I wonder if there is any research on whether someone is better off not updating at all or automatically updating. I would bet that apps are better off automatic

I wonder if there is any research on whether someone is better off not updating at all or automatically updating. I would bet that apps are better off automatically updating to remove published vulnerabilities than they are worrying about the handful of bitcoin wallet stealing backdoors. [1] It comes down to trust. Automatically updating something like https://www.npmjs.com/package/express https://www.npmjs.com/package/express is probably pretty safe. Automatically updating a relatively unknown package made by an unknown person is much less safe. Also, it goes beyond application dependency changes. What about your build server or that SaaS build pipeline you use? Key infrastructure gets hacked [2][3] and it turns out all the time you spent reviewing express updates should have instead been spent reviewing changes from somewhere else. [1]: https://github.com/dominictarr/event-stream/issues/116 https://github.com/dominictarr/event-stream/issues/116 [2]: https://blog.linuxmint.com/?p=2994 https://blog.linuxmint.com/?p=2994 [3]: https://blogs.adobe.com/security/2012/09/inappropriate-use-of-adobe-code-signing-certificate.html https://blogs.adobe.com/security/2012/09/inappropriate-use-o...