I disagree. There is a difference between not knowing what to do, or how to do it, versus simply not doing it out of laziness or negligence or an unwillingness to take on the responsibilities implicit in owning your own device.
The learning curve for keeping software up-to-date is not particularly steep.
I think some of you may have misinterpreted the "It's time-consuming, technical, and inaccessible" bit. Sorry, but I should have been a little bit clearer about precisely WHAT is time-consuming, technical, and inaccessible.
Browsing and understanding the source (and even the release notes, and bug trackers) of open source projects is frequently time-consuming, technical, and inaccessible. Particularly when it's ensconced solely in a GIT or SVN repo, with no user-friendly web front-end, and is only accessible via a command line.
I disagree with "robin_reala".
Updating software at your leisure, ON YOUR OWN SCHEDULE AND NOT SOMEONE ELSE's, by downloading installers, patches and packages is often a pretty reasonable task. Especially when it's a browser like Firefox or Chrome. It's also better to have redistributable offline copies of installed software and updates that you can retain as backups (uninfected backups, of course), in the event that network connectivity is unavailable, or because the network was essentially the source of the infection in the first place.
Yeah, yeah, yeah... good security practices dictate that we are ALWAYS on someone else's schedule. Live in fear. Okay, yeah, that's great, I get it, we all get it.
This is not an improvement. I do not like it when my computer changes itself without asking.
- Does no one question this anymore?
- Why should we blindly accept every single update unquestioningly?
- Why should we be forced to deal with the problems they introduce after the fact?
- Why will no one contemplate that constant automatic updates are an attack vector unto themselves?
The more you force your feedlot of end-user livestock to tolerate potentially disruptive updates, the more they will grow accustomed to not being in control of their own machines, and the less likely they will be to notice a real problem as a signal amidst all the noise. Honestly, why even bother pretending to have control of our machines anymore.
When people ask me for help now, my eyes glaze over, and I am often forced to respond "I don't know what the fuck that thing is doing. It clearly has a mind of it's own."
This, my friends, is an affront to the very sensibility of the control an "open source" project, should ostensibly extend to it's community and user base. And spare me your bullshit about "Oh, hay guyz, you can just go on GIT or SVN and look at the code yourself!"
It's time-consuming, technical, and inaccessible to normal people, never mind the complications of different platforms, and the shifting sands of dependencies, commits and continuous integration.
The learning curve for keeping software up-to-date is not particularly steep.