Is it wrong not to upgrade software?

With the software we have today, from browsers to even just random applications that do unique things, they're affected by updates as with operating systems. Everyone would know by now that updates sometimes break things rather than fix them, or add in changes that are completely unnecessary. But I question if it's right to think this and therefore not update anything, even if the developers behind them say they're "critical" for security and what else.

To start, I've decided not to accept any .NET Framework update that throws at me each month and now, I'm doing the same for Firefox (and so everyone knows, I use the ESR version). The reason why I'm going with such notion is that out of curiosity, I installed 78 ESR and already I had one nitpick about it... the address bar. Why does it have to be slightly bigger when I select it? And why do I have to click away from it twice after I've used it? As a result, I've downgraded back to 68 ESR and made it so that the browser doesn't get automatically updated when its lifecycle ends (although it came to that today).

I also refused to update VirtualBox when I had it as it required a brand new installer, which was over 100MB, downloaded each time unless that's been changed since then and more recently Any Video Converter even when I got notified of updates for it too much, and had the option to skip new versions I'm told about (as the one I have, 7.0.2, is absolutely fine).

Hope I'm not the only one feeling this way, even about how I'm dealing with Firefox now. I could've even had this stagnate at 52 ESR if I wanted.

Comments

  • I generally prefer to keep things updated. Given the massive number of updates, from apps to OSes that I deal with on a regular basis, I think they fail much less often than you think. It's the whole gamblers logic thing where they only remember the wins and not the losses. Failed updates only stand out because they fail.

    There are some tools I use that are not regularly updated and generally they don't get updates unless I run into a problem with them. At which time, I'll try updating it to see if it resolves the issue. But it's not because I don't want to update those tools, it's generally because I wasn't aware they had updates and they don't prompt to update. Also, they tend to be things I don't use very often or things that are pirated and getting updated versions require obtaining new keys, which is sometimes difficult to track down.

    When the app does prompt for updates and I decline, it's usually because I'm just trying to get something done and don't have time to bother with an update. Three apps that come to mind that do this are notepad++, winscp, and mkvmerge. I have nothing against updating them, I'm just usually busy when they want to update.
  • edited September 2020
    It is absolutely not wrong. Back before web browsers, it was standard practice to load a piece of software, carefully test and evaluate all relevant functionality, and then don't change things.

    Even a well meaning developer and a small program can accidentally break critical functionality. When users call in complaining they can't get their work done, who is going to get the blame? The developer(s) who made a mistake, or you for loading an untested piece of software in to the system? Keep in mind there is no shortage of blame.

    As we know, not all developers are well meaning. Increasingly the problem is not that the new version can't add A+B due to a coding mistake, but rather they have changed EVERYTHING around just for the sake of change. This means it may not run at all without changing hardware or software dependencies. This means you may waste months re-learning a user interface for an application you only use for 5 minutes every two years. This means you may have to sit through advertisements just to add A+B. This means all of your actions are logged, sent back to the mothership, aggregated, and used to incriminate you. Sigh. Then they finally pull the plug on the very ability to add A+B because they are too busy supporting the new UI, advertising engine, and telemetry systems, but the lame excuse is that only "old" people want to add A+B.

    Unfortunately, now thanks to web browsers and the way idiots handle data, you have people running around yelling "All old stuff is insecure! Pollywannacracker!".

    It is true that security issues are a serious problem. But the cost of changing software should always be weighed carefully.

    In my opinion, most software based security flaws are a symptom of larger design flaws that no one is willing to address. Such as building everything including the kitchen sink in to a web browser or OS.

    I hate to say it, but I probably did my part to help contribute to this problem. Back in the day I loved to download the latest Mozilla and Firefox nightly builds. But I am/was an actual software tester. I felt I was helping Mozilla by testing, catching bugs as soon as a change was made, and filing bug or crash reports. Getting access to "new features" was only a secondary concern, and mostly limited to testing.

    Apparently there were enough people who did this that Mozilla decided to start doing rapid releases. Unfortunately, I believe many of them were downloading nightly builds for the wrong reason, usually to get access to buggy new features.

    Quite frankly, EVERYONE should be using the ESR Extended Support Release builds, unless they consider themselves software testers.

    What is really unethical is how these days "security upgrades" are used as an excuse to push unwanted garbage to users.

    A security upgrade should NEVER, EVER, EVER break anything, change visible functionality, get in your way, or remove functionality. If this were the case, then there would simply never be a reason for not installing security fixes.

    But as most here are painfully aware, this is seldom the case.

    Every time I have to "update" something, I cringe and wonder how I am going to get raped up the ass now. Am I going to get advertising now? Will I have to buy all new hardware? Will I have to change other software to make it happy? Will it break other software? Will I have to waste time learning a new user interface designed by some managers 5-year old daughter? Is it going to start sending all my personal information back to the vendor? Are they bringing back Clippy? Will I now have to be locked in to some online service bullshit just to use it? Will I have to change everything around to get it to do what I need again? Will it even do what I need at all? If I am lucky, it is just going to be massively slower. Will they at least ship me a bottle of lube so it doesn't hurt as much?

    So, yea, the security parrots will keep bitching, but unless this madness ever stops, they can shove it up their own colorful feather laden asses.

    It used to be that OSes like DOS, Windows 3.1/95/98/ME had NO security whatsoever. I've worked extensively with those, and I am painfully familiar with how to mitigate security issues with these OSes. It's not as easy, but these techniques are still applicable to newer systems. It is mostly a matter of being careful about where you bring in data, what data you expose to other programs, or allowing data out, and periodically checking the integrity of the system. Heck, I remember when the entire internet was mostly unfirewalled, you could poke at any port on anyone's computer (oh, look, I see another idiot who installed Microsoft Personal Web Server for Win98 and all its exploits). Most of the time, it is just about not doing dumb stuff.
  • Things can't stay the same. People's tastes change, their needs evolve and software has to evolve with it. Plug and pray is thankfully a thing of the past. Web browsers, for better or worse, generally work on everything.

    As for security, you can certainly go overboard with it, but that's because you pretty much have to. Especially if you work for a large business. You don't really have a choice in the matter because you have to pass audits and meet compliance requirements.

    Never underestimate how dumb a user can be.
  • The issue depends on why one doesn't want to upgrade. Choosing not to take a free update that fixes problems one is having does not encourage me to help with the solving of those problems.

    I am very happy not to be a security developer. Half the security issues I have seen have taken the form of a user might try to do something and it might be bad and the requirement was to prove it was impossible for a user to do something bad. The security auditing team does not need to concern themselves with minor details like ensuring the user can actually do their job.
  • In some ways it depends on what it is. If it's a system that faces the public Internet (like a web server), then yes it should have security patches applied. If it's a piece of local software, then no, there is absolutely nothing wrong with not upgrading.

    As pretty much everybody knows here by now, I use Windows 2000 (or older), Office 2000, Cool Edit Pro 2.1, and various other old software pretty much daily. Why? Because it works and does exactly what I need it do.

    I have many reasons to not upgrade. For example, the newest version of Adobe Audition is missing features that Cool Edit Pro 2.1 has, AND I would be locked into a paid subscription that requires an Internet connection to activate. It would also mean that I'd have to upgrade to Windows 10, which is slow, bloated, and doesn't work with my sound card. So I'd have to buy an expensive new sound card as well (I use a professional model). I'd also need the 64-bit version of Windows 10 to make use of my 16GB of RAM (whereas 2000 with PAE enabled can use all of it), which means that I'd lose the ability to use any 16-bit software.

    Much of the internal parts of my network are old. They just work. And I've had no problems with security. I know how to secure my network, and I've not had a virus since 2006. HOWEVER, anything that directly faces the Internet does get regular security patches.

    I would recommend keeping web browsers updated as much as possible, or at least blocking advertisements somehow. I use AdGuard DNS for this, tied in with my Windows DHCP/DNS server, so anything on my network has ads blocked automatically.

    Finally, if you're worried about security, just be careful. Don't use unpatched things to browse spammy sites, download random "virus scanners", or open random e-mail attachments from people you don't know. Don't use an admin account unless you have to. Most of the security problems are caused by the users themselves.
  • Looking at updates, it help to look at the ancient times.

    Best you had was a dial-up connection a fraction of a fraction the most garbage internet today has. 56Kbps? Woah. Not a thing. Best you got is probably a #####bps modem you don't know what to do with. Maybe the fancy enterprises had StarLan or a coax network across their systems. But you didn't. Especially not to global network.
    When you bought a software, the support you had was a phone call. A trip to the vendor. Maybe even write a letter. And most of the time a waiting game for a response.
    When things broke it was up to you to fix them yourself. Maybe you could get a fix on a physical medium in the mail a week or so if you paid postage if that was an option. Or maybe the response was "don't do that again."
    Nonetheless, this was the ancient times. A connection was a luxury.
    Software needed extensive testing to do the best they can to anticipate because heavens know what you can do to fix a major bug creating a PR disaster because there's no fast, economical method to get fixes out to ever single customer. Even then it was more economical to just release a new version to the market that advertises that bugs was fixed. If you could get updates to issues, and cheap, you wanted it. And in Microsoft's case, they couldn't release dozens of fixes on physical medium at a time. That'd take world supply of floppies and CDs for each and every update. And that was the theory behind Service Packs. Put a mass collection of updates on a CD or a floppy set and distribute that for a minor fee.

    Enter the internet, cloud computing and all that fancy mumbo-jumbo. Fixes can be downloaded and applied automatically in seconds. Why do extensive testing when users can just file a bug report, we'll fix it, and push it to their machine? Why do we need to invest in testing labs when we can have users do it for us? And there is the flaw.
    When you have millions of reports filing in, how do you filter them? You can't do it by hand. It would take months to read all those reports ranging from "bring muh aero back" or "stop muh trakung" to "Major corruption issue related to storage spaces." You instead have AI that you program up to do the best and even then what gets to the developers from that winds up missing a whole lot of the point because AI isn't perfect either.
    Software isn't tested as extensively as it was. Updates are released more rapidly to fix issues as fast as possible. But even those updates aren't tested as they were before because of how rapid they've become.

    Should you avoid every single update on the market forever? No. That's outrageous. But at the same it's not a grand idea to let the system download and install updates every single day either. As a home user, you have leeway. You know how you work, what you do, and take steps to mitigate foreseeable risk. Enterprises have to anticipate everything from dude tethering his phone to the computer to get around web-filters to see his porno, to girl trying to e-stalk her ex to whatever you can think of has probably happened at an enterprise somewhere.
    There's a fancy update delay system I recommend doing. I think I already told how I work. Read up on the updates. Don't install them on launch. Wait a week or so after they've been in the wild to see any potential issues that arise. And if Windows 10 forces it down your throat, hope you got a backup.
    It's how I used to work with patch Tuesday. Every week I'd be installing the past week's after a little research, unless they were urgent fixes.
  • edited September 2020
    Well, about my issue with the latest Firefox ESR, I installed it and... it's not as problematic as it was before. Let's just say that 78.3 ESR fixed the things I experienced with 78.2 ESR. But just in case things if the next ESR ever lets me down in any way (even though it's not until another year) or if this version doesn't seem to agree with me for any longer, I have Waterfox installed as a stand-by.

    Also, rather unrelated but I still use Office 2010 on my system and next month would be the final month of updates for it. Obviously after that, it would be most vulnerable but I'm not too bothered, as I don't make much use of Office software anyway (and when I do, it's mostly with Excel and Access). Then again, I still have FrontPage 2003 even though Office 2003 ended support seven years ago.

    EDIT: Another minor gripe I have with 78 ESR is that Japanese text looks weird, because of different fonts being used (one using Microsoft YaHei and the other Meiryo, when they didn't use this before as I believe MS PGothic was used last time if I recall correctly). Tried changing the font for the language but to no effect (and I even refreshed the pages too). Waterfox seems to have this as well, but at least that doesn't have links on pages with certain letters not underlined (and why did that "change" proposed in the first place... links are now unsightly to look at that way). Yeah, I seem to find fault with everything these days. Don't mind me. Also, I might be wrong but Waterfox seems to have a built-in ad blocker, because I saw ads seemingly "blocked" without me having to bring back uBlock Origin. Strange, but if that's the case, then that's awesome.
  • You know what, I'm just waiting for the day where it's "everything as a service."

    One day it's going to be "Windows 365" and you'll have to pay a monthly fee to use your computer or you have "limited functionality mode."
  • One day it's going to be "Windows 365" and you'll have to pay a monthly fee to use your computer or you have "limited functionality mode."


    They have done this before - Windows XP Home Edition for Subscription and Prepaid Computers!
  • Just a reminder, "subscriptions" are the exact opposite of what personal computing was all about. It was about having software under your own control on your own machine.
  • edited September 2020
    Oh yeah that subscription model "flexgo" XP (I think I heard of a Vista one too). But at least after a certain amount of credits were added it would convert to a standard license.

    Oh I can imagine it now. Somebody giving a presentation in 2025:
    Notification: Your Office 365 has now expired. We will now exit the program and bring up the activation prompt for you to renew it.
    Your One drive subscription has also now expired, renew now or we'll delete files to fit the reduced capacity.
    Windows 365 subscription has now expired. You will now be logged off. Upon next login you will have "reduced functionality mode" which allows you to purchase a new subscription online or enter your card information.


    You know what, it's good to know there are people who have similar ideas.
  • It's pretty much a given they will offer a subscription based managed desktop. It's certainly not something I'd be interested in, but I could see it being a good idea for some use cases.

    But I will say from past experience with office 365, they warn the shit out of you when your subscription is about to be cancelled, and they retain data for a while as well with repeated notices that they're going to delete it on a certain date. So, no, you're not going to be in the middle of a presentation when they suddenly cut you off. And if you are, it's because you've ignored many, many warnings. Also, they do automatic payments, so as long as the card is good, there's no danger if anything expiring.
  • If Microsoft ever considered making their precious OS a subscription-based model, then I think a boycott will ensue. That would be just a desperate move to rake in more cash from people... and don't they have enough of it already? Greedy sods.

    Now, back to my gripe with Firefox 78 ESR... I hope there's a way to fix the Japanese font displayed on web pages and of certain characters not being underlined and if so, I suspect it'd be done under about:config. I recently brought this up under the Firefox Reddit but so far, no response.

    If no joy on that however, not even if upgrading to Firefox 81 would be the solution, then Pale Moon is the only way to go (and yes, I did say Waterfox but decided against it recently).
  • edited October 2020
    You can fix the address bar with userchrome.css or make it less annoying (but still present) by using reduced motion on your OS. Actually, some of the modern Firefox 7x/8x idiocy makes me wonder how many would like a fork of Firefox 68 (although it would run into the problem of moving to newer code to be able to continue to backport security updates, and the length of time it would take for a project like that to catch up with security updates anyways as more people seem to want to do that with Mozilla 1.8 rather than Firefox 68, and only a large amount of people could maintain such a huge codebase on their own for so long.)

    As for updating software,I would recommend it for all applications connected to the internet in production use. Yes, there are undisclosed security problems in new software, but the nice thing about auto-updating (at least on long-term versions) is that it can be fixed quite soon, without having to wait weeks or months. The disclosed ones, however, can easily be exploited on out of date but still used OSes (There's a certain one with a version number of 5.1) tl;dr try to upgrade internet-connected software if you are not using it for novelty.
  • One of the restrictions as 'everything as a service', is that it places the repair requirements on the one renting it out. This means that if it causes a problem, the provider is legally required to fix it etc. It's an ugly issue that killed it in the past.

    The current subscription models are that while subscribed, updates are free or reduced prices, and you keep the software after the subscript ends.

    To updating software. It can hurt but it's more often better to have the more recent thing.
  • Pretty soon, Microsoft will start charging you by the hour, and you will receive USB sticks in the mail to install Windows 365 along with 1000 hours of usage free.
  • 2040: OEMs charge you a monthly subscription to use your computer plus monthly subscription of the Operating System plus monthly subscription to install stuff in it. :D
  • 2050: All devices transform in to robots that rape everyone. They make money off of that somehow. Everyone just shrugs and puts up with it. The thought of using something "old" that doesn't do that never even crosses their mind.
  • edited October 2020
    The thought of using something "old" that doesn't do that never even crosses their mind.


    There will be no such thoughts permitted. The World Congress will proclaim that those who use or think of using operating systems (as well as hardware that is more than 14 months old) that are not Windows 365 are insubordinate terrorists (the War on Insecure Tech!). So I'll get a trip to the electric chair before I can express my opinion anyway.
  • @os2fan2

    The unfortunate problem is that major subscription-based companies (such as Adobe) do not follow that model.
    For instance, when your subscription runs out yes you can still "use" the program. But feature usage is severely limited and you can expect to run into "your license does not allow this action." This was the major concern with those of use who had a perpetual license to Substance Painter. If we "upgraded" to the new subscription, our work would essentially become view-only once the subscription runs out. Adobe now holds your, YOUR, work hostage if you don't pay the ransom. And therefore, your work is no longer your work.
  • edited October 2020
    Can I catch a time machine back to the 1990s?

    Supscription models for software are really, really stupid. Can I pay for software *once* and not have to keep paying you?
  • But then the CEO can't buy the newer model private jet!
  • Subscription models were beginning in the 1990s. SAS was one of the early products to rely on an annual subscription. Most of the Unix variants were similar though the annual subscription was officially for support. Describe tried to bring subscriptions into the world of PC word processing with a subscription that would be accompanied by quarterly update disks that would permit another 3 months of use. Unfortunately, trying to have higher prices and a subscription did not help Describe challenge any of the major word processors of the time.
  • Some subscriptions are in place of buying updates. They do not affect you after you have acquired the software. If the subscription is used to enforce use, such as periodic checkin and deactivations, then this is a different issue. It came to a head during the early part of this century.

    What companies write in their EULAs and other contracts, do not necessarily stand in court. It is illegal to advance things that clearly circumvent laws. For example, the 'reverse engineering' clause does not stand in court.

    In point, the nature of Microsoft's EULA has never been tested in court. It has come to court a number of times, but they caved in each time so that their ways might not be challanged. Selling used licences has been contested in court. It is not a breach of copyright, since the licence to copy that copy and to transfer that licence with its copies is not an act governed by copyright law. It has to deal with rights after first sale.
  • edited January 2021
    Continuing from my gripe with Firefox, there'll probably be a time I may wish to ditch it for good, or earlier, over a new thing I may see for 91 ESR (and 89 for regular Firefox)... the Proton design change. When I first saw it, I didn't like it. Too much light grey all round yet it's currently it's a work-in-progress but knowing developers, they'd just keep it that way. Once again, Pale Moon will be used if not fully satisfied (even if it's based on older Firefox code and YouTube and other "modern" sites would cause high CPU usage).
  • How many "radical redesigns" do they have to go through?
    The lack of variation in shades is poor. The lack of decent separation is poor. Keep trying to look like chrome which is already a poor UI. And make sure to ditch those sharp corners because you may cut yourself!

    When they added advertising to the new tab page, I already gave up on them.
  • edited January 2021
    Pale Moon's devs are jerks, removing the WebExtensions support their older Gecko base already had, yet keeping the quite insecure NPAPI (even though nobody actually supports it now that Flash is EOL), (and they tend to attract the worst kind of internet users, however New Moon and Mypal have a much less asshole-ish userbase and developers) and I use the other applications in the suite, so I have been using SeaMonkey lately. (It is slightly old but they have been backporting some newer code to a Gecko 56 base, and are working on a Gecko 60-based release)

    I nuked Pocket long ago, the only reason it exists is that Mozilla needs more money (because fewer people use Firefox, and so their CEO can buy more personal cruise ships)
  • @yourepicfailure You can have a blank page for new tabs, which I've always had set up.
  • Yes, but point being they're serving ads.
  • Not only are they serving ads on the new tab page, but it also advertises extensions and plugins as you surf, unless you go into settings and turn it off. I was a huge supporter of Quantum when it was first released, but Mozilla is pissing me off these days.
Sign In or Register to comment.