Updating Infrequently Used Programs - How Important is this?

[eldar]

Hello guys,

I have a question with regards to updating your PC. I update windows, plugins, and software on a weekly basis to keep my PC secure.

When updating, I am always finding myself updating the most used programs, and skipping the programs I use very rarely. This has triggered the following question:

Q. Does an out of date program pose a 'security risk' when it is not being used very often? For example, If I haven't updated VLC player for months, but equally haven't used VLC player in months, does this pose a security risk? Should I even bother to update it, if not using it regularly?

Note: I used VLC as a random example, but of course there are many infrequently used programs on a PC. Alot of these programs you want to keep installed because they are useful from time to time.

Thanks guys,
Eldar

 

[oscer1]

Hi i have not updated any programs unless it ask to be updated. for you example vlc player no need to update it if it is working for you. my modo is if it isn't broke dont fix it. of cource i always update maleware and anti virus programs and windows updates.

 

[Callender]

Personally I keep everything updated where possible.

Re: VLC. What you mostly need to worry about is that it's a web facing application especially if you use the web plugin. Most of these exploits that target unpatched software are going to target web facing apps and browser plugins but may also exploit vulnerabilities in software used to open downloaded files or email attachments. Or anything that can launch a script.

Examples:

​

​

You can read about some threats and applications targetted here:

https://www.fireeye.com/blog/threat-research.html

 

[optiplex gx520]

I update all windows and ms programs except IE and my dell optiplex gx520 is the fastest windows computer I have ever used

 

[optiplex gx520]

if you dont use programs and they are not nessecary for your computer or os to run you should consider removing them

 

[Alejandro85]

A program that isn't run does exactly nothing to the system. Just wastes some storage space, but otherwise it doesn't influences the computer in any way (don't forget that drivers and services run in the background, so you might not realize they're running in some cases).
Most programs don't pose security risks at all, even if run every time and unupdated, and many updates don't tackle security problems specifically. Relatively few developers care or know about security, so it's mostly rare to come with security updates in many software. For those who really care, they're often quite noticeable.

Anyway, I generally follow a similar scheme to yours, often updating most programs together from time to time. I consider updates to be a risky operation. For one, they provide new features and bug fixes, but also may come with removed features and regression bugs, and maybe UI changes that makes it worse in general. You should evaluate if it's worth an update, read the release notes of the author to see what improvements it brings, or if it fixes a critical bug. My general personal approach is "if ain't broken, don't fix it".

It won't get desperate for leaving a non-current program on my computer, specially if it works, unless I know of a vulnerability or otherwise serious problem. For one I won't let update automatically anything. It's nice to have the last version of everything, but not of utmost importance, and must be a balance decision evaluating pros and cons.

 

[Layback Bear]

I do all updates manually. No auto updates.

On programs I use seldom I check for update right after I start them for the seldom use. I check for what the update is suppose to do. I'm looking for security reasons to update the program if the program is working as it should and their no security updates I might not update it.

All updates are not created equal and that is the reason one should investigate what the update does.

 

[Mellon Head]

I keep all of my programs updated, but I do it manually. I like to see what is being done to the program and if I really need it.

 

[Callender]

Re: Autoupdates. The only auto-updates I allow are virus definitions databases. Everything else is manually checked. If a program checks for updates automatically I set it so that it doesn't. If that's not possible I block connection using my firewall.