3 ms·

We’ve discovered that backporting security fixes to a large matrix of (outdated) versions isn’t generally sustainable outside of a few specific cases. So… YES.

by orf 5y ago

We’ve discovered that backporting security fixes to a large matrix of (outdated) versions isn’t generally sustainable outside of a few specific cases. So… YES. Regular updates to all of its software is how you stay on top of security updates.

Black101 5y ago
Yes and that is really bad... hopefully someone, one day, will solve this problem. I don't auto-update Android apps that what I need, because as a rule of thumb, app quality declines over time...
- orf 5y ago
  Then by definition you are not receiving security updates. Android sandboxing obviously helps here, but it’s still not a sensible position to take in the general case and definitely not an idea you want to give to your less technical friends or family.
  - Black101 5y ago
    > Then by definition you are not receiving security updates. There are certain apps that I will update though, like Element, but I don't even update Firefox because the new engine breaks too many things for me, like extensions and bookmarklets. IE: Last time I checked you could only choose between 12 extensions on the latest Firefox Mobile.
  - vagrantJin 5y ago
    > definitely not an idea you want to give to your less technical friends or family. That's a load of garbage. I don't do updates and zapped all google services except the playstore. Been looking good since.only whatsapp is the only culprit that demands me to update by force.
  - anonymousab 5y ago
    Then it is unfortunate that the general behavior of (some big?) app developers has made it so necessary to eschew updates by default to avoid change-for-the-sake-of-change workflow breakages (e.g. how Mozilla went about rolling out Fenix) and to dodge the threat of user hostile changes (e.g. the ad and tracking nonsense we see so often on Windows updates). This is a problem of their own creation, trying to tell users to accept it anyways is a non-starter for many.
birdyrooster 5y ago
Of course… IT DEPENDS on the type of app, if the app doesn’t share user input with other users and doesn’t download or run untrusted code, then you probably don’t need to update it.
pmlnr 5y ago
> isn’t generally sustainable outside of a few specific cases. WordPress can do it. Others also could, if they wanted to.
- orf 5y ago
  > if they wanted to. But for various reasons they don’t, and that’s the problem.
tarsinge 5y ago
And that's how you introduce new vulnerabilities too.

by orf 5y ago

Black101 5y ago

Yes and that is really bad... hopefully someone, one day, will solve this problem. I don't auto-update Android apps that what I need, because as a rule of thumb, app quality declines over time...

orf 5y ago
Then by definition you are not receiving security updates. Android sandboxing obviously helps here, but it’s still not a sensible position to take in the general case and definitely not an idea you want to give to your less technical friends or family.
- Black101 5y ago
  > Then by definition you are not receiving security updates. There are certain apps that I will update though, like Element, but I don't even update Firefox because the new engine breaks too many things for me, like extensions and bookmarklets. IE: Last time I checked you could only choose between 12 extensions on the latest Firefox Mobile.
- vagrantJin 5y ago
  > definitely not an idea you want to give to your less technical friends or family. That's a load of garbage. I don't do updates and zapped all google services except the playstore. Been looking good since.only whatsapp is the only culprit that demands me to update by force.
- anonymousab 5y ago
  Then it is unfortunate that the general behavior of (some big?) app developers has made it so necessary to eschew updates by default to avoid change-for-the-sake-of-change workflow breakages (e.g. how Mozilla went about rolling out Fenix) and to dodge the threat of user hostile changes (e.g. the ad and tracking nonsense we see so often on Windows updates). This is a problem of their own creation, trying to tell users to accept it anyways is a non-starter for many.

birdyrooster 5y ago

Of course… IT DEPENDS on the type of app, if the app doesn’t share user input with other users and doesn’t download or run untrusted code, then you probably don’t need to update it.

pmlnr 5y ago

> isn’t generally sustainable outside of a few specific cases. WordPress can do it. Others also could, if they wanted to.

orf 5y ago
> if they wanted to. But for various reasons they don’t, and that’s the problem.

tarsinge 5y ago

And that's how you introduce new vulnerabilities too.