Hacker News Reader

Comment by Chabsff | Hacker News Reader

Unfortunately, it's been established for a long time now that users cannot be trusted to perform updates by themselves, no matter how naggy you get about it, even for the most critical of security fixes.

Automatic updates, again unfortunately, are critical to safety.

View on HN

Problem is every single update claims to be security fixes, like for Android. Now I realise almost any bugfix can be construed as a security fix, but I've never seen an Android update that doesn't claim to include security updates, and I've never seen one that goes into any kind of detail(in the pop up prompt that is) on what any of the updates entail.

Probably some of those were critical, and some of them were completely unlikely to affect real world security. As a user, how do I know when to take it seriously and when not to? All I'm told by the UI is that every single update they push "improves security and performance".

This if the ToS problem. Tell me, of the many services you use and products you own, how many ToS have you read? 3%? 10%? Probably less than 2%. Changelogs and release notes have the same problem. They take time to create, edit and review and no one who matters reads them. Why would they spend their time on it?

I get your point, but changelogs can often be generated semi-automatically from VCS.

And I realise I'm not the typical user, but I actually do read(skim) TOS just to see if there's any centipad like stuff. Most of it is just boilerplate and you get pretty quick at finding the substantive parts with some practice. Of course TOS/EULA are hard to read for most people by design. They don't actually want you to read it. If they did, they'd offer a summarised version without all the legalese boilerplate.

I get the same feeling about changelogs. They probably have one internally if they know what they're doing. It may even be online somewhere if I go looking. I can only surmise that for whatever reason, they don't want me to read it, which doesn't inspire trust.

The trouble is, security fixes (generally) don't get backported to older branches. If older branches are even a thing.

Say you're on Foo 1.4.7, and the jump to Foo 1.5 includes a feature re-org you don't want, and no security fixes. So you hold your version on 1.4.7.

But then a security issue is found, and Foo 1.5.1 is released with a fix. Is the version you have vulnerable? Maybe, depending on where the bug is. Is there a 1.4.8 update to fix it? Maybe not. How would you even get it? Heck, if you've switched off automatic updates, have you even heard about the 1.5.1 release? Are you checking on the release announcements for Foo to find out if there have been any security updates, ever?

OK, maybe you check those things. But do you think J. Random User who saw a post on Reddit that said 1.5 sux0rz and they should stay on 1.4.x is going to? And do you like having botnets? Because that's how you get botnets.

The trouble is, security fixes (generally) don't get backported to older branches.

Even if the security fixes were backported, it would produce a new version of the older branch, and requires an update in order to actually use it. If the security fix is in an older branch or a newer branch doesn't matter: it still qualifies as an update.

I thought I covered that in the part about needing to check for updates/release announcements yourself if you've turned automatic updates off?

This attitude is a large part of what I find so repulsive about tech today. You are a guest on my machine. No matter how much you think you know better than me (even if you're right!), you don't get to make decisions like that. You can ask nicely, and if you can convince me that something needs to be done, I will decide to do it.

Why, sure. And I'll bet you prefer to do your own vehicle maintenance, too.

But automatic updates aren't for you or me, or any of the other geeks here.

They're for everyone else.

My device is mine, not everyone else's. It's not your decision to make regardless of whether or not you think it's best for the "greater good".

You're not wrong.

Fortunately, you have choices. You can choose to avoid software and operating systems that feature automatic updates.

You can even write it yourself, if you wish: You're absolutely empowered to be absolutely in control of your things.

There's nothing stopping you.

Practically speaking, we have the choices that one monopoly or another offers us, and only so long as those choices are convenient for them.

I do avoid corporate overreach where it's practical (I have a dumb TV/vehicle/appliances/etc), but there will come a day when it's impossible to participate in society without giving in.

Life is whatever you want it to be.

There's plenty of ways to get through life that don't involve computers or software or television.

You can choose differently than you have.

I don't see what this has to do with the discussion at hand at all.

I'm happy enough with my life. But yours seems like a very ... I don't know, defeatist? point of view.

You make it sound like I can either have the stunted over commercialized shovelware thats on offer or I can choose to go live in a hut in the woods. Where's the middleground where we put a little market pressure on our corporate overlords so they make better widgets?

You can choose to do anything at all. It's your life.

You want software that doesn't update itself on your computer? Nobody is going to stop you. Simply make it so.

(And if you're happy with your life, then what are you here bellyaching about?)

Yep.

That being said, I really like VS Code's approach of having auto-updates enabled by default, but making a switch to turn off the feature available for nerds like us who care.

That's the model to follow in my book.

It has also been established that vendors cannot be trusted to refrain from bundling unwanted feature changes (and sometimes straight-up malware) with their security updates, so it's no wonder that users might be reluctant to install such updates.

Yes, this is the reason I do not enable automatic updates (in general, not just browser addons), and that software updates are so frustrating.

If there was a way to specify I only want security updates and bug fixes and I do not want new features, UI redesigns, and so on, I would always update and maybe even turn on automatic updates. Software companies have no excuse--we have sophisticated version control software that allows you to manage multiple branches easily. Every software should have a maintenance branch and a "new shit" branch, and should allow both kinds of updates.

> I only want security updates and bug fixes

Just FYI, for iOS updates, you can in fact opt into these release channels separately.

Go to Settings > General > Software Update > Automatic Updates. You will see two separate toggles, one for "iOS Updates" and another for "Security Responses & System Files."

Yeah, it's nice. Also, old major iOS versions still get security updates, so a very old iPhone is still practically usable.

Users often don't want to perform updates because the updated version is worse in some way. That it has a security impact is unfortunate, but that's how it is.

I had an extension update itself and partially stop working. There's no way to go back to a previous version unless you happen to back up the old files.

Are outdated Chrome extensions really attack vectors? They're very sandboxed. I'd be way more concerned about the update itself being malicious, especially for simple extensions that shouldn't really need updates.

Pedantically, outdated Chrome extensions make for a poor attack vector in the first place because the majority of users get automatic updates, including being disabled/removed by Google themselves if the dev is gone and a problem is found.

Yeah, I meant if they weren't automatic. Or to make things less theoretical, how often do extension devs currently find and patch security flaws?

Critical to the user safety? Well, that's not a problem.

Critical to the safety of some site/other users? Then the problem is a bit deeper, as my computer/software shouldn't be able to affect someone else.

Find a way to do security patches without restarting the application or interrupting user's work, and keep featuers/enshittification updates separate from security patches - and then people will not mind auto-updates. Hell, you could just apply them and not even ask anymore.

And these automatic updates are often abused to remove or change features, or generally "enshitify" things. Which breaks trust and we are back to square one.

> Unfortunately, it's been established for a long time now that users cannot be trusted to perform updates by themselves, no matter how naggy you get about it, even for the most critical of security fixes.

So let them not update. It's not your device, it's theirs. Mind your own business.

Reply on news.ycombinator.com