waffle

Hey, what do you know, maybe running Portal under Mac OS X directly isn’t that impossible after all.

Update: Thanks to this topic in the compatibility forum…

Gruber again asks: “Honest question to those who think Apple is in the wrong here: Would it make a difference is the checkbox for Safari were off by default instead?”

Let’s define our domain here. Let’s outline a few cases of what Software Update could theoretically do in order from worst to best.

• Case A: Software Update installs Safari silently, with no method to opt out of it; there isn’t even a checkbox. This is the worst case. This would indeed be malware tactics, not just act very closely to them.

• Case B: Software Update installs Safari by default, unless you explicitly opt out of each and every version; there is a checkbox, checked by default. (You have to uncheck the checkbox every time you run Software Update, and “ignoring” its entry in the “update” list will only ignore that particular version of Safari.) This is also bad, and this is what actually happens today.

• Case C: Software Update installs Safari by default; there is a checkbox, checked by default. You can choose to ignore every version of the Safari product. This is slightly better.

• Case D: Software Update does not install Safari by default; there is a checkbox, unchecked by default. You can choose to ignore this entry entirely but you have to ignore each and every version.

• Case E: Software Update does not install Safari by default; there is a checkbox, unchecked by default. You can choose to ignore every version of the Safari product. In a world where we assume that Apple does want to deliver new applications through Software Update, this is by far the best choice for them to do so, way better than even Case D since you only have to decline once.

The reason that case B and C are bad, despite the fact that you can uncheck Safari in them, and the reason I call this malware-like tactics is simple. Most people will click the big button and install every update because that’s what they’ve been told is good for security. After doing so, they will find a new icon on their desktop that they don’t remember authorizing and that they probably don’t recognize; something that should set off bells saying holy crap, I’m insecure. Calling these people morons doesn’t really change anything; if they act precisely according to the advice they’ve been given by people who they trusted to secure their computers — automatic updates GOOD, mysterious new apps BAD — this shit is what will happen.

What’s the alternative? That they read the notes attached to each update? While I think it would be great if everyone could make a reasonable judgement regarding whether they need to install certain updates or not, it’s also not something that’s going to happen. Automated updates are optimized towards letting you be able to just hit “update”, and for the right stuff to happen regardless. The application (or applications) you’re updating will just automatically become more secure. This is a wonderful tenet of usability in security; it’s not a substitute for every computer user everywhere being able to make informed decisions about security, but it’s terribly convenient since we’re not going to get there for now. As long as people’s updaters keep pumping out updates, this will keep working.

By introducing things that aren’t “updates to things you’ve already gotten installed” as a second class of items that will also be installed when you hit Update without changing anything (something the vast majority of users will do), Apple’s well on their way to ruining “just install everything the updater tells you and you’ll be fine” as a golden rule. That Safari (and iTunes, if you’ve only gotten QuickTime installed) will end up as new icons on the desktop and be likely to trigger the “fuck, there’s stuff on my computer that I didn’t [knowingly] install” reflex only makes this worse, especially since if a connection is made, people will stop updating their apps, and we’ll all be worse off.

It’s not really relevant what Microsoft does with Windows Update (Microsoft owns the OS and has an extended license to keep finishing the OS; sometimes that includes shipping new system tools like Windows Defender), or how good Windows is, or how good Internet Explorer or Firefox or Safari are. The real takeaway is that when Apple does shit like this, it degrades Software Update and the extent to which people can unconditionally recommend it as a useful and convenient security precaution. Good security precautions don’t come with caveats.

Update: Gruber comes around to a different side of the argument:

The reason reactions to this controversy have been so polarized is that we’ve been mostly arguing about the wrong thing: how or whether Apple should offer new applications to Windows users via the current Software Update app. The problem is with the design of the Software Update app itself.

The reader is right: updates to currently-installed software are an entirely different thing than offers to install new software. Different things should look different; the current design of Software Update doesn’t allow for such a visual differentiation.

More from Rick Falkvinge:

Summary in one paragraph: This is the leader of the Swedish Pirate Party explaining how the US went bankrupt in 1971, and has been covering it up through an accelerating whack-a-mole borrowing frenzy that is bursting right now. It has been paying rapidly growing VISA bills using MasterCard and vice versa for 37 years. The creditors are catching up, and the US is about to go extinct as a superpower. Become irrelevant. It is not yet on its death bed, it is still walking, breathing and capable of entertaining a conversation in public. But there are ominous bloodstains on its hands used to cover the painful coughing.

reddit + server move = brutal pain, apparently.

reddit users looking for Thursday’s post will be granted a static copy to soothe the server and calm down technical support who saw load averages dipping when they disabled waffle. (Thus the 403s.) If you have found your way around here anyway (it’s not particularly hard), feel free to comment as you see fit. I just wanted to stop the majority of the traffic.