News for hackers. Stuff that matters.
Re:We Need Software Updates Forever by KronisLV on Thursday September 23, 2021 @02:43AM (#28625896)
I made a blog post under the humorous title of "Never update anything" which does sound a bit like what you're suggesting: https://blog.kronis.dev/articles/never-update-anything

It's probably a bit chaotic, but some of the arguments that i made were that "updates" is too broad a term to be meaningful, since you might be interested in security updates without any other sorts of breaking changes being forced upon you:

  Types of updates are the problem
  
  The problem here is that we never differentiate between the types of updates properly:
   - major leaps in the development of the software which add new features
   - security updates that don't change any actual functionality apart from the security fix
   - bug fixes that should not alter any functionality in significant ways
   - small backwards compatible feature updates that are essentially opt in
Essentially, you might want stable and secure software and not much more, since if it was enough for you at a certain point in time, then it might be the same way in 10 years, instead of needing new features that break your logic numerous times over that period.

But perhaps the current situation that we're in is simply a reflection of the current industry and market conditions, where companies try to have their products remain competitive.

You can't sell stable software (or hardware) that has a new feature once every 10 years, when there are products out there that release new stuff monthly - at least when it comes to the layperson, otherwise we wouldn't have enterprises like Google or Facebook make significant UI/UX changes, since none of those make sense from a purely engineering oriented point of view.

Of course, that's just my interpretation after applying Occam's razor - for some reason we don't hear much about extremely stable products as success stories.

Re:We Need Software Updates Forever by Arnt on Thursday September 23, 2021 @04:35AM (#28626644)
Extremely stable products do exist. The Z80 wouldn't still be made (after almost 50 years) unless software needs that CPU, and at this point that has to mean stable software, right?

But in this case, the software works as it did, provided that you give it the surroundings for which it was made. The change needed isn't one of the four classes you point out, but rather a fifth:

- support for new networking technology

For the N95, a new web stack, presumably including xhr, webrtc and the other goodies so many apps use nowadays. For the Playstation, the ability to connect to new WLANs.

I suspect that new hardware would be needed in both of these cases. Running webrtc on a CPU from 2007 sounds dubious, and didn't 802.11foo change something extremely low-level wrt. hardware?

Re:We Need Software Updates Forever by bryanrasmussen on Thursday September 23, 2021 @02:46AM (#28625913)
some functionality might only be possible by being insecure, thus a security update may have to remove functionality.
Re:We Need Software Updates Forever by selfhoster11 on Thursday September 23, 2021 @04:14AM (#28626513)
Nope. A security update that removes a feature should add a checkbox to a control panel that's pre-checked to disable functionality. The system administrator is prominently notified that they must take a look at whether this breaks their use case, and make the right call following risk assessment.
Re:We Need Software Updates Forever by KronisLV on Thursday September 23, 2021 @03:16AM (#28626125)
In that case, we're probably (hopefully) talking about air gapped environments, like medical devices that aren't networked or internal corporate networks with very particular host access rules.

In those cases, you might truly want no updates of any kind, with which i agree - updates should always be compatible with the "opt out" approach, or even do "opt in" (like Debian has an unattended upgrades package, for example: https://wiki.debian.org/UnattendedUpgrades).

That said, due to the world that we live in, it's risky to forgo any sorts of security updates, especially in the context of networked devices and systems!

Re:We Need Software Updates Forever by bryanrasmussen on Thursday September 23, 2021 @03:58AM (#28626426)
I mean I was thinking more about the thing were WMF files used to allow you to run scripts inside the files which created security issues https://www.computerworld.com/article/2826084/what-you-need-... - lots of functionality that is enabled to make things easier for applications to do stuff is fundamentally insecure, so pushing a solution to fix the security issue will sometimes lead to remove functionality from the application that the user has to accept.

So the premise that we could remove security issues but not touch functionality seems utopian.