Hacker News Reader

Comment by ordinaryperson | Hacker News Reader

OK, so there was an image orientation bug in that specific release of Chrome.

But it's estimated there are 1 billion users of Chrome. One billion! How wide of an attack surface does that present? Or how much of a nightmare would it be if they were all on wildly different versions?

I get that this specific bug may have caused problems for you. But if I had to choose between security and compatibility for 1 billion software users vs an occasional image orientation bug, I'll choose the former, personally.

View on HN

> But if I had to choose between security and compatibility for 1 billion software users vs an occasional image orientation bug,

This is a disingenuous characterization of my argument. The image orientation bug was a simple example. Further, why can't there be some kind of compromise where security updates are automatically applied and feature updates are not (of course I understand that the line can get blurry)?

Lastly, in a philosophical sense, I don't want to cede control of my machine to a third party. Automatically updating apps removes the chance for me to consent to changes and puts me at the mercy of a third party. It removes my ability to make an informed choice.

It's a simple example but that's the kind of tradeoffs platforms are trying to make. Small bugs in favor of security and compatibility. It could be a thousand image orientation bugs. Same arguments still apply.

And yes, you can't cordon off security updates from everything else. They accidentally break other things. But this is a general problem of software development.

If you're using a third-party's software, aren't you already consenting to their "control"? How much control do you have over someone else's software?

No using third party software doesn't mean you are consenting to their control. Why would you believe that?

For open source you can read the source and decide to install or change. You can limit permissions by assigning to different user groups. You can disallow firewall access. You can choose to use selinux and have additional restrictions.

Automatically updating anything introduces risk.

Maintaining forks of old versions is expensive and error prone.

Sounds like a good argument against moving so fast that you break things all the time.

1 billion chrome users != 1 billion ubuntu users.

My phone living on an older version of chrome is included in that number. It won't be updated.

You are looking at 20 million at most. Most are running just a server. If you are lucky if 1% are affected. Doesn't really close the loop and in the worst cases it breaks more experienced computer users.

Not the greatest tradeoff.

Reply on news.ycombinator.com