2

I have here in my launcher bar an icon which states that there are currently 418 available updates. Now I think people will appreciate that A That's a lot of updates and B It is not likely that an average user such as myself would know what most of these things do.

My basic fear is that by installing some of these updates, it is going to adversely affect things that are already running fine. I have already seen this happen with installing packages for LaTeX in Ubuntu.

So why not just leave well enough alone and ignore the updates?

Are there a few that would be particularly important that I should be aware of?

2 Answers 2

3

There are several different kinds of updates in the software world, especially when package managers, with a party other than upstream is involved:

  • Updates because there is a new version: Unless you're using a distro which focuses on stability (see Debian), the default strategy would be keeping the system up-to-date by having the almost-newest version of every package, unless there is no good reason to do so. There is no other point here other than being up-to-date.

  • Updates because there are new features. This is sort of a subset of the former, but a bit more meaningful:

    • You will want to upgrade libpoppler once in a while, as this may introduce new features in the PDF support used by many PDF readers and manipulators out there, such as GNOME's evince. For example, annotation support: implementation is still ongoing, but it was definitely unavailable some versions of libpoppler ago. Perhaps this is not evident if you don't use source-based distros, but you can compile evince against different versions of libpoppler, annotation support would, of course, only be available if compiled against a version of libpoppler providing it.
    • go-oo (what you used to call OpenOffice.org under GNU/Linux, now libreoffice) has been undergoing a big cleanup with many fixes, and with extensive work regarding Office Open XML support. Even if you don't use that kind of applications a lot, you may want a newer version so that you're able to open these .docx files people now send because Microsoft Office started defaulting to Office Open XML and some people simply use that instead of the more widely supported CDF "Office 97/2000" format (both formats are open, the difference is exactly in the level of support from third-party applications)
    • Emacs version 23 included Xft support, effectively allowing you to use OpenType fonts under X Windows. This led to a much better font support, with a much broader glyph coverage, not to mention that the text looks much nicer with Xft.
  • Bugfixes, fixing programming errors that led to undesired/unexpected/unspecified behavior, for example, ghostscript may need to be changed so that it interprets some Postscript construct correctly and that it stops mangling some PDF or Postscript file using that feature; libreoffice may need to be updated to fix some UI bug where the "Undo" button did not work in Draw; and so on. Unlike the next kind of updates, these bugfixes don't involve security issues, just something working on a way other than the expected/desirable way.

  • Security updates, the ones I think you're completely forgetting about, and perhaps the most important of them all. Some projects mix these with the above (See Mozilla, what actually led to a legal problem with Debian, where the Debian team wanted to focus on fixing the security issues rather than updating the Mozilla stuff all the time). This means, for example:

    • Preventing other people from executing random executables on your machine simply by loading a font (which is even more of a concern nowadays, as it seems that the new CSS cool is to have fonts downloaded from the web... fonts which are handled using the same tools that were designed to process local fonts, not having to worry with this kind of scenario. Expect more issues like this in the near future.)
    • It is kind of frequent to have this kind of "denial of service or program execution" vulnerability with the media stack: media players are something you use with files you get from many many sources: They're nowadays' floppy disks, if one wants to spread some malicious code, using an exploit in some widely-deployed media library is a good strategy. Ubuntu: libav
    • Along with these two specific kinds of libraries, any vulnerability that hits a library is more troubling than one that hits a single program, as it will be exploitable in all the programs using that library. For example, there has been a trend to move to XML configuration files. GNOME's XML library has had vulnerabilities
    • Adobe products. This deserves its own category. If you use Adobe's (formerly Macromedia) "Flash", you want to update frequently, as Flash is considered to be one of the worst programs security-wise, and it is something some people run on every website which wants to run some Flash applet. Less likely, given the broad range of less-bloated, more smooth and lightweight alternatives, is when you run Adobe's Acrobat Reader.

Ever wondered why Google's Chrome has new versions so frequently? Part of it are security fixes.

Now, let's go to what you want: "My basic fear is that by installing some of these updates, it is going adversely affect things that are already running fine." Yeah, it happens. Although I'd say that if this happens too frequently, you may consider changing to a distro where updates aren't that sloppy: part of what a team behind a package manager is supposed to do is to make sure things don't break.

Even then, you may encounter some breakage once in a while, or you may have to sit down an read through some kind of news bulletin issued (hopefully) before the update with any special instructions. But, most of the time, this is not Windows, there is a package manager, the occurence of that kind of breakage is not going to be that common. And if it does happen, it will happen to a wider audience, and there will be enough data to help the devs fixing it.

But yes, your concerns are of course valid. You could pick a distro where updates are only done to take care of what you really don't want to ignore: security updates. Debian does this, what some people have trouble understanding in their definition of "stable" is that it does stand for "we don't update just because there is a new version with new features, not even with fixes for some non-critical behavior, we focus on keeping the system the same for the duration of the release". They just fix attack vectors, so that you can have almost no updates while having a more secure system.

This is one of the things you should actually worry when picking a GNU/Linux distro, it's not "which DE does that distro bring by default", but what kind of package manager do you have, how does the team behind the package list/tree work and what are the update policies.

0

I would recommend installing updates. It will take little effort on your part. On top of all that, many of these can be important security updates.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .