It's time to update the software update process | Hacker News Reader

It's time to update the software update process

networkworld.com

26 pointswalterbell23 comments

This article takes multiple frustrations and goes completely the wrong direction. As an OWNER of the system I should have complete control over what updates I do and don't receive and never should software disable my access to the network under any circumstances unless I purposely setup such access controls. Maybe they're highly recommended, but there's very specific reasons why you don't go auto-updating all of the devices when you know you have something working. On top of that the author even suggests that paying for updates is okay, even though it's the companies responsibility to update the product if security/stability issues affect the devices performance. If they don't then they can be required to recall devices, or suffer lawsuits.

> As an OWNER of the system I should have complete control over what updates I do and don't receive

I understand (and share) this sentiment, but you have to understand that it's a sentiment that's held by a very very very small number of people. Most people see micromanaging updates as an unwelcome burden and simply don't want to deal with it. So if the only options you present them are "micromanage updates" and "install no updates," they will just choose "install no updates" and roll merrily along with their increasingly insecure systems.

They just don't care, and no amount of nagging from well-meaning nerds like you and I ever going to make them care. For a lot of them, not even getting hacked will make them care. So the only way to protect these people from the consequences of their apathy is to just install the updates for them. This annoys people like us who actually care about this stuff, but since there are so many who don't it's the only responsible approach.

Those aren't the only choices though. The objection is that you shouldn't force people to use auto-updates, because it impedes their ability to use their software.

Let's say I'm writing software for something important with a deadline, and my OS decides to update itself and break some of the libraries I was using. That would be completely unacceptable. It's almost no worse than walking up to my computer and smashing it to pieces.

You have to be able to control updates because that's the only way to ensure your system is stable. It may not be secure, but stability is often more important than security, especially during critical periods. Most people want their computers to work today the same way it worked yesterday. If updates didn't break things, nobody would have any reason not to get them. But updates are destructive.

I think it's worthwhile to unpack exactly what "owner" means; I don't think it's purely binary. In our current society, I can own land, but still be restricted by HOAs and zoning laws. I can buy a piece of software, but really it still belongs to the creator, who has granted me a license laden with restrictions. And these days, of course, we might own the hardware of our devices, but they're fancy bricks without the software that we certainly do not own. Heck, even the change in your pocket is only owned by you in the sense that there are implicit and explicit contracts with other humans not to take it, and what the repercussions are if they do.

It may be worthwhile to renegotiate these norms and definitions of ownership. In the meantime, I think it behooves all of us to be not be naive, and understand the terms of every "ownership" contract that we sign.

Real Property really does have scarcity-- nobody is making any more Earths right now. Comparing that to to manufactured goods (which have scarcity only in that a finite number of copies are manufactured) or software (which has no scarcity) isn't a very good comparison to my mind.

I disagree with the idea that we need to renegotiate the norms and definitions of ownership. I think we need to require sellers to be clear on whether you're buying or renting.

Rentals are great for a lot of things, but I want to know when I'm renting something. It's very frustrating that I must to heavily scrutinize every business transaction because, seemingly, many things that are sold as purchases are actually rentals. If I'm told I'm purchasing something I would expect it to perform in reasonably the same manner until it physically wears out. I don't want to be required to be tied to any third-party services, updates, "cloud", etc. If I am then it's not a purchase-- it's a rental and needs to be called that.

Totally agreed that the issue is one of customer transparency. "Click Agree to this incomprehensible EULA" is completely unacceptable.

I'd be happy to pay for updates, if this would make the companies issuing them more liable for their quality. The whole "agile" and free thing has gone too far.

I hate it when I post an opinion about a bad update, then someone comes around and replies "hey, it's a free update" or "it will be fixed in the next release". Yeah great, but until that I have to live with the poor update and that's something I'd rather pay money for to avoid. Even Apple disappointed with their iOS 9 stuttering release.

Ehhh. Updates are frequently to fix things that were missed-- mistakes. No amount of money can completely eradicate mistakes. Even NASA which spends a lot of money and time on code still has mistakes that they have to go back and fix.

Just to pick a nit about liability -- I don't think you'll ever find a vendor risking general liability for anything. That's just asking to lose a lawsuit, IMO.

These things need to take into account at least two very distinct user types: the power users like you or I who want and sometimes need the control over updates fir various reasons and understand the full potential security/stability/other implications, and the man-on-the-street who knows no better and wouldn't update anything if it wasn't automatically done or somehow more irritating not to than to.

You can usually get all the control you like through Enterprise Configuration Management (e.g. deployment profiles, Group Policy, etc.) Bigcorps have real, business-level needs for doing their own update rollouts, and they're willing to pay to get that feature—and many others—included.

Really, the way to be a "power-user" in the modern era is to set yourself up on your device as an "Enterprise" of one. Otherwise you're basically part of the default "Enterprise" controlled by the manufacturer.

As long as vendors aren't separating security/bug fixes from features and attempts to push services then even the man on the street should have absolute control.

this is precisely why I mentioned that it should be an opt-in thing. There's nothing stopping a vendor from pushing 'you should enable this feature'

So in order to fix the annoyance of push updates introducing unwanted or unusable functionality, his proposal is that push updates should also disable the device until accepted by the user?

Not quite clear on how that's an improvement

Not just that, but also:

> Hey—charge me for the damn upgrades if they can come bereft of some insane advertising model that somehow underwrites your cost.

I find the thought of my device being held for ransom to be incredibly disturbing. Although, even if updates were free, bricking my device until I accept them is, itself, unacceptable.

"This upgrade has the possibility of making the device unusable. To deal with that, we're going to certainly make the device unusable."

Yeah, I wouldn't call that an improvement either.

If it is my computer, I'd like the right to not update it and keep using it just the way it currently is.

I don't think the proposed solution is reasonable because it violates a lot of assumptions about the things I own and use.

I feel the same way. However, it is interesting that effectively zero Chrome users complain about auto-updates, presumably because they are stable, seamless, and very conservative with user-facing changes.

What I would prefer to see is seamless updates by default, with limitless ability to roll back and freeze updates. Unfortunately, the business case for this is negligible, outside of specific enterprise requirements, and especially complex to implement when considering external factors like APIs and file formats.

You make a good point that when they are seamless it doesn't bother users. When I do come across things that break with chrome's frequent updates it annoys me greatly. One other thing to point out is that we aren't locked into using Chrome so there is less pain from automatic updates. If my smartphone forced me to update automatically for instance this would be a much bigger issue as they lock me into using their software.

In my view the crappiest part of software updating is that it is all-or-nothing. You have to take the bad if you want the good. Maybe I'd like to update my software so that I can get all the latest security patches and bug fixes, but I'd rather not have yet another UI re-design or a load of new features I will not use. Currently, for most software, if I want the fixes, I have to also swallow the features. Either upgrade to version 2.6 or stay on 2.5, you have no other alternatives. It would be great to be able to cherry-pick only the bits I want. Probably not an easy problem to solve, but it's a pain point for a lot of people.

You know who does this? Sony. PS3/4. Author should have done some research before proposing such a ridiculously stupid idea. If I was legally allowed to, I would hurt them physically for for imposing this shit on me when I just want to play videogames.

EDIT: Not to mention it obviously doesn't improve security. This is Sony we're talking about here.

Of all the walled gardens, Sony's is the most infantilizing.

This problem is almost non-existent on any system that uses a decent package manager.

Reply on news.ycombinator.com