For me, the solution is simple: anything you download and run locally should not auto-update ever, period. Installing an update (or refusing one) should always be a conscious user action. Otherwise it's just a socially-accepted RCE backdoor.
I used to use Duplicacy for my backups. The author was hell bent on not allowing disabling auto updates.
The go binary would be downloaded automatically and silently periodically. I tried to fight it for a while but at some point he added checks (!) to ensure that nobody was blocking his RCE model. Meaning it would no longer run on one of my partially air gapped system.
I moved on, but many other software behave that way.
Most chromium-based browsers will show a big scary and permanent button if they can't update, for example.
> Most chromium-based browsers will show a big scary and permanent button if they can't update, for example.
Vivaldi which I use thankfully doesn't do that. At least on macOS it uses the common Sparkle updater, which would pop up a window in your face when you least expect it telling you that an update is available, showing a changelog and letting you decide when and whether to install it.
Even though it is an interruption, it's still much more respectful than what Chrome does. It insists on running a background service at all times and the only way I was able to neutralize it was to delete its .plist file and create a directory with the same name.
Yep, just like Anti-Virus back in the day. Sure, it might protect you from a virus now and then, but AVs actually caused more broken computers, and false positive triage work than they protected. In the long run it was never worth running an antivirus on your computer.
This is how updates are now. Sure, there are sometimes some security updates that you should have installed. But more often than not it's just some bullshit I don't want.
