Comment by zxcmx | Hacker News Reader

Comment by zxcmx | Hacker News Reader

Parent Full thread

Context matters. So 3d sculpting software or CAD do not deeply need automatic updates, although it can greatly reduce support requests (e.g. something in the OS changed, software is now crashing, need to install update).

The state of play in 2020 however is that operating systems and browsers 100% need automatic updates for security issues. The reason we have them is because of all the bad things that happened when we didn't.

There should then be a very small switch hidden somewhere deep in the system where people like you who know what they are doing can turn them off. For the people who are using the software to say, run the electrical grid and a) care more about stability than security and b) pay people to write scathing reports about all the patches they're not installing.

IMHO there is a sticky middle ground with respect to office suites and email clients where the software is widespread enough that bugs are wormable.

Updates as a whole are inter-twingled with the developer's support and release model, how they a/b test and general maturity in terms of managing change. I feel like we're often complaining about different aspects of this when we talk about "updates".

I have been in IT for over 20 years now.

I have had orders of magnitude more problem with updates than with malware/viruses/hackers.

The thing is with malware/viruses/hackers sooner or later something will get through any defences, so you need robust recovery system anyway.

And most updates that brake systems are not even security updates. I wouldn't mind automated security updates, but many many many maybe most vendors pile whatever happens to compile to their updates so that they customers can test it for them.

Firefox on mobile just fucked us in the ass (extension we developed for client doesn't work anymore and we can't fix it. And since we have support contract we will probably have to eat the cost of whatever alternative we have to build.).

> I have had orders of magnitude more problem with updates than with malware/viruses/hackers.

Maybe that's precisely because the updates are preventing you from being owned?

The % of security fixes vs speed ui improvements is 100 to 1. Very rarely do we get issues that require forced updates that a once a year limit on these types of updates would be ideal.

I have been in IT for over 20 years now. I have had orders of magnitude more problem with updates than with malware/viruses/hackers.

Until you get hit by this....

https://www.giac.org/paper/gcih/201/microsoft-iis-superfluou...

It was the first widespread IIS vulnerability that almost hit me. The tl;dr version: All you had to do was encode a shell command in the url bar if the site was running IIS and it would execute it on the server.

Oh we(organizations I have worked for) have been hit several times (not IIS, but once it was several wordpress sites we used, once it was outlook, once we never figured out - probably inside job, ... ). But that was 3, 4 times in 20 years.

Updates its 3,4 times per year. Like I said order of magnitude difference

The article specifically states

> should be incremental and security or bug fixes only

There's a big difference between that and, for example, constantly pushing UI changes that nobody asked for and for no other reason than that some designer somewhere decided that "A/B testing" would look good on their resumé.

Reply on news.ycombinator.com