6 ms·

Alternative point: I don't think _any_ app store should have the ability to auto update apps. That's a security nightmare for anything and anyone. Updates shou

Alternative point: I don't think _any_ app store should have the ability to auto update apps. That's a security nightmare for anything and anyone. Updates should be user requested, every time. Sure you can nag at them till they do, but the user should have the final say every time.

steelbrain 5y ago
It's a double edged sword. Either the scenario you described (less likely IMO) or our grandmas are stuck with outdated Applications with known vulnerabilities for years because they don't go into App Stores and update manually.
ayoisaiah 5y ago
Auto update is good default policy IMO. Most non-technical people don't care to update apps as long as the apps are working which could lead to unnecessary security issues or critical bugs left unpatched.
- Aerroon 5y ago
  Perhaps technical people should take more care when making updates for their application? There's a negative sentiment over updates for software and it arose from how bad updates ruining things. Updating might help with security, but it also forces you to put up with every harebrained UI change and removal of features that developers come up with. Eg tab groups were pushed onto mobile users in Chrome, yet it feels like the people who made the UI change don't actually use mobile chrome much, because the UX is awful. Luckily you can trudge through flags to change this behavior to the old one, but how long until we can't do that anymore?
- victornomad 5y ago
  I got tired of certain apps that kept changing behavior or UI every single week. Some of them sneakily added antifeatures that were not there originally or move features to premium asking me to pay again. In consequence I disabled auto updates and run an update when I remember... I'd rather prefer to have auto updates for just security patches not for features.
  - gmac 5y ago
    This doesn't help much, since antifeatures are rarely described as such (or even at all) in release notes. What would be more helpful would be the ability to revert to previous versions (can't speak to Android, but this is certainly missing in iOS).
    - selfhoster11 5y ago
      Android can sort-of do it. It's often possible to downgrade without losing data if the application signature hasn't been tampered with.
- emptyparadise 5y ago
  Automatic security updates, yes. Automatic feature updates, no.
  - junon 5y ago
    That still gives power to the developer. O could add an anti-consumer change and call it a security feature, prompting devices to automatically update it. Let's not act like Google would hand out any punishment, either.
- devit 5y ago
  Applications should not have security issues or critical bugs to begin with.
  - HappySweeney 5y ago
    Unfortunately, humans are not capable of errorless long-term work.
  - anaganisk 5y ago
    Lol wut? Thousands of brilliant programmers who work for top tech companies push bug fixes and android gets a security update every few months. We are people, people make mistakes, we're not some code fairy queen.
- VMtest 5y ago
  It's funny because as you mention this, somebody made a thread few days ago for iOS already 1. https://news.ycombinator.com/item?id=27175955 https://news.ycombinator.com/item?id=27175955 | An iOS app update that annoys me | Hacker News
londons_explore 5y ago
Trying to restrict updates is in effect trying to prevent the original developer changing the behaviour of an app after installation. Thats very hard to do, since in the extreme case the developer could code in a change of behaviour after a certain date/time, or depending on a response from a server on the internet.
- dTal 5y ago
  I feel there's a qualitative difference between time-influenced or server-influenced code, and the ability to arbitrarily change the code itself. In the former, control is limited to whatever the dev thought of at the time the software was released. It's the difference between vetting a dev at a particular point in time, versus trusting them in perpetuity.
  - nulld3v 5y ago
    On Android apps can download and execute arbitrary code anytime they want. The app doesn't need to have the code built in.
    - londons_explore 5y ago
      Same on iOS in certain circumstances - eg. webviews.
    - dTal 5y ago
      They could, but a developer won't design it that way unless they're already trying to sidestep update mechanisms. The point still stands that there's a difference between "I trust the developer now" and "I trust the developer forever".
- selfhoster11 5y ago
  > Trying to restrict updates is in effect trying to prevent the original developer changing the behaviour of an app after installation. Sounds just like the pre-Internet era to me.
znpy 5y ago
I fully agree. My stock calculator app now asks for me to agree to terms and conditions. It didn't do that previously. Why on earth would I ever upgrade my calculator? (I always decline of course) Any by the way, WHY does android even bother me with upgrades, if it's going to upgrade my apps anyway whether I want it or not?
- devoutsalsa 5y ago
  I'm guessing to get you to accept a new terms of service.
UncleMeat 5y ago
IMO, auto updates are among the single most impactful benefits to user security.

steelbrain 5y ago

It's a double edged sword. Either the scenario you described (less likely IMO) or our grandmas are stuck with outdated Applications with known vulnerabilities for years because they don't go into App Stores and update manually.

ayoisaiah 5y ago

Auto update is good default policy IMO. Most non-technical people don't care to update apps as long as the apps are working which could lead to unnecessary security issues or critical bugs left unpatched.

Aerroon 5y ago
Perhaps technical people should take more care when making updates for their application? There's a negative sentiment over updates for software and it arose from how bad updates ruining things. Updating might help with security, but it also forces you to put up with every harebrained UI change and removal of features that developers come up with. Eg tab groups were pushed onto mobile users in Chrome, yet it feels like the people who made the UI change don't actually use mobile chrome much, because the UX is awful. Luckily you can trudge through flags to change this behavior to the old one, but how long until we can't do that anymore?
victornomad 5y ago
I got tired of certain apps that kept changing behavior or UI every single week. Some of them sneakily added antifeatures that were not there originally or move features to premium asking me to pay again. In consequence I disabled auto updates and run an update when I remember... I'd rather prefer to have auto updates for just security patches not for features.
- gmac 5y ago
  This doesn't help much, since antifeatures are rarely described as such (or even at all) in release notes. What would be more helpful would be the ability to revert to previous versions (can't speak to Android, but this is certainly missing in iOS).
  - selfhoster11 5y ago
    Android can sort-of do it. It's often possible to downgrade without losing data if the application signature hasn't been tampered with.
emptyparadise 5y ago
Automatic security updates, yes. Automatic feature updates, no.
- junon 5y ago
  That still gives power to the developer. O could add an anti-consumer change and call it a security feature, prompting devices to automatically update it. Let's not act like Google would hand out any punishment, either.
devit 5y ago
Applications should not have security issues or critical bugs to begin with.
- HappySweeney 5y ago
  Unfortunately, humans are not capable of errorless long-term work.
- anaganisk 5y ago
  Lol wut? Thousands of brilliant programmers who work for top tech companies push bug fixes and android gets a security update every few months. We are people, people make mistakes, we're not some code fairy queen.
VMtest 5y ago
It's funny because as you mention this, somebody made a thread few days ago for iOS already 1. https://news.ycombinator.com/item?id=27175955 https://news.ycombinator.com/item?id=27175955 | An iOS app update that annoys me | Hacker News

londons_explore 5y ago

Trying to restrict updates is in effect trying to prevent the original developer changing the behaviour of an app after installation. Thats very hard to do, since in the extreme case the developer could code in a change of behaviour after a certain date/time, or depending on a response from a server on the internet.

dTal 5y ago
I feel there's a qualitative difference between time-influenced or server-influenced code, and the ability to arbitrarily change the code itself. In the former, control is limited to whatever the dev thought of at the time the software was released. It's the difference between vetting a dev at a particular point in time, versus trusting them in perpetuity.
- nulld3v 5y ago
  On Android apps can download and execute arbitrary code anytime they want. The app doesn't need to have the code built in.
  - londons_explore 5y ago
    Same on iOS in certain circumstances - eg. webviews.
  - dTal 5y ago
    They could, but a developer won't design it that way unless they're already trying to sidestep update mechanisms. The point still stands that there's a difference between "I trust the developer now" and "I trust the developer forever".
selfhoster11 5y ago
> Trying to restrict updates is in effect trying to prevent the original developer changing the behaviour of an app after installation. Sounds just like the pre-Internet era to me.

znpy 5y ago

I fully agree. My stock calculator app now asks for me to agree to terms and conditions. It didn't do that previously. Why on earth would I ever upgrade my calculator? (I always decline of course) Any by the way, WHY does android even bother me with upgrades, if it's going to upgrade my apps anyway whether I want it or not?

devoutsalsa 5y ago
I'm guessing to get you to accept a new terms of service.

UncleMeat 5y ago

IMO, auto updates are among the single most impactful benefits to user security.