8 ms·

> regular updates of all its software NO. You need security patches. The current "regular updates" bullshit where the Play Store wants to update and app I upd

by pmlnr 5y ago

> regular updates of all its software NO. You need security patches. The current "regular updates" bullshit where the Play Store wants to update and app I updated an hour ago is insane.

orf 5y ago
We’ve discovered that backporting security fixes to a large matrix of (outdated) versions isn’t generally sustainable outside of a few specific cases. So… YES. Regular updates to all of its software is how you stay on top of security updates.
- Black101 5y ago
  Yes and that is really bad... hopefully someone, one day, will solve this problem. I don't auto-update Android apps that what I need, because as a rule of thumb, app quality declines over time...
  - orf 5y ago
    Then by definition you are not receiving security updates. Android sandboxing obviously helps here, but it’s still not a sensible position to take in the general case and definitely not an idea you want to give to your less technical friends or family.
    - Black101 5y ago
      > Then by definition you are not receiving security updates. There are certain apps that I will update though, like Element, but I don't even update Firefox because the new engine breaks too many things for me, like extensions and bookmarklets. IE: Last time I checked you could only choose between 12 extensions on the latest Firefox Mobile.
    - vagrantJin 5y ago
      > definitely not an idea you want to give to your less technical friends or family. That's a load of garbage. I don't do updates and zapped all google services except the playstore. Been looking good since.only whatsapp is the only culprit that demands me to update by force.
    - anonymousab 5y ago
      Then it is unfortunate that the general behavior of (some big?) app developers has made it so necessary to eschew updates by default to avoid change-for-the-sake-of-change workflow breakages (e.g. how Mozilla went about rolling out Fenix) and to dodge the threat of user hostile changes (e.g. the ad and tracking nonsense we see so often on Windows updates). This is a problem of their own creation, trying to tell users to accept it anyways is a non-starter for many.
- birdyrooster 5y ago
  Of course… IT DEPENDS on the type of app, if the app doesn’t share user input with other users and doesn’t download or run untrusted code, then you probably don’t need to update it.
- pmlnr 5y ago
  > isn’t generally sustainable outside of a few specific cases. WordPress can do it. Others also could, if they wanted to.
  - orf 5y ago
    > if they wanted to. But for various reasons they don’t, and that’s the problem.
- tarsinge 5y ago
  And that's how you introduce new vulnerabilities too.
teddyh 5y ago
If security-patches-only (a.k.a. “stable”) is an available update channel, feel free to use that. I always do. But if you don’t update at all, you will be subject to an exploit, and you and your devices will then possibly be unwitting members of (possibly multiple) botnets.

by pmlnr 5y ago

> regular updates of all its software NO. You need security patches. The current "regular updates" bullshit where the Play Store wants to update and app I updated an hour ago is insane.

orf 5y ago

We’ve discovered that backporting security fixes to a large matrix of (outdated) versions isn’t generally sustainable outside of a few specific cases. So… YES. Regular updates to all of its software is how you stay on top of security updates.

Black101 5y ago
Yes and that is really bad... hopefully someone, one day, will solve this problem. I don't auto-update Android apps that what I need, because as a rule of thumb, app quality declines over time...
- orf 5y ago
  Then by definition you are not receiving security updates. Android sandboxing obviously helps here, but it’s still not a sensible position to take in the general case and definitely not an idea you want to give to your less technical friends or family.
  - Black101 5y ago
    > Then by definition you are not receiving security updates. There are certain apps that I will update though, like Element, but I don't even update Firefox because the new engine breaks too many things for me, like extensions and bookmarklets. IE: Last time I checked you could only choose between 12 extensions on the latest Firefox Mobile.
  - vagrantJin 5y ago
    > definitely not an idea you want to give to your less technical friends or family. That's a load of garbage. I don't do updates and zapped all google services except the playstore. Been looking good since.only whatsapp is the only culprit that demands me to update by force.
  - anonymousab 5y ago
    Then it is unfortunate that the general behavior of (some big?) app developers has made it so necessary to eschew updates by default to avoid change-for-the-sake-of-change workflow breakages (e.g. how Mozilla went about rolling out Fenix) and to dodge the threat of user hostile changes (e.g. the ad and tracking nonsense we see so often on Windows updates). This is a problem of their own creation, trying to tell users to accept it anyways is a non-starter for many.
birdyrooster 5y ago
Of course… IT DEPENDS on the type of app, if the app doesn’t share user input with other users and doesn’t download or run untrusted code, then you probably don’t need to update it.
pmlnr 5y ago
> isn’t generally sustainable outside of a few specific cases. WordPress can do it. Others also could, if they wanted to.
- orf 5y ago
  > if they wanted to. But for various reasons they don’t, and that’s the problem.
tarsinge 5y ago
And that's how you introduce new vulnerabilities too.

teddyh 5y ago

If security-patches-only (a.k.a. “stable”) is an available update channel, feel free to use that. I always do. But if you don’t update at all, you will be subject to an exploit, and you and your devices will then possibly be unwitting members of (possibly multiple) botnets.