3 ms·

You can’t create perfect software no matter how hard you try. Security updates especially need to be a forever thing, lest some major RCE comes along and is use

by judge2020 5y ago

You can’t create perfect software no matter how hard you try. Security updates especially need to be a forever thing, lest some major RCE comes along and is used on tech support scam sites to cause actual harm to the user.

choeger 5y ago
Read OP's point again: You don't need security upgrades in many cases. Neither my dishwasher nor my fridge are, or should be, connected. I could imagine them having some kind of protocol for remote maintenance (showing power consumption, warning about damage), but that's it. Software for utility devices should not be a selling point. It should just be there and do its job and maybe get an update every five years or so. Why does my TV need updates nowadays? My car? Do I have to download updates for my clothes or my bed soon? How about the toilet? These updates are indeed just a way to turn products you once used to buy into leased stuff. Every business loves to lease: There's much more profit in it and the customer has no say about how long they use a particular device. But as a customer I hate it. Here's just one instance: I had an old kindle paperwhite. I loved that thing for piling all the stupid, cheap scifi on it that I would otherwise have bought as cheap paperback and that would then clutter my apartment. Literally two weeks after the device went out of the warranty, amazon decided to push an over-the-air upgrade. And it bricked the device. Now customer care was nice enough to send me a new one, but what if they didn't? Who is legally to blame? I would have to explain the concept of over-the-air upgrades and how software can sometimes destroy hardware to a judge and that judge would have to apply law from a hundred years ago to that situation. In a court case over maybe $100 - good luck with that.
- bigiain 5y ago
  > Why does my TV need updates nowadays? My car? Do I have to download updates for my clothes or my bed soon? How about the toilet? Those things don't all need software to exist. But good luck buying a new TV or car these days that isn't 100% reliant on software to keep doing what you bought it to do. (And I'm sure there are clothes/furniture/toilet manufacturers looking very closely at John Deere's current business model to try and see if they can turn "buyers" into "recurring licensees" of their products.) But I think that's missing the article's point. It talks about "some old gadgets" and "each booted up successfully" and "Two perfectly good pieces of electronic gear have become useless, simply for want of software updates." - it's clearly not talking about clothes or beds, probably not cars (although arguably they count), and probably is talking about modern TVs (many of which het thrown away when the ancient Android version they run can no longer update to new versions of that apps the TV came with). I'm not sure whether "We should mandate that device manufacturers set aside a portion of the purchase price of a gadget to support ongoing software maintenance, forcing them to budget for a future they'd rather ignore." is the only/right answer. but the article certainly eraises an important question.
  - jfrunyon 5y ago
    > "Two perfectly good pieces of electronic gear have become useless, simply for want of software updates" isn't even true. The PSP is "useless" (in his book) for want of hardware updates and the same is probably true of the tablet to be honest. (Personally, my PSP isn't useless; I even have a secondary wifi running 802.11b and WEP for it and other old hardware.)
- dotancohen 5y ago
  > How about the toilet? So long as you flush the cache manually after each use, no, the toilet does not need software. Cache invalidation is classically a very difficult problem in software.
- wolrah 5y ago
  > Why does my TV need updates nowadays? My car? Because they're connected to the internet or to internet-connected networks. Anything that's connected to the internet needs to be receiving at least security updates. If it's not connected to the internet, it's your call whether the update is worthwhile If you don't want to update it, don't connect it to the internet. Easy. If you want to connect it to the internet, you need to accept the rules of society and one of those is don't leave vulnerable systems online where they can become part of a botnet and mess things up for the rest of us. I could not care less about your data, but we've seen with hacked security cameras and such that insecure crap left on the internet causes problems for everyone, not just their owners.
hardwaresofton 5y ago
This is a really reasonable counter point, but maybe we need to live in a world where that becomes a problem for some third party (or if right-to-repair really takes off). You buy a device, the manufacturer finds out there are flaws -- if it's under their promised timeframe (there's an incentive for them to offer ) they offer you updates. If you're outside of their time frame, you hope for a third party or you determine if you must upgrade. As the number of devices outside support range grows a market is made. This isn't a new problem -- software can copy off of the robust recipe that automobiles have left, hopefully making fewer mistakes this time and letting a little less corruption in.
pjmlp 5y ago
Sure you can, make liability a thing like in other industries, and make introducing development practices that make RCE avoidable a legal requirement. Most RCE come to to happen, because the industry largely considers security best practices an afterthought and keeps pushing for the use of unsafe languages. Don't complain about death tools, when people keep driving without helmets and seat belts.
CogitoCogito 5y ago
Extremely few software updates I'm presented with seem to be focused on security. Including those specifically saying they are. It's all adding/removing/tweaking features.
- ryandrake 5y ago
  We need to encourage a culture of maintenance releases at companies where we work. As a user, I want the software I use to look and behave the same, and have the same feature set forever, with only under-the-hood security updates and bug fixes. I don't want the constant UX churn, constant feature cram/bloat, constant regressions and increased CPU/memory usage. But with most companies' development process, you're stuck having to take the bad with the good. Their release tree is one long trunk, and to get the security updates you must also take the latest PM's pet features and the disruptive results of their latest UX designer's art project. Companies need to learn how to branch at major versions and offer minor maintenance releases on each of those branches, while offering the next version. EDIT: If 'grep' was developed like most commercial/startup software, its command-line switches would all change with every release, it would require an internet connection, it would be able to grep through Tweets, and it would phone home to its developer with logs of every file you grep through.
  - CogitoCogito 5y ago
    I guess the underlying issue is that maintenance is afforded as few resources as necessary and is hence not somewhere most want to end up. So there is a lot of incentive to keep products from ending up in maintenance mode even if they really should. I find it quite sad. So many offerings seem to be made worse when people can't leave well enough alone.
- JohnFen 5y ago
  This hits on one of the ways that I think the software industry has gone very wrong -- no longer separating security updates from feature updates. I shouldn't have to accept whatever feature/UI madness developers have cooked up in order to have security issues fixed.

choeger 5y ago

Read OP's point again: You don't need security upgrades in many cases. Neither my dishwasher nor my fridge are, or should be, connected. I could imagine them having some kind of protocol for remote maintenance (showing power consumption, warning about damage), but that's it. Software for utility devices should not be a selling point. It should just be there and do its job and maybe get an update every five years or so. Why does my TV need updates nowadays? My car? Do I have to download updates for my clothes or my bed soon? How about the toilet? These updates are indeed just a way to turn products you once used to buy into leased stuff. Every business loves to lease: There's much more profit in it and the customer has no say about how long they use a particular device. But as a customer I hate it. Here's just one instance: I had an old kindle paperwhite. I loved that thing for piling all the stupid, cheap scifi on it that I would otherwise have bought as cheap paperback and that would then clutter my apartment. Literally two weeks after the device went out of the warranty, amazon decided to push an over-the-air upgrade. And it bricked the device. Now customer care was nice enough to send me a new one, but what if they didn't? Who is legally to blame? I would have to explain the concept of over-the-air upgrades and how software can sometimes destroy hardware to a judge and that judge would have to apply law from a hundred years ago to that situation. In a court case over maybe $100 - good luck with that.

bigiain 5y ago
> Why does my TV need updates nowadays? My car? Do I have to download updates for my clothes or my bed soon? How about the toilet? Those things don't all need software to exist. But good luck buying a new TV or car these days that isn't 100% reliant on software to keep doing what you bought it to do. (And I'm sure there are clothes/furniture/toilet manufacturers looking very closely at John Deere's current business model to try and see if they can turn "buyers" into "recurring licensees" of their products.) But I think that's missing the article's point. It talks about "some old gadgets" and "each booted up successfully" and "Two perfectly good pieces of electronic gear have become useless, simply for want of software updates." - it's clearly not talking about clothes or beds, probably not cars (although arguably they count), and probably is talking about modern TVs (many of which het thrown away when the ancient Android version they run can no longer update to new versions of that apps the TV came with). I'm not sure whether "We should mandate that device manufacturers set aside a portion of the purchase price of a gadget to support ongoing software maintenance, forcing them to budget for a future they'd rather ignore." is the only/right answer. but the article certainly eraises an important question.
- jfrunyon 5y ago
  > "Two perfectly good pieces of electronic gear have become useless, simply for want of software updates" isn't even true. The PSP is "useless" (in his book) for want of hardware updates and the same is probably true of the tablet to be honest. (Personally, my PSP isn't useless; I even have a secondary wifi running 802.11b and WEP for it and other old hardware.)
dotancohen 5y ago
> How about the toilet? So long as you flush the cache manually after each use, no, the toilet does not need software. Cache invalidation is classically a very difficult problem in software.
wolrah 5y ago
> Why does my TV need updates nowadays? My car? Because they're connected to the internet or to internet-connected networks. Anything that's connected to the internet needs to be receiving at least security updates. If it's not connected to the internet, it's your call whether the update is worthwhile If you don't want to update it, don't connect it to the internet. Easy. If you want to connect it to the internet, you need to accept the rules of society and one of those is don't leave vulnerable systems online where they can become part of a botnet and mess things up for the rest of us. I could not care less about your data, but we've seen with hacked security cameras and such that insecure crap left on the internet causes problems for everyone, not just their owners.

hardwaresofton 5y ago

This is a really reasonable counter point, but maybe we need to live in a world where that becomes a problem for some third party (or if right-to-repair really takes off). You buy a device, the manufacturer finds out there are flaws -- if it's under their promised timeframe (there's an incentive for them to offer ) they offer you updates. If you're outside of their time frame, you hope for a third party or you determine if you must upgrade. As the number of devices outside support range grows a market is made. This isn't a new problem -- software can copy off of the robust recipe that automobiles have left, hopefully making fewer mistakes this time and letting a little less corruption in.

pjmlp 5y ago

Sure you can, make liability a thing like in other industries, and make introducing development practices that make RCE avoidable a legal requirement. Most RCE come to to happen, because the industry largely considers security best practices an afterthought and keeps pushing for the use of unsafe languages. Don't complain about death tools, when people keep driving without helmets and seat belts.

CogitoCogito 5y ago

Extremely few software updates I'm presented with seem to be focused on security. Including those specifically saying they are. It's all adding/removing/tweaking features.

ryandrake 5y ago
We need to encourage a culture of maintenance releases at companies where we work. As a user, I want the software I use to look and behave the same, and have the same feature set forever, with only under-the-hood security updates and bug fixes. I don't want the constant UX churn, constant feature cram/bloat, constant regressions and increased CPU/memory usage. But with most companies' development process, you're stuck having to take the bad with the good. Their release tree is one long trunk, and to get the security updates you must also take the latest PM's pet features and the disruptive results of their latest UX designer's art project. Companies need to learn how to branch at major versions and offer minor maintenance releases on each of those branches, while offering the next version. EDIT: If 'grep' was developed like most commercial/startup software, its command-line switches would all change with every release, it would require an internet connection, it would be able to grep through Tweets, and it would phone home to its developer with logs of every file you grep through.
- CogitoCogito 5y ago
  I guess the underlying issue is that maintenance is afforded as few resources as necessary and is hence not somewhere most want to end up. So there is a lot of incentive to keep products from ending up in maintenance mode even if they really should. I find it quite sad. So many offerings seem to be made worse when people can't leave well enough alone.
JohnFen 5y ago
This hits on one of the ways that I think the software industry has gone very wrong -- no longer separating security updates from feature updates. I shouldn't have to accept whatever feature/UI madness developers have cooked up in order to have security issues fixed.