The myth that software needs constant updates has utterly undermined the principles of free software and immensely empowered sloppers and other bad actors.
The whole idea was supposed to be that, once you get something released as free software, you have it forever, and don't have to care about the people who made it selling out and betraying you.
That was like the whole distinction from proprietary software, where we knew it would always end that way.
And somehow we let the worst people in our spaces convince us that we have to accept the same from free software.
I largely blame the authoritarian infosec culture for this.
The authoritarian infosec crowd is just like cop apologists.
They want you to believe it's better to trust abusive authority figures than to risk your luck with the hordes of scary criminals out to get you.
@dalias
I would love another answer that works.
@dymaxion That presupposes that their answer works. It doesn't.
Users are still getting popped, just in constantly new and different ways introduced by new things they don't even have time to learn to use safely before the rug is pulled again.
The authorities who they demand users trust to keep them safe are the same authorities who refuse to give them the tools they need to be safe. Basic things like "don't accept media attachments from unknown senders, period".
@dalias How do you fix vulnerabilities without updating software?
Yes, most software is written badly, sometimes because the folks writing them don't have the resources they need, and sometimes because we insist on writing code like it's the 90s.
I'm in favor of more defensive design and giving users better tools, but, for instance, if I use a mail client, I will receive media attachments from people I use email with — and that includes people I've never emailed before. I don't mind if there's an option to turn this off, but if it's not on by default, almost no one will turn it off, and it is off by default, many users will try the software and then abandon it as broken — UX is an unavoidable part of software development.
Defensive design doesn't fix everything, though — you will always have attack surface, and it will eventually have vulnerabilities.
We started doing automatic updates because if updates aren't automatic, they didn't get applied. Most systems have options to only apply them manually, for folks who know what they're doing, but they're off by default because it's the wrong answer at the population scale.
Yes, there are times when malicious updates get applied. Our process for getting code to users securely is good in most places, but not perfect. We're seeing more cases where software gets taken over. A lot of them happen because the teams don't have the resources to do better. Folks are working on adding better tools for detecting malicious code to update pipelines, but that's always going to need continuous work; it can't simply be fixed, because "malice" is a human interpretation of code.
Large organizations quarantine updates and scan and review them before applying them. It could be made easier for individuals to do this too, but very few people want spend their evenings reading patch diffs, so there's no demand to make this easier.
(Eleanor, we met at IFF in Valencia years ago — you loaned me a power adapter for the con, which I returned on the last day. Thank you again for that.)
More to the point, most software is written badly because (a) software is hard and (b) the vast majority of programmers openly encourage non-professionals to write code.
I'm one of them. You own that computer: why not learn how to control it a bit better? Why not assert your independence from the tech priesthood?
I'm all in favor of power-to-the-people, but the combination of "software is hard" and "we encourage non-professionals to join us" results in, well, the consequences of our social choices.
To demand perfection from software is to demand perfection from the people making the software, and that's just authoritarian and inhumane.
The alternative requires us to acknowledge that software, even libre software, is allowed to have bugs. In this ultra-hostile network environment in which we find ourselves, that means frequent patches.
I don't understand how saying "please apply security updates" is authoritarian. It seems quite polite to me. It's certainly not the one-size-fits-all solution we thought it was in the '90s, but I genuinely don't see the downside in making it part of today's best practices.
But, I dunno. Maybe I'm just lacking in vision. Could be!
@rob @dymaxion Because there is no "please apply security updates". There aren't security updates.
There are new, drastically different versions of the software that break users' workflows, functionality, expected privacy properties, muscle memory, accessibility, etc. Oh, and the vuln fixes are only in these new versions.
But even if that weren't the case, the software vendor just *having* a backdoor to make changes to the user's system, which entails the potential to access any of their data, and which state authorities can force the vendor to use for that purpose, is itself authoritarian.
@dalias @rob How else do you solve the problem for give or take six billion people, not all of whom are functionally literate, let alone technical?
Yeah, it would be great if teams had the capacity to backport patches to every version ever, but there's never been a software team that could do that.
With open (or at least source-available) code, it's possible to make malicious use of update mechanisms exceptionally expensive, should folks decide to lean fully into reproducible builds and binary transparency mechanisms. I think this would be a great idea, for many reasons. However, few states are willing to get near this, because the blowback of people in their state no longer patching security vulnerabilities is basically never worth it for any single target.
