4 ms·
> We trust applications like that all the time Sure, nobody ever said otherwise. But that doesn't mean it's a good idea. The software I use is open-source, so
by CaptSpify 9y ago
> We trust applications like that all the time
Sure, nobody ever said otherwise. But that doesn't mean it's a good idea.
The software I use is open-source, so I can see what I'm running, and what updates I get. I also don't use any auto-updates. The web is inherently different in that I can't really guarantee that the code I get is going to be the same code that you are getting.
- damnyou 9y agoI hope you've thought very carefully about your threat model when you say you don't autoupdate. For most people your advice is quite plainly wrong. Most people should have everything on autoupdate.
- galaxyLogic 9y agoRight. Point is there are two types of bad downloads. You can download a version which is not malicious but is insecure. Then auto-updating it makes it more secure. Or you can auto-update to a version which is malicious. Then you are screwed. But your previous version you downloaded to start with might have contained the threat to start with. So just saying don't auto-update does not really protect you from malicious versions. Auto-updating does mean that you get updated security fixes making you less vulnerable. The original non-updated version can be malicious even with a vendor you think you should be able to trust because it is a popular product used by many others: https://www.piriform.com/news/blog/2017/9/18/security-notification-for-ccleaner-v5336162-and-ccleaner-cloud-v1073191-for-32-bit-windows-users https://www.piriform.com/news/blog/2017/9/18/security-notifi...