(comic per public link to XKCD (xkcd.com) )
It’s not always true that you should always update your mobile device or workstation immediately, even though that’s what people are generally encouraged to do. Server administrators never patch production servers immediately, we only keep dev/test servers on the latest and greatest versions. Generally we run what’s called “N-1″ (“N minus 1”), such that the servers run the version before the latest and greatest.
Security is a matter of risk over time. The odds are better that a brand new update will break something than your falling prey to some terrible 0-day security vulnerability. Therefore, give it some time… but not too much.
Updates that break something else are common. Since Apple started their Bug Bounty program (offering to pay people for any security flaws found) they’ve issued an inordinate number of security updates, but many of these patches simply fixed something a previous update broke! Microsoft is doing better than in years past, but their patches still break things sometimes.
Some major Android vulnerabilities came to light recently and we have every reason to update – but how long should we wait? When it comes to updating your home computer or mobile device(s), here are some guidelines to follow:
- Don’t be over-eager to update. This is actually how a lot of malware spreads – you get an email or notice that it’s CRUCIAL you install a given update RIGHT NOW. Generally if you see an Adobe, Windows or Android update has been released, it’s generally safe to ignore it for a week or two.
- Rarely do you read about a particular update in the news. Sometimes you read about a serious flaw that’s been discovered and then a day later read about an update being available – these are the updates you should install sooner rather than later (not immediately – just within the week).
- Enabling automatic updates can be helpful but you should do it for critical security updates only. It’s preferred to allow the computer/device/browser to download the update and wait until you decide to manually install it.
- Any time you see a notice to download and install an update, DO NOT click OK – close that window and go directly to the site to download the update by hand. More often than not, when you see an “Important update for Adobe Flash” while you’re reading the news, it’s not a real update but malware. Go to adobe.com yourself and if there’s no update available, don’t worry about it.
Microsoft releases updates on “Black Tuesday”, which is the 2nd Tuesday of the month. Many other vendors release updates close to that week – the last week of the month is a good time to do updates. If you should happen to let it sit another couple weeks after that, it’s probably just fine.