Comment by BugWatch | Hacker News Reader

Comment by BugWatch | Hacker News Reader

Parent Full thread

WHENEVER I had (or left) the auto-updates on, I came to regret it, from Windows updates to Android apps. Form it usually takes is (and all of them personally encountered):

- system instability - just plain data deletion and/or loss - features not working at all, or quarter-baked - previous free feature moved to premium or behind the paywall - incompatibility with previous files - just plain resetting my previous settings and customizations to defaults - arriving with the wrong language (based on keyboard layout or location vs my OS-chosen one) - somebody was frelling bored, so decided to move the position or change a keystroke of the function in the menus - just "because" or "it boosts engagement" or some similar crappy excuse - plain spyware/malware delivered as an "update" (with app betwixt updates being sold to spammers/scammers) - app/program sold in the mean time, with the new one preferring to siphon all the telemetry possible (all options conveniently on by default) - messing up my file or action associations

...and probably 12 other things that don't cross my mind at the moment.

I will bloody update my hardware and my installed (or portable-d) software whenever the frell I please. I cannot stand the mommy-gloves and mommy-stance I am subjected to

I do not have will nor time to battle with that. My largest "attack surface" in any/all meanings of the word comes from auto-updatijg. So, off with your hea-- auto-updates.

I've been blocking/filtering all auto-updates and all Internet access to all apps/programs/OSes where ever possible. Whenever possible, I use portable versions that don't require installation, and I have a huge software library; letting things run amok is not an option.

I've been doing it for a decade now (in different, but ever enlarging scope), and I've never been happier. Nothing breaks. Things work. AS THEY SHOULD. And nobody forcefeeds me the crap 95% of the "common folk" are subjected to.

Yes, this is a rant. And the topic is a sore one. I'm just so, so, so bloody sick of it.

So you keep track of critical CVEs for the entire stack of all software you use, and make quick and informed decisions about which components really do need to be updated immediately?

Almost all of software in my library/catalog is offline-only, as in - online component is not required, nor wanted: I'd specifically choose local/offline variant vs a fancy online-required one; open-source over freeware over commercial, etc. (I have only addressed the auto-updates, not all other points of my "system", not its exceptions, and certainly not its finer points.)

I thought it self-evident in my post that I expect the software in question to notify me of a new version, provide the cumulative change log, and offer me an update (plus even an auto-update, but only as an option).

Software that did that (let's call it "polite" software), got its net access (for limited aforementioned uses). And if it was a piece of software I particularly found useful and non-clashing with my stances, I sometimes even enabled the telemetry (because it might help improve it).

What I cannot stand is being forcefed those. They break everything when I least expect it, and when I most need the things to function and function fast (e.g. auto-update on program start VS offered update on close). Most (90? 95%?) of my catalog is specific (and offline) use only, so eventual issues usually do not affect me.

Often used software I update on a more regular schedule, but still - almost exclusively manually (by downloading the new portable version). OS is updated once I'm done with a project or whatever I was doing in that duration - meaning when I can temporally afford to be frelled in the posterior by Microsoft's updates, and spend an hour fixing stuff... such as figuring why the bloody gamepads are now suddenly preventing my monitors from going to stand-by, thus messing up my presence & tracking software, thus messing up my home automation recipes. (If you are impacted, it's the 2019-timestamped XBox driver; revert to something ancient [find it somewhere], and "lock it" down by listing device identifiers via group policy.)

To sum up, in simplified terms - any frell-up resulting from an auto-update impacts me 100% (and costs me time, nerves, will to live) VS extremely low percentage of being affected by the critical security vulnerability du jour (and especially taking into account security and precautions I practice).

Constantly-used and online-required software has its own, different set of "rules" (security, precautions, guidelines, etc.). Don't mistake my ire at a certain type of an unfortunately too common (mis)use of a feature (in my specific circumstances and use cases and scenarios) as an irrational blanket refusal of absolutely everything under that category.

(Note: typing on a phone, so due to editing troubles my chain of thought might be all over the place.)

You're really splitting hairs here, the "polite software" you're talking about also needs to "phone home" to check and offer the update, which probably leaks about as much information as you manually refreshing the project's web site every week.

I am not. Please re-read. While privacy is always an issue, notice I even directly said I'd willingly enable telemetry for some software (as a means of disambiguation and explanation of my stance), amongst other caveats.

However, what I do not stand for is auto-updates without my explicit knowledge and explicit consent, because it regularly messes up my... well, my "anything and everything". (Insert specific xkcd instance about breaking-workflow here.)

Therefore, due to personally-experienced and ever-widening common abuse of the mechanic (and ever-encroaching march on my privacy and rights on & from all fronts), I am less and less willing to even consider giving the pieces of software I actually enjoy the benefit of the doubt (aka useful telemetry).

Please notice - my original reply was (exclusively) addressing the specific portion of one of the preceeding user's comments "pushing" for the auto-update mechanism as mandatory (and not to the Audacity's issues/attempt/approach specifically). From my perspective, it seems that you and the previous commenter are addressing my replies as a full and all-encompassing description of the whole of my approach and practices (and I have specifically said that isn't the case in the comment above this one).

Additionally, there is an assuming of the non-use of any (or a combination, or all) of the myriad of the additional layers of protection available to any semi-advanced user [e.g. Tor, purpose-configured browser, proxy, VPN, etc.] while obtaining the software in the first place (and/or subsequent instances), and that the software in question could be "gotten" from alternative and directly unrelated locations if need be. If true, that assumption would be in error.

Reply on news.ycombinator.com