Patch Tuesday Is a Love Language
Right now the world is terrified of a chatbot deleting the internet. Meanwhile, the machines that can delete the internet: your router, the print server nobody names, the laptop that's two Windows versions deep in its own timeline. They're sitting there, quietly, on last year's build. We're paying attention to artificial intelligence like it's the threat, when the real threat ships free, boringly, and has been sitting in the download queue for two months.
I did the Fear Machine essay a fortnight ago. This is its mirror. The fear industry tells you the danger is new, exotic, and arriving. The actual failure mode is old, mundane, and already on your machine.
The "I'm Not That Kind of Person" Fallacy
Ask anyone if their systems get patched and you'll get a version of the same smile. "I'm not really the hacker type. I'm not that kind of person." It's the security equivalent of "I'm not that kind of driver." The people WannaCry ate in 2017 weren't the ones who'd never patched a thing. They were the "not that kind of person" businesses, and the patch for the bug that took them down (EternalBlue, if you must have the name) had been available for two years.
The numbers aren't flattering to any of us. Tens of thousands of new vulnerabilities get catalogued every year. The average critical patch takes well over a hundred days to reach the devices it's supposed to protect. Windows 10 is out of support, and hundreds of millions of machines are still running it out of pure stubbornness. Nobody got hacked by being clever. They got hacked by being current in their own head and outdated in everything else.
And here's the bit I find genuinely funny: for most people, the fear of the fix outweighs the fear of the disease. An update once broke something. Therefore all updates are dangerous. Therefore the safe move is to postpone, indefinitely, the very process that closes the holes. We'd rather live with a known wound than take the anesthetic. That's not a security strategy. That's a phobia with a settings menu.
The Enemy Is Friction
Patching fails for one reason, and it isn't malice or stupidity. Every skipped patch is a decision, and every decision has a cost. "Do I reboot now? Will my presentation break? What if the update's the bad one?" The question costs you thirty seconds of dread, and the reward (a hole closed) is invisible. Invisible rewards lose to visible dread every single time. That's just how brains do trade-offs.
So the people who get it right aren't more disciplined. They removed the decision. Automatic security updates on the phone. A server that applies its patches in the dead of night and reboots on its own schedule. A router that phones its maker and fixes itself while you're asleep. Boring as a dental checkup. The trick isn't willpower, it's wiring the boring thing in so it happens whether you remember or not.
Which is why I keep coming back to the title. A machine that patches itself is a machine that looks after itself. It takes care of you when you're not watching. If that isn't a love language, I don't know what is. ✨
What To Do
Three moves, all of them free, all of them ten minutes each. Turn on automatic security updates on everything you own: phone, laptop, the home server you forgot you had. You don't have to auto-update the whole operating system, just the security class, and you've handled the overwhelming majority of the risk. Then schedule the reboot for a machine, at an hour you'll never notice. 3 AM on a Tuesday is fine. Your Tuesday, at 3 PM, in the middle of something, is how updates get their bad reputation.
And one question to ask before any new device goes on your network: does it patch itself? If the answer is no, you've just volunteered. You're now the patch management system for a toaster.
So next time the headlines tell you the sky is falling because a machine thought something strange, take a breath and check the boring list first. If your machines are patching themselves in the dark, you're safer than you think. If they're not, well. The patch was free. It always is.
— P