

Some upgrades require human input like when core service config files upgrades are offered. (ex. would like to update /etc/samba/smb.conf with the maintainer’s version or keep your own?)
In my experience this can occasionally cause background apt processes to hang while they wait for your answer to that kind of question. There is a debconf trick you can try. debian_frontend=noninteractive. You can create your own cronjob, as root, that runs a script with this export command, apt update, then apt dist-upgrade -y.



It seems to just be more attack surface for very little actual gain on JS. At least with JS I have NoScript, Ublock and some actual say over what loads/runs on my box. For this reason, I usually just disable all wasm/webgl/webrtc until I find out that I actually need it which for me is basically never or only for very short periods.