Hacker News Reader

Comment by alkaline9 | Hacker News Reader

Perishable software is a huge problem - things keep operating only in dynamic equilibrium, such that they would fall apart as soon as we stop putting energy into fixing flaws.

I have been thinking for years that as a society, we need 100-year products. It would be a global good to counteract the local incentives for producing perishable software.

However, over time I have realized that there are legitimately unforeseen circumstances that come up - for example, the general realization of the need for stricter security around logins (e.g. two-factor authentication). Maybe a 10 year time window is realistic for now.

In the meantime, requiring expiration days would go a long way towards calling out how perishable our devices and software are.

View on HN

> such that they would fall apart as soon as we stop putting energy into fixing flaws

This is not true. The only reason software needs constant updates is because new features are constantly being added to stay competitive. If you stop adding features, in theory you will eventually run out of bugs to fix as well.

The problem is feature creep. Software doesn't "decay," and thus does not need infinite maintenance.

That is assuming that software is ever written 'correctly', which outside of (semi-) academic exercise is never the case (so far).

You can have a program with 1 purpose and no added features experience a variety of critical flaws over a period of 30 years. While there might not be a 'decay' as such, there definitely is new understanding and as such new attack vectors.

The same goes for the stuff the software runs on top of. Your program might be programmed just fine, but if the CPU it was programmed on no longer exists and the replacement CPU has new features that allow that program to be exploited in new ways, that is still a flaw of the software. It couldn't have been foreseen, but it still happens.

The concept dat the things we build are frozen in time never holds up. The difference with software vs 'other things' is that it doesn't degrade or get 'used up' (as you wrote yourself). But the things around it do and as you cannot write programs against all possible future contexts, it will need maintenance for as long as it is in use (from a software perspective - a business thinks differently about that, especially risk analysts).

Not really. There is literally precedent in this regard. TeX is stable. Very stable.

Has it been extended? Yes. And some extensions can be seen as borderline required. But I'm not unconvinced that one of the biggest factors in this is that he tried to make it stable. And showed great restraint in what requirements to go after.

Which TeX? Over the last 10 years, over 20 serious and critical vulnerabilities have been found in various TeX implementations. They were all fixed via... maintenance.

How many of those were extensions? Pdftex, as an example, is not TeX. There have been roughly, what, eight releases in TeX since version 3? Hence we are now at 3.14159265.

This is not to say things couldn't have been done better. But I love that all of my documents still compile just fine. Modern practices? Nope.

Coming back to this after a few days. I also can't help but take a double take at 20 vulnerabilities in 10 years being a serious criticism. Is the implicit claim that this is a bad record compared to other software legit? (Honest question.)

> The only reason software needs constant updates is because new features are constantly being added to stay competitive.

New features... or just a redesign of the UI to make it look "fresh"

That depends on the abstractions you build on and who's maintaining them. If you have a stable abstraction to build on, it's due to having common standards at the OS and instruction set level, along with device drivers hiding the churn. At the hardware level, suppliers discontinue components all the time. I wonder if most cell phone manufacturers could even build one of their designs from four years ago due to parts that have been discontinued since then?

Perhaps I should amend my statement: "such that they would fall apart as soon as we stop putting energy into maintaining hardware and software dependencies"

Software assumes that there exists specific hardware, operating systems, and services underlying it to keep operating. If you try to turn on a 5-year old android phone, you will find that your apps probably don't work (because of service changes for example), but also can't be upgraded because the latest versions don't work with your old version of android, and your android can't be upgraded because the latest versions don't have device drivers for your phone hardware. You're SOL.

So, to have a 100-year software, you need commodity components from the top down, that continue to be maintained for the same length of time. And it all probably needs to be 100% open source. Otherwise, you have perishable software.

I have, since January, a "frozen" Windows 7 environment with WiFi/LAN switched off. I use it rarely, now on Ubuntu, but there is something about it that feels good where it didn't before. I think it is just it's feeling of permanence.

> as a society, we need 100-year products

A 28kbaud modem, analogue phone, consumer film camera or virtually any electronic good that uses valves: if they were designed to last 100 years surely you agree that would that be a waste of resources?

Think of 50 technological objects in the home from say 75 years ago. Now look at the models or brands that were then designed to be still useful now. Was the extra cost worthwhile or did the object become obsolete for a good reason? What would the maintenance costs for those objects be? Go to a estate sale of someone that bought quality technology items and kept them: review how many of them would be obsolete (because they are just not useful, not maintainable, inefficient, time wasting, irrelevant, dangerous, or otherwise useless for fair reasons).

Even worse, expensive well designed goods (e.g. jackets) that while still useful are thrown away because no one wants them... Human capriciousness needs to be part of the compromises we make when designing goods.

> It would be a global good to counteract the local incentives for producing perishable software.

What are we talking about here? Asking people to not write bugs?

No, it is asking people to design and test systems for the long-term. It would require establishing strong interfaces between components that will hold up when subcomponents are swapped out.

I think of it like a car where parts can be replaced if those parts have an issue, but the designs of the connectors stays the same, and replacements are available. A 100-year car isn't one that requires no maintenance for 100 years; it is one that can be maintained, and replacement parts can be acquired, and it will still continue working.

If a car depends on a remote server, such that the car stops operating when the remote server is shut down, then that car is perishable.

There are a lot of cars that were maintainable, and built to be maintained, that can’t be maintained anymore simply because the manufacturer went defunct and there are no more parts (e.g. Saab, Datsun) or because the cost of manufacturing more parts for a car with a dwindling owner-base began to outweigh the profit, and thus, there are no more parts (e.g. older Ford models).

Unless the car is built primarily with 3rd-party parts (from manufacturers like Bosch, Brembo, etc) - which is something that consumers usually hold against a car, like how many people are upset that the new Toyota Supra is actually a BMW - then the problem is almost completely analogous to the shutting down of remote servers; if the manufacturer goes defunct or can no longer make a profit by continuing service, the car’s life has perished.

And in fact, the only way to avoid this is super conglomerates and monopolies - Lamborghini parts should always be available, because they come from the Audi parts bin, which comes from the Volkswagen parts bin.

In the past aftermarket parts makers came in to support popular cars after OEMs retired replacement part making for older model cars. Now if you so much as breathe on an aftermarket mod for your brand new software driven EV ( I won't name names here of course but you know who), the manufacturer may brick your car, or worse yet declare your warranty and/or any future support null & void.

My 2017 Volvo XC 90 somehow begins to casually malfunction whenever I drive it beyond a few service warnings. The car is HEAVILY software dependent. It can technically drive itself and park itself too. This behavior somehow disappears once the dealer performs software updates. It's pretty strange, and I worry it's a ticking time bomb for when I reach the end of my warranty on the car.

I am definitely against the newest measures taken by car companies, e.g. Porsche completely covering the engine (and voiding warranty should you access it) save the oil reservoir, on the newest 911s.

There is also something missing from my metaphor which is that even when the parts no longer exist, the car can still continue to run until it breaks down, rather than being remotely killed due to an external signal separated from the car itself (e.g. servers shutting down and triggering some switch in the code).

No, I'm asking you fix your bugs: when you sell software you should set aside money to fix your bugs.

Note I said bugs, not add new features, you can charge for features, but if I don't want the feature you should still fix the bug.

Nobody works for free. I get your beef but the problem is we buy things and want to pay once, if you were willing to pay for your router every month, well heck you could actually just buy a new one every year about already. fancy that.

I want to pay once for something that works as advertised. If I buy a car and the airbags are bad they will fix it. If I buy a device and the software fails I expect it is fixed too. I'm not asking for features, I'm asking for bug fixes, which if you had a perfect text plan would already be fixed.

You can't win at playing that game either:

https://news.ycombinator.com/item?id=22271306

At the bare minimum, products should be engineered so they can function at a reasonable level "manually" independent of software systems. These devices should also allow owners to take themselves off the network any time they want in order to ensure REAL OWNERSHIP. That maybe is the happy medium that can get you home if the network goes down?

Reply on news.ycombinator.com