3 ms·
Auto updating does so much for security it seems a no brainer. Is there a way to improve testing while gaining the benefits of auto updates?
by imwillofficial 4y ago
Auto updating does so much for security it seems a no brainer.
Is there a way to improve testing while gaining the benefits of auto updates?
- hansvm 4y agoSomething about automatic updates feels off: So software has bugs, and sometimes those bugs are bad, so we want to do something to mitigate that risk -- the risk that we might have something as serious as RCE in our software. To reduce the chances of somebody exploiting that hypothetical remote code execution vulnerability we have special code running on our machines that reaches out to download new code and executes it, blindly trusting that every Jo Schmo who's ever written software we were comfortable using once would never take advantage of that position. The fact that automatic updates sometimes have some benefits right now seems almost accidental when their fundamental operating principle is to open exactly the same sort of backdoor they're trying to protect against.
- imwillofficial 4y agoExperience has shown us that setting up a secure update mechanism is less risky than not updating your applications regularly. Is this always the case? Nope. But for most cases, updating often against newly exposed threats is worth the vulnerability that auto update introduces.
- coldtea 4y agoNot everybody has security as first priority. Not to mention the update could introduce security issues itself.
- imwillofficial 4y agoAs I replied above, experience has shown us, as a general rule, update mechanisms help more than they hurt. But like with every solution to a problem, you have to decide what’s best for you, your users, and the internet as a whole. Quite the balancing act.
- Ygg2 4y agoSpoken like someone who never had Windows/Linux auto update break a machine.
- ikiris 4y agoSpoken like someone who was born after Code Red.
- deleted 4y ago[deleted]
- Ygg2 4y agoThe 2001 worm? If so, you are sorely mistaken.
- imwillofficial 4y agoYeah, it’s a real problem, but for the masses, which once compromised are used as further vectors for attack, sensible auto update seems smart The problem now is how to make it safer