Why is it not possible to have software written without constantly updating its „security“?
Is „security“ just a form of collective busywork, or is it really justified and necessary?
The internet seems to make every computer insecure. Is it by (inherit) design or by choice? Is the culprit indirection (i.e, abstraction)? Are CPUs inherently insecure? Does it mean that layers of indirection are inherently harmful? What is ultimately causing this? Please don’t say anything along the lines of „policemen need criminals to justify their jobs“.
Is there even a computer system that can be connected to the internet that does not require any updates? Don’t say mechanical computers, or a calculator please, or a Turing machine, please.
What is the ultimate reason for the constant need of security updates when it comes to computers connected to the internet?
I mean, I am aware that you can inject malware with a USB pen drive or any external device that can be connected to the computer. But why are computers so fragile when connected in any shape or form to the „outside world“?
Why so fragile?
Internet connected computers have complexity that is several orders of magnitude greater than those simple appliances. This is much harder to get right and test every possibility. The internet allows access for people to exploit those untested or unhandled possibilities.
On top of that, the very ability to update remotely lets companies prioritize release dates over completeness, because they can ship it and update it later if anything is found. It becomes a cost benefit analysis. How much will a security incident cost vs the cost of delaying the product? What are the odds a vulnerability gets exploited before they can find and patch it?
Internet connected appliances create busywork, imo. They don’t need those features, so the initial design takes more time, adds complexity, and then creates perpetual maintenance to keep things secure and working with the supporting backend services. All of this feels like needless theater to give customers something most don’t even want. I’ve never seen anyone excited about their biweekly TV update prompt.
No. They build a thing and expect money. Customers do not have a binding contract with most of these vendors and there is no expectation that they will make any effort to protect you or your family thus it is currently on the consumer to protect themselves from their internet connected devices. Strict legislation in every country with serious consequences would be required to change this. That or cutting on trade with countries that harm consumers and that is a high bar to meet. Not likely to happen.