Never Update Anything • Hacker News Board

Re: Never Update Anything

#81

Post by ploxiln » Sat, Jul 20, 2024, 1:04 AM UTC

louwrentius wrote: post #62

KronisLV wrote: post #10

Oh hey, I was wondering why the VPS suddenly had over 100 load average, restarted Docker since the containers were struggling, now I know why (should be back now for a bit). Won't necessarily fix it, might need to migrate over to something else for the blog, with a proper cache, alongside actually writing better articles in the future. I don't think the article itself holds up that well, it's just that updates are of…

For contrast, I recently had a no 1. HN hit and my Pi4 never had a core beyond 20% Yes, it’s a static website. It’s amazing how little performance you actually need to survive a HN avalanche

It's amazing how powerful hardware is in the past decade, and how masterly crafted and efficient some software is (linux, nginx, etc) ... while other software is so profoundly inefficient, that we forget.

Re: Never Update Anything

#82

Post by type0 » Sat, Jul 20, 2024, 1:05 AM UTC

augusto-moura wrote: post #76

KronisLV wrote: post #19

Earlier quoted context omitted.

I am very much tempted not to because it works under lower loads, could just put it on a faster server, but how could I pass up the chance to write my own CMS (well, a better one than the previous ones I've done)? That's like a rite of passage. But yes, the irony isn't lost on me, I just had to go for that title.

If you are using open source you can always support your own old versions ~joking but not really~ Of course security updates are very hard, but if an old version has some good community you have the option of forking or upstreaming the updates yourself

> ~joking but not really~

For some languages and applications it can be trivial to backport the changes then trying to keep up with the new features. If it's tested and stable it will likely be more stable than a new version, I do this for some smaller programs and I'm not even a real programmer but more of a hobbyist

Re: Never Update Anything

#83

Post by tonymet » Sat, Jul 20, 2024, 1:11 AM UTC

our industry could use a risk assessment index scanner on updates, similar to "npm audit" , that measures the delta between versions and gives a risk indicator based on a number of parameters.

The issue with changelogs is that they are an honor system, and they don't objectively assess the risk of the update.

Comparing changes in the symbol table and binary size could give a reasonable red/yellow/green indicator of the risk of an update. Over time, you could train a classifier to give even more granularity and confidence.

Re: Never Update Anything

#84

Post by palata » Sat, Jul 20, 2024, 1:14 AM UTC

What the article points to is that most updates are bad updates. We teach people that they should accept all updates for security reasons, but really they should only accept security updates.

But they can't, because this is not a possibility that is given to them. All updates are put together, and we as an industry suck at even knowing if our change is backward compatible or not (which is actually some kind of incompetence).

And of course it's hard, because users are not competent enough to distinguish good software from bad software, so they follow what the marketing tells them. Meaning that even if you made good software with fewer shiny features but actual stability, users would go for the worse software of the competitor, because it has the latest damn AI buzzword.

Sometimes I feel like software is pretty much doomed: it won't get any better. But one thing I try to teach people is this: do not add software to things that work, EVER. You don't want a connected fridge, a connected light bulb or a connected vacuum-cleaner-camera-robot. You don't need it; it's completely superfluous.

Also for things that actually matter, many times you don't want them either. Electronic voting is an example I have in my mind: it's much easier to hack a computer from anywhere in the world than to hack millions of pieces of paper.

Re: Never Update Anything

#85

Post by acdha » Sat, Jul 20, 2024, 1:23 AM UTC

palata wrote: post #78

SoftTalker wrote: post #8

"In my eyes it could be pretty nice to have a framework version that's supported for 10-20 years and is so stable that it can be used with little to no changes for the entire expected lifetime of a system." This is what applications used to be like, before the web and internet hit and regular or even push updating became easy. It was simply so difficult and expensive to provide updates once the software was in the cu…

> For the most part, you bought software, installed it, and used it. That was it. It never changed, unless you bought it again in a newer version And it was much better than the current situation, if you ask me.

That software did a lot less, however, and you just had to live with bugs. I knew people who just learned that they couldn’t use a feature without crashing, or had to disconnect from the internet to print, had to write their own math formula because a built in function was wrong, etc. and just worked around it for years.

The first company I worked for in the 90s had a C codebase which seemed like it was half #ifdef or runtime version checks because they had to support customers who rarely updated except when they bought new servers, and that meant that if some version of SunOS, DOS/Windows/etc. had a bug you had to detect and either use a work around or disable a feature for years after the patch had shipped.

I do agree that stability, especially on the UI side, has serious value but my nostalgia is tempered by remembering how many people spent time recovering lost work or working around gaps in software which had been fixed years ago. I think the automatic update world is better on the whole but we need some corrective pressure like liability for vendors to keep people from pulling a Crowdstrike in their testing and reliability engineering.

Re: Never Update Anything

#86

Post by teeray » Sat, Jul 20, 2024, 1:33 AM UTC

hypercube33 wrote: post #41

SoftTalker wrote: post #8

"In my eyes it could be pretty nice to have a framework version that's supported for 10-20 years and is so stable that it can be used with little to no changes for the entire expected lifetime of a system." This is what applications used to be like, before the web and internet hit and regular or even push updating became easy. It was simply so difficult and expensive to provide updates once the software was in the cu…

I remember even games, or especially games were like this. Interplay would rarely have a post launch patch or make it past 1.01 versions of a whole game. then in the late 90s or 2000ish Tribes 2 came out and basically didn't even work for over a year until patches finished the game. I think once Internet hit critical mass things shifted forever and haven't gone back.

Also, the bugs became part of the game and make the whole thing more interesting. Speedrunning as a whole relies on these flaws.

Re: Never Update Anything

#87

Post by brirec » Sat, Jul 20, 2024, 1:39 AM UTC

hipadev23 wrote: post #68

stavros wrote: post #46

Earlier quoted context omitted.

If you have to write your own CMS, make it compile to static files. I did that with Django, used Django-distill, and it's hands down the best static site generator I've ever used. My site never needs updates and never goes down under any amount of load.

“static files” are nothing more than no-TTL caching strategy with manual eviction.

You’re not wrong… but “static files” ultimately are infinitely less complex than any dynamic CMS, and require no effort or brain power to migrate between (even bottom-of-the-barrel) providers

Re: Never Update Anything

#88

Post by o11c » Sat, Jul 20, 2024, 1:47 AM UTC

palata wrote: post #84

What the article points to is that most updates are bad updates. We teach people that they should accept all updates for security reasons, but really they should only accept security updates. But they can't, because this is not a possibility that is given to them. All updates are put together, and we as an industry suck at even knowing if our change is backward compatible or not (which is actually some kind of incomp…

I also noticed that there's another kind of update not mentioned:

* Updates that add a theoretically independent feature, but which other software will dynamically detect and change their behavior for, so that it's not actually independent.

Re: Never Update Anything

#89

Post by k_roy » Sat, Jul 20, 2024, 1:58 AM UTC

> In my eyes it could be pretty nice to have a framework version that's supported for 10-20 years and is so stable that it can be used with little to no changes for the entire expected lifetime of a system.

Yeah, me too. I also would like a few million bucks in the bank.

It's naive to think that every project wouldn't want to set this goal, simply because it's so unrealistic.

Re: Never Update Anything

#90

Post by walterbell » Sat, Jul 20, 2024, 2:15 AM UTC

> And lastly, choose boring technology. Only use software that you're sure will be supported in 10 years. Only use software, which has very few "unknown unknowns". Only use software, where the development pace has slowed down to a reasonable degree.

Perl has been stable for a couple of decades.