Comment by subscribed

But disabling updates on the system connected to the Internet is a terrible idea.

How do you update that afterwards?