Hacker News Reader

Comment by gregd | Hacker News Reader

Ugh. I'm extremely skeptical of auto-updates. My servers don't auto-update, my workstation doesn't auto-update..nothing I own, auto-updates if it's capable of it.

Can anyone tell me if it can be turned off? All I'm seeing is this:

For developers there are lots of options around how to control the new updates feature, including allowing it to handle major upgrades as well as minor ones, more sophisticated date query support, and multisite improvements.

I've been burned one too many times. I see a MASSIVE WP failure in the near future where an update gets pushed out and takes millions of Wordpress sites offline...

It's happened with Bitdefender. It's happened with AVG. It's happened with Windows 8.1 RT.

View on HN

@nacin says the WP auto-updates are disabled if the WP code is contained in any repository, up to the root folder. http://make.wordpress.org/core/2013/09/24/automatic-core-upd...

I'm fine with it, but i understand the concern. It sounds pretty easy to disable the feature...

> The simplest way to disable it is to add define( 'AUTOMATIC_UPDATER_DISABLED', true ); to your wp-config.php file

Urg. It should be off by default in my opinion. You should have to explicitly turn it on.

I think it should ask the user, explicitly giving him information about what's wrong with both approaches.

There are filters to turn off auto-updates easily. Also keep in mind it's currently for minor updates only, which basically never break a site. And in beta and RC testing, there were no hard failures, only some instances where the update stopped because it detected a potential issue. It's a pretty clean setup, and overall really good for the security of millions of websites.

@nacin responded to me on Twitter saying the auto-updates are automatically disabled if WP detects that it's being run from within some source control repositories. I asked if it's smart enough to know if it lives deeper within a repository and haven't yet received an answer.

It is smart enough, it'll keep traversing upwards and check every parent directory.

As long as there's a switch to turn it off, you'll be just fine. Meanwhile millions of poorly monitored sites will be less vulnerable to attack at the cost of what I suspect will be relatively infrequent update snafus. All security is a tradeoff and this is a good one.

I just updated a test site to 3.7 and I'm not seeing anywhere this can be turned off.

Found it! In order to disable it you have to add define( 'AUTOMATIC_UPDATER_DISABLED', true ); to your wp-config.php file

There's a constant so that you can turn it off. In the linked article, the first paragraph in the section about auto-updates links to the wordpress wiki page about it, the constant is basically point 1a on that page.

http://make.wordpress.org/core/2013/10/25/the-definitive-gui...

By default it only updates minor releases, which are only used to fix security issues and regressions. So it's only automating the the safest updates, and I think the good it will do by keeping sites secure outweighs the risk.

Reply on news.ycombinator.com