Hacker News Reader

Comment by stephen_g | Hacker News Reader

I was just saying to a friend yesterday that this would be a great policy. I think it would go a long way.

But the problem remains that these devices, more often than not just don't get updated. So in a year or two, there will probably be a handful of exploitable issues that won't ever get patched...

View on HN

How many Windows users are using a pirated version of their operating system that gets no updates? How many of those using the genuine version ignore/disabled it? How many update their anti-virus? Custom ROM users? How many Ubuntu users ignore the updates? ...

> How many Ubuntu users ignore the updates

Hopefully not many, though I could never understand why unattended-updates package is not installed and enabledby default.

Because it breaks things. Updates sometimes break things and require human intervention to get the device running properly again. This can happen since systems use different hardware. With IoT it's an issue to a lesser extent, but you can also brick those with an upgrade.

Better an individual device has some trivial breakage for a short period of time than the whole Internet breaks. I don't think we're there yet, but it feels like we'll need to take some pretty draconian steps if we continue the way we're going. Doesn't it make sense for 99% of IoT devices to only be able to communicate via a router over WiFi?

We are talking about common desktop PCs with more or less standard set of packages, not about server machines. I seriously doubt there are any breakages there.

I've noticed that sometimes updates to Firefox cause it to stop working until it's restarted. If you're writing a long message, or filling in some form, or if you have an order confirmation page open, then you might lose that data.

I've never seen that happen in native GNU/Linux applications, though. I guess it might be related to the XUL stuff in Firefox.

But given that Firefox (and Chrome/ium) are memory hogs that eventually get OOM killed, you need to restart them periodically anyway, so it might not make a big difference if the OS does auto-updates in the background.

The windows 10 anniversary update was a nightmare for me, my office, and seemingly a lot of people[0]. Note that the update installed itself too, opting to alert me at 7pm one evening while my machine was running unattended that it was going to restart in 15 minutes.

[0] http://www.telegraph.co.uk/technology/2016/08/25/windows-10-...

Actually, it is installed and enabled by default as of 16.04 LTS; see https://wiki.ubuntu.com/Security/Features for the detail.

Given that all these devices were 'hacked' using just the default credentials, exploits in the software aren't as relevant here.

Today they aren't. Once the fruit lying on the ground is exhausted, they'll get serious about the low-hanging software exploits

The point of my comment was that, yes, this kind of policy would be good and might have stopped this attack.

But it wouldn't solve the whole problem, just make it a tiny bit more difficult for the attackers. Definitely worth doing, but we will need to address the culture of 'ship and forget' also or we will just have the same problem but with software exploits.

Reply on news.ycombinator.com