4 ms·
> Automatic unattended autoupdate is logically indistinguishable from a RAT/trojan. What about: the same people do the automatic unattended autoupdate that you
by bmacho 2y ago
> Automatic unattended autoupdate is logically indistinguishable from a RAT/trojan.
What about: the same people do the automatic unattended autoupdate that you downloaded the original program from, or not?
- TeMPOraL 2y agoDoes it matter? Do you consider them a trusted party indefinitely? Think at scale of years, and think of e.g. Microsoft of Adobe when pondering this question.
- ripdog 2y agoThen just turn it off. qBT isn't windows, it doesn't demand autoupdate. That said, you really shouldn't be running outdated torrent clients, like any network-connected programs. Case in point - the topic of this thread.
- sneak 2y agoAbsolutely not. GitHub is usually used as a CDN for updates distributed in binary form; it is run by Microsoft. If I download source and build and run it, and it downloads binaries from Microsoft and runs those, that isn’t remotely “the same people”.
- bmacho 2y agowordpress guy did just that, he had a store/storage/registry for wordpress plugins, and 'forked' someone elses plugin, and started to serve 'his fork' as an update, under the same name and url ( https://news.ycombinator.com/item?id=41888808 https://news.ycombinator.com/item?id=41888808 ) Autoupdate is not good, especially with malicous actors between the user and the developer, which you can't really eliminate. Still it is not literally the same as a trojan.
- account42 2y agoAs others already have pointed out, people can change and trusting them during installation doesn't mean you want to have to trust those same people for as long as you use the software. But also, SSL certificates don't certify the people you are connecting to but instead certify control over a domain which can change hands for various reasons.