No opinion on what anyone should do here. It's pretty clear it's a challenging situation. More generally, the way I feel about Hyrum's Law is: * The only way

No opinion on what anyone should do here. It's pretty clear it's a challenging situation. More generally, the way I feel about Hyrum's Law is: * The only way to guarantee you won't run afoul of Hyrum's Law is to make no updates. * As a consequence, I don't care about Hyrum's Law. I make updates to the best of my ability, trying not to break others, but I don't/can't guarantee they won't break others. * If my updates can break others, I can't push them to others without explicit consent. Others have to pick them up on their own schedule, when they have the time to test them for their own context. * If my updates can break others, others may have to make changes to them for themselves. Rather surprisingly, these baby steps lead to a world entirely different from the one I live in. One where we don't have interchangeable parts (https://en.wikipedia.org/wiki/Interchangeable_parts https://en.wikipedia.org/wiki/Interchangeable_parts) yet, where software is often tweaked for a specific situation. I've been ranting about this for a long time: http://akkartik.name/post/division-of-labor http://akkartik.name/post/division-of-labor. It's shockingly unconventional, but I find the reasoning to be ironclad. If you can think of a refutation, I'd love to hear it. (Beyond, "no way anyone will use it." My goal is to understand what we _should_ do today, excluding tech breakthroughs.) The one open question with this approach is how to notify people when you discover a security vulnerability in the software they're running. The way we deal with such notifications today feels highly inefficient, and yet I don't really know how to improve things.