[thibran]

To get the latest version of an app you can use snap-packages. E.g. to always get automatically the newest version of LibreOffice: sudo snap install libreoffice

Don't forget to remove the preinstalled – and soon outdated – .deb-package version of LibreOffice :)

[calgoo]

the Snap packages are really nice when installing. However, i got a lot of issues with accessing network shares and other mounted drives from inside the applications. I also ran into issues where the cache from one of the applications (Spotify) would not migrate to another disk, so i ended up uninstalling all snap apps out of frustration and installed them locally.

[roryisok]

Wait... Do Linux apps (Firefox etc) not self update like Windows and MacOS?

[swebs]

Nope, they use a much more sane paradigm of letting the package manager handle updates, much like in iOS or Android. That way you can have your entire system update when needed, rather than whenever you start each individual program.

Programs are not supposed to update themselves, but some like Telegram or Steam annoyingly do.

[pasta]

No. And there are multiple reasons for this.

One example: when Firefox decides to integrade a keylogger it is very unlikely you will find that release on your Ubuntu installation.

But in my experience Firefox is updated very soon after official releases.

[mverwijs]

Ubuntu has long since flagged Firefox as a 'volatile' package, resulting in up-to-date Firefox packages when using the standard package manager.

[dogma1138]

On the other hand the only users that predictively fall to browser exploits when we run end user targeted red-team ops are the devs and IT peeps that run Linux instead of OSX/Windows.

In fact across the board Linux machines in many enterprises are more likely to run outdated and possibly vulnerable software.

[swebs]

It sounds like that's a failure of your IT team to handle updates. Either that or your sourceless claims are just to spread FUD.

Most distros have different update channels so that you can install security updates without feature updates. Tools like unattended-upgrades make it trivial to automatically install daily security updates. You can then manually install other updates at a later time if you're concerned with breakage.

https://wiki.debian.org/UnattendedUpgrades

[dogma1138]

I'm very well aware that there are ISM solutions for ensuring updates for all operating systems.

For Linux Desktops it is especially hard since many of the solutions are not oriented for desktop users and when the package manager is not used there are gaps in software enumeration.

The best solutions I've seen so far are essentially block access to all online repos and manage your own but many organizations don't want to go that route, with ubuntu you can even use the "appstore" UI for displaying only your repo.

Your thinking is also too narrow while I gave examples from a managed environment there are plenty of Linux users running on unmanaged machines. Most users even "technically savvy" ones are not going to be reading release notes and reviewing CVEs daily via RSS.

Having a reliable way to ensure automated updates for Linux especially for commonly used and exploited software is an important tool to have and I wish more repos would implement something like Windows Update than say "what if Firefox puts in a keylogger" because that isn't a good argument as you can argue to them back "what if you put in a keylogger?" if you already pull your updates from your distro's managed repo you already accept that risk as such the risk of having no automatic updates at that point makes you less secure not more.

If you want to use a different repo or build everything from source locally that's fine but that is a completely different security model.

Also neither shifting the blame or claiming FUD are good arguments. Firstly there was no blame associated with the end user, at any point where there is a security system failure the end user isn't the "causal factor" doesn't matter if it's an unpatched system or did clicked on a phishing link they are do not own any of the causal blame.

As for FUD, calling something FUD is generally intellectually lazy and is used to end an argument by moving the goal post and changing the subject.

[jhasse]

This is because Ubuntu doesn't automatically install updates by default. On Fedora you can install updates when shutting down your computer, resulting in less people delaying it.

[dogma1138]

My point wasn't about Ubuntu or not but rather about this so called "threat model" that is the reason behind the lack of automatic updates.

The threat model is simply not valid for the security model that users who use a package manager follow.

Don't get me wrong supply chain based threat models including the source and intermediates are a valid concern.

But you already accept those risk by using a package manager and a managed repo which contains the source code and or binaries for the applications you want.

Not providing automatic updates to protect me from Mozilla won't reduce the risk when the risk from the package manager and the managed repo is just as high if not higher it just increases the overall risk as now I need to ensure that I follow their release cycle closely to make sure that my browser is always up to date.

[Schiphol]

That's not for "Linux" to say. It would be easy to set up a Linux system that updates automatically, but it's more sensible to have the user review changes before updating. This is the default policy in all Linux distributions I'm familiar with.

[thibran]

* Traditional Windows Apps => bazaar, everyone does whatever they want

* Snap Apps => centralized, the snap-system updates the apps on a regular schedule

Traditionally on Linux there was only the system-package-manager to update the system and applications. Snaps are confined (unless declared --classic) and allow to have a stable base-system and up-to-date applications.

PS: Can't say much about how snaps compare to macOS.

[yoz-y]

On macOS it is a combination of centralized (if you install through the App Store) and free for all. Almost all applications that auto update use the same framework though (Spark) so the update look&feel is usually the same.

[dingo_bat]

No, they depend on the package manager to do that.

[adamtulinius]

No, that is usually the responsibility of the system wide package management system. :)

[pqb]

Xkcd "Standards" https://xkcd.com/927/ is obligatory here.

There are five ways to have update software on Ubuntu Linux these days:

* Ubuntu Store (snap).

* Via Flathub (flatpak).

* Official deb repository pool (apt-get).

* Community maintained PPAs (apt-get).

* Other, tools like appimage, nix, linuxbrew etc. etc.

If you are not fan of terminal tools, sometimes "Software Updates" popup will appear to ask you if you would like to install new updates.

By default there isn't any self-update enabled (please correct me if I am wrong), though it is recommended to configure automatic updates of unattended-upgrades [1]. In my experience 17.10 were asking about installing updates when you were shutting down or restarting OS.

[1]: https://help.ubuntu.com/lts/serverguide/automatic-updates.ht...

[augustl]

Oh, that's really cool! I had no idea this existed. Thanks a lot!