update-manager not asking for authentication in Oneiric Beta

[Colin Law]

I would be interested on comments on this bug ([Oneiric]
update-manager installs packages without authentication)
https://bugs.launchpad.net/ubuntu/+source/update-manager/+bug/814331

To summarise, in Oneiric Beta when an administrator user install
upgrades he/she is not asked to authenticate.  The bug is marked as
won't fix even though it is (as far as I can see) a change from
previous operation.

I am interested in this from two points of view

1. Should update manager ask for authentication?

2. I thought that one of the principles of Linux that makes it much
less open to attack is that one cannot write to system areas of disk
without authentication.  How is it then that update manager is able to
do this (whether by accident or design) without authentication?

Colin

-- 
gplus.to/clanlaw