Bonus thought experiment: this same criticism applies to most Chromium and Firefox forks. (Especially the ones that describe "no automatic updates" as a feature.)

I wouldn't call it criticism. Software at this scale and complexity will have vulnerabilities. I'd be a lot more concerned about someone who claims that their code is fully secure and doesn't need any patching ever.

> Software at this scale and complexity will have vulnerabilities.

Certainly. The question is what provisions the software has made to mitigate those potential vulnerabilities by notifying users that a patch is available and allowing them to automatically apply that patch.

Deliberately removing these mitigations from a piece of software which is highly exposed to exploits, like a web browser or an operating system, is nothing short of irresponsible.

Windows Ameliorated ships with a non-administrator user, thereby requiring a password for temporary admin privilages.

Most no-auth exploits take advantage of the user already being an administrator, and then bypassing UAC for example. The configuration mentioned above would likely mitigate this issue, although I'm not educated enough on this subject to say for sure

The hole is in SMB (Windows remote file&printing services), which run as SYSTEM, not the currently logged-in user.

I see, thank you for the information.

When was the last RCE that didn't involve running Javascript on an untrusted URL?

3 days ago.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...

What was the vulnerability? Was it in a component that is stripped in this project?