5 ms·

Yeah. People like to push that there are “legitimate reasons” to want old versions, but it usually comes down to businesses. I would suggest instead that there

by wredue 3y ago

Yeah. People like to push that there are “legitimate reasons” to want old versions, but it usually comes down to businesses. I would suggest instead that there are no legitimate reasons, and that businesses who are requiring old software are at best being negligent. I’ve worked with people that refuse to modernize and update and it’s always the same stupid thing: “cost”. We really do need strong regulations on businesses that negligently refuse keep reasonably up to date.

haolez 3y ago
You are assuming that software always improves as its development moves forward. It might not. It might even get more insecure as time passes.
- lallysingh 3y ago
  Or is always backwards compatible. Upgrades aren't free.
  - wredue 3y ago
    1) In general, older code tends to have security patches 2) it costs money to run a business, and saving money through gross negligence, leading to real people having real impacts through massive data leaks while suffering zero repercussions for that needs to end. “It costs money to keep software up to date” is a shit argument for why businesses should not be managing their software.
hamandcheese 3y ago
I'm not arguing against using old versions of software, per se, rather I'm arguing against old versions of transitive dependencies.
OhSoHumble 3y ago
> I would suggest instead that there are no legitimate reasons, and that businesses who are requiring old software are at best being negligent. 1. Backwards incompatible schema changes for data that the software works with which requires a migration path. The version for that software needs to be locked until that migration is complete. 2. A functionality regression in the software. The version needs to be locked until that patch lands. 3. A security vulnerability can be introduced with new features. The version needs to be locked until that security issue is patched out. You can't just yolo to the latest version of software every time it drops.

by wredue 3y ago

haolez 3y ago

You are assuming that software always improves as its development moves forward. It might not. It might even get more insecure as time passes.

lallysingh 3y ago
Or is always backwards compatible. Upgrades aren't free.
- wredue 3y ago
  1) In general, older code tends to have security patches 2) it costs money to run a business, and saving money through gross negligence, leading to real people having real impacts through massive data leaks while suffering zero repercussions for that needs to end. “It costs money to keep software up to date” is a shit argument for why businesses should not be managing their software.

hamandcheese 3y ago

I'm not arguing against using old versions of software, per se, rather I'm arguing against old versions of transitive dependencies.

OhSoHumble 3y ago

> I would suggest instead that there are no legitimate reasons, and that businesses who are requiring old software are at best being negligent. 1. Backwards incompatible schema changes for data that the software works with which requires a migration path. The version for that software needs to be locked until that migration is complete. 2. A functionality regression in the software. The version needs to be locked until that patch lands. 3. A security vulnerability can be introduced with new features. The version needs to be locked until that security issue is patched out. You can't just yolo to the latest version of software every time it drops.