This makes more clear which code have contact with untrusted data from VM.
/usr/lib/qubes/qubes-notify-updates