Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Never update anything

blog.kronis.dev

Post reply on HN
Print view View original

71–80 of 288 posts

Re: Never update anything

#71

Post by codestasis »

theptip wrote: post #23

There’s something to be said for being on the oldest minor version that still receives patch releases (usually the LTS if there is such a thing). Unfortunately most FOSS libraries don’t have the luxury/resources to support parallel releases. So to get security fixes you need to keep somewhat up to date with other changes. The worst place to be is having to fix a CVE in a hurry, but first having to upgrade your framew…

I lived and suffered this tension between stability and security for years running a tech team. Staying on the upgrade treadmill while delivering actually important product features for the business. Hopping from LTS to LTS is a solid default strategy when you can use it.

So pardon the plug, but finding a happy middle-ground to exactly this problem for Django based projects is what I now work on with https://www.codestasis.com/

Projects that can't upgrade, because of the ensuing cascade of breaking changes and dev time needed, subscribe to CodeStasis to minimally update Django to new non-breaking patch versions.

So you can keep your trusty old version yet also stay patched and secure if you find someone to do the heavy lifting for you at reasonable cost, which I think we deliver.

Re: Never update anything

#72

Post by k__ »

Android: We update your system until it's too slow to use.

Also, Android: One day we will stop giving you updates, so your apps can't talk to new versions of online services anymore.

Re: Never update anything

#73

Post by Waterluvian »

mikeklaas wrote: post #65
Waterluvian wrote: post #13

AWS: “Postgres 9.6 is old. On January 22 we will forcibly update your instances to 12. We hope you noticed this alert. We certainly didn’t email you about this. You’d better get off your ass and test/fix your clients for any potential issues.”

whoa, do you have a link?

https://imgur.com/dCxh2Dd (sorry. Looks terrible on phones)

https://forums.aws.amazon.com/ann.jspa?annID=8499

So obviously I was embellishing the language, but the sentiment remains the same. I found this because I checked the RDS admin panel, which I rarely do. I didn't get an email. It was very alarming to discover and makes me anxious about what other forced upgrades I'll miss.

I appreciate the point of this, but I think forcing upgrades is absolutely the wrong way to do it. Scream at me all you want, but don't force my stack to mutate and potentially break services.

Re: Never update anything

#75

Post by sokoloff »

shimonabi wrote: post #39

I upgraded my Ubuntu distribution last week and my old Xerox Phaser laser printer stopped working over the network. Something like this should never happen. I hate spending my weekends troubleshooting the Samba configuration. Maybe I will connect the printer to a Windows VM.

I have had much better luck exposing printers over smb from Linux than from Windows. My in-laws were visiting and couldn’t print to our network printers directly from Windows, so I had to add them to CUPS and smb, which was painless.

Re: Never update anything

#76

Post by nijave »

k__ wrote: post #72

Android: We update your system until it's too slow to use. Also, Android: One day we will stop giving you updates, so your apps can't talk to new versions of online services anymore.

The second is not so much a problem with Android but the horrible intersection for OEMs with no reason to support old devices, Linux baking drivers into the kernel, and hardware manufacturers releasing closed source blobs instead of OSS drivers.

Newer versions of Android have done a lot to decouple the device tree from the rest of the OS so you can update without OEM involvement.

Google also moved a lot of functionality into Google Play Services that updates over the air (but that's a negative for some people)

Re: Never update anything

#77

Post by ArclightMat »

romero-jk wrote: post #49
dsr_ wrote: post #46

Earlier quoted context omitted.

Sure, or if you prefer: the price of Debian Stable is that you only get security updates and bug fixes until the next Stable release. It's wonderful.

Except for chromium.

Chromium's a hard one for Debian. It is a big software that often suffers from security issues due to its size but it is hard to package according to Debian's policies. Its upstream ships with forked dependencies included, and this goes against Debian's policy, however Debian doesn't have enough manpower to untangle this mess while keeping up with Chromium's upstream.

I wish they would just drop it from their repos and suggest users to use flatpaks (or Nix?) or the proprietary variant Chrome (which is what most likely want due to sync), it is a big liability to keep an insecure browser around.

Re: Never update anything

#78

Post by sokoloff »

nameisname wrote: post #20
SkeuomorphicBee wrote: post #15

Earlier quoted context omitted.

You don't need semantic versioning for that. "Oh, this was introduced in build 22456" works just as well.

Except that using a build number in the way you're describing is just a worse semantic version. You now have no way to indicate if your changes are breaking. Separation of your pipelines also just got a lot more hectic because you could have a situation where you don't know what happened when you're missing "versions" (builds) because it's failing but still incrementing... Using build numbers for versioning doesn't r…

> You now have no way to indicate if your changes are breaking.

You now have no way to indicate that you know your changes are breaking.

Re: Never update anything

#79

Post by nijave »

dudeman13 wrote: post #69
TeMPOraL wrote: post #58

Earlier quoted context omitted.

Conversely, not updating until you can't not update anymore is often the optimal approach, because when you're eventually forced to update, you deal with potential breakage just once . The amount of hassle around updating does not scale with the amount of updates you missed.

You deal with it just once, but you'll still have to more or less deal with every major breaks that would have been easily detected if the patch wasn't huge. Sauce: had to deal with that recently. It was not pleasant. I'd rather deal with 50 points of failure spread over 5 years than 50 points of failure once. Far less stressful, far easier to diagnose.

The counter point is, new releases come with new bugs you may now hit and waiting could mean someone else hits them

Besides your points, it also sucks if you hit an old bug that's been fixed yyy versions down the line and you can't get there reasonably

(I tend to agree with many small chunks than a couple huge ones)

Re: Never update anything

#80

Post by encryptluks2 »

catlikesshrimp wrote: post #55
encryptluks2 wrote: post #2

Better yet, if you don't want updated software, then why are you installing it? Just use a versioned Linux distro be done with it.

Because many times security updates are tied to fancy changes nobody asked for but consumers are expecting.

Don't package maintainers for Debian and what not often backport changes without breaking things? I agree that the mental complexity of understanding so many components of software and staying relevant is near impossible, and that is specifically why I try to avoid JavaScript development altogether.
Post reply on HN