Outdated vs. Complete: In defense of apps that don’t need updates
vivqu.com
vivqu.com
The expectation that software libraries or frameworks should break every few months is disturbing. I think this may be due to the fact that many of the most popular frameworks do this. I find that React-based apps tend to break every few months for a range of reasons; often because of reliance on obscure functionality or bundling of binaries which aren't forward-compatible with newer engine versions.
I think there’s a useful lesson there.
I check for things like over-engineering and I check out the author (check their other libraries if there are any).
SQLite seems to hit a good balance. There's always something new but nothing particularly breaking (from my light usage POV), so it looks live.
The author chimes in, says he’ll take a look next evening, then two years whoosh by.
There is an ambitious todo and nothing moves.
The code is in alpha for years, considered unstable, huge exclamation points in the readme that it should not be used, and yet somehow there are hundreds of reverse dependencies and it’s like this for years (usually should mean “RUN!!!”). Sometimes sneaky as it’s not a direct dependency for you, but for those two or three libraries used by like 80% of the ecosystem.
"Do one thing and do it well" - the unix philosophy, and why I still use cd, ls (dir on windows) today.
If a project exceeds two functions its probably doomed to become either redundant or broken.
If a project does one thing well, even if something else uses it, you can always decompose to it (your software is always useful, even when somebody writes the fancy bells and whistles version).
I do think as a general heuristic no updates for 3 months means it’s been at least 2 months since anyone paid attention to outstanding bugs, especially the npm ecosystem.
I'm not saying that because of the leftpad fiasco, I mean that any library that small should simply be pasted into your codebase because the risk of managing the dependency outweighs the benefits.
If I see a library which is supposed to solve a simple problem but it requires a large number of dependencies to do it, that's a big red flag which indicates to me that the developer who wrote it is not good enough to have their code included in my project - I don't care how popular that library is.
Node libraries are a bit odd in that respect because package JSON files have an "engines" property that informs users about the minimum and maximum Node version the library works with. The author of leftpad could check its compatibility with each new version of Node that's released, and update the engines value version accordingly. That would be quite helpful because abandoned libraries that aren't known to be working with newer Node versions don't get updated, and users can user that information to look for something else.
What that means is that any Node library that isn't being updated as often as Node itself is probably not actively maintained, or the author isn't making full use of Node's feature set.
Really? This sounds feasible at all for you for all the millions libraries in npm not to be labelled as "obsolete"? Checking if string concatenation still works on every major node release and tagging it as such?
Yes. I mean, they could just leave the max version of the engines property blank because it should always work if it's something as trivial as leftpad, but in a well-run package repository the work of checking library compatibility should be getting done. The fact that NPM is full of old libraries that haven't been tested in new versions of Node is a bad thing, and those libraries should be flagged as untested.
What this means is that for most software an essential part of that software consists of knowledge that needs to be kept alive. The only proof people can have of this is activity surrounding the project. This puts us in the uncomfortable position of having to designate someone as the 'keeper of all knowledge' surrounding a project if it is to be sustained, and failing to do so will result in knowledge being irrevocably lost.
If your whole entire source code is so innovative that you can't immediately understand it, there might be trouble, but so much code is or can be pretty boring.
At most, changing something will make a bug that's not really in the spec but is something everyone wants and relies on, but isn't immediately obvious, then you'll have to fix it.
The trouble is that if knowledge is lost, people will probably not bother to figure it out, and starting fresh might be more appealing.
The bigger issue especially in open source is that if there's no activity, there might not be any in the future. It could be abandoned for 10 years and perfectly fine, until a change is needed, and even if the change is easy and the knowledge is there, it might not happen if nobody cares anymore, and you'll have to fork it yourself, so maybe you choose the actively maintained thing even if it's less complete or more complex or ugly to use.
Sure, you might have the specification that the original developer was given, but every developer brings their own opinions and hard-won experience to a project. Just because the specification says "outgoing messages are sent to a queue" and the program links with ZeroMQ, doesn't tell you whether that's a design goal or a temporary stop-gap proof-of-concept. Maybe the program is structured so it can use an email queue for distributed operation. Maybe the program is designed to be linked into a larger system and just push message structs onto an in-memory vector.
Whatever it was originally meant to do is probably either obsolete, or well known to all users, if it's been so long the original devs left.
If it's got ZeroMQ, and has for 5 years, one can probably assume someone will be upset if it suddenly does not have ZeroMQ.
Regardless of intent, for practical purposes, if people are using it, they probably want that to stay around until you do an orderly transition to some other thing.
I think if a project was that important, the people who needed something patched would be able to get it together even if the original maintainer went missing.
The original analogy to the challenges of knowledge transfer isn't totally applicable. Knowledge transfer is important to organizations because figuring everything out all over again would be costly, not because it would be impossible.
gn
We solve problems with code, or by finding ways to avoid writing code.
We translate vague requirements into things a computer can handle, or we translate between computer languages, because any spec that was complete would just be the program. That's why they keep us. The computers can do pure logic on their own.
Opinion is very much a part of it because pure logic is just a useless pile of text unless it has something to do with the real world, which is full of opinions.
Even inside the program itself, we aren't dealing with logic. Languages are designed for human minds, and compilers are meant to catch mistakes people make. Libraries are often chosen for all kinds of perfectly good nontechnical reasons, like "That one is actually maintained" or "Everyone already knows this" or "People seem to like this" or "That seems like it won't be a thing in 3 years".
You certainly care about what it will do tomorrow too (so you can keep up, or avoid having it break stuff for you), but if it goes unmaintained, you don't have to worry about that since it does the job for you.
OTOH, I've been on projects where a dependency was chosen on the promise of what they will do in the future. That future never materialized, so we were left with a bunch of unfinished dependency code, maintained a bunch of components ourselves etc — it was a mess, in short. So I never rely on promises, only on what's there today.
Reverse-engineering all that can be an utter nightmare even with tests. I suggest that people who disagree consider, for example, the word "reverse-engineer" as in how they might reverse-engineer a car.
Usually you have this kind of problem when it's NOT producing desired results and the problem is how to make it do something that's needed without affecting some set of usecases that you don't understand yet.
I don't know if this is a good suggestion or not but I wonder if some form of "keepalive commit" might help here. I can imagine a few ways they might work, some simple, some more elaborate.
Dependecies and external APIs change so software breaks.
An example from a project of a customer today: Ruby had a Queue class up to 3.0.2. For some reason they moved it to Thread::Queue since 3.1.0. It's only a name change but it's still one release to do.
I'm not sure what flags you are referring to, but that might be because I went from 8 to 11 and skipped 9 and 10.
> the changes of which only broke code using non-public API surface
The APIs weren't non-public. They were publicly documented. They did say they were internal and you should avoid them, but they were still used in libraries and referenced in tutorials and stack overflow answers. And if you happened to transitively use a library that used one of those APIs, it would cause a fair amount of pain when you upgraded.
Ultimately, the break seems to have been intentional, but did receive appropriate consideration. Mark’s comments about moving forward do address these points.
I think it is more that recent updates are used as a proxy for determining if the developer still cares about the project.
The problem is it is hard to distinguish between a project that has been abandoned, and a project that is feature complete and hasn't had any bugs reported in a while.
Although, if you assume that any software is free of bugs, and that at least some users will report bugs, if there is low activity, that suggests that either it isn't well maintained, or there isn't a critical mass of users to find and report those bugs. But then, higher quality software will require a higher number of users to hit that critical mass so it doesn't give you that much information unless you also know how good the software is.
I imagine that I am not the only one.
Edit: https://github.com/blaise-io/contribution
For example.. I guess that maybe gaming the system really is required if thats a 'good measure'.
"Library/repository activity has little to do with usability, or quality. Some things are more or less finished and correct."
Some software just does what it is supposed to and doesn't need to change, and this is OK, and I have no idea why this fact infuriates some people.
And there is also the state of "it has all the features I need, but I'd be open to adding a new feature if someone else shows a compelling use case for it."
I use a ton of tools I wrote myself and haven't had to touch in years except for the occasional dependency update.
17 hours ago: https://github.com/coreutils/coreutils/commits/master
Or let's phrase it differently: there will always be a part of the code that you do not have to touch for decades if all goes well. And if that part sits in a seperate repo, is it abandoned or just finished?
It's a little silly, but I could imagine that if this become a common enough thing, people would start to trust it.
Programmers are lazy creatures.
Fork it and start maintaining it with other people depending on it.
If the project already had the features you need, was thoroughly tested and debugged, and was built with almost no dependencies (only relying on a small number of very stable platform APIs), then it might not matter even if it was already abandoned when you started using it.
Case in point: On a recent software project, I took dependencies on two Lua libraries which were already abandoned. Their source code was short and readable enough that I had no problem going through it to understand how they worked. In one case, I added an important feature (support for a different type of PostgreSQL authentication to a Postgres client library). I also packaged both libraries for my Linux distro of choice and submitted them to the official package repositories. If anyone reports bugs against the version which I packaged, I'll fix them, but it seems unlikely that many bugs will ever be found.
As the OP rightly pointed out, the expectation that software libraries should normally need to be constantly updated is ridiculous. Many other things invented by humans stay in use for decades with no alterations. Beethoven's 5th symphony hasn't had any updates in more than 200 years.
What a shame it’s been abandoned and no other musician stepped up to take over the work.
I don't understand this argument. Are you saying that some things don't require updates, therefore we shouldn't expect software libraries to be updated as well? But there are also things that do require updates or maintenance. Would that invalidate the argument?
Some examples of things that need updates or maintenance: buildings, infrastructure, tools, machinery. Even immaterial things like books or laws receive updates.
And that includes the 5th Symphony too, which has different editions.
In today's world of software development, many take it as given that every software library should receive periodic updates, and that a library which has not been recently updated is in some sense "dead" and should not be used.
This is logical in cases where the domain is itself constantly changing. For example, software packages which calculate the results of income tax returns must be updated yearly, because the tax laws change. Similarly, packages which perform time zone calculations must be periodically updated, because the time zone rules change.
However, a vast number of software libraries operate in domains which are not inherently subject to change. As an arbitrary example, imagine a hypothetical library which performs symbolic differentiation and integration. Since the rules for how to integrate a function do not change, once thoroughly tested and debugged, there is no reason why such a library could not be used unaltered for decades. Yes, it might not benefit from the development of more efficient algorithms; but if the library was already more than fast enough for a certain application, that might not matter.
While software is different from other things created by humans, the existence of creative works such as books or musical compositions, which often survive for decades or centuries despite not receiving regular updates, provides an illustration of what can and should be possible for software as well. Note, this is an illustration and not an argument.
I guess that really depends on what it is.
The older I get, the more change-averse I become. That doesn't mean that everything is perfect and we shouldn't fix things that are broken, but it does mean I start to embrace the philosophy of "don't fix what isn't broken" more and more.
If I have something installed on my desktop / workstation that a) is not network attached and b) is not exploitable from a security point of view (least privileges, no sensitive data) c) has little risk of corrupting data and d) is unlikely to "just stop working" one day because of a systems / dependency update ... then I'm not in any hurry to update it. When I do get around to it it's probably because I'm installing a new version of Linux and so everything is getting an update. But if the old version still works, has no bugs or security risks and there's been no updates for years ... who cares?
I can think of several categories of applications that fall into this category:
- Music / mp3 player
- Classic Shell / Open Shell for Windows
- Office software, like LibreOffice. I'm sure newer versions offer some niceties but things "just work" for me. I don't see the reason to upgrade.
- Almost every game, ever (assuming it's stable and has no major usability bugs that need patching)
- Lots more
Things I do want to upgrade would be my web browser, operating system kernel, anything network attached. Really anything that could affect data integrity or security. Other than that, I'm lazy, comfortable and I don't want to risk the introduction of breaking changes.
Okay, so this is exactly what GP said. There is a difference between "not adding new features" and "not fixing bugs".
Would I be upset if the developer "fixed" these categories of bugs? Of course not. But would I avoid using the software at all if they never did?
...
"I guess that really depends on what it [the software in question] is."
What does it matter if the developer still cares about the project?
It isn't crashing and no new features are needed. If it did then the project wouldn't be complete.
We're not talking about some early access half broken NPM package here, the blog specifically talks about a completed product.
Of course there will be some maintainers who are simply not interesed or unable to offer paid support (e.g. due to their employer being a control freak) but that's ok. As others have pointed out, forking / maintaining out of tree patches (and providing them to others) is not inherently hostile.
For you it is.
But for a maintainer, reviewing and accepting a pull request can still be a lot of work, especially if the code has been stable for a long time.
Usually I browse the issues / bug reports page and see if there are any breaking bugs that aren't getting much attention. If there are, then that's one more data point that the project might be abandoned.
1) The owners sometimes archive the project or write in the readme: complete, no more features will be accepted.
2) You can look at the number of open issues. A project with X stars/used-by/forks that hasn't been updated in 8 months and has zero open issues is probably stable.
> The expectation that software libraries or frameworks should break every few months is disturbing.
As a library user, it's hard to find a good balance between fully trusting a system to stay alive for a while without maintenance, while being super paranoid about every aspect I rely on. Mentally it's easier to expect it to break every now and then, than to keep thinking "it's probably fine, but I still need to be defensive about stuff that never happen".
I think the issue on a library being "alive" or not is best mitigated by the users being comfortable to fix it if it broke under their use case. There's libraries I thought were completely dead but were a good shortcut to where we wanted to go, and we expected to extend it here and there anyway. That can't work for everything (thinking of security libs in particular, I wouldn't want to touch them) but it's to me the ideal situation, with no undue stress on the lib maintainer as well.
It’s not a common use-case, I guess, but I had some old projects that I abandoned and wanted to try working on them again and found it almost impossible. The worst cases had dependencies which weren’t available unless I used an x86 laptop with an older version of Mac, because the packages were never built for arm laptops.
In regards to the second case, bet that's Python with the wheels situation, where it doesn't fallback to building from source by default for some reason (instead throwing a super obtuse error), at least with Poetry.
At my company we had a real scramble to upgrade log4j when the CVE for that came out. A lot of software was many versions behind. Luckily for us, no breaking changes had been made, and it was simply a matter of bumping the version to the latest one.
That was a lucky break, because if that had been a library like Jersey or Spring it would have been an entirely different ballgame.
If you don't keep your builds up to date, you open yourself up to risks like that, which are unknown and to some extent unknowable.
What do you mean by this?
We do announce when there is a user-visible and significant issue or update, but that's quite rare, maybe once every 6 months or more.
Also, not many people (especially me included) are able to write something that's perfect first time. In an ideal world, other developers would be testing and challenging what's been written; which would meant the product or library needs updating.
I think it's (perhaps ideally) likely, that at least one of these factors is relevant.
According to the OP, it is also due to companies controlling mobile OS such as Apple.
One of the things I like about non-corporate open source OS like NetBSD is I can run old userland utilities with new kernels without any problems.
This expectation that things need to be committed to or updated every month has to stop, we're just wasting time and energy on stuff that is already fixed (unless there are security issues, of course).
Maybe GitHub needs to automatically include an UPDATES.md into each page, I dunno.
You might not care too much, and it clearly depends on the application, but for me updating a software that doesn't use anymore a library for getting user input that leads to a buffer overflow if you insert a certain character, or similar things (like remote code execution, etc.), can be quite important. Finally, apps are most of the time connected to the Internet, which makes them inherently vulnerable.
After searching "android software libraries CVEs" I found this in the first results' page: https://github.com/dotanuki-labs/android-oss-cves-research
It might be outdated, but the principle still applies.
It's very unlikely that your application is self-sufficient and doesn't need updates.
EDIT: I read the message from Apple as a "hopeful" attempt to say "come on, man at least update the dependencies".
What security ? "Google security" where everyone except the user has access to his data ? Why does a note taking app needs internet to function ? Why does my phone app need access to internet ?
I sort of assume this is the actual point? Apple presumably wants to drop support for older versions of the SDKs, and that requires that app developers update to the newer versions. I think you can make a reasonable argument that dumping work on third-party developers to simplify things for themselves is bad, but the author's belief that it was simply pointless busywork is probably incorrect from Apple's perspective.
I suspect the minimum download threshold to be exempt from this is _very_ high. Maintaining backwards compatibility for a small fixed set of apps doing things an old way is a categorically different problem from maintaining backwards compatibility for every app out there.
If this was really about deprecation, they wouldn't have a "minimum monthly downloads" exemption either. This policy is just a way to clear out old, unpopular apps from the store
Except popularity doesn't correlate with utility when it comes to apps. Probably only addictive games and social network apps will pass whatever arbitrary threshold has been set.
This will harm any one off apps built to satisfy a niche purpose downloaded by a small set of users. Which Apple probably think are not important, like all of the little high street shops, except cumulatively they might affect a majority of users. Also if it's measured by "downloads" rather than "installed", then it could take out larger more widely used apps that are considered complete by both authors and users, but don't have enough daily new users to pop up on their radar as important enough... this is similar to the "maintenance" fallacy of NPM, where frequent patches = better, even though if your package is small and well written you should be making no patches as a sign of quality.
Businesses don't want to be told that their working software needs to be updated to make a vendor's bottom-line cheaper. They recognize cost-shifting when they see it and respond by backing towards the exits. Microsoft maintained a philosophy for decades that it was their responsibility to, if at all possible, maintain backwards compatibility with older Windows software as a market differentiator. The primary times I remember them breaking this policy were security related.
(That having been said, I got out of active development of Windows software around Windows 8, so this may have changed).
Sure there are old things that are good and "complete" but far more old stuff is just old and could well be burnt to the ground, except for the fact that you have some customer somewhere relying on its oddities and unintended behaviors as an essential feature of their integrations.
There's no sign that being very-backward-compatible is holding Windows back that I can see.
In the other hand I have collected a set of utilities into my work-flow that are easily 20+ years old, and they all work fine.
The last major cull from Microsoft was that 16bit programs ceased to work on 64 bit platforms. Other than that I've never had an app fail.
Most of those utility supplies have long since disappeared, retired, or died. But I can still keep transferring those apps to the next machine and they keep running.
None of this impacts the quality of my current offerings. Ultimately all this costs me is some cheap disk space.
Maybe Linux could be beaten to work with it, but this works well enough.
Backwards compatibility is very much holding MS back
Something like Google's minimum sdk version is annoying, but understandable. It's technical and concrete - you must link against version X because version X-1 is going to disappear.
This is not that. It's culling apps that are arbitrarily too old and arbitrarily not popular enough. They must be keeping around old sdk versions if those old but popular apps are allowed to continue on.
And they also went above and beyond to make it happen too. That time when they byte-patched a binary which they didn't have the source code anymore comes to mind.
A better example is productivity software, like Photoshop and Illustrator or Paint Shop Pro. I can get Paint Shop Pro 5, a raster graphics editor from 1998, to run on Windows 11 just fine, for example. Another is Microsoft Office, in which Microsoft goes out of its way to make sure documents created long ago will load and work fine in modern Office, and ancient versions of Office itself will happily run mostly fine on modern Windows too (eg: I run Office XP on my Windows 7 machines).
Old games were also quite often doing direct access to graphic cards outside of official APIs
And games are not business software. An old game that stops working is "too bad, move long", accounting software that stops working has real life consequences.
More regular applications tend to be much easier to get working though. E.g. something like Delphi 2 or C++ Builder 1 work out of the box just fine. The biggest issue with older software is that they sometimes had 16bit installers who do not work with 64bit Windows. Windows comes with some updated stubs for some popular installers and it is possible to manually fiddle with some of the unsupported ones to run the 32bit engine directly, though something like odtvdm/winevdm that emulates 16bit code on 64bit would also work.
But in general you can get things working, depending on how well the application was written. In some cases (games, 16bit installers) you do need workarounds as they wont work out of the box, but even those workarounds are based on the 99.9% of the rest of the system preserving backwards compatibility.
Worked generally okay until the era of the Internet came along and after you quit the game, all manner of programs would crash when the network stack suddenly found itself teleported an hour or two into the future and couldn't cope.
> The most impressive things to read on Raymond’s weblog are the stories of the incredible efforts the Windows team has made over the years to support backwards compatibility ...
> I first heard about this from one of the developers of the hit game SimCity, who told me that there was a critical bug in his application: it used memory right after freeing it, a major no-no that happened to work OK on DOS but would not work under Windows where memory that is freed is likely to be snatched up by another running application right away. The testers on the Windows team were going through various popular applications, testing them to make sure they worked OK, but SimCity kept crashing. They reported this to the Windows developers, who disassembled SimCity, stepped through it in a debugger, found the bug, and added special code that checked if SimCity was running, and if it did, ran the memory allocator in a special mode in which you could still use memory after freeing it.
> ... Raymond Chen writes, “I get particularly furious when people accuse Microsoft of maliciously breaking applications during OS upgrades. If any application failed to run on Windows 95, I took it as a personal failure. I spent many sleepless nights fixing bugs in third-party programs just so they could keep running on Windows 95.”
> A lot of developers and engineers don’t agree with this way of working. If the application did something bad, or relied on some undocumented behavior, they think, it should just break when the OS gets upgraded. The developers of the Macintosh OS at Apple have always been in this camp. It’s why so few applications from the early days of the Macintosh still work. For example, a lot of developers used to try to make their Macintosh applications run faster by copying pointers out of the jump table and calling them directly instead of using the interrupt feature of the processor like they were supposed to. Even though somewhere in Inside Macintosh, Apple’s official Bible of Macintosh programming, there was a tech note saying “you can’t do this,” they did it, and it worked, and their programs ran faster… until the next version of the OS came out and they didn’t run at all. If the company that made the application went out of business (and most of them did), well, tough luck, bubby.
---
This really gets into a philosophical difference of how software should work and who should be maintaining it. As a user, I love Raymond Chen's approach. As a developer, trying to maintain bug for bug compatibility with older versions of the code is something that scales poorly and continues to consume more and more resources as more and more bugs need that bug for bug compatibility across versions.
It's fine to argue typical desktop applications need to be updated but purpose-built applications cost money, so when you have things like a POS terminal installed in thousands of fast-oil-change locations and it's from the Win3.11 era working perfectly fine for years but suddenly stops working after moving to 10, that's a sudden cost on a business (especially with no warning). Yes, you can argue that companies should be updating that kind of software, if only for reasons of security (I often did). The bottom line tends to be king, especially in smaller businesses, in my experience.
Even if Mac hardware manages to vastly outrun the top end gaming PCs on raw performance, they'll never be seen as serious mainstream targets for this reason alone.
To an extent, but the reality is that an unacceptably-large percentage of apps that are 2+ years old are not correctly handling current screen sizes and reserved sensor areas.
> This policy is just a way to clear out old, unpopular apps from the store.
Great. This is the kind of active culling/editing an app store requires to remain vibrant.
It doesn't matter if that tool you currently use is perfect, or the game you play is just fun as-it-is, it is clearly harmful to you (and makes the app store "less vibrant".
Everything older than 2 years must go. Crumbs, everything older than 1 year should go... Nay make that 1 month...
Who cares if users like an old app, "vibrancy" matters most.
/s
It reminds me of a class I once took where the professor stated that some colonial governments would go into tribal areas, claim land ownership, and start taxing the indigenous people. And because these people now owed taxes, they had to give up their lifestyle, enter the workforce, and participate in the money economy whether they wanted to or not. I don't know if that scenario is historically accurate but it certainly is analogous to Apple's policy. Developers who might not even want to make money are being compelled to do so or see their apps get pulled, because forced updates amount to a tax that must be paid.
It's not a tax that must be paid. The developer can simply discontinue the older app, and not have to pay anything. So your analogy doesn't apply.
Switching an app from free to paid is a lot more work than recompiling and updating the app. There's a ton of coding and infrastructure you have to do. So it's not really saving you anything. The work of switching is a large upfront cost, which might not pay off, because apps don't magically sell themselves, you have to market them (which costs money!). This is especially a problem if you already have an app with low download numbers and low consumer awareness.
You can suspect based on no evidence, but nobody knows, and Apple refuses to say.
The crazy thing is, if Apple truly wants to drop support for older version of the SDKs, then how in the world does it make sense to exempt the most used apps???
Again, a guess based on zero empirical evidence. Also, Apple's "rule" here makes no distinction between paid and free apps. Indeed, free apps tend to have more downloads than paid apps, which means that Apple would be targeting the wrong apps if they were looking to offset costs.
Basically a cost saving move.
> Basically a cost saving move.
Working 1-on-1 with companies to determine what to keep and what not is anything but cost saving, by my estimate.
If they paid me maybe I would have. Otherwise I don't have time to keep dealing with their requests every 6 months. Is it such a hard thing to ask that if shit works, just leave it be?
To Apple's defense, are they supposed to wait until the app breaks, starts receiving many complaints from customers, before it triggers the review process for them (which they would be forced to look at as somewhat high priority) before they then take action to remove the offending app? That hurts the customer experience from their perspective.
Better for them to institute a policy preemptively addressing these issues (arbitrary as the timeframe may be).
And four hours is a good chunk of time, but what percent of time is it compared to the amount of time for the app to be designed and implemented in the first place?
Except that Apple is exempting apps with more downloads, and only punishing apps with fewer downloads, which is the opposite of worrying about "many complaints".
For an app with more downloads, they can dedicate more labor/resources to it.
What resources? For older apps with more downloads, Apple is doing exactly what you said they shouldn't do: wait until the app breaks, and start receiving many complaints from customers.
The intention is to not support old iOS APIs with new versions of XCode and iOS anymore.
Apple isn't Microsoft or the Web - very old Windows programs and very old websites still run pretty fine.
Apple would rather shift the burden to update and App according to the latest API to the Devs than to provide API support forever.
I don't see Nintendo removing old Switch games from the eShop.
I don't see Apple Music removing the Beatles because they haven't updated recently.
My recommendation, which Apple's (obnoxious) ad business would never accept, would be to
1. Remove the obnoxious and generally useless ads which eat up the top half of the first page of app search on the iPhone.
2. Improve app search with more options and a fast, responsive UI. Also they might consider allowing you to consider ratings from other sources such as critical reviews vs. user reviews (a la metacritic.)
3. Better human curation with more categories. This is the same approach that Apple Music takes and it seems to work well. Games should have Artist/Studio/Developer pages as well as Essentials lists to facilitate discovery. Same with genre/category essentials, which have a rotating list that can be saved/bookmarked.
The real problem is that developers have no choice except to offer their app through Apple's store. There is no room for the developer to offer their labour of love or niche product in a storefront that better serves their needs, or even from their own website.
How is this different from other walled garden game systems/game stores like Nintendo's eShop?
Yet they seem to keep older games and apps, even niche titles for a limited audience (such as music production apps or BASIC programming apps) which I greatly appreciate.
I would agree that discoverability isn't great on the eShop, but there are dozens of enthusiast web sites which are pretty good for game discovery (also aggregators like metacritic.)
And, as I noted, I think Apple already has a good approach which they're using with Apple Music - better human curation including category/genre/time period/artist/etc. playlists. Podcasts/radio shows also help.
Many games (at least ones that aren't in the "live service" category) are more akin to movies, music, or books than to some sort of perishable produce, so a curation approach that balances older content with new content makes sense.
0: https://support.xbox.com/en-US/help/hardware-network/console...
As for other media, brick and mortar retailers were always selective about what they offered. I suspect that we will see something similar happen with their digital variants in the coming years. I also suspect that it will be sales numbers, not human curation, that will be the basis of their decisions.
“Make space”? This isn’t a shelf. There’s always enough space for digital items.
Even in a less wall gardened environment, I'm mostly not interested in running 10 year old applications unless they're something fairly simple that really does do everything required for the purpose and still runs reliably.
In any case, as a user, I probably figure that if an app hasn't been updated in five years, it may or may not work and I'll probably at least subconsciously resent the store's owner a bit for clogging up the store with old stuff.
The 10 year old version of AutoCAD still runs, and you can use it today to do a ton of high-value CAD work. Thanks to Microsoft for not arbitrarily blocking it from running.
This is precisely why Google only indexes webpages written in English and are focused on the American market.
Also - there's a cultural preservation issue here as well. That bothers me.
Removing apps based on downloads or lack of updates is troubling.
I don't hear independent developers griping that Apple is failing to advertise their apps and bring those apps to the attention of iPhone users. Instead, I hear independent developers griping that Apple is preventing their apps from being run on iPhones.
Therefore, I completely disagree. This is purely a matter of data storage space (cheap and nigh infinite), not a matter of limited attention.
There are huge numbers of good apps on the store that don’t get visibility.
By that argument they should also get rid of most old music, old books, old movies.
I do not. Do you think shovelware author x has any issues pushing a new garbage update?
I want the app store to be full of high quality stuff, not recent.
Besides, isn’t this the company that allowed you to install iPhone apps on iPads and blow the UI up to 2x size?
You could run iPhone 4 apps on iPhone 5 and beyond. But they looked horrible.
- they care about their apps not being evicted from memory as quickly when they switch apps because memory isn’t taken up by 32 bit and 64 bit versions of shared libraries.
- increased battery life by not having as much RAM - yes RAM takes energy.
- using the die space saved by not having 32 bit instruction decoding means you can use that die space for enhancements that users care about, and decrease the die size to make the phone more battery efficient
- for Mac computers, you have computers that are faster, have more than twice the battery life, are more memory efficient (meaning less swap), and can be fanless without getting hot.
You do realise the only reason iphone retina screens became a thing was to enable double pixel scaling because iphone apps at the time were coded to a fixed resolution.
That's the definition of a compatibility hack.
Of course apple being apple they managed to sell it as a feature and made every person who was happy with a 1366x768 laptop suddenly desire a retina display.
Let the user make the damn choice.
If you think that’s all a smartphone is, then it’s natural to come to the conclusion that the only thing that has changed is speed and resolution.
It also happens to be simply wrong.
Most applications basically just need:
- a canvas to paint some bitmaps on
- some way to tell what part of the screen the user tapped on
- a way to get TCP/IP or HTTPS traffic in and out - some sound output
- some persistence
- some way to show notifications
- a few other odds and ends like GPS, sometimes
Almost the entire list been supported on every major platform since the late 2000s. Yes, rich multimedia apps that make good use of additional APIs and hardware features do exist. But it's inappropriate to nuke most old "normal" applications just because old rich multimedia apps stopped working over time.
Apple introduced size classes and then you needed to adjust for different views for iPads once they supported more than one app being displayed on the screen.
Apple rightfully got rid of 3/ bit app support on the actual die. It introduced new permission models, design aesthetics change, new accessibility options are added, better APIS are written, etc.
As do a lot of iOS users. I think the stat you are looking for is that, on average, iPhone users purchase more apps.
Don't forget to consider Android's massive installed user base in the calculation. Even if Droid users convert to paid at 1/4 the rate of iOS, you can make it up in sheer bulk.
I wish I could upvote you for that multiple times!
The difference is that Nintendo shops have a limited shelf life, while App Store is forever(-ish). Nintendo will be shutting down the Wii U and 3DS eShops in 2023.
2023 is 6 years after Wii U was discontinued. Since the platform was frozen in time in 2017, there's no point to game updates.
Not true. More often than not, our iOS releases get delayed hours if not days, while our long-suffering iOS lead patiently walks yet another green reviewer through the policies and our previous interactions with reviewers to convince them that our app is in compliance. Among other things, our app repeatedly gets flagged for failing to comply with rules that don't apply to it. This is usually resolved with a simple message to the reviewer, but depending on the turnaround, that can effectively add a day to the time it takes to get a bug fix out.
Dealing with these bogus issues probably accounts for 5% of the productive time of our iOS lead. And this is despite keeping our release cadence slow (every two weeks except for the most critical bugs) and after we've made many reasonable low-to-medium effort changes in our app to stop triggering false positives in their tools.
God help us if Apple ever went the Google route. Apple reviewers might be inexperienced and undertrained, but at least they're human and capable of talking through issues.
Besides, users aren’t going to be updating their app multiple times per day as they would a website that is continuously updated.
We have an old iOS app for our products that runs fine even on the latest version and while there is a next gen app available that most users have switched to, some prefer the old one. For some use-cases, even for new users, the old app just fits a lot better.
We cannot rebuild and republish that app, because it depended on third party software that we no longer have access to. The app will continue to work fine for users that own a correspinding device but will most likely be removed from the app store for no real reason in a few months.
This will force all userd that want to actively use it to switch to the next gen app that they maybe don't want as soon as they add someone new to their device.
In our case, the apps are linked to hardware that the user owns and shares with multiple others. Due to very restrictive changes in iOS background activity over the years, we had to restructure some of the functionality, so the apps are not really interoperable. I think in this case, as soon as the user wants to add a new user to the device or an existing user gets a new phone, all users tied to that device would have to switch to the next gen app to keep having a consistent user experience.
This is not the kind of experience we want to provide for our users but we simply cannot invest as much money as would be required into completely mitigating the effect of Apple's decisions (such as heavily restricting background activity) year after year.
Some software from the past that made me feel that way:
1. Adobe Photoshop 7
Felt feature-complete, never ran into a bug, not resource-intensive (I would run it on a Pentium 200), no online activation/membership BS
2. Apple Aperture 3
Also felt feature-complete, had everything I needed. Nowadays I need to use 2 or 3 different software to have the features of a 2003 app. Unfortunately the app stopped working after 64-bit transition, and Apple retired it in favor of the much simpler Photos. Shame on you, Apple.
3. iTunes 10
Pretty much the sweet spot of features for managing your music library. Apple replaced with the Music app, because nowadays users consume streaming vs. maintain their own libraries, but the app is a buggy mess.
4. Winamp
Solid, just worked.
More software should be like that, but never will, because it isn't profitable to have users using the same version for many years. The revenue maximisation strategy is to release continuous beta-quality software, and apps should provide a steady revenue stream. That's why the Apple Store just assumes an app that didn't update is "abandoned". That's the perspective of users in general today, too.
You can get some of it back with FOSS applications, even if the quality normally isn't the same as with old freeware/proprietary applications. At least with a FOSS application you get to keep it forever, unlike SaaS which evaporates into thin air the moment the parent company decides to pull the plug.
Of course if time is of no essence you can spend it keeping the software up to date, but being able to waste that time doesn't really excuse the underlying foundations forcing application developers to waste their time.
Lots of stumbles and missed opportunities - like, what if they had actually been serious about making the Apple TV a Wii-style games console? They have the hardware expertise to do that at a reasonable cost, but they just have no idea about the market, and apparently no desire to learn.
If Nintendo took that approach then they'd end up throwing away Super Mario Odyssey and Zelda: Breath of the Wild.
Apple products very much have a time and a place. Their plan is recurring revenue. Something that happened 3 years ago is almost entirely irrelevant to them. It's true with both hardware and software.
Wii-style games on AppleTV would not be a win for them. They don't want to sell a few million copies of Wii Sports once every 3-5 years. They want you buying a new 99¢ game at least once a month. They want you spending $5-10 in micro-transactions a month. They want you subscribed to AppleOne for $15-30 a month. They want you to buy a whole new iPhone every 2-3 years and start the process all over again with some new AirPods, cases and bands in between.
Apple doesn't want to sell you a new game for $59 every 2 years. They want to sell you what amount to an average of $59 worth of goods and services a month… forever. And while that sounds like a lot, that's a low target. If you have your TV subscriptions through Apple and Apple Care you can easily be contributing $100/mo or more to Apple's bottom line.
We consider chalk 'finished' and probably won't release another major version that changes the API - perhaps just typescript maintenance as Microsoft messes with the language even further and we have to fix types.
Sometimes, software is complete. I hate this new industry dogma that code rots over time and needs to constantly be evolving in order to be "alive".
I'll use this package, multer-s3-transform, as an example. Its been abandoned. It depends on multer-s3, which depends on AWS-SDK and multer, which then depends on busboy.
Now, AWS-SDK, Multer, and Busboy have organizations maintaining them. However, the random projects overlayed on top of those are by single individuals.
The answer is to two-fold. Avoid overlayed projects and avoid big projects managed by a single individual.
Author complains about the time required to update libraries, and that's an aggravating process, but that's just an unfortunate part of maintaining an app. The real issue, again it seems to me, isn't that you have to do a lot of work just to increment the version string; it's that, ultimately, modern content ecosystems are designed according to engagement-driven revenue models. And solid, simple, quiet, long-lived, useful or fun little apps simply can't thrive when all the sunlight is blocked by towering marketing-tech giants.
IMHO.
This has been the name of the game in ad tech like fb, Google and social media in general. I think two worlds are clashing with each other, where consumer tech is somewhat aware of the problems around mindless scrolling and addiction, but the growth & engagement mindset of the 2010s is cemented in the culture. Apple has little reason to follow this model because they primarily make money from selling hardware. Having a software platform that protects the user from this crap is a competitive advantage against Google, who depends on ad-based revenue. Apple seems to have an identity crisis, fearing they lose out on sweet subscription fees and ad revenue, now that most apps are free. This in turn is creating conflicts of interest, where they end up fighting their own customers.
If regulators would bark and bite harder around anti-competitive behavior, it might actually force corporations to focus on what they're good at instead of everyone building their own mediocre walled gardens that grow like a cancer and eats the company from within. At least, that's my wishful thinking..
Fully offline, totally self-contained apps are a different matter, but those represent an increasingly small percentage of apps.
There is a dystopian arc, but I prefer to be more optimistic. I would think a legal mandate that champions interoperability, open data standards, and platform openness will put a dent in this march towards convert the human experience into numbers.
But there is one reason I somehow understand Apple stance. First is security, almost all apps are online now, and new vulnerabilities are found regularly. Super Mario has bugs, be no one cares, in fact, speedrunners have fun with them, because a NES is not online and there is nothing sensitive in there to begin with. Second is Apple's own fault: they break their own system and want you to make sure you keep up.
Super Mario Bros runs on a single piece of unchanging hardware. Even when you play it on any other platform, you're playing it through an emulator designed to mimic the original hardware.
And that's the case with all video game consoles. Even when the physical hardware changes, you're given the guarantee that it won't be breaking to the software. The few times that has not been the case has been notable.
iOS devices don't have that guarantee. The hardware can have breaking changes. You software now has to contend with the fact that there is no guarantee that certain features may or may not be present. Things that were previously not customizable, now are. If you want your software to run on the latest iOS, it is at least partly your responsibility to ensure that it does.
You also need an emulator to run 31 year old PC games like Civilization on modern OS/hardware.
In other words if there was some actual reason to do an update, like a security flaw or serious bug, she wouldn't have been able to readily do so.
This seems to support Apple's policy to make developers update the app every once in a while.
Closing off APIs that facilitate fingerprinting is just one of many incompatible changes Apple has been making.
Some other reasons are deprecating power hungry technologies and asking for more permissions to access private data.
These are changes that benefit users on a massive scale. Why shouldn’t a developer be expected to respect users needs?
Also - “windows does it” is obviously irrelevant when we are talking about a mobile OS.
I won't continue this discussion about maintaining compatibility. This is fundamentally a philosophical issue. I agree with the sibling comment that it is the job of an OS to provide stable APIs across versions. It requires some effort (as a long-term library maintainer, I'm very well aware of this), but it is not an impossibility at all.
The job of the computer is to serve the end user. The job of the OS is to manage the computer’s resources on the users behalf.
API stability can contribute to that goal, but this is not an absolute.
Apple balances their view of what is good for users over what is good for developers and themselves.
Your preference is to prioritize developer comfort over both end users and Apple.
If you think there are no insecure or inefficient APIs in older versions of operating systems, then you are simply wrong.
API stability sometimes serves the end user, and sometimes does not. When it does not, it should not be maintained.
Isn't this supposed to be why the App Store has a manual approval process? So Apple can actually check if developers are doing malicious things?
By all means, apply extra scrutiny if an old API is in use. Maybe allow the API only in updates to old apps, and not new ones.
> By all means, apply extra scrutiny if an old API is in use. Maybe allow the API only in updates to old apps, and not new ones.
If the developer is updating the app, there is no reason they shouldn’t adopt a more user friendly api.
(1) There wasn't.
(2) "After 4 hours of work to re-compile my app and 44 hours waiting in the review queue"
The biggest obstacle here isn't the developer, it's Apple.
So another way to look at it is Apple requires developers to once every 3 years do the absolute minimum amount of maintenance, and they get a 90 day window to do it in.
Developers needing to demonstrate once every 3 years that they still have the source code and it compiles should not be an obstacle at all.
You say "Developers" without qualification, missing the crucial exemption: for some bizarre reason, developers of apps that are above a certain download threshold do not have to demonstrate that their code still compiles. Does that make sense?
So when you ask but why are popular apps exempt? - well, they already told you exactly why, because they're popular. People still want the app.
I feel like the actual reason you're against this policy is left unstated.
1) The criteria do not include "crappy". Apple didn't claim that the article author's app is crappy.
2) What's the difference between "old" and "outdated"? The article author's app was recompiled but otherwise not changed.
3) The app is now back in the App Store. So if Apple's goal was to remove the app from the App Store, then Apple failed.
> People still want the app.
Alternatively, they could be scams that are getting downloads from keyword stuffing, fake reviews, search ads, and other well-known methods.
> I feel like the actual reason you're against this policy is left unstated.
Not at all. The same reason as the article author:
"The decision to remove outdated apps places a disproportional burden on indie developers and hobbyists"
Apple has said, in response to anti-trust claims that "developers, from first-time engineers to larger companies, can rest assured that everyone is playing by the same set of rules." But that's clearly a lie, is it not?
I said that was part of their intention, indicated by "follow current review guidelines". Go ahead now and try to put Apple's intention into your own words. What do you feel is Apple's intention behind this policy?
> "... everyone is playing by the same set of rules." But that's clearly a lie, is it not?
Large developers also have to resubmit their very unpopular, obscure apps every three years. Small developers with popular apps also do not. Everyone is playing by the same rule. You made the claim, what developers are not subject to this same policy?
> "The decision to remove outdated apps places a disproportional burden on indie developers and hobbyists"
Explain why you feel a few minutes every three years is a burden. Literally the only thing Apple is requiring you do is recompile your unpopular app and submit it as an update once every three years.
It's not disproportional on indie developers and hobbyists unless you feel they have more unpopular apps that they also almost never update. Hobbyists can make popular apps, such as that Japanese guy's side-by-side calculator app that was on the HN front page the other day and they often put more love and effort into updating their apps, even the old ones. Frankly this view that hobbyists are oppressed by needing to recompile once every three years reads like an insult.
I can't read Apple's mind. You can't either.
> Large developers also have to resubmit their very unpopular, obscure apps every three years.
Oh give me a break. I'm done here, this is not a good faith argument.
> Explain why you feel a few minutes every three years is a burden.
A few minutes. Again, this is not a good faith argument. Your reply is not serious.
> Literally the only thing Apple is requiring you do is recompile your unpopular app and submit it as an update once every three years.
Your reply is contradicting itself, because you claim Apple's intention is to get rid of apps, but you also claim that it's incredibly easy to not get removed.
> Frankly this view that hobbyists are oppressed by needing to recompile once every three years reads like an insult.
Do you think the original article author was insulting herself?
What a bad faith, insulting reply.
I asked what your understanding was, not what Apple actually was thinking, and you absolutely can say what you believe about Apple and their intentions; this goes to Theory of Mind that is a cornerstone of being a functional person.
> give me a break ... not a good faith ... reply is not serious .. bad faith, insulting reply
It's now clear to me that you have unstated reasons because when calmly asked to explain your reasons you went off crazy like this rather than simply state those beliefs. You feel it's a burden, but why is effort so minimal a burden? You won't say.
Your expression of concern over the blog author's character, your inability to explain your views, and those views being irrational leads me to conclude that you are simply white-knighting.
It seems like this could be done for at least some games, but defining a virtual machine and binary format that's both good enough that game developers will want to use it, and at the same time stable enough that it lasts forever, seems like a challenge? Also, it needs to be non-networked, or it will stop working when the server goes down.
This was done a long time ago for interactive fiction, but doing it for modern mobile games seems like a challenge. WebAssembly should probably be involved, but the user interface will need a huge API surface that's also stable.
Take Github: to me it feels that it's now at an optimum where adding new features that make it more social or more "fun" would simply make it worse.
Similarly Youtube: tons of good material, user interface is fine. Then they introduced shorts, and to me it feels like these type of video's are simply not part of youtube's identity, adding them only makes it worse.
At some point it might be best to stop adding new features and just agree that things are fine now as they are.
Still, I don't think Steam would confess to deleting a game just because it is old. They carry a lot of games which haven't been updated in years and which still sell.
It's a real thing especially when you're building something under the unix philosophy of "do one thing only, really well".
I really don't think it's lost on Apple or the app review team. They simply have no incentive to change and a captive audience in both developers & app users/buyers. Better customer service (to devs) on the app review process when there are issues, and continuing support for older SDK's, cost time and money and Apple does not see the value in that investment.
Absent competition there's also no pressure to change this. There's effectively a duopoly in mobile software between Apple & Google. They don't even need to explicitly communicate with each other to act as a cartel, they just need to silently follow each other's lead.
Android is at least marginally better for allowing-- through a few scare-tactics hoops to jump through-- sideloading of apps, but I don't consider that sufficient competition to overcome the duopoly label. Neither is Android's allowance of alternative app stores, no more than MS allowing users to install alternate browsers was sufficient to overcome their uncompetitive practices when it came to IE. The primacy of the Play store on initial setup & its extremely deep integration in the OS is difficult to overcome.
Alternatively, I am slightly conflicted on this due to the security aspects of app installation. Mobile certainly isn't perfect, but the prevalence of malware seems significantly reduced from what is seen in PC's. (well, windows. MacOS is not as bad as Windows, but I've always considered that to be a produce of it's lower market share & therefore lower cost/benefit ratio for attackers.)
Apple is a trillion dollar company with over 154,000 employees. Apple has the resources to keep the code for two years, DOS programs still work on Windows 10.
The decision is arbitrary, someone who doesn't understand software has a lot of power over Apple.
I think the real answer here isn't to try and beg Apple to be nicer to the small fish, but to instead use the "old", non-walled version of the web.
Apple acts as a gatekeeper by only allowing native apps to be distributed through the App Store, so it is not unreasonable to ask that they refrain from making the process too onerous.
Until those gaps are fixed, native apps are your only option.
My app is 5+ years old and I basically considered it "done". It came to be exactly how I wanted and nothing more .. and users kept discovering new possibilities even after years of usage. It's a metronome https://talakeeper.org .
Platforms are supposed to absorb developer pain, but Apple offloads a continuous and multiplicative update burden onto all of their developers.
Incentive App developers who make good and substantial updates, whether its new features or updating to newer system APIs, with a positive % modifier to their search results in the App store.
This way well-maintained Apps should show up higher in search rankings and there's a natural incentive for developers to keep their programs maintained. But at the same time, this would allow developers to call a program "finished" and leave it on the store without being scared of having their hard-work destroyed. Their hard-work might not be as visible, but that would be on them.
Unfortunately there aren't many consumer electronics that fall into that category and a huge portion of consumer electronics that end up in the dump are not physically damaged in any way, but simply can't run the latest software, firmware, or OS. Or else they're missing the latest wifi or cellular radios, high end cameras, wireless charging protocols, etc.
[0] The PS2 platform is from 2000 but I use a miniaturized PS2 slim which was released and probably manufactured in 2004.
My mixer is an early example of a MIDI-controllable analog mixer but since the MIDI protocol is still ubiquitous, it still fits right into my modern workflow. New mixers don't really bring much to the table that am average person would need.
In any ecosystem at all: if it speaks HTTPS, it’s either never complete, or it ceases to function past some date.
I get the sentiment very much, but there are cases when you can’t have nice things.
There are "obsolete" devices that require Internet Explorer 6 with some ancient Java or ActiveX for configuration. I have a Windows XP virtual machine for this. Recently, there was an article about someone servicing trains using Windows 98 https://news.ycombinator.com/item?id=32884814
Nowadays, devices are configured with a smartphone app. In a few years, the apps will all be unavailable, and there will be no possibility to use such devices.
Of course I have to add that it does matter a lot for certain types of software. Anything that interacts with ever-changing APIs, hardware specs, and protocols needs to be kept up at least frequently enough to stay useful.
The other issue is the number of iOS hiccups which can lead to support documents saying to reinstall the OS. Doing that will make older, removed apps unavailable after reinstallation of the OS if the user relies on iCloud backups. This risk necessitates iTunes backups to insure such apps remain available after reinstalling the OS.
I doubt a situation like this contradicts the overall value of the culling. But I do know it has an effect on me and there are some people—certainly, a small number—who will lose apps because of the shortcomings in iCloud backups.
"Update or perish" is a bad model for software.
All of my WordPress plugins are free & Open Source. Most are tiny plugins using functionality (filters, actions) part of WordPress core. Unless WordPress becomes backwards-incompatible they will function perfectly fine for the foreseeable future. From my perspective these plugins are feature complete & unless there's a bug, don't need any attention from me. Sadly the WordPress repository expects me to update the version number or else the plugin will be become less visible in search results and a notice will be placed above the plugin's title stating: "This plugin hasn’t been tested with the latest 3 major releases of WordPress. It may no longer be maintained or supported and may have compatibility issues when used with more recent versions of WordPress."
So for some of my plugins I occasionally 'bump' the version number to make sure people can still find it in the search & for some plugins I just leave it be because I have better things to do. However it didn't feel quite right to keep people using my work in the dark, so I've added a text to communicate this to them. This is the text from my 'Redirect To Homepage' plugin:
"Is this plugin actively being developed? Yes and no. Let me explain: I consider this plugin to be feature complete and unless bugs are found there will be no development on this plugin. In other words this plugin is in maintenance mode and will be maintained for the foreseeable future. Due to other obligations I’m not always able to keep up with WordPress version’s and updating this readme’s ‘Tested up to’ version number. However, unless WordPress significantly changes the way the login_redirect filter works it should work perfectly fine even though the ‘Tested up to’ might be of a lower version number. As always, when in doubt, test it (and when it does give you issues, feel free to leave a comment)."
I think this balances both interests, those of people using (perhaps depending on) my work as well as my own. A similar approach could be used by commercial app stores to restore autonomy & balance interests.
I've also had to archive a few of my mobile apps and remove them from the App Store because it just wasn't feasible to get them running again.
I've adopted this practice with my SaaS startup (docspring.com) out of necessity, since I never want to change anything that might break a customer's templates or API integration. I also never remove or rename any database columns. It's been totally fine! I have a handful of feature flags sprinkled through the code, and a solid test suite that makes sure I keep supporting legacy behaviours. It has never bothered me. I don't understand companies or maintainers who are constantly changing things and breaking stuff.
I had a look at a Ember.js project recently and wanted to update everything to the latest version. I couldn't believe how many dependencies were broken, and how painful it was to even migrate to the next minor Ember version. Why??!?! What are all these extremely important changes people are making? The same goes for Rails, React, and every popular library. It's just a treadmill of things constantly breaking for no good reason.
But if you ignore upgrades for a while and fall behind, then suddenly a security vulnerability is announced and you've gotta spend the next 1-2 weeks upgrading libraries just so you can fix the vulnerability.
I had the idea to start a "upgrades as a service" development agency. We would monitor all your Dependabot PRs and fix any broken CI builds, and make sure you stay up to date. I wanted to build an automated code-mod tool that would know how to upgrade libraries between versions. Especially for simple things like a method or class being renamed.
I'd really love to be a customer of that service if it already exists. I waste so much time on this when I should be building new features and fixing bugs.
Maybe GitHub Copilot will be able to handle it one day.
I guess discoverability and monetization are key points, but what about free art projects or small games built as side-projects and such? It seems to me they wouldn't have much to lose and a lot to gain by moving to the web.
> Most people are trying to build well-designed, useful mobile apps
and then proceeds to say how the review process is not helpful because they don't weed out many malicious apps. First, confirmation bias. Second, do they have any idea how things are in Android land? It's a constant struggle against nefarious app devs trying to abuse new technologies or means of getting ad/install revenue. It's one of the things I like the least about the ecosystem I use.
they are destroying information at a rate that is almost unprecedented. I think they probably burn a library worth of information pretty frequently and just move along after salting the earth....
I see it with all sorts of platforms that claim to be innovative....they are so short sighted and think they can subtle hide their greed...
That is how open-source grows. Because you can’t grow a codebase if you have to keep updating and fixing what you’ve already done. As you have to keep updating and fixing stuff, new progress slows and eventually stops. It’s the same for “codebases” like ecosystems/package repos and open-source in general
You must update the software to show what the privacy levels are.
Apple App Store mandates spelling out how the users’ data are being used starting in 2021. Sadly, this only applies toward new updates.
Hiding behind how our data are being used … by the virtue of not updating your app … is not a defense.
Even Ma Bell couldn't tell you who you could buy a telephone from, who you could call, or what you could do on the call, much less take a percentage of anything you ordered over the phone. Enough is enough.
Doesn’t this imply that her app would not have worked on the latest OSses?
In other words: if she had done nothing then her app would not work on newer devices? If so, then isn’t it useful for apple to warn her about this?
Compiling with the newest versions of the libraries/tools can be a lot of hassle including downloading/instaling multiple GB's
The newest OSes will run apps made with earlier versions of the libraries/tools fine, up to a point of course.
Were I developing an app I would never target an apple device, and anything I developed would be in the same vein and the article's app.
At least with android I could develop an app and target the fdroid store.
Were the platform open to competition, we could have multiple stores that would have better policies. It would still elude the common user, unfortunately, but it would be a solution.
Having some rule that looks at number of downloads is unreasonable. That has nothing to do with compatibility or security.
Features and APIs are deprecated/ removed from libraries, and if you don't update your project stops working in most user environments.
Felt like magic both times.
They know you wont leave, they know you'll put up with it.
(Basically, programming is all about engagement nowadays, like with everything else.)
I wrote my own video player based on ffmpeg/vulkan/x11, changes did happen mostly because of a core change in ffmpeg or for some workarounds for hls streaming since my ISP has really trash peering with live stream CDNs.
I am still with x11, I use dwm and st, change are really rare.
Don't forget, open source software is not immune to planned obsolescence, this seems very true with open source software with strong ties with "corpos".
I don't think apps that truly don't need updates are possible, because platform APIs will change, and if they read or write files, or talk to anything on the network, other apps will change and compatibility will need to keep up.
But we shouldn't require updates for no reason, and we should probably be way more careful about messing with those platform APIs.
Android and I assume iOS is much better than something like Linux, where "platform APIs" don't even exist and things are provided by stacks and stacks of distro, version, and customization specific things, so there's no reason stuff shouldn't keep working for years.
“Though a program be but three lines long, someday it will have to be maintained.”
— The Tao of Programming, Geoffrey James
Do Apple really forbid apps mentioning that they are also available on Android?
Oh, that's right, Apple doesn't fully support PWA, because it breaks their rent model.
The author is a professional mobile engineer and has the newest Xcode.
The app is an old project not related to the author's current job.
> This is the way to get Apple and Google off your ass.
The article author has a full-time job as a mobile developer, does keep up, and is not lazy. Your comment was insulting.
> Yes I am aware it's a hobby project.
You show no recognition that people are busy and have better things to do than to constantly update a hobby project to satisfy Apple's whims.
> That's the least a "professional" iOS developer should do.
You continue to show no recognition of the situation, and you also continue to be insulting by putting "professional" in quotes.
Apple itself seems fine with developers updating once every 3 years, or even longer than 3 years, depending on how many downloads the app has.
When do we get to the point of companies hiring "review specialists" who used to work for Apple?
Apple requires an update in the past 3 years or else a minimum threshold of downloads. Presumably the latter is required so there are simply enough newer reviews to indicate whether it's broken (lots of 1-star) or not. These seem like pretty reasonable indicators that it's still working.
> My old code simply did not work anymore with the latest versions of Xcode. So I had to spend four hours on Saturday upgrading all my platform libraries simply so that I could compile the damn app.
Honestly that's just good hygiene. Because if they waited another 2 years, it might have taken 4 days to get the thing working. New versions of libraries come with all sorts of improvements, whether it's for accessibility or security or a hundred other things.
It doesn't seem unreasonable to me that if you're maintaining software in a public app store, you should be able to compile it semi-regularly with new versions of packages.
Not sure what category of software that was but e.g. for games it’s usually not an issue. I used to have a bunch of games and game-adjacent software from the first AppStore year, we’re talking the time when you’d pay a buck for a virtual rain stick which’s use the accelerometer.
They kept working until the 64b switch killed them. Rebuilding them would undoubtedly have been difficult for the author even if they’d not moved away from them, but because those’d use only minimal is features (raw-ish inputs, and setting up opengl) there’s basically nothing to break which would not be flagrant.
It isn't necessarily about API level, it could be (from time to time) about going from arm32 to arm64, to adding better-optimized builds for new microarchitectures, getting bitcode that's recompiled by Apple to support app thinning. Apple may deprecate or remove APIs from time to time that should also be addressed.
That there wasn't necessarily, specifically, a change this time doesn't mean that this program isn't about supporting that over time. It's much easier to make such changes if developers are in the habit of periodically making updates vs. being told to make a breaking update out of the blue.
And before you quote the number of “registered developers”, all of those aren’t paying developers.
More importantly for better than or worse it’s just not how game lifecycles and financing go.
I think this is a fair policy as well. From Apple's POV how can they ensure many apps in the app store still work on the latest phones? If the developer has been updating the app, they can be relatively sure. If the developer hasn't, but the app continues to be downloaded with success they can also be sure the app works. But for an app the developer has (seemingly) abandoned and and nobody downloads? It's most likely broken. You could argue that that Apple should test the app before sending such a message but I think it's probably likely that (1) the majority of apps that are abandoned are broken and (2) the developers don't actually respond. It's easier to tell all the devs to get up to speed and those that actually care will submit the app for review (even if all you have to do is change a version number).
What actually sucks is if you have to rewrite parts of your app because even though the iPhone 22 Pro Max Plus w/ Turbo & Knuckles supports the same SDKs as the iPhone 4, Apple won't let you resubmit your app as is.
(This debate is as old as computers, but I'm strongly in Raymond Chen's camp.)
1) Compatibility wise it wasn't worse than macOS Catalina or iOS 11, which both killed off 32-bit apps; actually a typical iOS release is probably worse than Vista in terms of backward compatibility
2) Vista's security improvements (such as sandboxing device drivers, requiring app permissions, etc.) were beneficial and persist to today – and were arguably the predecessor to modern app permissions systems in macOS and iOS (and Windows 10/11)
2a) Microsoft eventually largely addressed compatibility by providing an XP compatibility mode (really an XP VM); they could have/should have managed this better
3) Vista got the UI for app permissions wrong, and users hated it; I think Apple did it better but Apple is generally better at UI and also had the chance to learn from Microsoft's mistakes.
At the end of the day, Vista's woes were largely from not paying enough attention to backward compatibility, combined with poor UI design. It was a rough transition, but Microsoft seems to have learned somewhat from the experience (although Windows 8 also had some UI issues.)
But should Apple have kept support for PPC support forever? 68K? Why not keep a 65C02 emulator around so I can run Oregon Trail from the 80s?
Sounds good to me! Pretty sure Apple 2 system software and an emulator would only be a few megabytes, and it would be awesome as something you could install for free like GarageBand etc.. Apple might also be able to acquire the rights to a bunch of classic Apple 2 apps and games...
Maybe we can convince Apple to do it for their 50th birthday. Or maybe a Mac emulator for the 40th anniversary of the Macintosh in 2024. ;-)
It seems like a multiplicative trade-off: Apple saves a small number of hours but offloads a support burden onto thousands of developers.
I think you have to be careful about this. Apple benefits from lower costs and having more time to improve the platform; but developer time/focus/creativity is also being taxed by a constant support burden.
Backwards compatibility is not a trivial effort, and can severely constrain the future evolution of a product. Keep in mind you’re asking for a completely backwards compatible embedded device OS. Being willing to make breaking changes is part of why Apple’s software is the quality that it is.
If you want a counter example, Windows is notorious for strange undocumented behaviors and special case handling. These are consequences of Microsofts choice to fully embrace backwards compatibility. This leads to a complicated platform that is continually more and more expensive to maintain, polish, and secure.
That expensive polishing cost is what tips the scales here for Apple. Backward compatibility can get in the way to get the level of polish that they call acceptable.
> If you want a counter example, Windows is notorious for strange undocumented behaviors and special case handling. These are consequences of Microsofts choice to fully embrace backwards compatibility. This leads to a complicated platform that is continually more and more expensive to maintain, polish, and secure.
Yes, and macOS (and iOS) a POSIX operating systems that maintains backward compatibility with something from the 80s. In that regards Windows is much more modern.
I'm sorry this developer spent a couple hours hitting "build" until their app started working. If they'd done it earlier it would have been far less painful. Their sacrifice improves the community.
I say this as an iOS engineer since like 2012 and a macOS developer since ... 2004?
Carbon [1] should never be allowed to happen again. If you really want an old system, you should be allowed to virtualize it, but the world must move forward.
Going back to the original post, I find it ridiculous that Apple regularly ships breaking changes (to their APIs) and developers just put up with it. In my minds, it's like being in an abusive relationship where you think if you try a little harder and stay up to date with the latest API version maybe Apple will treat you better (they won't). Apple can get away with it because they own the whole iOS/macOS tower top-to-bottom, but if you want to build trust with your users breaking changes should be the absolute last choice.
Last time I checked, because MS worships at the alter of backwards compatibility, there are nine ways to represent a string in Windows in C and you constantly have to convert between them depending on which API you’re calling.
Every piece of code in your operating system is another vector for security vulnerabilities and something else to maintain and in Apple’s case port to a new processor. How slow has Microsoft been entering new markets because of the albatross of legacy code?
Apple can’t make these things compatible, nor should they try.
That's generally a good practice as buffer overflows and all kinds of entropy accumulates on an OS.
Oh, I like of course innovation but if we talk about mobile stuff, so something tied by choice to hw, their real update rates behind security related patches, should be very calm.
Anything must evolve to be alive, but also anything must NOT be stressed to change just some crap to prove that something have changed. That's not evolution.
Beside that, I fail to see any tangible improvement in ALL modern software to a point that I almost quit using mobile crapware of any vendor and kind, for real. I can't avoid it completely, unfortunately, but that's is.
This is squarely the fault of developers abusing the users trust.
The linked article already answered this:
For instance, the App Store could factor in:
- App Store ratings and reviews
- Active developer membership
- Historical behavior of the developer (ie. updating other apps)
- Number of crashes
- Number of active sessions, especially for the latest devices and platform versions
These are all metrics that the Apple already automatically tracksFirst they deprecate APIs and then remove support entirely. She said herself that she had to make changes to update her code to the latest SDK.
You think App Store ratings and reviews are accurate?
They're incredibly easy to fake and buy. Scam artists are doing it all the time.
A whole variety of scripts that used constants without quoting (`CONSTANT_NAME`), which later became a problem because the language mandated them in quotes (`'CONSTANT_NAME'`). We were finding those in various places literally months later.
mysql_ family of functions was gone from PHP, so we had to patch files to include a "polyfill" snippet to translate those calls to mysqli_
MySQL (/MariaDB) itself was another idiot-fest because of the way it handles Unicode. This is a slightly too long story and would risk doxxing myself, so I will simply give you some highlights, and then ask you to imagine that everything that could go wrong, did go wrong:
1. MySQL storage engines have a fixed upper limit on how long an index can be for each row. For 4-byte UTF-8, that is an upper limit of 768 characters.
2. MySQL defaults to utf8mb3 rather than utf8mb4.
3. Unicode characters in column names are rarely a good idea.
Apache, surprisingly, went relatively fine. I really don't like the ancient way it does things, but it's serviceable if you're fine with banging your head against the wall to do something that seems like it would obviously work.
Related: open source devs fret if a library hasn't been updated in the last month, even if it is feature complete with no bugs.
I personally support every version of my projects.
My goal is not to minimize the effort to myself but to facilitate the use of my software.
If, however, I saw a statement at the top of the README that said:
"Update as of 2 months ago: We believe this project to be complete. We are not adding new features at this time, but if you see any issues, please open a ticket, as this project is still under active development as needed"
then I would feel very confident.
Whether or not it's good to have a moving ecosystem is another story, but I request we not use the term "bit rot" when we mean "vendors breaking compatibility."
The thing is, even if the lib is "feature complete", it's pretty rare to not have to update anything, since the ecosystem in which this lib evolves will undoubtely have changed. Programming language, hardware, OS, etc. everything evolves all the time.
I think what you are saying is simply FUD when taken as a blanket statement.
But thanks for trying anyways.
Anyone can cherry-pick examples to try to disprove a security principle. A pure, functional math library isn't representative of the vast, vast majority of libraries that are imported every day.
The most-used libraries across languages are for things like database access, logging, package management, HTTP, and (de)serialization. All of those things need to be kept updated for security.
> Can someone explain why is it insecure and what updates are needed to complex algos to make them so? When looking at the code it is pure computation.
You didn't specify the language or library.
Most libraries that people import are going to be JS, just because of the number of JS users and the minimal standard library in that language. Many are also going to operate on user input, which means they can have vulnerabilities.
The mathjs package in NPM, for example, has had tons of vulnerabilities[1].
NPM system is security abomination I agree. But I am not using it. I look at things from my own perspective. If 90% of the world programmers are bound to NPM ecosystem (doubt it) it is their problem. Not mine. I do not "import" half of the Internet for my "hello worlds".
Maybe some other way like "Hey, we're still here just the thing we're working on doesn't need an update" would suffice for most things.
Thing is, even if there are no known bugs, having rare updates means if I do find a new bug it’s less likely to get addressed quickly.
If you look at the Nintendo DS/3DS (for example), the platform had many hardware revisions (about every other year) and dozens of firmware revisions, yet games from 2004 still worked on a brand new 3DS in 2020.
On the Sony side, PS4 games from 2013 still work fine on a PS5 in 2022 (and probably through 2029.)
Steam has tons of old games that work great on Windows (but the Mac side took a major hit with macOS Catalina's 32-bit apocalypse.)
In my experience old games often work better in proton/wine than in Win 11.
My understanding is that the Steam Runtime also provides a stable base, that (or something close to it) unfortunately wasn't adopted in other ecosystems. Flatpak is great, but not used widely used for binaries yet.
They were dropping support for older versions of PHP despite getting nothing from it and using none of the newer features. Just needlessly limiting the audience, and churn for churns sake.
e.g. say a bug comes up in the library, and say that it only affects older versions of PHP. Why can't the project just shrug its shoulders and be truthful that it doesn't have interest in maintenance/support against those old versions? It's better that the project declares this intention now, before the bug comes up, then later having to part ways with the old versions more abruptly.
This is why OSS is great, as you can decide if, at the time said bug is found, that you want to provide legacy support for older PHP versions, maybe through a fork or other means. Have at it, it's your software too.
Removing support for old versions is a simplification of what needs to be considered. It is a reduction of complexity. If someone is running a PHP version that has been EOLed, it is perfectly reasonable to discontinue support for it in a library - even if new features that weren't available in the EOL'ed version haven't been added yet.
Its not. Large Linux distributions support those PHP versions for a long time in their LTS releases, and majority of web hosts and infra providers use those distros in their infra.
That some provider is still hosting old EOL'ed and no longer supported versions shouldn't prevent a library author from saying "I'm not going to deal with something that had its last release nearly 4 years ago."
> That some provider is still hosting old EOL'ed and no longer supported versions shouldn't prevent a library author from saying
Yes it should. Its not 'some' provider. Its providerS. A gigantic part of the web lives on such large hosts. AWS and similar ecosystems constitute a small part of the web. This is not saying that the former is low traffic but large in size compared to AWS et al. There is similar traffic and user activity going on in both ecosystems.
You can easily 'deprecate' something and spend millions of dollars man-hours in upgrading your stack as a larger startup which uses AWS. But millions of small businesses, individuals who rely on Open Source software and such hosting providers won't have the money or time to jump through such upgrade hoops 'just because'. It is 'just because' for the simple fact that a lot of such version hops we do in Open Source software development do not bring much to the end users. And they will not appreciate their businesses getting hampered trying to go through upgrade hoops which they have never asked for.
An alternate approach to this is saying 'f*k you' to those people and doing Open Source for the sake of software development itself, without caring about end users. That would also work - but only for those who develop Open Source and who have the time to keep it updated. The general public would just move on from Open Source and start using reliable private service providers that don't break their businesses every other year.
Is it worth it for a library maintainer to remove support for 5.x even if they don't replace it with code that makes use of 7.x functionality?
If a site is still running 5.x (stats put it at about 20% of the sites out there are still running these versions https://w3techs.com/technologies/details/pl-php/5 ), are they going to be updating to the latest versions of libraries?
Note that the FOSS approach to "but it doesn't support the old version that I'm running" has been "don't upgrade or fork it and maintain it yourself." It's the flip side of https://boyter.org/posts/the-three-f-s-of-open-source/ ( https://news.ycombinator.com/item?id=32591265 ).
I'm experiencing this myself with Spring Framework 6 targeting Java 17 as a minimum version even though Java 8 LTS continues through at least 2030.
Based on the usage of the version and the support for it in large hosting/infra providers.
> Is it worth it for a library maintainer to remove support for 5.x even if they don't replace it with code that makes use of 7.x functionality?
Breaking backwards compatibility is practically always bad. You do it once. You do it twice. By the third time it does not matter because a large part of your users would have moved on to some other stack by the second time.
> If a site is still running 5.x (stats put it at about 20% of the sites out there are still running these versions https://w3techs.com/technologies/details/pl-php/5 ), are they going to be updating to the latest versions of libraries?
These must be seen as ecosystems. The ecosystem would slowly move to a higher version over the span of 2-3 years starting from the point when a version starts nearing its EOL. And the users upgrade slowly on their end.
> https://boyter.org/posts/the-three-f-s-of-open-source/
Using the same language in the article: The users would say one single F word to such a project, without the project maintainers ever hearing about it, and silently move on to some project that is not so self-indulgent and so irreverent towards its users. Nobody has the time to jump through hoops to keep their business running on Open SOurce, less suffer such arrogant sh*t.
Such an attidude is only workable if the project is a hobby one, does not aim to gather ANY kind of community/userbase, does not aim to do any impact.
> I'm experiencing this myself with Spring Framework 6 targeting Java 17 as a minimum version even though Java 8 LTS continues through at least 2030.
I would recommend that you prioritize your users and backwards compatibility in that order. The moment your users start trusting your project that it will not break their software, they will start upgrading easily and adoption and retention will get boosted.
JSON API spec's 'only add, never deprecate' approach is the holy grail to chase:
> New versions of JSON:API will always be backwards compatible using a never remove, only add strategy. Additions can be proposed in our discussion forum.
I suppose for simple libraries this might be possible (e.g. left-pad) but how would you know in general that something is bug-free? `units` was introduced in 1979 and is still one of the canonical examples used in automated program repair research to show that new bugs can be found even in extremely well-studied codebases.
I think people might be:
1. Implicitly assuming that all nontrivial code has bugs, and 2. Using recent commits as a signal that means, "If I ran into a bug, there is someone who might fix it (or at least accept a fix PR) to take away my immediate pain.
Our knowledge, our abilities, our raw materials continuously improve, and everything is expected to advantage of this. Things that don't improve, are soon outdated and fall behind.
Everything continuously improves: cars, bicycles, windows, houses, refridgerators, tv, etc, etc.
We reached the peak of software usability a long time ago, probably around the turn of the century. Now it's all about trendchasing, change for the sake of change, dark patterns to squeeze the $$$ out of you, etc.
Last 2 years, the thing i miss most about working in the office, is the ability to collaborate with co-workers in front of a huge whiteboard. The brainstorming, ideation. Miro is nice, but it deserves a huge screen, it needs more interaction with your co-workers, and it needs to help you take your drawings into real value (running software, designs that can be fed into 3d printers, cnc machines, etc).
This is how the Gods do programming :)
coreutils ls: https://git.savannah.gnu.org/cgit/coreutils.git/log/src/ls.c
freebsd ls: https://github.com/freebsd/freebsd-src/commits/927f8d8bbbed7...
busybox ls: https://git.busybox.net/busybox/log/coreutils/ls.c
openbsd ls: https://github.com/openbsd/src/commits/master/bin/ls/ls.c
The latter seems to be the most stable, yet has been updated two years ago, many years after its first introduction.
Security concerns are very clustered around limited attack surface, that many apps just don't have.