Hacker News Reader

Comment by drannex | Hacker News Reader

Alternative point: I don't think _any_ app store should have the ability to auto update apps. That's a security nightmare for anything and anyone.

Updates should be user requested, every time. Sure you can nag at them till they do, but the user should have the final say every time.

View on HN

Auto update is good default policy IMO. Most non-technical people don't care to update apps as long as the apps are working which could lead to unnecessary security issues or critical bugs left unpatched.

Perhaps technical people should take more care when making updates for their application? There's a negative sentiment over updates for software and it arose from how bad updates ruining things. Updating might help with security, but it also forces you to put up with every harebrained UI change and removal of features that developers come up with.

Eg tab groups were pushed onto mobile users in Chrome, yet it feels like the people who made the UI change don't actually use mobile chrome much, because the UX is awful. Luckily you can trudge through flags to change this behavior to the old one, but how long until we can't do that anymore?

I got tired of certain apps that kept changing behavior or UI every single week. Some of them sneakily added antifeatures that were not there originally or move features to premium asking me to pay again.

In consequence I disabled auto updates and run an update when I remember...

I'd rather prefer to have auto updates for just security patches not for features.

This doesn't help much, since antifeatures are rarely described as such (or even at all) in release notes.

What would be more helpful would be the ability to revert to previous versions (can't speak to Android, but this is certainly missing in iOS).

Android can sort-of do it. It's often possible to downgrade without losing data if the application signature hasn't been tampered with.

Automatic security updates, yes. Automatic feature updates, no.

That still gives power to the developer. O could add an anti-consumer change and call it a security feature, prompting devices to automatically update it.

Let's not act like Google would hand out any punishment, either.

Applications should not have security issues or critical bugs to begin with.

Unfortunately, humans are not capable of errorless long-term work.

Lol wut? Thousands of brilliant programmers who work for top tech companies push bug fixes and android gets a security update every few months. We are people, people make mistakes, we're not some code fairy queen.

It's funny because as you mention this, somebody made a thread few days ago for iOS already

1. https://news.ycombinator.com/item?id=27175955 | An iOS app update that annoys me | Hacker News

Trying to restrict updates is in effect trying to prevent the original developer changing the behaviour of an app after installation.

Thats very hard to do, since in the extreme case the developer could code in a change of behaviour after a certain date/time, or depending on a response from a server on the internet.

I feel there's a qualitative difference between time-influenced or server-influenced code, and the ability to arbitrarily change the code itself. In the former, control is limited to whatever the dev thought of at the time the software was released. It's the difference between vetting a dev at a particular point in time, versus trusting them in perpetuity.

On Android apps can download and execute arbitrary code anytime they want. The app doesn't need to have the code built in.

Same on iOS in certain circumstances - eg. webviews.

They could, but a developer won't design it that way unless they're already trying to sidestep update mechanisms. The point still stands that there's a difference between "I trust the developer now" and "I trust the developer forever".

> Trying to restrict updates is in effect trying to prevent the original developer changing the behaviour of an app after installation.

Sounds just like the pre-Internet era to me.

It's a double edged sword. Either the scenario you described (less likely IMO) or our grandmas are stuck with outdated Applications with known vulnerabilities for years because they don't go into App Stores and update manually.

I fully agree.

My stock calculator app now asks for me to agree to terms and conditions. It didn't do that previously. Why on earth would I ever upgrade my calculator? (I always decline of course)

Any by the way, WHY does android even bother me with upgrades, if it's going to upgrade my apps anyway whether I want it or not?

I'm guessing to get you to accept a new terms of service.

IMO, auto updates are among the single most impactful benefits to user security.

Reply on news.ycombinator.com