Software updates

Compared as text, version "2.9.1" sorts after "2.10.0", because the character 9 comes after 1; compared as numbers, 2.9.1 is the older one.

Is 2.10.0 newer than 2.9.1?

Try this before reading anything else. Your phone says version 2.10.0 is available, and you have 2.9.1. Is that an upgrade? Run the exercise below without changing it and look at the first line. It prints false. That is wrong. Text is compared character by character, and at the third character 9 comes after 1, so the comparison stops there and never sees the 10. Fix the function, then read on.

What an update is really carrying

Every large program has mistakes in it. Some of those mistakes are vulnerabilities, flaws that let someone run their own code on your device, read files they should not or take over an account. When the maker finds or is told about a flaw, it releases a fix, called a patch, inside an update. CISA's message is short: do not hit "Remind me later". Criminals study patches to learn which flaw was fixed and then go after devices that have not installed them yet. So the days after an update is released are when an un-updated device is most exposed.

A vulnerability that attackers use before any patch exists is called a zero-day, because the maker has had zero days to fix it. Zero-days make headlines. Most successful attacks, though, use flaws that were patched long ago, on devices that never installed the fix. CISA keeps a public Known Exploited Vulnerabilities catalogue listing flaws that have been seen in real attacks, and US federal agencies are required to patch them by set deadlines. For everyone else the lesson is the same: install updates soon after they arrive.

Letting devices update themselves

The easiest habit is to turn on automatic updates. CISA suggests looking in the device settings under Software or Security, or searching the settings for "automatic updates". Not everything updates itself, so install the ones you are notified about too, and give priority to web browsers and security software, which face the internet all day. Remember the less obvious devices. The home router, smart TVs, cameras and other connected gadgets run software too, and CISA's ransomware guidance lists operating systems, applications and firmware together as things to keep patched.

Get updates only from the device's own settings or its official app store. A web page that suddenly says your browser is out of date and offers a download is a common trick for installing malware. Watch for end of support as well. When a maker stops releasing security updates for an old operating system or device, new flaws are never fixed again. KISA's Boho Nara site posts notices when support for widely used software ends, advising an upgrade or a switch to something still supported.

Updates often need a restart to take effect, and a pending restart is an update that is not yet protecting you. Choose a time, such as the end of the day, and let the device restart when it asks. On phones, keep enough free storage for updates to download, since a full phone is a common reason updates quietly stop. Once a month, open the update screen on each device and check that it says it is up to date.