4 ms·
I, for one, wish we could go back to using years for major version numbers. And as a stretch goal, trying to align release schedules with calendar years more cl
by titzer 6y ago
I, for one, wish we could go back to using years for major version numbers. And as a stretch goal, trying to align release schedules with calendar years more closely. For example, long-term support versions could be even years. That gives the immediate benefit of knowing how old/how well-supported a given system is just from the year. I can't tell how many projects I've seen fall off and then look back...hey, the last version was from 2007. (not that being from 2007 is bad, it is just an indication that it's no longer being actively maintained and might be bitrotted).
When I worked on V8 our strategy was just to mirror Chromium's release cadence: every six weeks, the tip-of-tree became a dev branch, dev became beta, beta became stable, and stable became no longer supported. We did backmerge important bugfixes to beta and stable, but otherwise forgot about it. We never committed to long-term support of any version. That's not great for really important things like a kernel, IMHO.
- apostacy 6y agoAnd this strategy really benefits big institutions like Google, and harms smaller competitors. They are raising the barriers of entry. It is pretty clever.
- titzer 6y agoYeah, and in due fashion Chromium became "critical infrastructure" when SpaceX decided to use it as the basis of the Dragon capsule's UI. They pinned to a super-old version of Chromium that stopped getting updates 18 weeks after release. Which means it is absolutely chock full of bugs.
- refulgentis 6y agoA quality shared with all software :) a threat model that includes bad actors hacking into spacecraft ui using known chromium vulnerabilities would have to include a dizzying array of more tangible physical threats we regularly discount
- titzer 6y agoI don't know for sure if Tesla is also using Chromium for its in-car UI, but that's a much more tangible threat, because it is internet-enabled (and also not in orbit :-)).
- patrickthebold 6y agoIt seems dangerous to have a car on the internet regardless of how up to date the browser is.
- esprehn 6y agoWhen I worked on the SpaceX UI I don't remember the chromium version being super old. What was your experience with the pinning?
- ezekiel68 6y agoHrmm.. But can you name any infrastructure as approximately as critical as a space rocket that uses some kind of rolling update release scenario instead? You raise a good point about the risk of pinning. Could it be that intelligent people also have valid concerns about the risks of _not_ pinning for such uses?
- emptyparadise 6y agoIt's extremely silly to run a web browser on a spaceship UI, but I imagine that they have an entirely different set of bugs to prioritize compared to a desktop web browser release. Most security and privacy issues that browsers constantly try to patch up aren't really there on an isolated touch screen control panel. Unless they hooked it up to the internet, in which case may god help us all.
- slavik81 6y agoIf the software hasn't changed, then it was chock full of bugs when it was new, too. What has changed is that now you know what the bugs are. For a capsule UI, it seems to me that would be better than a new version with unknown bugs.
- EdwardDiego 6y agoI don't want to give up semver. When it's adhered to by dev teams (you can fuck right off, Spring 4.x where minor versions had major incompatibilities with previous version), it's a great contract to based your dependency management upon. All of my major issues using semver is coworkers who just upgrade to "the latest version" in a library that explicitly states it's using semver, and then complain that it's backwards incompatible.
- adrianN 6y agoWe could have a for-humans version number and a for-dependency-resolution version number at practically zero extra cost.
- EdwardDiego 6y agoI definitely agree, I think the hard part would be educating end users though which version number goes where (i.e., human release number doesn't go in the Maven dependency).