Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Never update anything

blog.kronis.dev

Post reply on HN
Print view View original

241–250 of 288 posts

Re: Never update anything

#241

Post by ByteJockey »

Negitivefrags wrote: post #67
Brian_K_White wrote: post #53

Earlier quoted context omitted.

What I always say about this kind of thing is not "It's ok now because they un-did it." but "It's still not ok because they tried." If they are the kind of people who would try something, then they are still the same people and that problem did not go away. They will try something else again, and may in fact already be failing to work to my advantage right now in ways I just can't see. Once you know that, I prefer to…

So basically you must be 100% perfect all the time and are never allowed to make any mistakes. This is one of the attitudes that makes the internet so toxic IMHO.

There's a big difference between being mad at this particular incident and demanding 100% perfection.

Dealing with a normal mistake isn't a problem because I can just opt out. They removed that ability here.

Re: Never update anything

#243

Post by freeflight »

LogonType10 wrote: post #206
freeflight wrote: post #25

Earlier quoted context omitted.

Auto-updates are an attacker's dream too. Also, this disclaimer in the very first sentence of the article: > "Here's a fair warning: this article is reductio ad absurdum"

> Auto-updates are an attacker's dream too. Why?

The attacker only needs to compromise the update-infrastructure to be able push a malicious updates to everybody who runs the software [0] [1]

[0] https://blog.malwarebytes.com/android/2021/04/pre-installed-...

[1] https://www.businessinsider.com/asus-acknowledges-computers-...

Re: Never update anything

#244

Post by habeebtc »

calmingsolitude wrote: post #169
habeebtc wrote: post #94

Timely. I was recently force upgraded to Win11. Today in fact. Last week I force-downgraded after I got an exception because it is my busy time of year. That exception was not respected and I realized fighting it weekly would be the same time investment as fixing compatibility issues. "What compatibility issues? Win11 is fine, I have had no problems." My coworkers say. Well on Day 1, 2 pretty important pieces of soft…

Might come in useful to others on Win11: To get the snipping tool working, close the snipping tool, manually set the date to around the start of October. Reopen the snipping tool and it should be working. The date can now be set back.

I went to Windows.old, and copied out the all the executables in System32, as well as the locale folder (en-US for me). Pinned snippingtool.exe to start menu, and then uninstalled the W11 snipping tool.

My snipping tool again works, and exactly how I need it to.

Re: Never update anything

#245

Post by CptMauli »

nuerow wrote: post #216
capableweb wrote: post #211

Earlier quoted context omitted.

> With JavaScript/NodeJS + npm you only shoot yourself in the foot that way if you purposely aim at your foot, remove the safety, and press the trigger really hard. Eh, no. You'll get shot no matter what, even if you have no gun. For example, let's imagine you now have your version locked down codebase and after a month you want to install a new package. This one is only compatible with XYZ V1 while what you have is…

> (...) after a month you want to install a new package. What's your point? If you want to update a dependency then you also need to go through all their dependencies. This is not a javascript/npm problem; it's a software development problem. Dependencies don't get magically updated, even with semver. You experience the exact same problem with other tech stacks. I'm fact, I've experienced this problem far more with C…

The point is, that in a moderately complex Java project that might be something on the order of 150-200 dependencies, and updating just one of those usually doesn't lead to a big change in the transitive dependencies (it is a different thing for a major update, Java 8 -> 11, or from the pre jakarta JEE to jakarta), but its possible for a single person to track whats happened. But with 1500+ dependencies, so an order of magnitude bigger, its just not possible.

Re: Never update anything

#246

Post by CptMauli »

lucumo wrote: post #223
capableweb wrote: post #211

Earlier quoted context omitted.

> With JavaScript/NodeJS + npm you only shoot yourself in the foot that way if you purposely aim at your foot, remove the safety, and press the trigger really hard. Eh, no. You'll get shot no matter what, even if you have no gun. For example, let's imagine you now have your version locked down codebase and after a month you want to install a new package. This one is only compatible with XYZ V1 while what you have is…

This is a far bigger problem in the Java world. Maven will just pick at sort of random (it's deterministic but hard to predict and mostly invisible). On the JS side there's a way deal with that if people use modules. Good dependencies don't clobber the global namespace. Multiple versions can exist side by side. It'll just make your build bigger.

Since the number of dependencies is way less then in the JS world, its possible to pin them down manually.

If you absolutely need to have multiple versions of the same dependency, you probably need to use OSGi.

Re: Never update anything

#247

Post by _piif »

AnIdiotOnTheNet wrote: post #227
calmingsolitude wrote: post #169

Earlier quoted context omitted.

Might come in useful to others on Win11: To get the snipping tool working, close the snipping tool, manually set the date to around the start of October. Reopen the snipping tool and it should be working. The date can now be set back.

The mind boggles at imagining the code that could possibly be responsible for this behavior.

It was actually caused by a digital certificate which expired last month

https://blogs.windows.com/windows-insider/2021/11/04/releasi...

Re: Never update anything

#248

Post by treis »

joombaga wrote: post #82
treis wrote: post #50

Earlier quoted context omitted.

I think the concept of a breaking change is part of the mistake. If you want to change something you should introduce the new way and support it side by side with the old for a while while going through a depreciation cycle. I'm with the GP on this. Pinning to a specific version is a code smell. You should have enough confidence in your regression suite to always use the latest version. And hopefully enough confidenc…

The concept only makes sense in the context of APIs. I don't know if that's obvious; I've seen people use semantic versioning with software that didn't have public interfaces. Even if you go through a deprecation cycle, you're still going to eventually have a build N with feature X, and build N+1 without feature X. That's a breaking change.

That's true in the sense that a bullet flying at you and steam roller running you down both represent mortal threats. But practically a reasonable depreciation cycle isn't going to be a breaking change because everyone will have plenty of time to upgrade.

Re: Never update anything

#249

Post by kaba0 »

forgotmypw17 wrote: post #32

I literally never update anything unless it is not working. Quite happy here with Firefox 66.x on Ubuntu LXDE 14.x, which is what happened to come with this particular device. I have an iPad running iOS 8.x, which I'm also happy with, especially when I do testing on the clusterfucks that are later iOS and Firefox releases. Browsing a handful of reputable text-based websites from behind a NAT, I don't see the problem.…

Jesus, you are technically illiterate if you use that old version of a web browser, I’m sorry.

Re: Never update anything

#250

Post by kaba0 »

xet7 wrote: post #217
k__ wrote: post #72

Android: We update your system until it's too slow to use. Also, Android: One day we will stop giving you updates, so your apps can't talk to new versions of online services anymore.

Android, iOS, macOS, Windows: Newest version only works on newest hardware. Old hardware not supported anymore. So, for old hardware: - Install Linux to desktop/laptop computers - Install Ubuntu Touch to smartphone, if available

I am anything but an apple fan, but newest ios and mac do work on even 5-10 years old hardware as well.
Post reply on HN