Comment by 1vuio0pswjnm7 | Hacker News Reader

Comment by 1vuio0pswjnm7 | Hacker News Reader

Parent Full thread

One of the interesing things about this story is that there appears to be no consideration of not "updating" to a new Chrome version. The idea of user choice in "updating" is completely absent. Why cannot a user say, "V3 sounds wonderful but I will stick with V2, thank you." A user has a version of a program that works for that user (e.g., with uBlock Origin), and Google can apparently forcibly stop that user from using that working version, through a process of "automatic updates". Users must "accept" updates which makes one wonder Google can pull this off. Does it not rely on user behaviour. By accepting every "update" without question, the user is effectively consenting to being controlled.

Perhaps users will someday "wake up" to realise that so-called updates are not necessarily being remotely installed for their benefit, but for the benefit of someone else. No doubt Google has some parallel construction type explanation why users need V3, but how many folks cannot see that they are letting the fox guard the henhouse.

Perhaps if ads can be blocked, so too can updates. (IME, it's possible.)

Companies rely on their fuckups to force you to update so you get the rest of the kool-aid right along with the stuff that is a must have. You can't say 'just give me that security stuff and hold the trash'.

On Debian, which I'm using, you can say that.

Not within a single application, usually. You get the application updated or not, but not 'just the security fixes' and the rest of the application stays the same, especially not with the likes of Firefox.

Even if you could force every app development company on the planet to support two-channel updates for "security only" and "everything else", How long would it take for them to force non-security related updates into the security channel through some vague justifications?

When it comes to extensions, they can _only_ be installed and updated through the "Chrome Web Store", so even if you were to stay on an old Chrome version that still supports V2, Google wouldn't let you download any extensions using it.

(There is a possibility to side load extensions for development purposes, but it's not a real option for end users. All other means of side loading has been killed by Google some years back.)

Why is it not an option for an end user? I have some local extensions installed, and there has not been any problems.

I vehemently disagree with the big G edicts here but to put forth an argument that automatic updates to a known user software tool is THE problem in an era where automatic updates have reduced the attack footprint for a variety of applications is... confusing. As 'anti-choice' as it may appear (AND IS) automatic updates for net connected software is how we have improved the general base level of security for the net. Unfortunately that has been completely dependent on providers of widely used software focusing on security and brand image over self serving interests. Nothing has ever prevented these companies from doing what could be considered the "wrong thing" over the right thing to date and, in general, blocking updates would be the wrong thing. With that said (written).... A project like this with an (mostly) open code base should have a veto mechanism to push the developers towards a different solution when something like this comes up.

There were over a dozen of 0day exploits this year alone. Some used in water hole style attacks, so not even that targeted. And these are state of the art incidents which would have pwned even users with all the updates installed.

After the patch has been pushed out, exploits become progressively cheaper so letting users to postpone security updates is a crime.

Ads, which is about running untrusted and usually hostile JS in your briwser, is the Pandora box of 0day exploits. Cut off ads, disable JS by default, and you'll solve 99% of 0days.

Reply on news.ycombinator.com