Companies rely on their fuckups to force you to update so you get the rest of the kool-aid right along with the stuff that is a must have. You can't say 'just give me that security stuff and hold the trash'.

On Debian, which I'm using, you can say that.

Not within a single application, usually. You get the application updated or not, but not 'just the security fixes' and the rest of the application stays the same, especially not with the likes of Firefox.

Even if you could force every app development company on the planet to support two-channel updates for "security only" and "everything else", How long would it take for them to force non-security related updates into the security channel through some vague justifications?

When it comes to extensions, they can _only_ be installed and updated through the "Chrome Web Store", so even if you were to stay on an old Chrome version that still supports V2, Google wouldn't let you download any extensions using it.

(There is a possibility to side load extensions for development purposes, but it's not a real option for end users. All other means of side loading has been killed by Google some years back.)

Why is it not an option for an end user? I have some local extensions installed, and there has not been any problems.

I vehemently disagree with the big G edicts here but to put forth an argument that automatic updates to a known user software tool is THE problem in an era where automatic updates have reduced the attack footprint for a variety of applications is... confusing. As 'anti-choice' as it may appear (AND IS) automatic updates for net connected software is how we have improved the general base level of security for the net. Unfortunately that has been completely dependent on providers of widely used software focusing on security and brand image over self serving interests. Nothing has ever prevented these companies from doing what could be considered the "wrong thing" over the right thing to date and, in general, blocking updates would be the wrong thing. With that said (written).... A project like this with an (mostly) open code base should have a veto mechanism to push the developers towards a different solution when something like this comes up.

There were over a dozen of 0day exploits this year alone. Some used in water hole style attacks, so not even that targeted. And these are state of the art incidents which would have pwned even users with all the updates installed.

After the patch has been pushed out, exploits become progressively cheaper so letting users to postpone security updates is a crime.

Ads, which is about running untrusted and usually hostile JS in your briwser, is the Pandora box of 0day exploits. Cut off ads, disable JS by default, and you'll solve 99% of 0days.