Originally Posted by
gfunkdave
Of course, the reason for this is bug fixes that fill in security holes. Couple that with the fact that 95% of users won't update software of their own volition, and auto-updates become an important way to fix security problems.
[Auto-]updates are not a security solution and cause critical issues too often.
Updates are what introduced the security hole. Maybe the update wasn't a bug fix, but a feature enhancement that introduced the problem. Rarely the problem was there from the beginning and only just discovered, but it happens.
Updates, auto or manual, solve known problems and create new problems. For this thread, 9.3.2 has features valuable to a user that 10.x.x makes impossible.
The purpose of security is to keep a system usable. There are notable past events where the 'security' solutions degraded or disabled systems, and not enough has changed to prevent this. That last ransomware event was bad for a number of people, but it's just as bad when $antivirusprogram false positives $bootprogram as virus and deletes it.
Updates need to be managed.
Up in the air, you don't want to start a Gogo or other for-pay, limited session, then find out that some piece of software as woken up and decided now is a good time to go get a large update.
On the ground, the last thing you want is to try to start that presentation or try to leave for the day to catch a flight and find out that Windows has decided "I am updating. Don't turn your computer off. Estimated time to complete: Let me get back to you on that"
Updates and patches have value, but it's a balance and auto-update doesn't strike that balance.