I considered that a few times, but eventually complex things like modern ad-blockers rot, so I would be forced to update every once in a while, and let's be honest: I am neither qualified nor prepared to audit the diff.

I guess deferring updates would give me lead time to let others get targeted / detect an issue before it's likely I would get the update. Still, installing the permission-less version is so much simpler and reassuring.

I rely on the latter. I am much more concerned about supply chain attacks of mass exploitation than I am about 0day in my Signal client or my browser extensions.

If there is something big enough to warrant quick update, my HN addiction will make sure I find out about it before it is a 1day.

There really isn't a great configuration for browser security rn, is there? The gold standard I think is Qubes, which afaict is not practical.

That only makes a difference if you’re auditing each extension update. Switching to extensions with per-site permissions reduces the attack surface drastically and you don’t have to worry about auditing or disabling updates.

Turn off extension autoupdate sounds like a bad choice, not all updates are mallware injected, many of them may contains security updates anyway