Hacker News Reader

Comment by antonvs | Hacker News Reader

Mature professionals and organizations have always waited to install updated dependencies in production, with exceptions for severe security issues such as zero day attacks.

"Free riding" is not the right term here. It's more a case of being the angels in the saying "fools rush in where angels fear to tread".

If the industry as a whole were mature (in the sense of responsibility, not age), upgrades would be tested in offline environments and rolled out once they pass that process.

Of course, not everyone has the resources for that, so there's always going to be some "free riding" in that sense.

That dilutes the term, though. Different organizations have different tolerance for risk, different requirements for running the latest stuff, different resources. There's always going to be asymmetry there. This isn't free riding.

View on HN

I think the appeal to the categorical imperative is very interesting though. Someone needs to try it. If everyone were wise as you term it, then it's essentially a stalemate while you wait for someone else to blink first and update.

Then again, there are other areas where I feel that Kantian ethics also fail on collective action problems. The use of index funds for example can be argued against on the same line as we argue against waiting to update. (That is, if literally everyone uses index funds then price discovery stops working.) I wonder if this argument fails because it ignores that there are a diversity of preferences. Some organizations might be more risk averse, some less so. Maybe that's the only observation that needs to be made to defeat the argument.

With that diversity of preferences, some organizations might also be willing and able to do rigorous testing of the updates that are most important to them.

It seems like a helpful efficiency to spread out the testing burden (both deliberate testing and just updating and running into unexpected issues). If everyone updated everything immediately, everyone would be impacted by the same problems at the same time, which seems suboptimal.

> it's essentially a stalemate while you wait for someone else to blink first and update.

I addressed that in my comment, and you essentially repeated that point:

> I wonder if this argument fails because it ignores that there are a diversity of preferences.

The stalemate you described is only an issue if everyone is in the same circumstances and operating under the same criteria, but reality is very far from that situation.

> Frankly, dependency cooldowns work by free-riding on the pain and suffering of others.

I suspect there are some reasonable points to be made here, but frankly, I pretty much stopped reading after that. Way too simple minded.

Reply on news.ycombinator.com