Why can't software ever be "finished" or "sufficient" to meet your needs? I don't see the point of having software is updated day after day, month after month, if I am not interested in the new features they bring.
I used to use an old version of Quicken for Mac (this was back in the MacOS 10.2 days). It was "finished" in that it did absolutely everything I needed and there were no bugs that affected me. As time marched on, Apple switched from PowerPC to Intel which was fine because they had technology (Rosetta) which allowed me to run PowerPC applications. Then they dropped Rosetta, so now I had to choose whether to upgrade MacOS or continue to use Quicken.
I now use software called Banktivity to replace Quicken. Much like Quicken, Banktivity is "finished" as far as my requirements go. The version I have is Intel-only and Apple is switching to Arm processors. How long will Rosetta 2 last before it's pulled and I'm forced to choose between upgrading my OS and using this software?
I think there are similar things in the mobile world too. I think Google requires apps to use a minimum API version to maintain a listing in Google Play. I believe Apple does something similar with the App Store too. So short of regularly recompiling, testing, and publishing your app, everything in the stores has a finite lifetime.
Microsoft operating systems have always strived to make that impossible.
Apple has to compete somehow.
When you push unfinished, not-fully-tested code out the door, even if you can confidently patch it later, it's just never been the most professional thing to do.
Especially for something that could be mission-critical like an OS.
Getting it into people's hands sooner is no excuse.
This kind of thing really lowers the bar when it comes to the rest of the development ecosystem constantly engaged in making temporary solutions to permanent problems.
This ripples out and overflows far enough to effectively be a major anti-recycling effort for megatonnes of hardware itself.
That's the one thing I've never seen someone accuse Microsoft of. They're famous for their obsession with backward compatibility.
It sounds like you've had a different experience, and now I'm curious. Care to share?
I've had software break in the forced feature upgrades of 10, and I had BSODs when printing on every machine I supported at work thanks to a security patch.
This might actually explain why 10 and 11 have been the most flawless experience I've had with Windows while so many people have endless trouble. It might be similar to the transition to NT in XP: everything broke, but almost everything made after was more stable and secure.
Each version of Windows was designed to ideally trigger a purchase of new hardware as a concession to the hardware partners, while each purchase of more powerful hardware was designed to be prohibitively difficult for users to operate using previous Windows versions, triggering a new OS purchase.
Non-Microsoft software suffers more from this disadvantage, compared to the benefit of having some of the Microsoft non-OS software function fairly well across a few OS versions.
I understand how embarassing it would be for users in general to have become aware of how much higher performance they could have gotten from using a previous version of Windows on the next generation of hardware, so this was always made unnecessarily difficult if not impossible.
Also how much hardware could have been saved from scrap heaps if maximum utilization of hardware was given top priority?
When the main reason for growth in manufacturing was consumers purchasing their first computer, this is not as much of a problem.
Once computers are ubiquitous, each new purchase triggers a corresponding waste declaration event.
Accelerating growth pressure under these conditions, while failing to even provide archives for "outdated" code needed to operate remaining vintage hardware, amounts to an overall anti-reuse/anti-recycling strategy.
In gaming this has become mainstream as GOG and Steam now leverage DOSBox for this purpose.
Personally I think vendors beyond a certain size should be regulated so they must maintain BC for some minimum period like 20y. Regressions should incur fines unless it's proven they are required for security fixes.
I’ve got a few GOG games and they’ve done an incredible packaging job with DOSBox - if there was a way to take an old PPC Mac app and package it up to run in a similar manner, I’d have probably taken a serious look at it back when Rosetta was discontinued.
Linux might be doable too if it doesn't have a bunch of shared libraries or if you at least know what versions it needs.
Like, take photoshop for an example. If you're a photographer that only ever edits your own photos, the odds of a needing a security update for photoshop are really minimal.
If you regularly edit photos from clients, maybe it's worth considering.
Is it riskier than keeping an updated copy? Sure. Is the expected return period of a hack given your circumstances above a threshold that is acceptable to you? Maybe, maybe not.
That seems like "hey, we develop our software the worst way so that it's always full of bugs, but if you want less bugs, buy our subscription". Complete conflict of interest vs making quality and well-tested software in the first place.
some people still use a 90's version of wordperfect, and that's fine, but if you have software that depends on other software - example Qt3 was dropped everywhere, even though there's plenty of useful Qt3 software around, it needs to be upgraded.
So even if your system wasn't buggy, it may be incompatible or the dependencies no longer are updated (like with Qt3, which had networking and other helper functions), you wouldn't want to keep using it.
With that said it can get problematic fixing old third party packages that are no longer supported.
Photoshop, for instance. I don't need it to have new features; there are certain things I need it to do for me, and that's it. I don't need constant new features. But I do expect security updates.
Same model we have with cars (that BMW is trying hard to upend): it has the features I need, and if there's a systemic defect that poses a safety risk across those models sold, they're expected to fix it.
I agree that subscriptions have become toxic in their prevalence.
Isn't updates to software in response to emerging security issues a "feature"?
For a very long time the driver was operating system and hardware features.
Yes, you also don't get updates to it.
That is actually perfectly fine for countless bits of software.
I have 30 year old software, and it still does it's original job just fine, if I happen to be ok with all it's original limitations. It's too late to try to say that is an insane idea, since, I already have it in my hands to prove that it's possible.
And then there is media. Every provider wants to force everyone onto the perpetual rent, nothing to leave to your kids, model for books/music/video, not just software. What's the "it blows my mind" excuse there?
It does not blow my mind at all that there are people on HN trying to excuse and justify this rent-life hell they've created for everyone else. It is the most obvious thing in the world.
This is an overused excuse that does not actually justify nearly as much as what it's used for.
Also, online services suffer leaks and outtages and 3-letter/police pressure that I have no control or knowledge of that self owned self hosted software does not.
None of the excuses for rent hell are actually valid. They are just the excuses used to sell the idea.
The fact that services have their own problems does not mean there is no such thing as a valid service, or that the security update issue is not a real thing, it just means that this security update issue is just a thing like a lot of other things, that only really necessarily applies in certain cases, and doesn't apply everywhere, and doesn't override all other concerns, and there are other equally valid issues that are addressed by the opposite sort of model. Ie, it's nothing special and does not excuse or trump anything else.
If spftware industry is a joke and can't sort out it's own mess, its on us, not the consumer
In the United States, the landmark product liability case was Escola v. Coca-Cola Bottling Co.. In the majority decision, one of the judges wrote:
> Even if there is no negligence, however, public policy demands that responsibility be fixed wherever it will most effectively reduce the hazards to life and health inherent in defective products that reach the market. It is evident that the manufacturer can anticipate some hazards and guard against the recurrence of others, as the public cannot. Those who suffer injury from defective products are unprepared to meet its consequences. The cost of an injury and the loss of time or health may be an overwhelming misfortune to the person injured, and a needless one, for the risk of injury can be insured by the manufacturer and distributed among the public as a cost of doing business. It is to the public interest to discourage the marketing of products having defects that are a menace to the public. If such products nevertheless find their way into the market it is to the public interest to place the responsibility for whatever injury they may cause upon the manufacturer, who, even if he is not negligent in the manufacture of the product, is responsible for its reaching the market. However intermittently such injuries may occur and however haphazardly they may strike, the risk of their occurrence is a constant risk and a general one. Against such a risk there should be general and constant protection and the manufacturer is best situated to afford such protection.
There are some things to unpack here.
First, as a software developer, you are supposedly the expert and are in a far better position to evaluate your software and its potential hazards. Your customers are neither required to be experts in your software or how it might harm them, and realistically have no way to properly assess it no matter their skill level, so the responsibility falls on you.
Second, it is in the public interest to dissuade software developers from releasing faulty, broken, dangerous, etc software to the public. If a law which makes you responsible for the results of your software's failing makes you think twice about selling it, then that is a benefit to the public. If you aren't confident enough that you can accept the liability, why should your customers.
https://en.wikipedia.org/wiki/Escola_v._Coca-Cola_Bottling_C....
Consider the example of a music player that was mentioned in another comment upstream in this thread. Suppose a company sells music player software that turns out to have a RCE vulnerability when run on a maliciously crafted .mp3 file. Should they be liable?
It's helpful to consider a physical product analogy: imagine the company sold a cassette player instead. Now, let's say that someone designs a malicious tape that is lined with noxious chemicals, which when played in the cassette player causes it to catch on fire and explode. Would anyone regard the cassette maker as liable if this caused someone to die or a house to burn down?
In the Escola v. Coca-Cola Bottling Co. case that you cite, a key phrase from the majority opinion is:
> Upon an examination of the record, the evidence appears sufficient to support a reasonable inference that the bottle here involved was not damaged by any extraneous force after delivery to the restaurant by defendant.
In other words, there was no 3rd party malicious use or manipulation of the bottle: it exploded during "normal" use. If the bottle had exploded because some 3rd party had deliberately weakened the bottle, or added extra pressure before giving it to the waitress, there's no way Coca-Cola would have been liable.
With respect, a malicious tape lined with noxious chemicals is not analogous to a maliciously crafted .mp3 file for several reasons. First a tape lined with noxious chemicals is dangerous unto itself.
Second, it is not reasonably foreseeable that a tape deck would be used to play a chemically sabotaged tape. If there were millions of tapes in circulation that could cause a tape deck to self-combust, the manufacturer would be (at least partly) liable for that foreseeable outcome. They would be required to take steps to ameliorate that possible outcome.
It is now reasonably foreseeable that software designed to open arbitrary files may be subject to a maliciously crafted attack.
Should medicine manufacturers be liable if someone circumvents their tamper-proof seals and laces them with a poison?
Should berry growers be liable if someone inserts needles into foods that are sold at supermarkets?
All of these are crimes that are either widespread or famous from media scares that happened in the past, and thus foreseeable going ahead, but I think liability would still be limited because the resulting harms are caused by a 3rd party criminal act.
This is an interesting hypothetical, but I don't see the relevance.
> Should medicine manufacturers be liable if someone circumvents their tamper-proof seals and laces them with a poison?
Yes, and they are.
> Should berry growers be liable if someone inserts needles into foods that are sold at supermarkets?
The retailer should be, and is.
> This is an interesting hypothetical, but I don't see the relevance
That's your willing ignorance, and on the 2nd point too.
If by my second point, you're referring to circumventing the tamper-proof seal on medications, then maybe you'd like to expand? Manufacturers, retailers, and medical staff are (jointly) responsible for medications for their entire life cycle. A retailer who sells a poisoned medication is absolutely liable, as is the manufacturer who produced a fallible tamper-proof seal (which is worse than no seal at all).
Feel free to elaborate on why you think I'm wilfully ignorant.
Although, I think some companies use recalls in a dark pattern, specifically baby product companies.
The EU's Safety Gate programme documents safety recalls all the time, and it's common to get an email (for bigger purchases) or see recall notices at the entrance or checkouts at retailers. Retailers of safety-critical products (medical equipment, lifejackets, climbing gear, etc) will often insist on a phone number or email address in case of recall.
Incidentally, perhaps you can eventually be paid back for your stroller or crib if you do keep the receipt and watch the lists.
Thrift stores will have to check recall lists of donated items and discard the ones that are recalled, or there might be some legal exposure.
If the lobby of your building has a fancy chair in it, the furniture company isn't going to expect $10 a month forever to keep using it, and on the flip side, if the furniture turns out to be accidentally made of asbestos, it's the furniture company's responsibility to do something about that, regardless of the fact that you're not paying them every month.
Is there a version of the concierge that's a one time purchase? Probably not a good one? The fee your paying is for 1. continued incentive to continue doing a good job and 2. Training and improvements to the staff.
Is there a version of the chair that should be a recurring fee? Maybe if the chair company comes and swaps out the chair every month, but then you're not paying for the chair, you're paying for the chair service. Should the apartment building have the expectation that under a flat fee the fabric in the chair is going to get upgraded to fit new styles and tastes? No, that's never a expectation when you buy furniture. The only case where the manufacturer would be beholden to you would be if there is some gross defect in the product or if there was some negligence on their part that could lead to injury.
Realistically there's not going to be an issue where a chair lets robbers in, but if you bought a door lock for example, and the lock failed when someone tapped it, you're not SOL because your not paying a subscription to the lock maker, they're liable for their defective product.
There's absolutely cases where software should be a subscription model and there's absolutely cases where it shouldn't be.
I don't need any features that have been added to Adobe Premiere since 2013. I don't want or need updates--my copy of CS6 still works. I'm not getting a CC subscription.
If I needed software to help with accessibility compliance, I would absolutely be willing to pay a monthly fee because the standards change and information becomes out of date quickly. It would be an unreasonable expectation that a lump sum I paid in 2013 would still have my websites up to code today.
--
Forgive typos, on my phone.
My thoughts on this:
1. How long would it take a team of 4 people to build this with just the features I need for a single user?
2. How much would it cost to contract a team to build that (ball bark)?
If it can be done on a single person's salary, I'm not paying a monthly subscription, no matter how inexpensive. I'm also not contracting that work either, but I might be tempted to compete with them if my employer let me (they won't).
Only certain things make sense as a subscription, and those are things that have an infinite (or practically infinite) cost to the consumer, thus they should have an amortized infinite cost.
Do you think there's a case where something might have an infinite cost to the consumer but a finite cost to the company? Ie a solution to some recurring problem that, without the software or service the customer would endlessly pay for, but with the software or service would not incur the recurring cost--and in that situation, do you think it would be fair for the company to charge a recurring fee given that it's not costing them to continually develop it? So the customer is saving money compared to before they had the software but it's not supplementing a cost of development?
Now you’ve set yourself up for a community to grow: core devs you pay, customers that contribute code and help diagnose bugs, customers that pay you only for support, and customers that pay you to do everything.
I did this once, and the support-only customers were the most interesting. They helped locate latent race conditions that only appeared on underpowered hardware, but could happen on over-subscribed machines (like the hosted version), and so much more.
I never got any contributions on the code side, but one guy randomly took over responding to issues without being asked to. By the time I got to them, it would be ready to close or I would have enough information to address it immediately.
If you are going this route, just be aware that companies *will* eventually replace you with a home-grown solution. Even if it takes years. So ask yourself if you want to be the solution everyone goes to, you need an FOSS solution to give people. Otherwise, you’ll be replaced with the other ones, eventually.
IOW, if a company like auth0 were to have an open source server, they’d be killing it everywhere. Five or six years ago. By now, there’s enough free (as in free speech) solutions out there that they will probably never be the default solution, just one that you pay for for a little while until you figure out how or have the time to host your own.
@d13 What if the house magically changed shape so the chair couldn't be used any more in that house? Suddenly one day you'll need to sit on the floor and eat, until you had gotten new chairs, for the new shape of the house
Who would you sue (the house or the chair company or no one?)
Or instead, when the house changes shape randomly and whenever, what about paying the chair company for upgrading your chairs to match the new shape of the house (and you'd never have to cook and eat on the floor)
(It makes little sense, I think, to compare software with chairs and houses. Unless the houses are magical as per above)
Why you might need updates: 1. New functionality (if you need a particular feature that was not available before) 2. Security issues
These are not industries where people make programmer wages. Combining all of the required software costs is very expensive. Subscriptions more closely match the model/needs of the producer, but they are often quite bad the consumer.
Your analogy is flawed. Rather, you will never indefinitely get the latest quality chair for free after buying it. Nor if tomorrow plastics are banned, they won't replace your chair with wood or metal for free either. And if the fabric wears, they won't replace it for free either.
So, why should software updates be free in a dynamic computing world?
It's fine for the rental option to exist, the problem is only when no other option exists, and, increasingly, no other option exists.
Please don't waste our time pointing out how this is generalization and alternatives do exist technically for most things. It's obviously not 100% services, but the entire world of software is becoming more and more each day, worse today than yesterday, worse tomorrow than today, a choice between two opposite ends of a spectrum: 0% ownership in the form of services, and 100% ownership in the form of open source. Each of those are fine in various circumstances.
For many things, and increasing, no practical alternative to "RentACenter" software exists because in most cases an individual is not realistically free to do their own thing if they want to sell to customers and buy from vendors and interoperate with family and friends who all take the easy path and use all the major services, or even without interoperation issues the alternative option simply doesn't do the same job or doesn't exist. And the damning thing is that it used to exist, meaning the rental model is not a required aspect to produce the product to do the job.
I loved this model, it clearly linked revenue earned by new versions to the value provided by the upgrade.
IMO, subscriptions are intended to shoehorn users who would only upgrade every few years into the equivalent of the “yearly” upgrade cycle. They’re a way of avoiding the accountability that comes with paid upgrades.
Personally, I have two subscriptions that I will dump the instant a quality pay-once alternative appears. Locked-in customers are the worst kinds of customers.
You buy the game once, then get access to online multiplayer servers.
Subscription models encourage constant needless changes to the product.
And expansions, dlcs, seasons, are a way to subsidize such online services.
How many games that offer no additional packages keep their online offering working forever?
All the games that actually released binaries for hosting your own servers. That used to be the standard back in the day.
The exception is the most played multiplayer game in the world.
As does the desire to sell paid upgrades.
Microtransactions, usually a lootbox like system so the gamblers pay for the rest of the players (quite profitable)
DLCs
I can't think of any other common ones.
This is part of the problem. Give me software that runs locally only, and there's no need for "backend support". This insane integration of local software with unnecessary remote services is absurd.
But yes, obviously one should pay for feature upgrades, as it was in the 90s. Everything went to hell when software started having the Internet as a core dependency.
Does software want to become the printer industry?
Sketch is now subscription-only; previously you paid for one year of updates. If you stopped paying for updates you could still continue to use the desktop app (i.e. the app did not expire).
The current Sketch model means you can use the app only when you pay to use the app: pay every year, or pay for a monthly usage.
Is it really reasonable for software industry to drain so much money just because it takes some effort to write a program that won't magically rot in a few years?
Security vulnerabilities don't change OS APIs. OS APIs are one of the most stable constructs in computing.
There is a huge subset of software that doesn't require interaction over the network, and can be written to last. And even inherently network-dependent applications could be written using p2p technologies, making them independent on anyone's computer. Just because the everything sucks right now doesn't mean it has to.
Especially for software I rely on I want the developers to consistently earn money so they keep motivated to work on it, do maintenance and fix bugs. I don't pay for software, I pay for the thing it allows me to do. Me paying a subscription fee creates an incentive and responsibility to keep things working.
If there is a backend component to its even more important as they will have continuous cost.
Also the "one off" model usually means you'll pay for versions which is not always cheaper. Take Sketch for example, some of my clients use it so I had to update each year spending 99$. With subscription I could just use it for a project and cancel afterwards saving money, something I have done with Adobe software (although I find their prices way too high).
If something is too expensive I will find alternatives, that has imo nothing to do with the subscription model.