worse than the possibility of running older software. Once a user has completely blocked updates you don't even have an occasional opportunity to ask them to update.

The updates are _constant_, every single day I get a new demand, and then quite often another one on the same day. Whatever frequency you are pushing out updates, they cannot possibly all represent critical security issues -- and even if they did, user control is still paramount. All modern software has this user control; Signal is not so different that it alone has good reason to lack it.

Screenshots

Platform Info

Signal Version:

v1.36.2

Operating System:

OS X 10.15.6

[nrrkeene]

I took a screenshot of the dialog box to create this issue, then pressed Cancel on it. When I submitted the bug a few minutes later, just a moment ago, a new dialog box appeared. That was about five minutes. _Literally every five minutes_ this software is bothering me needlessly. No other software on my computer behaves like this.

[EvanHahn-Signal]

It sounds like there are two issues here.

The first: Signal is bringing up that password dialog every five minutes or so. That's annoying, but it doesn't happen on any of my macOS machines. Are you running in a non-administrator account? Or do you have any other security mechanisms in place that would cause this to show up?

The second: Signal checks for updates frequently, and you'd like it to be configurable.

Does that sound right?

[Bloo-dev]

I can confirm this.

I really like Signal, but the frequency of updates is quite annoying.

I completely understand that updates are important, but instead of pushing a full update every day, bundled updates would be better. As of right now, I barely get through a day without signal prompting me to update.
I would appreciate an option to opt out of non-essential updates, or simply a policy change to bundle updates instead of publishing them immediately.

[EvanHahn-Signal]

I've filed this as a feature request. Thanks for reporting, and sorry the frequency of our updates is annoying.

We've also filed a bug about the permission dialog on macOS, which is separate from the feature request in my mind.

[insyria]

I totally agree with above, Its super annoying for non-admin users.

I would also love to see the ability for sysadmins to control the update (Enable/Disable) via PLIST (defaults on mac) ... or by .mobileconfig :)

[gsatliawol]

I'll second this request, and raise it a bit. Firefox, Chrome, Vivaldi, iTerm2, Slack, a _lot_ of packages have a button "Check for updates." No such animal here. I saw the 1.38.1 release message come out, which I was hot for, because Emoji 13 (but I don't care to run beta, since my family depends on messaging to work)... and I'm like, dangit, I've got cycles, I want my update NOW...

Half a hour later it finally signaled (ahem) readiness... (Is there a dirty hack to make it trigger the check loop?)

(I do like the new button that will make it go'way for a bit if you want; used to be it was just "UPDATE ME NOW"... but a settable update frequency and a "gimme now" button would be EVEN BETTER.)