4 ms·
What the article points to is that most updates are bad updates. We teach people that they should accept all updates for security reasons, but really they shoul
by palata 2y ago
What the article points to is that most updates are bad updates. We teach people that they should accept all updates for security reasons, but really they should only accept security updates.
But they can't, because this is not a possibility that is given to them. All updates are put together, and we as an industry suck at even knowing if our change is backward compatible or not (which is actually some kind of incompetence).
And of course it's hard, because users are not competent enough to distinguish good software from bad software, so they follow what the marketing tells them. Meaning that even if you made good software with fewer shiny features but actual stability, users would go for the worse software of the competitor, because it has the latest damn AI buzzword.
Sometimes I feel like software is pretty much doomed: it won't get any better. But one thing I try to teach people is this: do not add software to things that work, EVER. You don't want a connected fridge, a connected light bulb or a connected vacuum-cleaner-camera-robot. You don't need it; it's completely superfluous.
Also for things that actually matter, many times you don't want them either. Electronic voting is an example I have in my mind: it's much easier to hack a computer from anywhere in the world than to hack millions of pieces of paper.
- hulitu 2y ago> And of course it's hard, because users are not competent enough to distinguish good software from bad software, There was a time when Windows had a description for updates. Now the only distinction is between KB3587690 and KB67457770.
- o11c 2y agoI also noticed that there's another kind of update not mentioned: * Updates that add a theoretically independent feature, but which other software will dynamically detect and change their behavior for, so that it's not actually independent.
- ranger207 2y agoAnd you can't have _just_ security updates, because the combinational complexity of security fixes across feature versions is insane, not to mention the fact that the interaction of the security and features changes can themselves introduce bugs. There's groups that try (eg distro maintainers) but it's ultimately a losing battle. I'm convinced that patching is only a bandaid, but it's also impossible to have 100% bug-free code, so there needs to be some sort of systematic solution on top of whatever particular code is running. Behavior analysis, egress network analysis, immutable by default images with strictly defined writeable volumes and strictly defined data that's going to be written there, etc. There's not a silver bullet, but I think patching and trying to keep up with updates is, like, a gallium bullet at best
- NeatPitcher 2y agoFor a long while now it's been worse than that. Security updates are an excuse to push out new unwanted features (remote flags) or remove existing features in the process of being monetized.