Re:Patching is hard; so what?
by ams6110 on Friday September 15, 2017 @10:57PM
(#15262587)
That's not the mindset of enterprise IT though. The mindset of enterprise IT is "if it works, don't touch it." This mindset developed because of decades of dealing with arcane, complicated software that was at the same time critical to business operations. I'm aware of a major university that still has a three-week "change freeze" at the start of every semester because of this attiude and I'm sure they are not the only one.
[ Parent
| on HN ]
Three weeks freeze twice a year during the most critical time does not sound that horrible to me.
Software developers tend to break system with changes. That is not some kind of mythical rare issue - that happens often (with some vendors very often).
Re:Patching is hard; so what?
by user5994461 on Saturday September 16, 2017 @06:41PM
(#15267149)
Agreed. A company that doesn't have change freezes at the most critical times has very poor practices.
I've worked in enterprise security teams for the last decade. This is spot on. It's retarded and will never change because there is no accountability. Corporate IT don't give no fucks.
Corporate IT is doing what software developers have taught them through experience and pavlovian condition:
Don't touch anything, because it will break if you touch it.
IFF people who release software learn how to release security patches and bugfixes that don't include new features or break existing parts (except when breaking changes are actually needed), then, after several years of good results from pushing changes, Corporate IT will be conditioned to just push security fixes, it's not a big deal, plus it's important.
Re:Patching is hard; so what?
by CiPHPerCoder on Saturday September 16, 2017 @02:32AM
(#15263256)
Then let's hope Equifax shakes the foundation of their egos and they start to give fucks about this sort of thing.