So to sum that up, Johnny Won't Upgrade because like as not, the writers of the updates are The Enemy.
In order to fix their issue with the new version, they worked out how to roll-back by one version and disable future updates.
Inevitably some users will complain about changes in every new update while others complain about a lack of eagerly awaited new features and bug fixes. You cannot make everyone happy :/
I'm sympathetic to the idea that workflow/ui changes should be explicit updates (or on beta opt-ins) with security/crash fixes being automatic. This model makes the most sense for professional tools that people make a living from (e.g. CAD). To be sustainable, software with multiple supported major versions will cost more.
The state of play in 2020 however is that operating systems and browsers 100% need automatic updates for security issues. The reason we have them is because of all the bad things that happened when we didn't.
There should then be a very small switch hidden somewhere deep in the system where people like you who know what they are doing can turn them off. For the people who are using the software to say, run the electrical grid and a) care more about stability than security and b) pay people to write scathing reports about all the patches they're not installing.
IMHO there is a sticky middle ground with respect to office suites and email clients where the software is widespread enough that bugs are wormable.
Updates as a whole are inter-twingled with the developer's support and release model, how they a/b test and general maturity in terms of managing change. I feel like we're often complaining about different aspects of this when we talk about "updates".
I have had orders of magnitude more problem with updates than with malware/viruses/hackers.
The thing is with malware/viruses/hackers sooner or later something will get through any defences, so you need robust recovery system anyway.
And most updates that brake systems are not even security updates. I wouldn't mind automated security updates, but many many many maybe most vendors pile whatever happens to compile to their updates so that they customers can test it for them.
Firefox on mobile just fucked us in the ass (extension we developed for client doesn't work anymore and we can't fix it. And since we have support contract we will probably have to eat the cost of whatever alternative we have to build.).
Maybe that's precisely because the updates are preventing you from being owned?
Until you get hit by this....
https://www.giac.org/paper/gcih/201/microsoft-iis-superfluou...
It was the first widespread IIS vulnerability that almost hit me. The tl;dr version: All you had to do was encode a shell command in the url bar if the site was running IIS and it would execute it on the server.
Updates its 3,4 times per year. Like I said order of magnitude difference
> should be incremental and security or bug fixes only
There's a big difference between that and, for example, constantly pushing UI changes that nobody asked for and for no other reason than that some designer somewhere decided that "A/B testing" would look good on their resumé.
For desktop software, most seem to, sadly, be self updating or a website.
For example, youtube now has a miniplayer when playing a playlist on desktop. I find that "feature" to be absolutely atrocious and would rather do without it. But due to it being a website they changed it to make it impossible to turn it off.
[1] Whatsapp
Altough, the reddit redesign sucks on mobile too.
The problem here is the hostile relationship from the companies to their customers.
And even if they say security they usually bundle it with other changes, along with not even saying what kind of security change.
Give me a vulnerability tracker and what has been fixed, and I'll actually update your app.
For me, the "added security" is just not worth it MOST of the time. Partially due to actually only installing apps that don't even have the capability to do much/any damage, due to it only having permission to access parts I don't deem dangerous.
We're talking about phone apps. 99% of the time this just isn't the case and the remaining 1% is for issues so widely broadcast you would absolutely know.