If updates were not automatic a large number of people would not upgrade and would not receive important security updates along with various fixes and new features. If a user keeps running into a bug that has already been patched in a newer version that user will just think your software is bad and they will not realize that this poor experience they are having is because they are on an old version.
>The number of times I've been hacked and suffered a data loss is astronomically small
Being hacked even once is a bad thing. It is something that the industry tries to minimize as much as possible.
>the number of times I've had something update and suffered a data loss
Personally I have not experienced this, but it sounds like this would still happen when you update later. This is why doing gradual updates of rollouts and collecting telemetry is important. It is very useful in being able to detect a bad update and stop it from going out. Unfortunately, the Linux ecosystem is still behind the rest of the industry which leads to people having a poor user experience.
The "generic" response is beacuse the complaint is simiarly generic.
My personal experience does not match this at all, so is the explanation there that I'm just lucky?
Because software is never finished. There are always bugs to fix, new platforms to support, new features to be added, more polish to be added, etc. It is the developers goal to have the quality of their software to go up over time.
It is in developers interest for their users to remain secure, not experience bugs, have a good experience, and to solve a problem or need they have. Updates to applications try and address one or more of these things.
If making the user's life better is a cargo cult thing. Then maybe that cargo cult isn't such a bad thing.
If you are specifically talking about why should you care about a chrome 0day patch because you've never visited a shady site that tried to exploit it then the reason is that it's important for the ecosystem to be seen as secure. You want to make it as least financially viable to exploit Chrome as possible, you want to ensure people think of the web as a secure platform they can use without being afraid, as Google you want to avoid bad PR about a big hack. The first point is important. You want to increase the customer acquisition cost for an attacker which is "the cost to get a visitor divided by the chance a user's browser has not gotten the patch yet." Google's lever for increasing an attacker's CAC is to use autoupdates to lower the chance. When CAC > LCV (lifetime customer value) then the attacker does not have a financial incentive to compromise users and this results in a large drop in the rate of attacks. The required updates remove the incentives to use the attacks which is why you feel like you aren't being targeted.
It's like how some management don't understand the value of a system administrator because when a system administrator does their job correctly everything appears to just work. When security updates are properly going out it may feel like they are unneccessary, but that just means that the defenders are doing a good job.
Security wise for most applications there's the oft overlooked possibility of just not connecting to the internet. Though when it comes to my personal experience running antivirusless Windows with updates disabled it has not been a problem for me for a decade now. According to my router I'm not part of a botnet either. It just doesn't seem necessary at all. Your attack surface as an individual on a reasonably well secured network is minuscule and your threat model is basically just the background radiation of bots trying whatever random exploits. Sure, I keep my router patched because it's on the edge, but other than that it doesn't matter.
Though I will give you that browsers are a special case where the tool is specifically used all the time to connect to potentially hostile content and give that content the ability to execute code on your machine. Things on the edge are a scenario where keeping up with security patches actually make sense.
Before we get the point where we are discussing aspects like under what conditions should updates be applied or the priority of which updates should be installed first, desktop Linux needs to show that it can handle the basics.
Upgrading Android apps does not need a reboot of the device either. Again live patching is a separate feature from automatic application updates.
Is it very not true? Apt restarts processes and services all the time during upgrades.
When Ubuntu prompts me to restart the system after an update I can dismiss the dialog even for weeks, but at a certain point the cumulative updates start making the system behave erratically and I have to restart. Probably kernel, drivers, libc, other vital stuff get too much disaligned.
Parts of the program were updated and now the program is in a not tested, half-updated, half-old state.
The "other choice" for Mozilla is pretending nothing happened, attempt to open the tab, probably immediatly segfaulting and losing all your current work in a potentially unrecoverable way. Not really a good choice under most circunstances.
I don't think it's true, I had the disable unintended upgrade on Ubuntu because it runs cpu at 100% and make very big noise at night.
Ubuntu doesn't seem to realize (or simply doesn't care that) enterprise servers and user desktops are entirely different beasts.
Most other software should only update when specifically instructed to.
That's not a sane decision. Sane would be to update on closing.
Same way Windows offers to "Update and Shutdown" (you don't need the PC anymore why don't I under after you walk away) and not "Update on next Start up" (I'll wait until you need me to get in your way).
This presumes that shutting down is never a time-sensitive action. If I had a nickel for every time Windows decided it wants to spend a half hour installing updates when I'm trying to shut down a laptop so that I can put it in my bag and go somewhere with it, I'd be able to actually buy a Windows license instead of resorting to vlmcsd.
Perfect!
Quora always had reputation for being shit but I am impressed by how terrible that page is. I mean there are only two 2 types of answers there: "Window$ is BAD" and stuff that looks like generated by GPT-3( or straight up from those infamous "recipe sites" a.k.a. SEO farms).
Windows does sometimes get it correct.
Though I never seen it on Fedora or Windows, might be some quirks related to Ubuntu packaging.
On Windows, where no standard update mechanism exists, Firefox updates itself, so it does it only when it knows it's fully shut down (before it opens or after you close all windows).
And for Windows there is standard update mechanism - Microsoft Store - which also does the same sane thing.
So it's Ubuntu implementation problem, and not a Firefox one.
Do I understand correctly that it is based on systemd's offline upgrade mode, i.e. installation is done at the following boot? If so, you can do that on Ubuntu too. I'm not sure how (perhaps by invoking apt-offline?), but at least KDE Discover does it on Kubuntu.
Most software does fine, as long as it has already mapped in all of its libraries, those files can be unlinked in the filesystem, but will remain on disk in their current form. You do run into trouble if the software is part way through starting up and hasn't mapped all the libraries, or if you update the files rather than unlinking and copying new ones (at least, FreeBSD lets you update mmaped files and all processes will see the updates, which is usually not what you actually want when the files are code).
Windows makes it very hard to update program files while programs are running, so it's not surprising Firefox endeavors to do updates while it's not running.
This doesn't seem insane to me, but might not be an easy thing to fit in to the large body of code that's already there.
You still have issues if you're starting up during an upgrade, but that's a problem with anything dynamically linked.
I don't think so? As long as the main process is separate from the seed process, and the seed process is forked before specialization.
> It also makes address space layout randomisation less effective, because every forked process starts out with the same base memory layout, doesn't it?
Yeah, I think you're right. Not sure if you could maybe do some randomization post fork, but you're probably right.
Are you sure that originates in the update check? The update itself is downloaded asynchronously while the browser runs. The browser itself checks if an pending update has been downloaded when it is launched.
I don't think this is a fair decision. Virtually nothing requires such a forced update. And the browser should be sandboxed by the OS anyway.
That's not been my experience. I don't know what system you're using, but with Firefox on Ubuntu, I discover that Mozilla has put out another (goddamn) update (again, already, goddamnit!) when all my tabs suddenly crash, forcing me to restart the browser.
Eek hard disagree.
Most things I want to auto-update. Preferably at 4am. Somethings I want to disable auto-update.
What I never want is things to update when I’m in the middle of something.
Yes. For user orientated interactive systems it is mad.
But it has its uses, IMO, for IoT devices.
It was the reason I do not use Ubuntu on my personal computer. If I were in the business of building connected devices I would be interested.
The number of times I've been hacked and suffered a data loss is astronomically small compared to the number of times I've had something update and suffered a data loss, or more importantly the number of times I've had something update and cause a regression or break something. Then I have to spend my precious time bringing something that was PREVIOUSLY IN A WORKING STATE back to a working state, which is one of the most infuriating feelings.