8 ms·

Auto Updates without user interaction is the biggest security benefit I can think of for a normal user. Yes you read that right. It's f*cking great that my pare

Auto Updates without user interaction is the biggest security benefit I can think of for a normal user. Yes you read that right. It's f*cking great that my parents can use an always up to date browser and OS and I don't need to worry if they have updated all their stuff. Update mechanisms like for Java and other stuff which pop-up and require user interaction are a thing most people will not get right. Actually I really like the Chrome OS approach where it's done continuesly in the background. Not all people want to know what's going on under the hood and how the motor of their car works exactly. Some people just want to drive securely from A to B.

gcbw2 9y ago
that's the fallacy of people shipping bogus crap and you thinking you are at fault. Thanks google, i guess. Most new features on chrome are not for your security. They disable all referrer control options. Want to only send referrer to the domain you are at now? though lucky, google makes money on cross-domain referrer reporting so they can track conversion from their ads.
cesarb 9y ago
That makes me think of xkcd 463: auto updates might be better than the alternative, but we shouldn't be needing a constant stream of updates in the first place.
robotsonic 9y ago
I agree that there are certainly benefits to auto-updates, but where I tend to dislike them (especially on the phone), is where I have infrequently used apps. To stick with the Uber example, I don't live in a city with Uber, but have it on my phone for when I am. Why do I need to be burdened with using my data to constantly update an app I use once a year. This applies to a lot of apps (airlines, games, etc.). Games are really the worst offender as they tend to be quite large. Where release notes are provided in the app store, I will update if it is related to a critical security vulnerability, or something legitimate, but find it hard to rationalize constantly downloading 100+MB apps doing this for minor bug fixes that impact 0.001% of an apps user base.
- afterburner 9y ago
  > burdened with using my data There's usually a setting that forces updates to only download over a Wifi connection.
  - robotsonic 9y ago
    I do only do updates on wifi, however, internet is both expensive and data caps are quite low where I live. I'd rather watch one more Netflix show than download an app I don't often use four times a month. I agree with the comment below about this being an argument for delta updates.
  - hateduser2 9y ago
    There is on iOS
- gascan 9y ago
  Mostly this reads like an argument for delta updates.
- deleted 9y ago
  [deleted]
77pt77 9y ago
Auto Updates with new permissions authorized by default provided they belong to some ill defined permission group.
michaelt 9y ago
Auto Updates without user interaction is the biggest security benefit I can think of for a normal user. Auto updates are a great security benefit, yes. So it's a shame so many companies shit all over auto updates by rolling out poorly tested changes that introduce new problems, and similar behaviour that motivates users to disable auto updates.
- Thriptic 9y ago
  Agreed. You should be able to get automated security updates and optional feature updates.
  - SomeCallMeTim 9y ago
    Which would mean exponentially growing testing requirements on the part of the company delivering the updates. "Should" in an ideal world doesn't equal "should" in a world with deadlines and limited resources. It's enough work to ensure that all the features work with ONE version of an app. If you had to also test every version of the app without this or that feature update installed, you just continually multiply the testing requirements by the number of optional features. And don't say unit testing solves this problem. The problem is in INTEGRATION testing with the whole app, which 99% of the time can only adequately be done by making the build and having a human use it. Even automated integration tools won't find things like formatting errors and buttons too small for humans to click. I'd like to continue to maintain ONE app, please, and not `n!` app permutations.
    - deleted 9y ago
      [deleted]
    - Silhouette 9y ago
      Your premise seems to ignore that maintaining several versions, even with numerous highly dependent variations, is something that was the norm in the software industry until relatively recently. Microsoft famously managed it with Windows for a long time until they lost the plot. I've run Debian systems for many years and never had unattended-updates break a box. The trouble with today's highly connected world is that it has bred a culture of shipping software that isn't really production quality, on the basis that it can be fixed (or not) later and that's sufficient. This leads to arguments like your final paragraph: you (the developer) would obviously prefer to only maintain the latest and greatest of what you do, but stated without taking into account the consequences of that policy for your users/customers. While I have a lot of sympathy for your desire, as a developer myself, I think you can only justify that sort of position if your previous releases are sufficiently good that they don't need maintenance. Otherwise, if you have customers paying for one thing, and that thing is defective, and you then want to use those defects as leverage to push your customers to something that is not what they paid for, then I think you're on very shaky ground. There are a lot of ethical, economic and legal issues raised by that sort of business strategy.
13of40 9y ago
To continue the article's analogy: One night I scared off all of the workers with a stick and changed the locks on the car so they couldn't get back in. That worked great for the first several weeks, until one morning I woke up to find the car on blocks with its wheels, engine, and doors gone and an obscene message spray-painted on the windshield.
CodeMage 9y ago
The whole car metaphor is a bit unfortunate. Most people who want to drive securely from A to B would be pretty freaked out by a bunch of strangers quietly upgrading their car's brakes in the middle of the night. And they would definitely be pissed off if their car suddenly refused to accelerate beyond 25 mph on a clear, straight, empty stretch of dry road in broad daylight just because the speed limit happens to be 25 mph there. It's a matter of perception and ignorance. We've been trained, for lack of a better word, to perceive the execution of software on the hardware we own as something completely orthogonal to our ownership of that hardware.
- therealmarv 9y ago
  This argument can be also made positive. Imagine a new update (to be on your example, the new brakes) made the car safer and the saved your life because an accident could be avoided entirely. Otherwise you would be dead. It's not only negative... Btw. when thinking of Tesla cars.. they auto update their software remotely ;)
  - marssaxman 9y ago
    > when thinking of Tesla cars.. they auto update their software remotely That is one reason I will never buy one.
    - Silhouette 9y ago
      You are not alone. I drive a car that is relatively old now, but well maintained and in good working order. I have no interest in buying anything in the current generation of half-baked "connected cars", where critical systems are now connected to systems that are remotely accessible, but assumptions from another time underlie the architecture and security is bolted on as an afterthought if you're lucky. It's not as if the danger here is hypothetical. Leaving aside the immaturity of technologies like autonomous vehicles, I've seen way too many cars being compromised in more mundane ways, from theft because the remote unlocking mechanism was laughably easy to crack, right up to literally stranding a vehicle in the middle of a high speed road using a laptop that is somewhere else entirely. The consequences the first time someone compromises one of these remote systems and decides that every <some popular model> in the city should turn hard left or accelerate to 100mph or slam on the brakes are horrifying. Get back to me when we have the same level of scrutiny of these modern vehicles as we see in air travel, and when not getting security right poses an existential threat to the manufacturer's business, and then we can talk...
wvenable 9y ago
The problem is that security updates are bundled with feature updates, radical UI changes, and bleeding-edge bugginess. Nobody is arguing that the security benefit isn't there. Automatically installed Windows patches are fantastic. I hardly even notice them. Sometimes a patch will cause an issue with some software but that's an acceptable trade off. But then I get Candy Crush, or have to go through the setup again, or have all my display setting reset, get new "notifications", etc. These are not part of those security updates.
thomastjeffery 9y ago
> Auto Updates without user interaction Yes, but let's be clear about "without user interaction". That had better include "without user disruption". Windows 10 is one of the worst abusers here: Updates are forced, and during updates, the computer is suddenly unusable. That is not okay. Debian (derivatives, similar distros, etc.) has done it right for decades. Updates never block the user. Updates are consolidated, since every piece of software is a tracked package. The reason your parents don't want to update Java is because they remember how much of a pain it was 10 years ago, and it doesn't really feel different.
- dingaling 9y ago
  > Updates never block the user. Perhaps not intentionally but I always have "sudo pkill unattended-upgrades" close to hand when it pegs all my CPU cores whilst I'm trying to get something done.
  - CaptSpify 9y ago
    I think that actually adds more weight to the point. Even upgrades with the best of intentions can go wrong, and users should have the power to stop them when they do.

gcbw2 9y ago

that's the fallacy of people shipping bogus crap and you thinking you are at fault. Thanks google, i guess. Most new features on chrome are not for your security. They disable all referrer control options. Want to only send referrer to the domain you are at now? though lucky, google makes money on cross-domain referrer reporting so they can track conversion from their ads.

cesarb 9y ago

That makes me think of xkcd 463: auto updates might be better than the alternative, but we shouldn't be needing a constant stream of updates in the first place.

robotsonic 9y ago

I agree that there are certainly benefits to auto-updates, but where I tend to dislike them (especially on the phone), is where I have infrequently used apps. To stick with the Uber example, I don't live in a city with Uber, but have it on my phone for when I am. Why do I need to be burdened with using my data to constantly update an app I use once a year. This applies to a lot of apps (airlines, games, etc.). Games are really the worst offender as they tend to be quite large. Where release notes are provided in the app store, I will update if it is related to a critical security vulnerability, or something legitimate, but find it hard to rationalize constantly downloading 100+MB apps doing this for minor bug fixes that impact 0.001% of an apps user base.

afterburner 9y ago
> burdened with using my data There's usually a setting that forces updates to only download over a Wifi connection.
- robotsonic 9y ago
  I do only do updates on wifi, however, internet is both expensive and data caps are quite low where I live. I'd rather watch one more Netflix show than download an app I don't often use four times a month. I agree with the comment below about this being an argument for delta updates.
- hateduser2 9y ago
  There is on iOS
gascan 9y ago
Mostly this reads like an argument for delta updates.
deleted 9y ago
[deleted]

77pt77 9y ago

Auto Updates with new permissions authorized by default provided they belong to some ill defined permission group.

michaelt 9y ago

Auto Updates without user interaction is the biggest security benefit I can think of for a normal user. Auto updates are a great security benefit, yes. So it's a shame so many companies shit all over auto updates by rolling out poorly tested changes that introduce new problems, and similar behaviour that motivates users to disable auto updates.

Thriptic 9y ago
Agreed. You should be able to get automated security updates and optional feature updates.
- SomeCallMeTim 9y ago
  Which would mean exponentially growing testing requirements on the part of the company delivering the updates. "Should" in an ideal world doesn't equal "should" in a world with deadlines and limited resources. It's enough work to ensure that all the features work with ONE version of an app. If you had to also test every version of the app without this or that feature update installed, you just continually multiply the testing requirements by the number of optional features. And don't say unit testing solves this problem. The problem is in INTEGRATION testing with the whole app, which 99% of the time can only adequately be done by making the build and having a human use it. Even automated integration tools won't find things like formatting errors and buttons too small for humans to click. I'd like to continue to maintain ONE app, please, and not `n!` app permutations.
  - deleted 9y ago
    [deleted]
  - Silhouette 9y ago
    Your premise seems to ignore that maintaining several versions, even with numerous highly dependent variations, is something that was the norm in the software industry until relatively recently. Microsoft famously managed it with Windows for a long time until they lost the plot. I've run Debian systems for many years and never had unattended-updates break a box. The trouble with today's highly connected world is that it has bred a culture of shipping software that isn't really production quality, on the basis that it can be fixed (or not) later and that's sufficient. This leads to arguments like your final paragraph: you (the developer) would obviously prefer to only maintain the latest and greatest of what you do, but stated without taking into account the consequences of that policy for your users/customers. While I have a lot of sympathy for your desire, as a developer myself, I think you can only justify that sort of position if your previous releases are sufficiently good that they don't need maintenance. Otherwise, if you have customers paying for one thing, and that thing is defective, and you then want to use those defects as leverage to push your customers to something that is not what they paid for, then I think you're on very shaky ground. There are a lot of ethical, economic and legal issues raised by that sort of business strategy.

13of40 9y ago

To continue the article's analogy: One night I scared off all of the workers with a stick and changed the locks on the car so they couldn't get back in. That worked great for the first several weeks, until one morning I woke up to find the car on blocks with its wheels, engine, and doors gone and an obscene message spray-painted on the windshield.

CodeMage 9y ago

The whole car metaphor is a bit unfortunate. Most people who want to drive securely from A to B would be pretty freaked out by a bunch of strangers quietly upgrading their car's brakes in the middle of the night. And they would definitely be pissed off if their car suddenly refused to accelerate beyond 25 mph on a clear, straight, empty stretch of dry road in broad daylight just because the speed limit happens to be 25 mph there. It's a matter of perception and ignorance. We've been trained, for lack of a better word, to perceive the execution of software on the hardware we own as something completely orthogonal to our ownership of that hardware.

therealmarv 9y ago
This argument can be also made positive. Imagine a new update (to be on your example, the new brakes) made the car safer and the saved your life because an accident could be avoided entirely. Otherwise you would be dead. It's not only negative... Btw. when thinking of Tesla cars.. they auto update their software remotely ;)
- marssaxman 9y ago
  > when thinking of Tesla cars.. they auto update their software remotely That is one reason I will never buy one.
  - Silhouette 9y ago
    You are not alone. I drive a car that is relatively old now, but well maintained and in good working order. I have no interest in buying anything in the current generation of half-baked "connected cars", where critical systems are now connected to systems that are remotely accessible, but assumptions from another time underlie the architecture and security is bolted on as an afterthought if you're lucky. It's not as if the danger here is hypothetical. Leaving aside the immaturity of technologies like autonomous vehicles, I've seen way too many cars being compromised in more mundane ways, from theft because the remote unlocking mechanism was laughably easy to crack, right up to literally stranding a vehicle in the middle of a high speed road using a laptop that is somewhere else entirely. The consequences the first time someone compromises one of these remote systems and decides that every <some popular model> in the city should turn hard left or accelerate to 100mph or slam on the brakes are horrifying. Get back to me when we have the same level of scrutiny of these modern vehicles as we see in air travel, and when not getting security right poses an existential threat to the manufacturer's business, and then we can talk...

wvenable 9y ago

The problem is that security updates are bundled with feature updates, radical UI changes, and bleeding-edge bugginess. Nobody is arguing that the security benefit isn't there. Automatically installed Windows patches are fantastic. I hardly even notice them. Sometimes a patch will cause an issue with some software but that's an acceptable trade off. But then I get Candy Crush, or have to go through the setup again, or have all my display setting reset, get new "notifications", etc. These are not part of those security updates.

thomastjeffery 9y ago

> Auto Updates without user interaction Yes, but let's be clear about "without user interaction". That had better include "without user disruption". Windows 10 is one of the worst abusers here: Updates are forced, and during updates, the computer is suddenly unusable. That is not okay. Debian (derivatives, similar distros, etc.) has done it right for decades. Updates never block the user. Updates are consolidated, since every piece of software is a tracked package. The reason your parents don't want to update Java is because they remember how much of a pain it was 10 years ago, and it doesn't really feel different.

dingaling 9y ago
> Updates never block the user. Perhaps not intentionally but I always have "sudo pkill unattended-upgrades" close to hand when it pegs all my CPU cores whilst I'm trying to get something done.
- CaptSpify 9y ago
  I think that actually adds more weight to the point. Even upgrades with the best of intentions can go wrong, and users should have the power to stop them when they do.