3 ms·

Automatic software updates are a terrible idea. Not only do they make systems and devices less reliable but they are a vector for a malicious entity (Maybe even

Automatic software updates are a terrible idea. Not only do they make systems and devices less reliable but they are a vector for a malicious entity (Maybe even the vendor themselves, see Apple & CSAM)

fsflover 5y ago
Automatic security updates are important.
- duped 5y ago
  Unfortunately they're not propagated through different channels
  - fsflover 5y ago
    In a reasonable OS, e.g., Debian, they are.
    - xyzzy21 5y ago
      Not every OS is connected to the internet... Not every OS connected to the internet can afford the risks of bad updates (which are far more common than proponents think/claim)
      - s3krit 5y ago
        Debian package management doesn't have to rely on an internet connection. You could have the source of the security updates be a cd or USB stick or something with no problems
GPerson 5y ago
I hate automatic software updates. Is there a large contingent out there who loves them?
- Jtsummers 5y ago
  Anyone who has to be the family IT person. Though it's a love-hate relationship. On the one hand, automatic updates (particularly security related ones) keep my family members' systems, well, up to date and secured. On the other hand, UI changes mean I have to go and update my own systems and figure out where that damned option or button moved to so I can help. Since user interfaces (in particular) are not cleanly separated from the underlying system on personal devices, updates end up deploying both. I'd love for my family to get an updated browser or messaging client that only addresses issues around, say, the SSL implementation or HTTP or Unicode handling that specifically address security concerns. And then separate updates that alter the interface which become (somewhat) opt-in updates (though eventually they will be effectively mandatory). But that's not the reality of software development.
- UncleMeat 5y ago
  Security professionals.
  - GPerson 5y ago
    Haha you got me there.
- cuddlybacon 5y ago
  Me, within reason. A major version change (eg UI rewrite or API breakage is an exception). I don’t get the constant breakage the rest of HN seems to get, so there is no reason to pay the cost of manual updates.
- armchairhacker 5y ago
  I only mind when they make the software worse or hurt whatever i’m trying to do, e.g. more slowdowns or making some feature harder to use (and not just moving it somewhere else, actually removing it or adding steps). Or if the update fails to download and leaves my software in an unusable state. But if your app updates with minimal inconvenience, good for you. In fact it comes in handy when the update adds new features or improves performance.
sershe 5y ago
I agree, and people do tend to disagree, and not just because of security. Forced non-security updates for paid software should simply be mostly-illegal. For non-networked software, and most changes for networked software, it's a no-brainer. For breaking server API changes... you sell it, you have to support it let's say for 10 years. I suspect having this requirement would also greatly improve API design...

fsflover 5y ago

Automatic security updates are important.

duped 5y ago
Unfortunately they're not propagated through different channels
- fsflover 5y ago
  In a reasonable OS, e.g., Debian, they are.
  - xyzzy21 5y ago
    Not every OS is connected to the internet... Not every OS connected to the internet can afford the risks of bad updates (which are far more common than proponents think/claim)
    - s3krit 5y ago
      Debian package management doesn't have to rely on an internet connection. You could have the source of the security updates be a cd or USB stick or something with no problems

GPerson 5y ago

I hate automatic software updates. Is there a large contingent out there who loves them?

Jtsummers 5y ago
Anyone who has to be the family IT person. Though it's a love-hate relationship. On the one hand, automatic updates (particularly security related ones) keep my family members' systems, well, up to date and secured. On the other hand, UI changes mean I have to go and update my own systems and figure out where that damned option or button moved to so I can help. Since user interfaces (in particular) are not cleanly separated from the underlying system on personal devices, updates end up deploying both. I'd love for my family to get an updated browser or messaging client that only addresses issues around, say, the SSL implementation or HTTP or Unicode handling that specifically address security concerns. And then separate updates that alter the interface which become (somewhat) opt-in updates (though eventually they will be effectively mandatory). But that's not the reality of software development.
UncleMeat 5y ago
Security professionals.
- GPerson 5y ago
  Haha you got me there.
cuddlybacon 5y ago
Me, within reason. A major version change (eg UI rewrite or API breakage is an exception). I don’t get the constant breakage the rest of HN seems to get, so there is no reason to pay the cost of manual updates.
armchairhacker 5y ago
I only mind when they make the software worse or hurt whatever i’m trying to do, e.g. more slowdowns or making some feature harder to use (and not just moving it somewhere else, actually removing it or adding steps). Or if the update fails to download and leaves my software in an unusable state. But if your app updates with minimal inconvenience, good for you. In fact it comes in handy when the update adds new features or improves performance.

sershe 5y ago

I agree, and people do tend to disagree, and not just because of security. Forced non-security updates for paid software should simply be mostly-illegal. For non-networked software, and most changes for networked software, it's a no-brainer. For breaking server API changes... you sell it, you have to support it let's say for 10 years. I suspect having this requirement would also greatly improve API design...