5 ms·

The problem with your theory is that "peak version" is different for every user of the software.

diggan 7y ago
The solution is that every deployable version of the service should be usable on it's own and users should be able to chose exactly what version they are locked on to. Or they can choose to live on bleeding-edge and always get the latest updates. Wishful thinking maybe
- vbezhenar 7y ago
  It's called long term support. And it's not cheap.
  - flohofwoe 7y ago
    There's a big difference between offering "end-of-life" versions for download, even if they are no longer supported, and forcing users on new versions even if they don't want to (which is fairly common for mobile/web apps and generally subscription-models like Adobe and Autodesk switched to).
    - vbezhenar 7y ago
      That's because the world decided to adopt software as a service model, where your device is just a thin client and real work is happening on a server. And that model is incompatible with letting customers to run old versions.
      - TeMPOraL 7y ago
        I.e. exploitation pure and simple - delivering value to customers is incompatible with company exploiting those customers. This deserves as much pushback as possible, even though it seems like a quixotic effort.
      - Doctor_Fegg 7y ago
        That’s not at all true of the Adobe stuff. The real work in Photoshop or Illustrator still happens on the Mac.
        sah2ed 7y ago
        But it is only a matter of time. Once webassembly achieves near feature parity with the native versions, you bet Adobe will switch users to the webassembly version. From Adobe's perspective, it offers a lot of benefits: - they don't have maintain build farms or pay a CDN to host GBs of binaries of native installers (for different OSes); - users will always be on the latest (read: most secure) version since there is nothing to install or nag the user to check for updates/apply security patches; - browser-dependence implies near-persistent Internet access, making license management/enforcement a whole lot easier; - they can upsell you on cloud storage so that all your assets are available from any web browser.
        sjy 7y ago
        If the user has to download the whole webassembly binary at the beginning of every session, it seems unlikely that Adobe would save money on CDNs.
      - noobermin 7y ago
        Sure if you by "world" you mean bean counters and not users.
- AnIdiotOnTheNet 7y ago
  I think some people around here, most especially the package-manager-uber-alles crowd and the security-for-the-security-god types [0], will be very upset you said this, but I agree. Why shouldn't I use software that works best for me, even if it isn't the latest and greatest version? Why shouldn't I be able to use multiple versions of the same software as though they were different products because they do different things well? As I recall this was expected behavior in the before times, in the long long ago, when internet wasn't yet a thing. [0] Oh, also the web-all-the-things! people.
  - ryandrake 7y ago
    One of my pet peeves is that software always makes you take the good with the bad. You want the latest bug fixes and security updates, but you don’t want the added chat feature and UI redesign #12. But in order to get the former you also have to accept the latter. Companies should do a better job of maintaining old versions so you don’t have to take disruptive changes and feature cram just to patch a security hole.
- bryanlarsen 7y ago
  That was feasible in a world where every computer was air-gapped because there was no such thing as the Internet. Now every app needs to stay up to date for security reasons, even if it doesn't directly use the internet itself.
  - thekyle 7y ago
    What types of security vulnerabilities could apps like LibreOffice or Photoshop have?
    - cldellow 7y ago
      Programs that manipulate binary files are common vectors for attacks. A malformed file can trick even well-written and well-tested parsers into executing code that they shouldn't, or corrupting aspects of the user's environment. For example, cvedetails.com, some random website I found from Googling, lists 13 vulnerabilities for Photoshop and 31 for Libreoffice in the last few years.
    - CydeWeys 7y ago
      There have been plenty of attacks targeting image and document viewers/editors over the years. It's a great vector, because recipients are more likely to open a document than run an executable. Some of the very "best" vulnerabilities of all time have been attacks taking advantage of scripting features in Office.
    - j605 7y ago
      https://www.securityfocus.com/bid/109374 https://www.securityfocus.com/bid/109374 just recently.
  - AnIdiotOnTheNet 7y ago
    Do they really? If you do a cost benefit analysis on using older versions of software that work better for you, including the probability of exploitation of both the new[0] and old versions, you'll find that it very often doesn't work out. Besides which, if you're really concerned about it there are plenty of better ways to mitigate those threats like sandboxing. [0] updates have been known to make software more vulnerable too you know.
- rurp 7y ago
  I agree with you and wish this was far more common. JetBrains is one company that does it well. They let you download previous versions or upgrade to the latest version if you have an active subscription. If your subscription lapses you can still download older versions of the software from the time you had an active subscription. I've done both, kept the latest version or rolled back to previous versions when I didn't like the latest changes. So, it's certainly doable, and I wish more companies offered this.
bschne 7y ago
I'd argue that it diverges not only across different users, but is also variable over time - as other tools, customer expectations, user expectations, paradigms of interfaces and human-computer interactions change, there is some amount of new features and changes which needs to be done not to lose touch. Of course if we could isolate the whole domain the application fits in from external influence there might be a stable optimum feature set, but I don't think that's how it works in practice.
reroute1 7y ago
Is that really a problem? Couldn't you calculate an average across users and us that as the peak measurement instead.
- pwinnski 7y ago
  Yes, it's really a problem. An average fails to be the peak version for anyone, missing some features wanted by some users, and having too many features for other users.
  - reroute1 7y ago
    That's not necessarily true. An average could also be the peak version for many users. And if it is true, I still don't see why it's a problem, the average would still measure the peak state across all users?

The solution is that every deployable version of the service should be usable on it's own and users should be able to chose exactly what version they are locked on to. Or they can choose to live on bleeding-edge and always get the latest updates. Wishful thinking maybe

vbezhenar 7y ago
It's called long term support. And it's not cheap.
- flohofwoe 7y ago
  There's a big difference between offering "end-of-life" versions for download, even if they are no longer supported, and forcing users on new versions even if they don't want to (which is fairly common for mobile/web apps and generally subscription-models like Adobe and Autodesk switched to).
  - vbezhenar 7y ago
    That's because the world decided to adopt software as a service model, where your device is just a thin client and real work is happening on a server. And that model is incompatible with letting customers to run old versions.
    - TeMPOraL 7y ago
      I.e. exploitation pure and simple - delivering value to customers is incompatible with company exploiting those customers. This deserves as much pushback as possible, even though it seems like a quixotic effort.
    - Doctor_Fegg 7y ago
      That’s not at all true of the Adobe stuff. The real work in Photoshop or Illustrator still happens on the Mac.
      - sah2ed 7y ago
        But it is only a matter of time. Once webassembly achieves near feature parity with the native versions, you bet Adobe will switch users to the webassembly version. From Adobe's perspective, it offers a lot of benefits: - they don't have maintain build farms or pay a CDN to host GBs of binaries of native installers (for different OSes); - users will always be on the latest (read: most secure) version since there is nothing to install or nag the user to check for updates/apply security patches; - browser-dependence implies near-persistent Internet access, making license management/enforcement a whole lot easier; - they can upsell you on cloud storage so that all your assets are available from any web browser.
        sjy 7y ago
        If the user has to download the whole webassembly binary at the beginning of every session, it seems unlikely that Adobe would save money on CDNs.
    - noobermin 7y ago
      Sure if you by "world" you mean bean counters and not users.
AnIdiotOnTheNet 7y ago
I think some people around here, most especially the package-manager-uber-alles crowd and the security-for-the-security-god types [0], will be very upset you said this, but I agree. Why shouldn't I use software that works best for me, even if it isn't the latest and greatest version? Why shouldn't I be able to use multiple versions of the same software as though they were different products because they do different things well? As I recall this was expected behavior in the before times, in the long long ago, when internet wasn't yet a thing. [0] Oh, also the web-all-the-things! people.
- ryandrake 7y ago
  One of my pet peeves is that software always makes you take the good with the bad. You want the latest bug fixes and security updates, but you don’t want the added chat feature and UI redesign #12. But in order to get the former you also have to accept the latter. Companies should do a better job of maintaining old versions so you don’t have to take disruptive changes and feature cram just to patch a security hole.
bryanlarsen 7y ago
That was feasible in a world where every computer was air-gapped because there was no such thing as the Internet. Now every app needs to stay up to date for security reasons, even if it doesn't directly use the internet itself.
- thekyle 7y ago
  What types of security vulnerabilities could apps like LibreOffice or Photoshop have?
  - cldellow 7y ago
    Programs that manipulate binary files are common vectors for attacks. A malformed file can trick even well-written and well-tested parsers into executing code that they shouldn't, or corrupting aspects of the user's environment. For example, cvedetails.com, some random website I found from Googling, lists 13 vulnerabilities for Photoshop and 31 for Libreoffice in the last few years.
  - CydeWeys 7y ago
    There have been plenty of attacks targeting image and document viewers/editors over the years. It's a great vector, because recipients are more likely to open a document than run an executable. Some of the very "best" vulnerabilities of all time have been attacks taking advantage of scripting features in Office.
  - j605 7y ago
    https://www.securityfocus.com/bid/109374 https://www.securityfocus.com/bid/109374 just recently.
- AnIdiotOnTheNet 7y ago
  Do they really? If you do a cost benefit analysis on using older versions of software that work better for you, including the probability of exploitation of both the new[0] and old versions, you'll find that it very often doesn't work out. Besides which, if you're really concerned about it there are plenty of better ways to mitigate those threats like sandboxing. [0] updates have been known to make software more vulnerable too you know.
rurp 7y ago
I agree with you and wish this was far more common. JetBrains is one company that does it well. They let you download previous versions or upgrade to the latest version if you have an active subscription. If your subscription lapses you can still download older versions of the software from the time you had an active subscription. I've done both, kept the latest version or rolled back to previous versions when I didn't like the latest changes. So, it's certainly doable, and I wish more companies offered this.

bschne 7y ago

I'd argue that it diverges not only across different users, but is also variable over time - as other tools, customer expectations, user expectations, paradigms of interfaces and human-computer interactions change, there is some amount of new features and changes which needs to be done not to lose touch. Of course if we could isolate the whole domain the application fits in from external influence there might be a stable optimum feature set, but I don't think that's how it works in practice.

reroute1 7y ago

Is that really a problem? Couldn't you calculate an average across users and us that as the peak measurement instead.

pwinnski 7y ago
Yes, it's really a problem. An average fails to be the peak version for anyone, missing some features wanted by some users, and having too many features for other users.
- reroute1 7y ago
  That's not necessarily true. An average could also be the peak version for many users. And if it is true, I still don't see why it's a problem, the average would still measure the peak state across all users?