idea that no sane user could possibly have anything more critical in their life than installing whatever code comes out
The problem is when you examine user behavior, they inexplicably seem to have something more critical than installing updates, 24/7/365. Which is how bot farms begin.
I'm not sure users have been finding the alternative that has been playing out any more acceptable. Does it look that way to you?
Now, do you have the right to own and drive this autonomous car around on public roads, if you’ve modified the car to be an “open server” where anyone can anonymously connect to it from anywhere on the Internet and drive it around?
And, if not, then what’s the difference between that modification, and knowingly driving the car when it has an unpatched vulnerability allowing people to do the same?
And if you find that there is no difference, then what’s the difference between a vulnerable car that can DDoS physical infrastructure, and a vulnerable PC that can DDoS virtual infrastructure?
MS could deliver security updates separately to feature changes but chooses not to. The Tragedy of the Commons is that well-publicised incidents like this (and the trend of updates to consumer software, supposedly under the guise of enhancing security, to bring about significant changes in appearance and behaviour) make people less, not more, inclined to defer updates to all software with the result that developers feel the urge to strong-arm users into updating.
The only justifiable reason for updates to be forced in the example with the vehicle is the physical danger that could otherwise result, and that simply doesn't exist in the example with the home computer. To my mind, the line of thinking you are engaging in here is a perfect example of the rampant authoritarianism that seems to be so rife in the computer security community these days.
How about if there not only was no FDA approval process for the vaccines, but the pharma company itself didn't bother testing them?
Because that's Windows Update in a nutshell. Every couple of months somebody breaks into my house in the middle of the night, even though I locked my doors and windows and posted a no-trespassing sign, and pokes me with a needle... and I'm supposed to just sit there and take it in the name of "security."
Imagine what the FDA already does, and then imagine that they were verifying a drug that would be given to every person in the country. There'd be a crazy strenuous verification system for that.
And that's a big part of the problem. Not only is there no 'FDA' to test these patches -- nor should there be -- but the manufacturer evidently doesn't test them either. They fired their QA personnel a few years ago, so that's now our (unpaid) job as users.
Even worse, there are some indications that this particular bug was discovered and reported by insider program members and actively ignored by the company.
Windows Update is apparently the team where Microsoft employs their B- and C-level players and managers. That's not OK. If you're going to insert yourself forcefully into everyone's critical path, you'd better know what you're doing.
Besides, if you look at what sorts of vulnerabilities they're actually patching, the majority of them require local access anyway; remotely-exploitable-by-default ones (fortunately) tend to be few and far between.
They mover force an update but make you aware you're on an older version.
I'm much happier in a world where only those that put in the effort to research how to block updates and then go through the steps can do so. They are much more likely to encounter info on how they should really think about what they are doing, and whether there are alternatives or partial solutions that achieve most their needs without being as extreme.
Please don't ruin the little bit of herd immunity we've built up.
At any rate, iCloud is not “backup” in the traditional sense, it’s really “cloud sync” for user data. In that context it’s not really surprising that connecting a new device to iCloud and restoring pulls the newer OS version, given you never really backed up the OS data at any point.