3 ms·

> trusting this browser-based solution isn’t fundamentally different from trusting an installed application that can update itself. Which is still a bad idea t

> trusting this browser-based solution isn’t fundamentally different from trusting an installed application that can update itself. Which is still a bad idea to trust, so I'd say that it is a logical extrapolation.

giaour 9y ago
We trust applications like that all the time. Browsers update themselves, and we trust them to secure our communication with banks, governments, health providers, etc. Most browsers now also store passwords in an encrypted secret repository. If you're on Windows or OSX, your OS is also constantly updating itself with closed-source binary blobs. I mean, sure, you can never use an auto-updating application again and always manually review system updates before installing them. But realistically, I don't see anyone besides Richard Stellman adopting that lifestyle.
- CaptSpify 9y ago
  > We trust applications like that all the time Sure, nobody ever said otherwise. But that doesn't mean it's a good idea. The software I use is open-source, so I can see what I'm running, and what updates I get. I also don't use any auto-updates. The web is inherently different in that I can't really guarantee that the code I get is going to be the same code that you are getting.
  - damnyou 9y ago
    I hope you've thought very carefully about your threat model when you say you don't autoupdate. For most people your advice is quite plainly wrong. Most people should have everything on autoupdate.
    - galaxyLogic 9y ago
      Right. Point is there are two types of bad downloads. You can download a version which is not malicious but is insecure. Then auto-updating it makes it more secure. Or you can auto-update to a version which is malicious. Then you are screwed. But your previous version you downloaded to start with might have contained the threat to start with. So just saying don't auto-update does not really protect you from malicious versions. Auto-updating does mean that you get updated security fixes making you less vulnerable. The original non-updated version can be malicious even with a vendor you think you should be able to trust because it is a popular product used by many others: https://www.piriform.com/news/blog/2017/9/18/security-notification-for-ccleaner-v5336162-and-ccleaner-cloud-v1073191-for-32-bit-windows-users https://www.piriform.com/news/blog/2017/9/18/security-notifi...
- cyphar 9y ago
  > We trust applications like that all the time. Browsers update themselves, Not if you're using a Linux distribution's browser packages (we patch out the auto-update code because you should always update through the package manager). And distributions build their own binaries, making attacks against builders much harder. While people might trust auto-updating applications, they really shouldn't. And there are better solutions for the updating problem.

giaour 9y ago

We trust applications like that all the time. Browsers update themselves, and we trust them to secure our communication with banks, governments, health providers, etc. Most browsers now also store passwords in an encrypted secret repository. If you're on Windows or OSX, your OS is also constantly updating itself with closed-source binary blobs. I mean, sure, you can never use an auto-updating application again and always manually review system updates before installing them. But realistically, I don't see anyone besides Richard Stellman adopting that lifestyle.

CaptSpify 9y ago
> We trust applications like that all the time Sure, nobody ever said otherwise. But that doesn't mean it's a good idea. The software I use is open-source, so I can see what I'm running, and what updates I get. I also don't use any auto-updates. The web is inherently different in that I can't really guarantee that the code I get is going to be the same code that you are getting.
- damnyou 9y ago
  I hope you've thought very carefully about your threat model when you say you don't autoupdate. For most people your advice is quite plainly wrong. Most people should have everything on autoupdate.
  - galaxyLogic 9y ago
    Right. Point is there are two types of bad downloads. You can download a version which is not malicious but is insecure. Then auto-updating it makes it more secure. Or you can auto-update to a version which is malicious. Then you are screwed. But your previous version you downloaded to start with might have contained the threat to start with. So just saying don't auto-update does not really protect you from malicious versions. Auto-updating does mean that you get updated security fixes making you less vulnerable. The original non-updated version can be malicious even with a vendor you think you should be able to trust because it is a popular product used by many others: https://www.piriform.com/news/blog/2017/9/18/security-notification-for-ccleaner-v5336162-and-ccleaner-cloud-v1073191-for-32-bit-windows-users https://www.piriform.com/news/blog/2017/9/18/security-notifi...
cyphar 9y ago
> We trust applications like that all the time. Browsers update themselves, Not if you're using a Linux distribution's browser packages (we patch out the auto-update code because you should always update through the package manager). And distributions build their own binaries, making attacks against builders much harder. While people might trust auto-updating applications, they really shouldn't. And there are better solutions for the updating problem.