Google Software Update sneaks its way onto computers

This article was originally on a blog post platform and may be missing photos, graphics or links. See About archive blog posts.

Software developers generally use one of three ways to alert and deliver version updates to users: a pop-up prompt when you launch the app, a systemwide refresh tool -- like the App Store for the iPhone and Firefox’s add-on framework -- or nothing at all (they just hope the user checks their website at some point).

But then there’s a fourth option -- one perhaps even worse than the ‘not tell you’ approach. That’s the standalone program, installed by a company, that looks for all updates to its suite of software.

We see this only in a few cases, when a development house has the audacity to assume you use so much of its software that you need an entirely separate program just to check for bug fixes. As Google’s recent use of this shows, the execution can be anything but sweet.

For the record, I have no problem with Apple’s Software Update app for the Mac or Microsoft’s Windows Update on PCs. Obviously, if you’re using a Mac, you have a great deal of Apple software and vice versa.

But Microsoft’s AutoUpdate for Mac oversteps the operating system boundary. AutoUpdate latches on to a system after you install Microsoft Office and will periodically check for updates to those programs. Companies like this method because it keeps users informed about whatever tweaks the developer wants to throw at them. (Fortunately, AutoUpdate allows you to disable it in its preferences.)

Google has jumped on the bandwagon, too -- or rather, sneaked onto the wagon with ninja-like furtiveness. Like AutoUpdate, Google Software Update checks for new versions of Google software in the background, and it pops up a window when it finds something.

I saw it for the first time today. There I was, composing e-mails, and then, out of nowhere, an alert for ...

... an update to GoogleTalkPlugin -- a framework for video chat within the Gmail Web interface. After much prodding from a friend, I had installed the plug-in on a lark a month ago, when Google announced the feature. After a brief test, I quickly forgot about it.

As it turns out, when I installed the tiny plug-in, I also gave a free pass for Google’s software updater to come along for the ride. Thanks for the memo, Google.

Now, software companies don’t really appreciate when writers compare their products to a Trojan horse (you know, because of the whole computer virus connotation). But when I download a program and some unwanted junk comes onto my computer without my knowledge, it’s a classic Trojan scenario.

Google did not immediately respond to a request for comment. But I’m willing to bet the company wouldn’t have liked that analogy.

The updater doesn’t appear to do anything harmful, per se. But it’s annoying. Although it’s well-hidden, it runs constantly and cannot be disabled unless you remove the software it’s associated with. Only a few apps are supported at the moment -- the Talk plugin, App Engine and Google Earth Plugin, among them.

Google provides very little documentation on Software Update -- only a couple of Web pages for third-party developers to code their programs to tie in with Update Engine.

A few bloggers have sounded off on the ‘security breach,’ as some call it. A Google employee, who goes by the name Roman N, responded to concerns on a developer message board, saying, ‘We’ll look into modifying the wording on the installer splash page to clarify this auto update procedure.’

Well, at least they’re looking into it.

My advice to any developers who think their software is so awesome that it should have its own standalone program for updates: Don’t. And if you think it’s absolutely necessary, at least tell your users about it.

-- Mark Milian