Feedback Implement option to turn off auto-updates

The Hub downloads and installs updates automatically:


Can you please add an option to toggle this behavior? I would like to disable auto-updates and decide when to update.

Not being able to turn off auto-updates has a bitter taste after the node-ipc incident which is the main reason why I want this toggle to happen. I assume chances are reduced to be affected by such incidents when turning auto-updates off.

 

Upvote +949,869,384,570,293,847,590,874.

I would like to relate a similar story to demonstrate why forced updates and "always update" are such terrible, terrible ideas.

I used to be a network administrator in charge of an email server. One day I noticed that SSL was out of date on my email server. Wanting to be responsible and effective, I decided to follow the prevalent "always update" advice we keep getting. So I downloaded the latest version of SSL (version 1.0.1 at the time). I unpacked it, got the command typed in to start the install, and, I kid you not, I had my finger over the enter key, when something stopped me. I struggled with it for a few minutes, unsure of whether I should continue. In the end, I decided to give it a week or so, then do the install.

Three days later, Heartbleed was discovered. I had the last version that was not affected by it (version 1.0). Talk about dodging a bullet. I knew some admins who had to perform reinstalls on entire server farms, and had to have all users change their passwords.

TL;DR on Heartbleed: The exploit lets a malicious user slowly, over time, use the heartbeat feature of SSL to read the entire contents of the server's memory - including usernames, passwords, and whatever else might be in memory. Ouch.

Some things to note about Heartbleed. It was based on a new feature that many servers didn't really need - basically, a keepalive ping to maintain an open connection to the server. My email server didn't need that. From the Wikipedia article, the effects of Heartbleed were so widespread and sweeping that it even affected web services like Wikipedia itself, Amazon Web Services, and Akamai Technologies. This happened to a development group that has been in the security business for 24 years!

This incident and others (including the Hub version 3.1.0 incident) should make us all rethink the "always update" strategy everyone keeps pushing. A better idea is this: Provide the update, Encourage the update, Tell what the update does (in detail, not just "security, stability, and usability improvements"), and Let the users decide if they need it.

Please . . . please. Let's get away from the forced update insanity.