Hacker News Reader

Comment by diggan | Hacker News Reader

The solution is that every deployable version of the service should be usable on it's own and users should be able to chose exactly what version they are locked on to. Or they can choose to live on bleeding-edge and always get the latest updates.

Wishful thinking maybe

View on HN

I think some people around here, most especially the package-manager-uber-alles crowd and the security-for-the-security-god types [0], will be very upset you said this, but I agree.

Why shouldn't I use software that works best for me, even if it isn't the latest and greatest version? Why shouldn't I be able to use multiple versions of the same software as though they were different products because they do different things well? As I recall this was expected behavior in the before times, in the long long ago, when internet wasn't yet a thing.

[0] Oh, also the web-all-the-things! people.

One of my pet peeves is that software always makes you take the good with the bad. You want the latest bug fixes and security updates, but you don’t want the added chat feature and UI redesign #12. But in order to get the former you also have to accept the latter. Companies should do a better job of maintaining old versions so you don’t have to take disruptive changes and feature cram just to patch a security hole.

That was feasible in a world where every computer was air-gapped because there was no such thing as the Internet. Now every app needs to stay up to date for security reasons, even if it doesn't directly use the internet itself.

What types of security vulnerabilities could apps like LibreOffice or Photoshop have?

Programs that manipulate binary files are common vectors for attacks. A malformed file can trick even well-written and well-tested parsers into executing code that they shouldn't, or corrupting aspects of the user's environment.

For example, cvedetails.com, some random website I found from Googling, lists 13 vulnerabilities for Photoshop and 31 for Libreoffice in the last few years.

There have been plenty of attacks targeting image and document viewers/editors over the years. It's a great vector, because recipients are more likely to open a document than run an executable.

Some of the very "best" vulnerabilities of all time have been attacks taking advantage of scripting features in Office.

https://www.securityfocus.com/bid/109374 just recently.

Do they really? If you do a cost benefit analysis on using older versions of software that work better for you, including the probability of exploitation of both the new[0] and old versions, you'll find that it very often doesn't work out. Besides which, if you're really concerned about it there are plenty of better ways to mitigate those threats like sandboxing.

[0] updates have been known to make software more vulnerable too you know.

This constant stay on latest and cross your fingers mentality has to go if we ever are to have more stable releases and interfaces (both UI and APIs) again.

Average app developer is clearly not trustable for keepimg a whole system secure (Zoom for a recent example). We have to go back to air gapping but do it on app and even internal component level instead of whole machine. Sandboxing and containers is the only way forward.

I agree with you and wish this was far more common. JetBrains is one company that does it well. They let you download previous versions or upgrade to the latest version if you have an active subscription. If your subscription lapses you can still download older versions of the software from the time you had an active subscription.

I've done both, kept the latest version or rolled back to previous versions when I didn't like the latest changes. So, it's certainly doable, and I wish more companies offered this.

It's called long term support. And it's not cheap.

There's a big difference between offering "end-of-life" versions for download, even if they are no longer supported, and forcing users on new versions even if they don't want to (which is fairly common for mobile/web apps and generally subscription-models like Adobe and Autodesk switched to).

That's because the world decided to adopt software as a service model, where your device is just a thin client and real work is happening on a server. And that model is incompatible with letting customers to run old versions.

I.e. exploitation pure and simple - delivering value to customers is incompatible with company exploiting those customers. This deserves as much pushback as possible, even though it seems like a quixotic effort.

That’s not at all true of the Adobe stuff. The real work in Photoshop or Illustrator still happens on the Mac.

But it is only a matter of time. Once webassembly achieves near feature parity with the native versions, you bet Adobe will switch users to the webassembly version.

From Adobe's perspective, it offers a lot of benefits:

- they don't have maintain build farms or pay a CDN to host GBs of binaries of native installers (for different OSes);

- users will always be on the latest (read: most secure) version since there is nothing to install or nag the user to check for updates/apply security patches;

- browser-dependence implies near-persistent Internet access, making license management/enforcement a whole lot easier;

- they can upsell you on cloud storage so that all your assets are available from any web browser.

If the user has to download the whole webassembly binary at the beginning of every session, it seems unlikely that Adobe would save money on CDNs.

Sure if you by "world" you mean bean counters and not users.

Reply on news.ycombinator.com