Sure, but in some products that's really a non-issue.

Like, take photoshop for an example. If you're a photographer that only ever edits your own photos, the odds of a needing a security update for photoshop are really minimal.

If you regularly edit photos from clients, maybe it's worth considering.

I'd say definitely: https://www.f-secure.com/v-descs/exploit_w32_jpg_vulnerabili...

Eh, it still depends.

Is it riskier than keeping an updated copy? Sure. Is the expected return period of a hack given your circumstances above a threshold that is acceptable to you? Maybe, maybe not.

> so that's one reason to upgrade.

That seems like "hey, we develop our software the worst way so that it's always full of bugs, but if you want less bugs, buy our subscription". Complete conflict of interest vs making quality and well-tested software in the first place.

Well except most useful software (not all) interacts with other systems. I loved my old mail client until it stopped working with the latest encryption schemes. A nicer way around this is like what plan9 has, where programs don't worry about handling secure connections etc, so you don't need to patch every program.

some people still use a 90's version of wordperfect, and that's fine, but if you have software that depends on other software - example Qt3 was dropped everywhere, even though there's plenty of useful Qt3 software around, it needs to be upgraded.

So even if your system wasn't buggy, it may be incompatible or the dependencies no longer are updated (like with Qt3, which had networking and other helper functions), you wouldn't want to keep using it.

Security vulnerabilities should be fixed by patches/security fixes w/o forcing users to go up the ladder to "za niu anz shaini version" + "our new and enhanced x$/mo"

Should be = not happening in a world where not doing it means more money.

With that said it can get problematic fixing old third party packages that are no longer supported.

Then the money for doing this should be provided to developers by the universe.

Proprietary software should come with a warranty that covers security vulnerabilities for N years.

Nothing is stopping you from requesting such a warranty from your vendors, and refusing to buy from those who fail to offer such a warranty.

Coordination problems do.

Imagine a developer who has to spend 50-90 hours per month just to provide the promised security patches for each of the 5 products they have created and sold at least once.

No one is in a better position than that developer to make this maintenance burden lighter, so they're the one who should be incentivised to do that.

https://news.ycombinator.com/item?id=32286651