For me, Brave automatically checks for a new version, but never downloads it automatically. Instead, I get a polite popup reading, “A new version fo Brave Browser is available! … Would you like to download it now?” with a link to the release notes as well as buttons to “Install Update”, “Remind Me Later”, or “Skip This Version”.
What wizardry have I performed for this option? I simply don’t log in to my computer as an admin user.
MacOS handles this beautifully; when software I’m running needs admin privileges (for instance, after choosing “Install Update” above), I get a prompt from the operating system for a username and password with admin privileges. This is a small price to pay for the added control and safety I get in return.
I highly recommend it!
NB this behavior could change in future versions of Brave; I see that in issue 9562 – https://github.com/brave/brave-browser/issues/9562 – this behavior is being treated as a bug. That is the Google Chrome team’s attitude as well; in Chrome, there is no user-accessible way to turn off autoupdates. The primary motivation is security: to keep browsers secure, you have to feed them autoupdate bandwidth. It’s not about belittling or patronizing users; it’s about shrinking the practical attack window for a given exploit as much as possible, so that exploits can’t scale as well, so they become less valuable. Autoupdates make us collectively better off.