4 ms·
> I’m convinced that updating so much more often is worse, not better. The issue of cooldowns aside (which is about delaying updates, not reducing their freque
by JoshTriplett 3mo ago
> I’m convinced that updating so much more often is worse, not better.
The issue of cooldowns aside (which is about delaying updates, not reducing their frequency): you're going to have the same set of problems when you update, whether you do it frequently or infrequently. The difference is that if you update frequently, you'll have a smaller set of updates (so it's easier to debug) and you'll have more opportunity to report issues upstream and fix them in a timely fashion.
It's the same underlying problem as CI and build time. Most people abandoned the concept of projects that take so long to build you can only do testing once a week, because CI that runs on every PR provides a much better experience. This is the same lesson applied to updates.
- Waterluvian 3mo agoMy logical read of the situation is that I end up making fewer overall changes if I end up upgrading a dependency once, not thrice, to a specific version. And the changes are their own source of risk.
- jjmarr 3mo agoIn reality, one massive update is too big to digest and it never happens. So you're stuck on out-of-date packages having lost the ability to update. That's never a problem until it suddenly is. Company is put at significant risk (courts want to reason by analogy and "engineers skipped maintenance and endangered people" is an easy one) and nobody is to blame since nobody owned the task.
- Waterluvian 3mo agoExcept I’ve been doing it this way for years and it’s not actually a real problem. Just an imagined one.
- bunderbunder 3mo agoI think that’s the response the “it’s never a real problem until suddenly it is” observation was trying to head off. There’s always someone who doesn’t want to take the advice of all the people who’ve been burned because “well it’s never happened to me.” I used to be that someone myself. Until the day it happened to me.
- brabel 3mo agoFor most things in life that hit us periodically, we try to buffer them into manageable amounts so that when we address them, we do them all at once, benefiting from “economy of scale”, instead of having to constantly work on addressing everything that comes our way immediately. With package updates, however, another consideration is security: the longer you wait to release a security update, the more users may be vulnerable to it. There’s no right answer. Every case is different, trying to impose a single rule for everyone just simplifies things beyond what is reasonable.
- Kudos 3mo agoI've seen a similar benefit enforcing a 1 year instead of 3 year TLS cert lifetime limit in the past. It forces more automation and stronger processes.
- yearolinuxdsktp 3mo agoDelaying non-security updates has the benefit of not wasting a team’s time when something regresses and is fixed in a quick follow up patch. Having to report issues upstream is not free.
- JoshTriplett 3mo agoSure, by all means wait a week. Don't wait six months.