4 ms·

Extremely few software updates I'm presented with seem to be focused on security. Including those specifically saying they are. It's all adding/removing/tweakin

Extremely few software updates I'm presented with seem to be focused on security. Including those specifically saying they are. It's all adding/removing/tweaking features.

ryandrake 5y ago
We need to encourage a culture of maintenance releases at companies where we work. As a user, I want the software I use to look and behave the same, and have the same feature set forever, with only under-the-hood security updates and bug fixes. I don't want the constant UX churn, constant feature cram/bloat, constant regressions and increased CPU/memory usage. But with most companies' development process, you're stuck having to take the bad with the good. Their release tree is one long trunk, and to get the security updates you must also take the latest PM's pet features and the disruptive results of their latest UX designer's art project. Companies need to learn how to branch at major versions and offer minor maintenance releases on each of those branches, while offering the next version. EDIT: If 'grep' was developed like most commercial/startup software, its command-line switches would all change with every release, it would require an internet connection, it would be able to grep through Tweets, and it would phone home to its developer with logs of every file you grep through.
- CogitoCogito 5y ago
  I guess the underlying issue is that maintenance is afforded as few resources as necessary and is hence not somewhere most want to end up. So there is a lot of incentive to keep products from ending up in maintenance mode even if they really should. I find it quite sad. So many offerings seem to be made worse when people can't leave well enough alone.
JohnFen 5y ago
This hits on one of the ways that I think the software industry has gone very wrong -- no longer separating security updates from feature updates. I shouldn't have to accept whatever feature/UI madness developers have cooked up in order to have security issues fixed.
- therealjumbo 5y ago
  That isn't just a problem of misaligned incentives, it's more fundamental than that. It's also a problem with how software "construction" tools work at a very basic level. Look around at open source projects, they don't have this perverse incentive, and which of them ship security updates separate from the feature updates? Nobody does because it causes a combinatorial explosion in code branches, and in testing. This isn't just a problem with the higher level convenience tools like compilers and package managers, its a problem with the actual source code as formulated as it is today. We'd need an entirely different way of writing code in order to do that without a massive increase in programmer/testing hours. Personally I don't think it will ever realistically happen, but I'd love to be proven wrong.
  - JohnFen 5y ago
    As a user, it doesn't matter to me why software updates have degraded like this. All that matters is that they have. As a developer, I don't really understand. I've been working on large, complex software that targets multiple operating systems for years, and we don't have any such issues. It sounds to me like a lot of companies are using development methodologies that are a bit broken... I've long thought that the reason for this is rather different -- the industry really wants to go to continuous-release models (which I don't think is a good thing, but that's a separate issue), which make security-only releases a bit nonsensical.

Extremely few software updates I'm presented with seem to be focused on security. Including those specifically saying they are. It's all adding/removing/tweaking features.

ryandrake 5y ago

We need to encourage a culture of maintenance releases at companies where we work. As a user, I want the software I use to look and behave the same, and have the same feature set forever, with only under-the-hood security updates and bug fixes. I don't want the constant UX churn, constant feature cram/bloat, constant regressions and increased CPU/memory usage. But with most companies' development process, you're stuck having to take the bad with the good. Their release tree is one long trunk, and to get the security updates you must also take the latest PM's pet features and the disruptive results of their latest UX designer's art project. Companies need to learn how to branch at major versions and offer minor maintenance releases on each of those branches, while offering the next version. EDIT: If 'grep' was developed like most commercial/startup software, its command-line switches would all change with every release, it would require an internet connection, it would be able to grep through Tweets, and it would phone home to its developer with logs of every file you grep through.

CogitoCogito 5y ago
I guess the underlying issue is that maintenance is afforded as few resources as necessary and is hence not somewhere most want to end up. So there is a lot of incentive to keep products from ending up in maintenance mode even if they really should. I find it quite sad. So many offerings seem to be made worse when people can't leave well enough alone.

JohnFen 5y ago

This hits on one of the ways that I think the software industry has gone very wrong -- no longer separating security updates from feature updates. I shouldn't have to accept whatever feature/UI madness developers have cooked up in order to have security issues fixed.

therealjumbo 5y ago
That isn't just a problem of misaligned incentives, it's more fundamental than that. It's also a problem with how software "construction" tools work at a very basic level. Look around at open source projects, they don't have this perverse incentive, and which of them ship security updates separate from the feature updates? Nobody does because it causes a combinatorial explosion in code branches, and in testing. This isn't just a problem with the higher level convenience tools like compilers and package managers, its a problem with the actual source code as formulated as it is today. We'd need an entirely different way of writing code in order to do that without a massive increase in programmer/testing hours. Personally I don't think it will ever realistically happen, but I'd love to be proven wrong.
- JohnFen 5y ago
  As a user, it doesn't matter to me why software updates have degraded like this. All that matters is that they have. As a developer, I don't really understand. I've been working on large, complex software that targets multiple operating systems for years, and we don't have any such issues. It sounds to me like a lot of companies are using development methodologies that are a bit broken... I've long thought that the reason for this is rather different -- the industry really wants to go to continuous-release models (which I don't think is a good thing, but that's a separate issue), which make security-only releases a bit nonsensical.