Software Update Dialog is a Security Risk

I feel that if the system has been configured with "automatic updates" enabled, there should be a feature that allows this to happen without any notification or confirmation via password... That's what "automatic" means, not "semi-automatic".

For instance when one enables "automatic log-in" to an account, at the moment of selection/activation, the credentials of the account to log-in to must be given, and then - later - when the auto-login is activated, there is no "enter your credentials here" dialog.

The option "automatic update" (for apple update, that should be "sufficiently trustworthy", and ideally - especially for security updates - rolled out asap) should then also permit (the "well informed about possible consequences" administrator to authorize the setting (with a once given authorization), and then that setting is "kept" as permissive - until ever it is disactivated.

Software Update is easy enough to turn off in Apple menu -> System Preferences -> Software Update.

I agree though in principle that all push notifications pose a security risk.

And anyone who enables it needs to be aware whether or not the dialog they are receiving is genuine.

Good computer training is vital no matter whom uses the computer.

If someone turns on automatic software update, they should be trained to cancel it it and then see if it is genuine through Apple's own software in System Preferences or Apple menu -> About This Mac, and never take such dialogs at face value.

Sadly since the advent of push notifications over 20 years ago, such a security risk has always been present.

You can choose to turn off automatic updates. Apple menu -> System Preferences/Settings Software update will let you do just that.

I see the same dialogs from time to time, and am also suspicious. Agreed that all legit requests should ideally come from the System Settings environment. But beyond that, why would Apple even allow a dialog like this (from them or others), to invoke an action without actually specifying *what* is being updated? Seems easy enough to do, and would be even better as an experience if there was an info link in the dialog along the lines of the existing "About this update" links they use in other contexts.