5 ms·

This has became the new normal it seems. Just like it's acceptable to reboot a computer without a user's permission, losing all their work (or to start it in th

This has became the new normal it seems. Just like it's acceptable to reboot a computer without a user's permission, losing all their work (or to start it in the middle of the night and not switch it back off). This is purely something that these companies do for their own good without any regard for the user. They probably think "What are you going to do about it? Install Ubuntu?"

collectively 9y ago
Do for their own good? I see this as for the collective good, as most of the people hurt by unpatched software are NOT microsoft but people, small businesses, and the victims of the resulting botnets. Obviously if you know what this is you can turn it off.
- marksomnian 9y ago
  The issue with having an off switch is that non-tech-savvy people will blindly follow some instructions to disable it and will get caught by a major security vuln. Case in point: when Chrome throws a TLS error, you could type "danger" to bypass it, but they had to change it because businesses started teaching users to bypass errors blindly. Not exactly apples to apples, but similar enough in my mind. If users blindly disable updates, they won't be updated when there's a major security patch.
  - Trav5 9y ago
    A good reminder that if a software company is given enough trust to auto update, keeping that trust us important. Seems the big boys have been breaching that trust a lot lately.
  - collectively 9y ago
    This is true. But i’m ok with stupidity hurting individuals—at least in terms of compromise—i’m less ok with default settings being potentially insecure one day.
- userbinator 9y ago
  The decision should ultimately be up to the user. This sort of subtle authoritarianism in the name of "security" is quite frankly extremely disturbing, and the companies are using it to force what they want by bundling plenty of other highly disruptive and completely-non-security changes too. I could go into a more political direction here, but looking at some of the other changes that have happened to society in general lately, I'm not surprised at all. Disappointed, but not surprised.
  - collectively 9y ago
    I mean, I’d rather just not have internet connected devices at all. But the internet is a commons, and people who don’t patch ruin it for everyone. But, there’s a difference between auto update by default and forced updates. And there’s, again, the option of buying the same thing with no internet connection—pretty much nothing you own needs to be connected to the internet at all.
danpalmer 9y ago
> Just like it's acceptable to reboot a computer without a user's permission, losing all their work To play devil's advocate, the system provides great APIs for preserving work during reboots (above and beyond just saving to files, full state restoration of all UI in the system frameworks). It's arguably only poorly designed software that does not do this. I don't fully believe this, but it's one way of looking at it. For pro users, shouldn't be rebooting, for most users, they shouldn't notice.
- userbinator 9y ago
  Applications shouldn't need to care, because the computer should not ever be rebooted for the vast majority of security updates --- the ones that everyone will be fine with (even those who otherwise hate upgrading), the ones that fix things like buffer overflows, the ones that actually matter to security. It is highly irritating to see that the "patch" to fix one unchecked buffer copy turns out to require half a dozen whole-file-replacements and takes tens of MB, when ultimately only a handful of bytes needs to be changed. Perhaps these companies should learn from the crackers and reverse-engineers and make patches that are actually patches: find and modify the appropriate bytes in memory, and also the file on disk. Those who have used crack/noCD/etc. patchers will know how fast and painless the experience is. The changes are instant and persistent, with no disruption at all. If such a system was used, I would guess that security updates may, instead of the hundreds of MB or even GB they take today, and take tens of minutes or more to install (not even counting the productivity lost by the obligatory reboots), only be MB at most --- with the majority being several KB, install instantly, and present absolutely no disruption. Related: https://news.ycombinator.com/item?id=15720923 https://news.ycombinator.com/item?id=15720923
  - keithpeter 9y ago
    drpm files on Fedora 25+ spring to mind, along with jigdo and zsync (Debian, Ubuntu - for full isos). I'm sure they will get there, but then perhaps different installs have a different set of files that need to be replaced?
fvargas 9y ago
> Just like it's acceptable to reboot a computer without a user's permission, losing all their work This is something I've found fault with in Windows, and was greatly disappointed to see happen in Sierra. I had been getting the High Sierra update reminder notification once a day for several days and normally just clicked "Remind me tomorrow" (since there's no option for "Don't remind me"). One day after having it pop up, I instead clicked "Try in an hour". I expected this to ask me again in an hour, at which point I would choose whether or not to proceed with the update. Instead, while my MacBook was asleep with work open, it went ahead and updated the OS without my consent. I don't (think) I lost any work, as I typically save things and Vim didn't leave any swp files. But the experience was disconcerting and bitterly reminiscent of Windows...
psyc 9y ago
I’ve had it up to here with pushy updates. Tragedy of the commons: every app thinks it’s important enough to update several times per week. On any given day, at least one of Windows, Firefox, VSCode, or myriad other less important apps wants to update before it runs. Talk about pessimising app start times! App start time is now the time to download and reinstall! Windows FCU silently borked 6 of my machines by steamrolling drivers I had carefully selected for stability and performance. Broke GPU and Wifi on 5 of those, and it took me half a day to figure out what changed. On my main dev machine, Windows Update got into an infinite loop of churning the disk 100% and never finishing. Every fix I tried did nothing, until finally I disabled all WU services. So in resignation, I did install Ubuntu. And was quickly reminded why I don’t use it. Ironically, the productivity-killer there is also about updates: for any app I need to run properly, I have to update its whole lineage of dependencies, often manually, and work out which versions it likes. So I’m reluctantly back to Windows. I’ve just changed all the update settings I can find to ask me or just leave me alone and let me get a little work done.

collectively 9y ago

Do for their own good? I see this as for the collective good, as most of the people hurt by unpatched software are NOT microsoft but people, small businesses, and the victims of the resulting botnets. Obviously if you know what this is you can turn it off.

marksomnian 9y ago
The issue with having an off switch is that non-tech-savvy people will blindly follow some instructions to disable it and will get caught by a major security vuln. Case in point: when Chrome throws a TLS error, you could type "danger" to bypass it, but they had to change it because businesses started teaching users to bypass errors blindly. Not exactly apples to apples, but similar enough in my mind. If users blindly disable updates, they won't be updated when there's a major security patch.
- Trav5 9y ago
  A good reminder that if a software company is given enough trust to auto update, keeping that trust us important. Seems the big boys have been breaching that trust a lot lately.
- collectively 9y ago
  This is true. But i’m ok with stupidity hurting individuals—at least in terms of compromise—i’m less ok with default settings being potentially insecure one day.
userbinator 9y ago
The decision should ultimately be up to the user. This sort of subtle authoritarianism in the name of "security" is quite frankly extremely disturbing, and the companies are using it to force what they want by bundling plenty of other highly disruptive and completely-non-security changes too. I could go into a more political direction here, but looking at some of the other changes that have happened to society in general lately, I'm not surprised at all. Disappointed, but not surprised.
- collectively 9y ago
  I mean, I’d rather just not have internet connected devices at all. But the internet is a commons, and people who don’t patch ruin it for everyone. But, there’s a difference between auto update by default and forced updates. And there’s, again, the option of buying the same thing with no internet connection—pretty much nothing you own needs to be connected to the internet at all.

danpalmer 9y ago

> Just like it's acceptable to reboot a computer without a user's permission, losing all their work To play devil's advocate, the system provides great APIs for preserving work during reboots (above and beyond just saving to files, full state restoration of all UI in the system frameworks). It's arguably only poorly designed software that does not do this. I don't fully believe this, but it's one way of looking at it. For pro users, shouldn't be rebooting, for most users, they shouldn't notice.

userbinator 9y ago
Applications shouldn't need to care, because the computer should not ever be rebooted for the vast majority of security updates --- the ones that everyone will be fine with (even those who otherwise hate upgrading), the ones that fix things like buffer overflows, the ones that actually matter to security. It is highly irritating to see that the "patch" to fix one unchecked buffer copy turns out to require half a dozen whole-file-replacements and takes tens of MB, when ultimately only a handful of bytes needs to be changed. Perhaps these companies should learn from the crackers and reverse-engineers and make patches that are actually patches: find and modify the appropriate bytes in memory, and also the file on disk. Those who have used crack/noCD/etc. patchers will know how fast and painless the experience is. The changes are instant and persistent, with no disruption at all. If such a system was used, I would guess that security updates may, instead of the hundreds of MB or even GB they take today, and take tens of minutes or more to install (not even counting the productivity lost by the obligatory reboots), only be MB at most --- with the majority being several KB, install instantly, and present absolutely no disruption. Related: https://news.ycombinator.com/item?id=15720923 https://news.ycombinator.com/item?id=15720923
- keithpeter 9y ago
  drpm files on Fedora 25+ spring to mind, along with jigdo and zsync (Debian, Ubuntu - for full isos). I'm sure they will get there, but then perhaps different installs have a different set of files that need to be replaced?

fvargas 9y ago

> Just like it's acceptable to reboot a computer without a user's permission, losing all their work This is something I've found fault with in Windows, and was greatly disappointed to see happen in Sierra. I had been getting the High Sierra update reminder notification once a day for several days and normally just clicked "Remind me tomorrow" (since there's no option for "Don't remind me"). One day after having it pop up, I instead clicked "Try in an hour". I expected this to ask me again in an hour, at which point I would choose whether or not to proceed with the update. Instead, while my MacBook was asleep with work open, it went ahead and updated the OS without my consent. I don't (think) I lost any work, as I typically save things and Vim didn't leave any swp files. But the experience was disconcerting and bitterly reminiscent of Windows...

psyc 9y ago

I’ve had it up to here with pushy updates. Tragedy of the commons: every app thinks it’s important enough to update several times per week. On any given day, at least one of Windows, Firefox, VSCode, or myriad other less important apps wants to update before it runs. Talk about pessimising app start times! App start time is now the time to download and reinstall! Windows FCU silently borked 6 of my machines by steamrolling drivers I had carefully selected for stability and performance. Broke GPU and Wifi on 5 of those, and it took me half a day to figure out what changed. On my main dev machine, Windows Update got into an infinite loop of churning the disk 100% and never finishing. Every fix I tried did nothing, until finally I disabled all WU services. So in resignation, I did install Ubuntu. And was quickly reminded why I don’t use it. Ironically, the productivity-killer there is also about updates: for any app I need to run properly, I have to update its whole lineage of dependencies, often manually, and work out which versions it likes. So I’m reluctantly back to Windows. I’ve just changed all the update settings I can find to ask me or just leave me alone and let me get a little work done.