Tinfoil Hats and New Door Sounds
I was surprised to log onto our server today, and hear new sounds coming from my client. I didn't download any updates; I am still running the 1.8.1 client. So somehow, without any feedback from me, the game client decided to update parts of itself.
I am not too keen on the Minecraft client updating itself without using the usual notification or prompt. If there is code on the client to bypass the user-driven downloads, then any payload could be sent to the client at any time. We know that Mojang is not terribly in control of their IT infrastructure (previous incidents of game codes and account data loss, and ongoing difficulty in managing their custom authentication servers). Now we know that the client will silently download and run code from that same cobbled-together environment.
To run the Minecraft client at all requires a certain level of trust. You are running someone's code on your computer; it could do anything. You must trust that it will be benign. With Mojang, I trust their intentions. But they are haphazard. They are young, and they are a small business, and they are very shaky on the IT side of things. With an update system that was non-secretive and that users had some control over, you were at a minimum aware that something had changed. You could see an update and ask, "hey what was in that last patch?" Now we know that there is also the ability to silently, secretly pull content and apply changes from somewhere inside Mojang's hosted environment.
I believe that I can trust that updates by Mojang will be safe. Mojang will probably not upload a spam relaying program, or a keylogger, or a DDOS bot. But is Mojang really in control of their infrastructure? How long before someone finds a way to insert something less benign into that holding pen, and then all of our clients mindlessly fetch and apply it, without anyone noticing that it has happened? How long would any of us be running a bot, or spamming, because nobody knew that the code had been pulled down and loaded; before even Mojang themselves noticed that they were playing host to a botnet of millions of unwitting players?