TL;DR: Don’t bother unless you’re messing with a programmer that’s over a decade old.

As part of figuring out why I couldn’t use a USBtiny on OSX I ended up with a pair of USBasp programmers. When using one to make LEDs blink, I got the following output from avrdude:

avrdude: warning: cannot set sck period. please check for usbasp firmware update.

So, I went over to the USBasp site and grabbed the latest firmware. Then I did the following:

1. Set voltage jumper to 5v on both USBasps
2. Bridge 2-pin self-programming jumper next to the voltage jumper on the target USBasp
3. Connect the target USBasp and the programming USBasp with the 10-pin ribbon cable
4. Plug the programming USBasp into a USB2 port
5. Back up the firmware with

   % avrdude -c usbasp -p atmega8 -U flash:r:usbasp.bin.bak:r
   

6. Write the new firmware with

   % avrdude -c usbasp -p atmega8 \
   -U flash:w:./usbasp.2011-05-28/bin/firmware/usbasp.atmega8.2011-05-28.hex
   

Now, to test out my shiny new firmware to flash an atmega318p:

% avrdude -c usbasp -p atmega328p
...
avrdude: initialization failed, rc=-1
Double check connections and try again, or use -F to override
...

Oh. It was definitely a problem with the programmer, though, because the other USBasp worked fine. So, plug everything back in, re-bridge the self-programming jumper, and

avrdude -c usbasp -p atmega8 -U flash:w:usbasp.bin.bak

The moral of the story is to just ignore that avrdude warning. The firmware on generic USBasp programmers coming straight out of Shenzhen is actually just fine how it is.