Hacker News Reader

Comment by sillysaurus3 | Hacker News Reader

Should programs periodically check for critical security fixes, and then refuse to run if the current version is affected?

It seems like there are a lot of people who don't really pay attention to social media or other security alert channels, who won't have a clue about the extent of this vulnerability. I'm sure they'd update if they knew "if I clone a malicious repo, I'm toast," but there's no way to inform them except by HN/Twitter/Reddit/mailing lists.

One could argue that they get what they deserve for being uninformed, but it seems like the ethical obligation might actually be on us to develop tools that ping home and ask whether it needs to stop working until it's updated.

Actually, I'm not sure it's ethical to embed such shutdown behavior into a tool that needs to be reliable. Maybe just a scary warning message like "This version is critically vulnerable, update immediately" every time the program runs would suffice.

View on HN

I'm not sure how I feel about programs phoning home like that. I tolerate it with apps, but command line tools ought to be doing their stated function when run.

There was a discussion of this a few weeks ago on the mailinglist of a scientific software project I use. The people were very clearly divided into the "Flash does it, so it's ok" and "omg no, think of the user privacy" camps, it was quite interesting.

I think I'm much more ok with background things upgrading in the background. For instance: I never open a new browser tab and think "hmmm, lets launch a Flash process", it's just there, ready to respond when needed. So it isn't shocking to find that it polls for updates and applies them.

By contrast, git is a tool that I manually invoke on the command line, and when the process terminates it's done. Having that phone home at runtime feels more invasive.

That's a good point actually. It fits with the principle of least confusion. (The software I mentioned is a command line tool/library.)

A tool printing "This version has a critical vulnerability, upgrade immediately" wouldn't be confusing though, or cause any problems. Even if it wasn't connected to the network, it simply wouldn't print that message. Everything else would still work properly.

It seems like people are worried about privacy without thinking it through.

I think it's a distro's job to deal with it. The cli tool shouldn't phone home, but the distro should be able to be notified of a critical update and strongly warn you the next time you try to launch it.

Maybe even a push update you can subscribe to.

It can be done in a way that preserves privacy: Package manager regularly asks for compromise information. When programs run, they ask package manager if they are compromised.

That still feels like asking too much of each individual program. I'd prefer it if the package manager did the check itself periodically.

Coming from NPM land, sounds like a nice module to build.

Reply on news.ycombinator.com