Re:Why Johnny Won't Upgrade
by burntoutfire on Thursday August 27, 2020 @05:59AM
(#24291916)
> I have had orders of magnitude more problem with updates than with malware/viruses/hackers.
Maybe that's precisely because the updates are preventing you from being owned?
The % of security fixes vs speed ui improvements is 100 to 1. Very rarely do we get issues that require forced updates that a once a year limit on these types of updates would be ideal.
Re:Why Johnny Won't Upgrade
by scarface74 on Thursday August 27, 2020 @09:49AM
(#24293639)
I have been in IT for over 20 years now.
I have had orders of magnitude more problem with updates than with malware/viruses/hackers.
Until you get hit by this....
https://www.giac.org/paper/gcih/201/microsoft-iis-superfluou...
It was the first widespread IIS vulnerability that almost hit me. The tl;dr version: All you had to do was encode a shell command in the url bar if the site was running IIS and it would execute it on the server.
Oh we(organizations I have worked for) have been hit several times (not IIS, but once it was several wordpress sites we used, once it was outlook, once we never figured out - probably inside job, ... ). But that was 3, 4 times in 20 years.
Updates its 3,4 times per year. Like I said order of magnitude difference
I have had orders of magnitude more problem with updates than with malware/viruses/hackers.
The thing is with malware/viruses/hackers sooner or later something will get through any defences, so you need robust recovery system anyway.
And most updates that brake systems are not even security updates. I wouldn't mind automated security updates, but many many many maybe most vendors pile whatever happens to compile to their updates so that they customers can test it for them.
Firefox on mobile just fucked us in the ass (extension we developed for client doesn't work anymore and we can't fix it. And since we have support contract we will probably have to eat the cost of whatever alternative we have to build.).