> Shipping an app without auto update in 2022 is a no go. If your user has to manually download every update I don't think they are going to be happy.
Honestly, in certain crowds the opposite is true. Having to install updates for software that is for all purposes feature complete is incredibly annoying, if you don't need an actual bug fix for something that impacts your workflow.
Sure, there can be security concerns, like in software that's used to sign documents and whatnot, but for most local software for things like content creation, updates are a nuisance a lot of the time.
Consider something like LibreOffice - if things work for me, I don't want some update that could cause a flawed re-install to happen behind the scenes and lose some of my preferences, file history, or mess with anything else in my workflow along the way. I am okay with manually installing the latest version once per year or something.
When it comes to security concerns, it’s not just about what you can do within an exploited binary. There’s also a lateral movement component: specifically the binary could be used to achieve privilege escalation or manipulated to write to the filesystem by controlling the input, etc.
Certainly, you're right there. Though do we need auto updates for addressing that, with all of the risks and annoyances that come with that mechanism?
For example, something like GitLab doesn't have automatic updates (in self-hosted versions) and seems to get by just fine with sufficiently scary update notices for serious CVEs, for example: https://about.gitlab.com/releases/2022/08/22/critical-securi...
Of course, those who just don't care won't even bother with those updates and the consequences are obvious. Automatic updates would prevent that, but then again, the backlash in the Ubuntu community for having snap packages on servers (and to a lesser degree on desktop) would suggest that that's just not enough to get people to buy into it.
One could also claim that server software and desktop software are entirely different beasts, but personally I'd prefer to update software on my desktop PC through apt or another standard mechanism (when I want, from sources I trust), as opposed to every piece of software deciding on their own bespoke update mechanism.
Personally, I don't really have a good answer. Both approaches are somewhat flawed, just in different ways to different folks in different circumstances.
> the backlash in the Ubuntu community for having snap packages on servers (and to a lesser degree on desktop) would suggest that that's just not enough to get people to buy into it.
> Personally, I don't really have a good answer. Both approaches are somewhat flawed, just in different ways to different folks in different circumstances.
You hit the nail on the head. It depends on the target market for your application. If your users do not expect to manually update, it’s probably a good idea to build an auto update mechanism that is opt-out or opt-in. It might not be worth it for other target markets though.
However, my point was that just because an application isn’t doing something critical, doesn’t make security vulnerabilities in that application harmless.
Honestly, in certain crowds the opposite is true. Having to install updates for software that is for all purposes feature complete is incredibly annoying, if you don't need an actual bug fix for something that impacts your workflow.
Sure, there can be security concerns, like in software that's used to sign documents and whatnot, but for most local software for things like content creation, updates are a nuisance a lot of the time.
Consider something like LibreOffice - if things work for me, I don't want some update that could cause a flawed re-install to happen behind the scenes and lose some of my preferences, file history, or mess with anything else in my workflow along the way. I am okay with manually installing the latest version once per year or something.