The state of play in 2020 however is that operating systems and browsers 100% need automatic updates for security issues. The reason we have them is because of all the bad things that happened when we didn't.
There should then be a very small switch hidden somewhere deep in the system where people like you who know what they are doing can turn them off. For the people who are using the software to say, run the electrical grid and a) care more about stability than security and b) pay people to write scathing reports about all the patches they're not installing.
IMHO there is a sticky middle ground with respect to office suites and email clients where the software is widespread enough that bugs are wormable.
Updates as a whole are inter-twingled with the developer's support and release model, how they a/b test and general maturity in terms of managing change. I feel like we're often complaining about different aspects of this when we talk about "updates".
I have had orders of magnitude more problem with updates than with malware/viruses/hackers.
The thing is with malware/viruses/hackers sooner or later something will get through any defences, so you need robust recovery system anyway.
And most updates that brake systems are not even security updates. I wouldn't mind automated security updates, but many many many maybe most vendors pile whatever happens to compile to their updates so that they customers can test it for them.
Firefox on mobile just fucked us in the ass (extension we developed for client doesn't work anymore and we can't fix it. And since we have support contract we will probably have to eat the cost of whatever alternative we have to build.).
Maybe that's precisely because the updates are preventing you from being owned?
Until you get hit by this....
https://www.giac.org/paper/gcih/201/microsoft-iis-superfluou...
It was the first widespread IIS vulnerability that almost hit me. The tl;dr version: All you had to do was encode a shell command in the url bar if the site was running IIS and it would execute it on the server.
Updates its 3,4 times per year. Like I said order of magnitude difference
> should be incremental and security or bug fixes only
There's a big difference between that and, for example, constantly pushing UI changes that nobody asked for and for no other reason than that some designer somewhere decided that "A/B testing" would look good on their resumé.