Hacker News Reader

> If the customers had been handed the software on day 1, by day 100 it would be full of security bugs, would need to be re-written for the new version of Node.js (the old one having been deprecated and also full of security bugs).

We don't have to make everything a javascript app running on the open internet. Though even an insecure node server could be perfectly fine if deployed on the corpnet behind a VPN...

Thats a very spicy threat model post the age of IoT.

Any stray device you may not even be aware of can rip that assurance apart.

A fully locked down network can in theory enable this however, very few enterprises actually are strict enough for this to be enforced across the whole network.

You obviously have full trust of Google and Microsoft accounts. You should take a visit or research of dark web. So many never ever get reported to haveibeenpwned.com. And if you are lucky to know some white hacks, they will be laughing at the idea of subscription software more secure. I worked in these kind of industry. Sometime we just swapped out libraries with zero bug fixes or even introduced obvious faults to justify updates. And many time we purposely blocked updates so can justify "upgrades", which is like subscriptions on top of subscriptions with maybe some kind of microtransactions disguised as optional addons. They are full of security exploits. We hope they are discovered to allow another round of updates and upgrades.

> day 100 it would be full of security bugs, would need to be re-written for the new version of Node.js

I do not believe this is the case at all. If I'm running software locally that works on local files that I control then there is no security issue. Even if there are bugs that can be exploited, they won't be exploited because I'm in control of the data.

This whole mess is a non-issue and is only there as an excuse to push this horrible web SaaS subscription nonsense that we have. It's nothing but a stupid excuse to justify daily software updates so that companies and inject ads and remove features to push subscriptions.

Even shrinkwrapped software is subscription-based. It's just whether the subscription is monthly or every 5 years.

> This argument is unfortunately flawed. If the customers had been handed the software on day 1, by day 100 it would be full of security bugs

Stop. This doesn't have to be true...

> Oh and they'd have to maintain mobile apps on Android and iOS as those platforms change and break things. They might need to buy cyber risk insurance too.

This worked just fine, also, until Apple decided to have meetings with devs of popular software to push for subscriptions. Not we have the current state of bullshit.