Levels on Update Manager? [SOLVED]

[wallyUSA]

I am new to Mint (& Linux) and learning it for my home, personal use. I see there are 5 levels of updates on the Update Manager. Is it safe to automatically install all fives levels? I remember seeing somewhere that level 4 & 5 might be risky. I see one today referring to Kernel 4.4.0-81.104. I like to keep things up-to-date but I do not need to be on the bleeding edge. Safest approach?

[Pjotr]

Safest approach?

Only level 1, 2 and 3.

A bit less secure than when you install levels 4 and 5 as well, but it's still acceptable. A lot more secure than Windows.

Note that the level system has changed considerably in the new Update Manager in the upcoming Mint 18.2. I'm not quite sure whether this new Update Manager will also become available for Mint 18 and 18.1. I hope so, because it contains many improvements.

[Cosmo.]

I hope so, because it contains many improvements.

Hope not. It is a security disaster.

[Pjotr]

I hope so, because it contains many improvements.

Hope not. It is a security disaster.

It's a bit unfortunate that Firefox is level 3 at all, in the new Update Manager.... But this incident seems to be a glitch which will surely be repaired.

[Cosmo.]

If the updates for the pre-installed browser do not even get shown with the first policy and are also pre-selected for the "recommended" policy, it is not a matter of unfortunate and is not a glitch, this is a big security leak. The fact, that in 2 weeks there came no reaction (besides a second user complaining) doesn't give much hope, how this will proceed. And heaven knows, for which other applications the same leak exists.

If the user cannot trust, that the important updates get preselected, you can forget it. If the user relies in the new commandline tool, he will never see the offer for the update. Is there anybody who thinks, that leaks, which are judged by the browser manufacturer as critical, are in reality of second ranking in importance?

The down-leveling of FF is obviously not an error, as it is expressively described in the help file. This has been done by will.
Has anybody seen, that an faulty update for the browser broke anything else in the system? This is principally possible in case of Internet Explorer in a Windows system, but we have neither the one nor the other.

[Pjotr]

Has anybody seen, that an faulty update for the browser broke anything else in the system? This is principally possible in case of Internet Explorer in a Windows system, but we have neither the one nor the other.

Firefox is tagged level 3, not because it affects other system parts or other applications (it obviously doesn't), but because it's such a vitally important application.

As such, it's a bit misleading, but perhaps practical, to tag it level 3 anyway. I'm all for practical (the big picture matters more to me than always sticking to the rules), but in this case the implementation seems to have been a bit flaky.

[richyrich]

C'mon folks, quit hijacking other member's posts ! You already know where BETA conversation should be !

[Cosmo.]

Firefox is tagged level 3, not because it affects other system parts or other applications (it obviously doesn't), but because it's such a vitally important application.

Where do you take this from? Obviously not from the update manager itself, which says in the preferences for level 3:

Apply with caution. Impact on multiple applications.

.
Further more: If the browser is vitally important application, than the user is advised to leave the (in case of FF 54) 25 open security leaks unfixed? If a browser with documented security leaks gets further used, because the software says "Caution", what an uncertain user might easily interpret with "Do not, if in doubt", and with the first policy the update does not even get displayed, the consequences of stone-aged outdated versions with multiple of 25 security leaks is predictable. Even with the default policy the FF updates get not pre-selected for updating. In contrast to that in the "old" (but far more secure) update manager pre-selected the FF-updates even with first policy. What a terrible regression.

If people (e. g. from Ubuntu) said in the past, that Mint is less secure because if the update manager - now they have got a well-founded reason for this objection.

Besides that: We had enough complaints in the forum because of a FF failure after updating. I cannot count the cases, where I had troubleshooted those cases. In the end it was always either a broken profile or a broken account. On the other site: I have never seen a case, where the browser stopped working after an update. Theoretically this can of course happen, but the frequency is a million or billion times lower than the risk of unfixed browser leaks.

A knowledgeable user wrote some time ago:

For most home users their web browser is the most vulnerable point of attack.

Another one wrote:

The moment you enter the wonderful world of the world wide web the attackers will be around you. This is no paranoia.

This list could easily be made as long as you wish. Did they say only nonsense? Or is out of a fantastic reasons this 6 months later suddenly not more valid?

Fact is: If the most vulnerable point is open for attacks, we can forget all what we tell about security. Every chain breaks on the weakest part. Then there is not a glitch, there is nothing only a bit unfortunate, it is a disaster.
Interestingly: Here you said yourself, that firefox is a high-risk-package.

[Pjotr]

Firefox is tagged level 3, not because it affects other system parts or other applications (it obviously doesn't), but because it's such a vitally important application.

Where do you take this from? Obviously not from the update manager itself, which says in the preferences for level 3:

Apply with caution. Impact on multiple applications.

.

It's explained in the help text of the new Update Manager itself. As I'm a Dutch translator for Linux Mint, I've read it all. Had to.

there is not a glitch, there is nothing only a bit unfortunate, it is a disaster.

As richyrich already said: it's still a bèta.... By the way: note that this bug only affects the first update policy, which isn't the default. I think it's reasonable to presume that this bug will be fixed before the release of 18.2 final.

[Cosmo.]

It's explained in the help text of the new Update Manager itself.

Right, the description in the lower section of the help page stands in contradiction to the table above. And what it tells is simply wrong.

Novice users would be unable to perform common tasks if these applications stopped working.

Even if this is claimed there, it does not happen. No Firefox (and I talk only about that) update did break the browser, except if the profile or the account is broken. And the theoretical chance that it does is null against the definitive certainty, that security leaks give far bigger problems, problems which are - at least, if the privacy gets damaged - never repairable again.

note that this bug only affects the first update policy, which isn't the default.

Wrong. It affects also the default policy, you can read in my previous post why. The help file says also:

It is recommended to apply them with caution and in isolation ... you are expected to be cautious and to know what you are upgrading.

For Firefox: cautious about what? What special risk does the author of those lines expect (who btw. mixes update and upgrade) for Firefox?

I think it's reasonable to presume that this bug will be fixed before the release of 18.2 final.

There are bugs unfixed, which are open since one year. It would be reasonable to expect, that they had been fixed already half a year ago; the naked facts are different. It would be reasonable, that in 2 weeks somebody would at least be assigned to the bug, but this is not the case, again nothing. I expect nothing any more, except what I see.

In the blog Clem wrote:

Please visit https://github.com/linuxmint/Roadmap to follow the progress of the development team between the BETA and the stable release.

I follow and what I see is - silence. This is not a presumption, that is the fact taken from the point, where Clem pointed to.

[Pjotr]

@Cosmo: the bug has been fixed today, with mintUpdate 5.2.8:


"Always mark Firefox and Thunderbird updates as security updates"

[Cosmo.]

No, the bug is not fixed. I saw already this morning at GitHub, that Clem has provided a fix regarding the security flag in UM and named it an oversight (obviously found it following my second Github report 1 week ago). But this is only a part of the problem.

With the security flag fix the user with the first policy will now (with default UM settings) see the Firefox update, but it will not be pre-selected. Users, which have selected the first policy, because they say "I am unexperienced" will also have read in the policy page, that they have to apply security (and kernel) updates with care. If they read the help file, they will again been told, that level 3 updates should be used only with special care and they are also told that they have to know, what they are doing. Something, what an unexperienced user often cannot know, otherwise they would not place themselves into the "unexperienced" section.

And one very important point more: Even with the today's fix the tray icon of UM will for policy 1 users not even show the blue icon, if a Firefox update is available, but none level 1 or 2 updates. They will get not the slightest hint, that their system is at highest risk and this can endure several days. Telling, that the security leak is solved with the last updates ignores the most simple facts.

Fact is, that Firefox is still and without any reasoning in the danger zone of UM. Why? Why as the only browser? Chromium is set as level 1, all other browser as level 2. What makes Firefox such a critical, dangerous and mysterious browser? Many years of practice tells me, that this is not true. Many years of experience tells me also, that using a browser only one day longer than necessary without available updates belongs to the biggest mistakes, a user can do. In a previous post I demonstrated with a few quotes (as example), that I am in good companion.

Interesting to note, that for example Thunderbird is set as level 1. Assumed the situation, which Clem obviously does in case of Firefox, that an update will break this application, the warning in the help file

Novice users would be unable to perform common tasks if these applications stopped working.

would be far more true than for the browser. If a browser should really break because of an update, you can until a final solution replace it with another one. But if the mail-client breaks, than at least users with a POP3 account become really poor people. They cannot easily replace TB with another client and expect, that they can continue to work; not even for simply reading their mails. If there is really an application, which should get set into the danger zone (I don't say so), than TB would be a perfect example. LibreOffice (also level 1) is a similar case and problematic for user, who have the urgent need, that their office software works on every day.
Now assume, that one of the given example applications break because of an update (as assumption, which Clem obviously judges as relevant for Firefox), what do you think, how happy those user will be, if they read in the help file (for level 1):

You can apply these updates without worrying about regressions.

A user with common sense has to assume, that the situation for the level 3 Firefox is far, far worse. But I ask: How so? Whereby founded?

So Firefox into level 3 is still with the fix from today a security bug. Qualifying it as far more at risk (2 levels down) than TB or LO because of a (only hypothetically) broken update is beyond every known facts.

It will be a logical consequence, that we will see in the future (assumed, the bug makes it into the final release) more outdated Firefox installations. (If we would not assume this, we would have to assume, that the level thing is without practical impact.) And this not because of a (far too often) delayed maintenance of the packages in the repositories, but because of a Mint design decision.

I have tried to reopen the issue today.

[Pjotr]

Yes, although the fix has been a step in the right direction, it's not quite sufficient.

But I think your chance of persuading the developers will increase, if you "soften" the tone of your words a bit....

[Cosmo.]

Yes, although the fix has been a step in the right direction, it's not quite sufficient.

Finally an agreement.

But I think your chance of persuading the developers will increase, if you "soften" the tone of your words a bit....

What precisely do you mean? Either at GitHub or here. I cannot see, where my tone was anyhow un-soft; but regarding the facts: There is nothing to soft; the situation, as it is and as it is not given by me, but by those, who are responsible for the decisions, is as hard as I described it.

[Pjotr]

By the way: if you can't re-open the issue at GitHub, it's probably best to open a new one. Then you can place a link to the new issue in a final message in the old one.

[Cosmo.]

No, this is not an option. I have invested now a year to learn how GitHub works and how to use it. (Despite my age I am still able to learn.) So I can tell you, what would happen, if I would follow your advice: The next dev team member would immediately link the new issue to the existing one and then close it. Game over. What I did is readable in the GH issue and also here.

But I think your chance of persuading the developers will increase, if you "soften" the tone of your words a bit....

What precisely do you mean? Either at GitHub or here. I cannot see, where my tone was anyhow un-soft; but regarding the facts: There is nothing to soft; the situation, as it is and as it is not given by me, but by those, who are responsible for the decisions, is as hard as I described it.

Nothing more about that? No? If you have reasons for your demand, you should be able to point them out. If you cannot point at anything, than I consider your demand as meaningless. We will see, if Clem finds my tone in any kind un-soft. Yes, in content we disagree, otherwise a discussion would not be necessary at all.