6 ms·

Depends on the purpose I imagine If you stop nagging users to update their software it's going to make everybody's operational security even worse than before

izacus 3y ago
Threathening people with "you'll lose security so evil guys will come to get ya" so they take user hostile updates and UI roulette is dark pattern by itself. If the companies continue to bundle adware updates with security updates, lesser security might actually be a better outcome for users.
- dylan604 3y ago
  This is essentially what the mafia security rackets use. Maybe they should reword their modals to say "it's be a real shame if something were to happen since you didn't update like we suggested"
- lp0_on_fire 3y ago
  Extortion is the word you're looking for, imo.
hnlmorg 3y ago
The problem here is that it's very easy to argue a lot of these prompts as "security". - Upgrade to Windows 11, our most secure operating system ever! (more secure against which benchmark?) - Switch to Bing, our most secure browser ever! - Enter your phone number into Facebook to help secure your account! (translation: we want another data point to track you) None of the above is technically wrong, but it doesn't mean that the intention of the nagging is to protect users.
- siggen 3y ago
  > - Upgrade to Windows 11, our most secure operating system ever! This one should be in comparison to Windows 10 wrt benchmark.
  - hnlmorg 3y ago
    The problem is "secure" is a vague term and thus easy to gamify. eg is it secure because of fewer CVEs? You'd probably expect fewer CVEs because it is newer, so that doesn't mean it is more "secure" in any meaningful way but it's definitely an easy position to defend if someone were to challenge Microsoft's claim.
    - userbinator 3y ago
      Look up the number of CVEs by OS and you'll find the results are... amusing.
  - tremon 3y ago
    Not if the claim contains "ever". They would need to prove that Windows 11 has fewer vulnerabilities than e.g. MS-DOS 6.22.
    - dylan604 3y ago
      how secure is MS-DOS 6.22 though. sure, there's no networking access, but is the code secure in other ways? what kind of code was just never exposed to fully reveal how fragile they were? there has always been software slightly less fragile than a house of cards. people were just much less incentivized to poke them the way they are today
- _ea1k 3y ago
  IDK, the line seems fairly clear. Asking someone to upgrade an existing product for security makes sense. Similarly, asking to switch to two factor isn't a bad idea at all, even if there are secondary motives. Asking someone to come over from a competitor's current product doesn't sound like an actual security intent.
  - gkbrk 3y ago
    Can Google really complain? For years they bundled Chrome installers that set the browser as default with other random software. And every time you visited Google with Internet Explorer or Firefox, they told you to "upgrade" to Chrome.
    - _ea1k 3y ago
      Yes. Making deals to distribute their software is a well accepted practice and Chrome is far from the worst thing to come preinstalled. Advertising your wares on your own website is even more reasonable than that. Observing when a competing browser is used to visit a competing site and then having the desktop OS open a popup crosses a very different line.
- dylan604 3y ago
  > (translation: we want another data point to track you) Wasn't it more of "just confirm the data we slurped from one of your friends when they allowed us access to their contacts. we already have your number, we just want it official from you so we can move it from the dark profile to your main profile where it is absolutely already being used to track you, so why not?"
- sebstefan 3y ago
  Everytime someone asks "But where's the line?", the answer is "somewhere" When I push an update that prompts my users to update their software, it's because it fixes a CVE
account42 3y ago
I know I regularly update my Linux desktop but keep dismissing the upgrade prompt on my Android phone because no way I am going to do what it wants after it so rudely interrupted me.

izacus 3y ago

Threathening people with "you'll lose security so evil guys will come to get ya" so they take user hostile updates and UI roulette is dark pattern by itself. If the companies continue to bundle adware updates with security updates, lesser security might actually be a better outcome for users.

dylan604 3y ago
This is essentially what the mafia security rackets use. Maybe they should reword their modals to say "it's be a real shame if something were to happen since you didn't update like we suggested"
lp0_on_fire 3y ago
Extortion is the word you're looking for, imo.

hnlmorg 3y ago

The problem here is that it's very easy to argue a lot of these prompts as "security". - Upgrade to Windows 11, our most secure operating system ever! (more secure against which benchmark?) - Switch to Bing, our most secure browser ever! - Enter your phone number into Facebook to help secure your account! (translation: we want another data point to track you) None of the above is technically wrong, but it doesn't mean that the intention of the nagging is to protect users.

siggen 3y ago
> - Upgrade to Windows 11, our most secure operating system ever! This one should be in comparison to Windows 10 wrt benchmark.
- hnlmorg 3y ago
  The problem is "secure" is a vague term and thus easy to gamify. eg is it secure because of fewer CVEs? You'd probably expect fewer CVEs because it is newer, so that doesn't mean it is more "secure" in any meaningful way but it's definitely an easy position to defend if someone were to challenge Microsoft's claim.
  - userbinator 3y ago
    Look up the number of CVEs by OS and you'll find the results are... amusing.
- tremon 3y ago
  Not if the claim contains "ever". They would need to prove that Windows 11 has fewer vulnerabilities than e.g. MS-DOS 6.22.
  - dylan604 3y ago
    how secure is MS-DOS 6.22 though. sure, there's no networking access, but is the code secure in other ways? what kind of code was just never exposed to fully reveal how fragile they were? there has always been software slightly less fragile than a house of cards. people were just much less incentivized to poke them the way they are today
_ea1k 3y ago
IDK, the line seems fairly clear. Asking someone to upgrade an existing product for security makes sense. Similarly, asking to switch to two factor isn't a bad idea at all, even if there are secondary motives. Asking someone to come over from a competitor's current product doesn't sound like an actual security intent.
- gkbrk 3y ago
  Can Google really complain? For years they bundled Chrome installers that set the browser as default with other random software. And every time you visited Google with Internet Explorer or Firefox, they told you to "upgrade" to Chrome.
  - _ea1k 3y ago
    Yes. Making deals to distribute their software is a well accepted practice and Chrome is far from the worst thing to come preinstalled. Advertising your wares on your own website is even more reasonable than that. Observing when a competing browser is used to visit a competing site and then having the desktop OS open a popup crosses a very different line.
dylan604 3y ago
> (translation: we want another data point to track you) Wasn't it more of "just confirm the data we slurped from one of your friends when they allowed us access to their contacts. we already have your number, we just want it official from you so we can move it from the dark profile to your main profile where it is absolutely already being used to track you, so why not?"
sebstefan 3y ago
Everytime someone asks "But where's the line?", the answer is "somewhere" When I push an update that prompts my users to update their software, it's because it fixes a CVE

account42 3y ago

I know I regularly update my Linux desktop but keep dismissing the upgrade prompt on my Android phone because no way I am going to do what it wants after it so rudely interrupted me.