4 ms·

Yup, 100%. My golden rule of computers is: If it's working right now, an update can only cause it to break. The best case scenario is that it still works. Why

Yup, 100%. My golden rule of computers is: If it's working right now, an update can only cause it to break. The best case scenario is that it still works. Why would your roll the dice?

hoffs 2y ago
Golden rule to get exploited
- 38 2y ago
  the "but muh security" argument is absolute horseshit 99% of the time. and the 1% that actually need it, are going well beyond automatic updates to secure their systems.
  - trog 2y ago
    If you look at the background radiation of the Internet of automated things just hitting services to probe for exploits, they are most commonly looking for exploits from bugs in older software. There's a timing argument - that unless you're at risk of zero days (like you're the DOD) - that you probably don't need to upgrade immediately. But it seems unarguable to me that the longer you wait, the greater the risk from a security perspective. As always, security is a trade off. Risk of breaking from an update has to be balanced against risk of exploit. I'd argue the latter is going up more quickly than the former.
    - thot_experiment 2y ago
      How many actual zerodays are there that don't require you to ALSO be doing something dumb per year? It seems exceedingly rare. I understand the argument if you're talking about like, a server running some CMS or whatever, sure that's gonna get pwned because it's a big target so it's worth going after. Your natted personal machine? You're fine unless you're running executable off random russian sites (and even then you're probably fine if you're getting your shit from reputable shady sites)
      - l33t7332273 2y ago
        There was that Windows IPv6 no click zero day within the last couple of weeks
        thot_experiment 2y ago
        good thing i disable IPv6 at home because it's an annoying pita and i run no machines with windows in the cloud, checkmate :P on a more serious note though I don't think machines with ipv6 enabled that are behind a NAT are likely to be vulnerable to this, i suppose maybe wormable if you can natpunch through some p2p voip or gaming service, it's the sort of patch i would probably install if i were made aware of it (if i had ipv6 enabled), but being made aware of it doesn't like, leave me worried, and i don't consider it to be likely to affect me unpatched
        BSDobelix 2y ago
        >I don't think machines with ipv6 enabled that are behind a NAT are likely to be vulnerable to this Would you be interested in educate yourself about IPv6? https://ipv6.he.net/certification/ https://ipv6.he.net/certification/
        thot_experiment 2y ago
        No, I'd rather just keep turning it off. Though if you're interested in telling me why I'm wrong concisely instead of being snarky I'll read that.
        BSDobelix 2y ago
        NAT and IPv6......you really should educate yourself about it IPv6 is not "that" new...trust me (bro). You know, keep learning is a big part of life ;)
  - LorenzoGood 2y ago
    No, this is a crazy take, old versions of software are usually rife with exploits, where everyone knows about the bug.
    - thot_experiment 2y ago
      It's really not, I never upgrade anything and I haven't been pwned in like a decade. (Or maybe I have been pwned but not in a way that's affected me at all so you know, whatever)
      - LorenzoGood 2y ago
        On an internet exposed server?
        38 2y ago
        thats not what the discussion is about, stop hijacking the thread to push your narrative.
        LorenzoGood 2y ago
        I understand that auto updates aren't ideal, because they cause breakage (most of my systems dont auto update), but I don't get not updating your systems at all.
        thot_experiment 2y ago
        While sibling comment is correct about the discussion I do have a few VPS I've had around for a while (<5 years with only password based SSH too because keys are annoying asf to manage when you're like, on your phone trying to do something etc) and I barely ever upgrade those and everything seems fine. They have DNS pointed at them too so it's not like they're secret in any way. I suspect it's because I don't use many common software packages so the attack surface is small-ish.
        ndriscoll 2y ago
  - Tepix 2y ago
    Attacks get automated and targets are no longer hand-picked. Having many unpatched systems makes the environment ripe for self-replicating worms.
emeril 2y ago
so true - the few who are at risk of real exploits are already aware of this and do more than just system updates I only let my browser autoupdate (somewhat reluctantly) since I view that as the most likely security issue on my winpc but when I used to let win10 autoupdate (and other garbage dell drivers), things would start breaking after each update this also applies to phone app updates - I only update if there's a reason to, not just for the sake of updating... and people wonder why I have the best working phone and pc at the office...
- appendix-rock 2y ago
  > the few that are at risk… Boxes get popped all the time. Why are you painting such a dishonest picture? > and people wonder why I have the best working phone and pc at the office... Probably because you know about computers. Nothing to do with your poor security practice. And this still doesn’t say anything about the explicitly absolutist advice in the parent comment. “No matter the circumstance, turn auto-update off! Just in case you want to partake in some piracy!”
  - LoganDark 2y ago
    > Probably because you know about computers. Nothing to do with your poor security practice. IME knowing about computers is what causes auto-update to break things. Because you actually rely on the kind of things that it would break.
adr1an 2y ago
The arch rule says update btw

Yup, 100%. My golden rule of computers is: If it's working right now, an update can only cause it to break. The best case scenario is that it still works. Why would your roll the dice?

hoffs 2y ago

Golden rule to get exploited

38 2y ago
the "but muh security" argument is absolute horseshit 99% of the time. and the 1% that actually need it, are going well beyond automatic updates to secure their systems.
- trog 2y ago
  If you look at the background radiation of the Internet of automated things just hitting services to probe for exploits, they are most commonly looking for exploits from bugs in older software. There's a timing argument - that unless you're at risk of zero days (like you're the DOD) - that you probably don't need to upgrade immediately. But it seems unarguable to me that the longer you wait, the greater the risk from a security perspective. As always, security is a trade off. Risk of breaking from an update has to be balanced against risk of exploit. I'd argue the latter is going up more quickly than the former.
  - thot_experiment 2y ago
    How many actual zerodays are there that don't require you to ALSO be doing something dumb per year? It seems exceedingly rare. I understand the argument if you're talking about like, a server running some CMS or whatever, sure that's gonna get pwned because it's a big target so it's worth going after. Your natted personal machine? You're fine unless you're running executable off random russian sites (and even then you're probably fine if you're getting your shit from reputable shady sites)
    - l33t7332273 2y ago
      There was that Windows IPv6 no click zero day within the last couple of weeks
      - thot_experiment 2y ago
        good thing i disable IPv6 at home because it's an annoying pita and i run no machines with windows in the cloud, checkmate :P on a more serious note though I don't think machines with ipv6 enabled that are behind a NAT are likely to be vulnerable to this, i suppose maybe wormable if you can natpunch through some p2p voip or gaming service, it's the sort of patch i would probably install if i were made aware of it (if i had ipv6 enabled), but being made aware of it doesn't like, leave me worried, and i don't consider it to be likely to affect me unpatched
        BSDobelix 2y ago
        >I don't think machines with ipv6 enabled that are behind a NAT are likely to be vulnerable to this Would you be interested in educate yourself about IPv6? https://ipv6.he.net/certification/ https://ipv6.he.net/certification/
        thot_experiment 2y ago
        No, I'd rather just keep turning it off. Though if you're interested in telling me why I'm wrong concisely instead of being snarky I'll read that.
        BSDobelix 2y ago
        NAT and IPv6......you really should educate yourself about it IPv6 is not "that" new...trust me (bro). You know, keep learning is a big part of life ;)
- LorenzoGood 2y ago
  No, this is a crazy take, old versions of software are usually rife with exploits, where everyone knows about the bug.
  - thot_experiment 2y ago
    It's really not, I never upgrade anything and I haven't been pwned in like a decade. (Or maybe I have been pwned but not in a way that's affected me at all so you know, whatever)
    - LorenzoGood 2y ago
      On an internet exposed server?
      - 38 2y ago
        thats not what the discussion is about, stop hijacking the thread to push your narrative.
        LorenzoGood 2y ago
        I understand that auto updates aren't ideal, because they cause breakage (most of my systems dont auto update), but I don't get not updating your systems at all.
      - thot_experiment 2y ago
        While sibling comment is correct about the discussion I do have a few VPS I've had around for a while (<5 years with only password based SSH too because keys are annoying asf to manage when you're like, on your phone trying to do something etc) and I barely ever upgrade those and everything seems fine. They have DNS pointed at them too so it's not like they're secret in any way. I suspect it's because I don't use many common software packages so the attack surface is small-ish.
        ndriscoll 2y ago
- Tepix 2y ago
  Attacks get automated and targets are no longer hand-picked. Having many unpatched systems makes the environment ripe for self-replicating worms.

emeril 2y ago

so true - the few who are at risk of real exploits are already aware of this and do more than just system updates I only let my browser autoupdate (somewhat reluctantly) since I view that as the most likely security issue on my winpc but when I used to let win10 autoupdate (and other garbage dell drivers), things would start breaking after each update this also applies to phone app updates - I only update if there's a reason to, not just for the sake of updating... and people wonder why I have the best working phone and pc at the office...

appendix-rock 2y ago
> the few that are at risk… Boxes get popped all the time. Why are you painting such a dishonest picture? > and people wonder why I have the best working phone and pc at the office... Probably because you know about computers. Nothing to do with your poor security practice. And this still doesn’t say anything about the explicitly absolutist advice in the parent comment. “No matter the circumstance, turn auto-update off! Just in case you want to partake in some piracy!”
- LoganDark 2y ago
  > Probably because you know about computers. Nothing to do with your poor security practice. IME knowing about computers is what causes auto-update to break things. Because you actually rely on the kind of things that it would break.

adr1an 2y ago

The arch rule says update btw