I'd agree with you if they were making changes to their product code, but they weren't. This was just a monitoring interface, quite separate from their actual product (which is internet access, not RRDtool graphs).

I was expressing concern about the process not the particular changes made. I am pretty gung-ho and the sole person who makes changes to any customer facing areas and even I would take longer than this to address anything that was functioning.

The only change they needed was "Options -Indexes". Hardly likely to break anything.

We have pushed severe/security issues to production nearly as fast to a major bank. Granted we had the attention of an entire team but this ISP seems to be much smaller and these tools probably see a lot less use.

Out of curiosity, how long do you think it would take to where you wouldn't be concerned? It seems hard to me to be really concerned without knowing exactly what changes were made, how many people were involved, and what kind of process they have in place for pushing code out the door.

I agree if the issue is critical that you want to get the fix out as soon as you can. I also agree with you that we don't really know the full background here, but I am concerned when this is being held up as a good way for a company to behave.

I can only speak for myself, but I never push any non-critical changes out on a customer facing application in less than a day. I like to think about what I have done overnight just to make sure I am not breaking something. Even doing this I have still managed to break things on occasion :)