5 ms·

Security vulnerabilities are regularly found in many softwares (both online and offline), so that's one reason to upgrade.

NoMAD76 4y ago
Security vulnerabilities should be fixed by patches/security fixes w/o forcing users to go up the ladder to "za niu anz shaini version" + "our new and enhanced x$/mo"
- pixl97 4y ago
  Should be = not happening in a world where not doing it means more money. With that said it can get problematic fixing old third party packages that are no longer supported.
- EugeneOZ 4y ago
  Then the money for doing this should be provided to developers by the universe.
Enginerrrd 4y ago
Sure, but in some products that's really a non-issue. Like, take photoshop for an example. If you're a photographer that only ever edits your own photos, the odds of a needing a security update for photoshop are really minimal. If you regularly edit photos from clients, maybe it's worth considering.
- wizofaus 4y ago
  I'd say definitely: https://www.f-secure.com/v-descs/exploit_w32_jpg_vulnerability.shtml https://www.f-secure.com/v-descs/exploit_w32_jpg_vulnerabili...
  - Enginerrrd 4y ago
    Eh, it still depends. Is it riskier than keeping an updated copy? Sure. Is the expected return period of a hack given your circumstances above a threshold that is acceptable to you? Maybe, maybe not.
ekianjo 4y ago
> so that's one reason to upgrade. That seems like "hey, we develop our software the worst way so that it's always full of bugs, but if you want less bugs, buy our subscription". Complete conflict of interest vs making quality and well-tested software in the first place.
- calvinmorrison 4y ago
  Well except most useful software (not all) interacts with other systems. I loved my old mail client until it stopped working with the latest encryption schemes. A nicer way around this is like what plan9 has, where programs don't worry about handling secure connections etc, so you don't need to patch every program. some people still use a 90's version of wordperfect, and that's fine, but if you have software that depends on other software - example Qt3 was dropped everywhere, even though there's plenty of useful Qt3 software around, it needs to be upgraded. So even if your system wasn't buggy, it may be incompatible or the dependencies no longer are updated (like with Qt3, which had networking and other helper functions), you wouldn't want to keep using it.
Kinrany 4y ago
Proprietary software should come with a warranty that covers security vulnerabilities for N years.
- nradov 4y ago
  Nothing is stopping you from requesting such a warranty from your vendors, and refusing to buy from those who fail to offer such a warranty.
  - Kinrany 4y ago
    Coordination problems do.
- EugeneOZ 4y ago
  Imagine a developer who has to spend 50-90 hours per month just to provide the promised security patches for each of the 5 products they have created and sold at least once.
  - Kinrany 4y ago
    No one is in a better position than that developer to make this maintenance burden lighter, so they're the one who should be incentivised to do that. https://news.ycombinator.com/item?id=32286651 https://news.ycombinator.com/item?id=32286651
    - deleted 4y ago
      [deleted]

NoMAD76 4y ago

Security vulnerabilities should be fixed by patches/security fixes w/o forcing users to go up the ladder to "za niu anz shaini version" + "our new and enhanced x$/mo"

pixl97 4y ago
Should be = not happening in a world where not doing it means more money. With that said it can get problematic fixing old third party packages that are no longer supported.
EugeneOZ 4y ago
Then the money for doing this should be provided to developers by the universe.

Enginerrrd 4y ago

Sure, but in some products that's really a non-issue. Like, take photoshop for an example. If you're a photographer that only ever edits your own photos, the odds of a needing a security update for photoshop are really minimal. If you regularly edit photos from clients, maybe it's worth considering.

wizofaus 4y ago
I'd say definitely: https://www.f-secure.com/v-descs/exploit_w32_jpg_vulnerability.shtml https://www.f-secure.com/v-descs/exploit_w32_jpg_vulnerabili...
- Enginerrrd 4y ago
  Eh, it still depends. Is it riskier than keeping an updated copy? Sure. Is the expected return period of a hack given your circumstances above a threshold that is acceptable to you? Maybe, maybe not.

ekianjo 4y ago

> so that's one reason to upgrade. That seems like "hey, we develop our software the worst way so that it's always full of bugs, but if you want less bugs, buy our subscription". Complete conflict of interest vs making quality and well-tested software in the first place.

calvinmorrison 4y ago
Well except most useful software (not all) interacts with other systems. I loved my old mail client until it stopped working with the latest encryption schemes. A nicer way around this is like what plan9 has, where programs don't worry about handling secure connections etc, so you don't need to patch every program. some people still use a 90's version of wordperfect, and that's fine, but if you have software that depends on other software - example Qt3 was dropped everywhere, even though there's plenty of useful Qt3 software around, it needs to be upgraded. So even if your system wasn't buggy, it may be incompatible or the dependencies no longer are updated (like with Qt3, which had networking and other helper functions), you wouldn't want to keep using it.

Kinrany 4y ago

Proprietary software should come with a warranty that covers security vulnerabilities for N years.

nradov 4y ago
Nothing is stopping you from requesting such a warranty from your vendors, and refusing to buy from those who fail to offer such a warranty.
- Kinrany 4y ago
  Coordination problems do.
EugeneOZ 4y ago
Imagine a developer who has to spend 50-90 hours per month just to provide the promised security patches for each of the 5 products they have created and sold at least once.
- Kinrany 4y ago
  No one is in a better position than that developer to make this maintenance burden lighter, so they're the one who should be incentivised to do that. https://news.ycombinator.com/item?id=32286651 https://news.ycombinator.com/item?id=32286651
  - deleted 4y ago
    [deleted]