Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Never update anything

blog.kronis.dev

Post reply on HN
Print view View original

251–260 of 288 posts

Re: Never update anything

#251

Post by krapp »

kaba0 wrote: post #249
forgotmypw17 wrote: post #32

I literally never update anything unless it is not working. Quite happy here with Firefox 66.x on Ubuntu LXDE 14.x, which is what happened to come with this particular device. I have an iPad running iOS 8.x, which I'm also happy with, especially when I do testing on the clusterfucks that are later iOS and Firefox releases. Browsing a handful of reputable text-based websites from behind a NAT, I don't see the problem.…

Jesus, you are technically illiterate if you use that old version of a web browser, I’m sorry.

This is Hacker News - someone here is probably reading this on a PDP-11.

Re: Never update anything

#252

Post by kaba0 »

krapp wrote: post #251
kaba0 wrote: post #249

Earlier quoted context omitted.

Jesus, you are technically illiterate if you use that old version of a web browser, I’m sorry.

This is Hacker News - someone here is probably reading this on a PDP-11.

The thing is, it’s not that old to be so obsolete to not be a pile of vulnerabilities/lack of advanced feature that actually provide an attack surface, but it is old enough that one should simply not run it.

I have nothing against running lynx where you don’t even have js support.

Re: Never update anything

#253

Post by grey-area »

empthought wrote: post #240
grey-area wrote: post #141

Earlier quoted context omitted.

Yes it’s a terrible example directly contradicted by the graph he gives above of everyone stuck on Java 8. Go, after 10 years, is still on version 1 and likely to remain so and takes this problem of breaking updates really seriously.

Pretty sure that decision is based on the standard library size and package repository culture, not language updates.

IMO the Go libraries are less extensive but more focussed than Java and the Stalin covers most of the bases for web apps very well.

Re: Never update anything

#254

Post by forgotmypw17 »

kaba0 wrote: post #249
forgotmypw17 wrote: post #32

I literally never update anything unless it is not working. Quite happy here with Firefox 66.x on Ubuntu LXDE 14.x, which is what happened to come with this particular device. I have an iPad running iOS 8.x, which I'm also happy with, especially when I do testing on the clusterfucks that are later iOS and Firefox releases. Browsing a handful of reputable text-based websites from behind a NAT, I don't see the problem.…

Jesus, you are technically illiterate if you use that old version of a web browser, I’m sorry.

Do you have any actual arguments to back up your opinion?

Re: Never update anything

#255

Post by Jenda_ »

forgotmypw17 wrote: post #32

I literally never update anything unless it is not working. Quite happy here with Firefox 66.x on Ubuntu LXDE 14.x, which is what happened to come with this particular device. I have an iPad running iOS 8.x, which I'm also happy with, especially when I do testing on the clusterfucks that are later iOS and Firefox releases. Browsing a handful of reputable text-based websites from behind a NAT, I don't see the problem.…

How do you make sure these are the reputable websites and not some interceptor, when using plaintext protocol?

Re: Never update anything

#256

Post by TheAceOfHearts »

xcambar wrote: post #230
kabes wrote: post #158

Earlier quoted context omitted.

If you can't get reproducible builds the team doesn't know how to use lock files properly. Don't go blaming it on the stack.

What's your workflow with lock files? Do you force them in CI/prod only or also in dev? I'm tempted to enforce lockfiles at every stage of the product cycle, making upgrades an explicit action, rather than the side-effect/byproduct of another action. Does it make sense? What do you think?

Lockfiles get commited to the repo and used everywhere to avoid version differences. Upgrade dependencies as needed and have everyone reinstall when they change.

I'm amazed anyone wouldn't do this, it's the only sensible course of action.

Re: Never update anything

#257

Post by kaba0 »

forgotmypw17 wrote: post #254
kaba0 wrote: post #249

Earlier quoted context omitted.

Jesus, you are technically illiterate if you use that old version of a web browser, I’m sorry.

Do you have any actual arguments to back up your opinion?

Copying my previous answer to a similarly bad idea:

“ Browsers run untrusted code 0-24, which get JIT compiled to machine code through a very complex and bug-prone process. Add to that that desktop OSs are quite lacking when it comes to sandboxes, so even with browser sandboxes, the potential for serious damage is quire big. So, staying ahead of bugs is a must.”

Re: Never update anything

#258

Post by lucumo »

gonzo41 wrote: post #225
lucumo wrote: post #224

Earlier quoted context omitted.

> I see both codebases in Java 6 and maven poms that are a paradise to change (and a java 8 upgrade is often trivial and sufficient to get most of the nice candies you really need) Using Java 6 is major red flag. Even Java 8 should be red flag nowadays, if it weren't so extremely common. Both versions no longer receive any security updates or bug fixes. If an organisation doesn't care to put a system on a platform wi…

Java 8, if you use corretto, is supported until 2026. It's totally fine to use and support. And java being java and jumping to 11 won't be that bumpy either.

> Java 8, if you use corretto, is supported until 2026.

Interesting, I was not aware of this. I've not seen people use Corretto either, but it seems OpenJDK has a separate project just to maintain Java 8. So that's indeed still fine to use.

> And java being java and jumping to 11 won't be that bumpy either.

The update from 8 to 9 was rather painful in the beginning, mostly due to libraries not working well with the module system. I'm not sure how it is nowadays, it could have gotten better.

9→10→11→12→13→14→15→16→17 were very painless. I don't foresee a lot of companies getting stuck on those, though it's too early to tell.

Re: Never update anything

#259

Post by xcambar »

TheAceOfHearts wrote: post #256
xcambar wrote: post #230

Earlier quoted context omitted.

What's your workflow with lock files? Do you force them in CI/prod only or also in dev? I'm tempted to enforce lockfiles at every stage of the product cycle, making upgrades an explicit action, rather than the side-effect/byproduct of another action. Does it make sense? What do you think?

Lockfiles get commited to the repo and used everywhere to avoid version differences. Upgrade dependencies as needed and have everyone reinstall when they change. I'm amazed anyone wouldn't do this, it's the only sensible course of action.

Some things go without saying, yet go better with saying.

Re: Never update anything

#260

Post by dimaor »

TranquilMarmot wrote: post #147
abraxas wrote: post #98

"When your company won't be the first to market, because about 20% of your total development capacity needs to spent on keeping up" In the world of JS and Typescript this ratio looks more like 80%. I swear that node hipsters at my last job spent four out of five of their working days wrangling with dependencies or their transpilers, linters, packagers, bundlers and whatever the hell else needs to happen to actually m…

As a full stack dev who leans heavily towards the frontend... yes, honestly, some weeks 80% is a realistic number and WOW is it exhausting to fix Webpack or Babel or some random npm package for the nth time. I do feel like I run into issues less often today than I did about five years ago, there are really only a few packages where upgrades are a massive pain. TypeScript makes these upgrades a lot easier. That being…

_have way more having fun writing.._ - pretty much seems to be the culprit here.
Post reply on HN