Hacker News Reader

Comment by Gigachad | Hacker News Reader

Depends on the end consumers stance on security. I've watched it shift from "Only update if we can prove we are impacted" to "Update everything immediately just in case".

The frequency and severity of cyber attacks has increased to the point a much more cautious approach has become common. It's also easier to sell this work to management when you can point at the security tab on some tool and say "Look we need to patch these CVEs"

View on HN

"Update everything immediately just in case" is a lot less attractive when you see more downtime from updates breaking things than you do from hackers. Windows updates are an endless source of pain, but now every program seems to demand to be updated practically daily. Even things that you shouldn't have to think about like keyboards, mice, and printers beg to be updated all the time.

Downtime is annoying but workable. You can't unleak customer data after your system gets hacked.

There is no reason, why a newer version has less bugs, than an older version. Both are essentially an unknown number. The only thing you know, is that you likely know a higher percentage of bugs for the older than for the newer version.

It certainly has less known bugs. And when you have to make a statement to the media, “we were hacked by an undiscovered 0 day exploit” sounds a lot better than “we were hacked by a known exploit because we didn’t update”

If you do know about it, you can also just mitigate that.

I do this this is theoretical, especially with recent spread ups.

> It certainly has less known bugs.

This isn't necessarily true, and will be less true in the coming age of LLM-automated vulnerability scanning. The version that you're downloading (after being nagged for a day) that adds Feature A may contain 3 vulnerabilities that are already known before you even download the update, and may or may not fix old vulnerabilities.

That’s empirically false

It’s an idea that can be checked, empirically, and it has been.

There are studies of patch releases that show patch releases introduce new bugs _only_ 15-25% of the time.

Which is not a small failure rate, sure, but that still means that a priori you are much more likely to become less vulnerable by blindly installing patches than by blindly not installing patches.

Yeah, the fact that security forces you to update has been used with great effect by product managers and feature engineers to shove their changes down everyone's throat and quickly drop support for previous versions. Neat for them.

> I've watched it shift from "Only update if we can prove we are impacted" to "Update everything immediately just in case".

> [...] a much more cautious approach has become common.

I'd argue that this is a less cautious approach, not more. It takes time to carefully evaluate, review, and test each change.

Reply on news.ycombinator.com