I lived under impression that timely updates were very important. Even a home user wouldn't like their computer to demand ransom for their data. However, the less home and the more corporate our setting is, security only becomes more, not less important. A big company that has a lot to lose needs to apply all security updates the second they are available, which hopefully but not necessarily means 'sooner than a bad guy exploits the vulnerabilities'. There is simply no time for an administrator to wake up in the morning, go to work and apply them manually. And because of this, corporate systems must be set to update automatically.
And apparently this is not exclusively true for corporations: IIRC this is precisely one of the arguments I heard why home people are recommended to use cloud services to run their websites instead of running their own dedicated servers in their homes. The cloud updates their systems immediatelly; but if a home user runs their own server, they have to sleep sometimes, so the updates are at best applied each morning, so each night is a vulnerability window.
However, it seems I was wrong? Quoting competent people from Linux Mint forums: https://forums.linuxmint.com/viewtopic.php?t=311756
As a rule, updates should always be done consciously. So that they won't ever interrupt or damage your work. So I think automatic updates are generally a bad thing. A corporate system administrator who enables them, should be fired on the spot.
(...) What I mean is that a corporate system administrator should be the one who determines when updates to the machines of his company should be rolled out. He should first properly test them himself, on a test rig, and then roll them out at a time that no one is using those machines. After normal working hours.
Such a system administrator should not, under any circumstance, enable automatic updates and therefore leave everything to the OS maker. Because that could disrupt work flows and could even create major havoc and damage in a company.
So, under my reasoning, this is a recipe for getting the systems compromised while the sysadmin properly tests the updates himself, on a test rig, and then rolls them out at a time that no one is using those machines? And then to see, for example, all corporate data, including the data of all company's customers, put for sale on dark web?
People seem to be worried that automatic updates introduce regressions that break systems. Which risks is, therefore, considered more dire by sysadmins: that an update introduces unexpected regressions or that reluctance to apply updates immediately creates a security vulnerability?
Do sysadmins apply updates immediately, or do they wait and test them carefully and only apply them outside of working hours?
