I wish that security updates consisted only of "Hi there, if you're [GUID] running [VERSION], then you should be apply update [SHA-256 SUM], which hopefully wil

I wish that security updates consisted only of "Hi there, if you're [GUID] running [VERSION], then you should be apply update [SHA-256 SUM], which hopefully will get you to [LATER_VERSION]. [Cryptographically] Signed, [SOMEONE YOU TRUST]." That assertion could easily live in a kilobyte of data. Then if you cared about that message, you could go anywhere -- vendor site, Bittorrent, IPFS, your classmate's computer via your local network, even the attacker trying to own you -- to get the multi-megabyte/gigabyte update. If the hash matches, apply it. Otherwise, ignore it. The (slightly contrived) relevance to this post is whether Intel should get to decide whether its updates are redistributable. They should definitely get to declare which updates are authentic. But it seems reasonable that the remaining decisions should be up to the owner of the hardware, who has to deal with the consequences of its software/firmware not being up to date.