From: seaohveh@hoffmanlabs.invalid   
      
   On 2026-02-15 19:23:00 +0000, John Dallman said:   
      
   > In article <10mst4a$5o8o$1@dont-email.me>, seaohveh@hoffmanlabs.invalid   
   > (Stephen Hoffman) wrote:   
   >   
   >> The concept that computers and apps are fixed and unchanging over time   
   >> is becoming increasingly rare yes, outside of SCADA and  process   
   >> control and factory floor environments, and enterprise  environments,   
   >> and such; long-term deployments.   
   >>   
   >> And even within those LTS-aligned environments, changes such as   
   >> encryption and authentication and related hardening are becoming   
   >> required, and which then causes other changes within the apps and   
   >> hardware configurations.   
   >   
   > The rule I work to is that if a system is always air-gapped and cannot   
   > communicate with any other computer, even via exchangeable media   
   > (floppy drives, USB sticks, etc), then it can be frozen. Anything else   
   > needs security updates, and if there's software in the stack that does   
   > not get security updates, it has to go.   
      
   I follow similar, though with the "isolated" network and server   
   operations instrumented and monitored. Canaries, too. Isolation is   
   nice. I like isolation. But I don't trust it to be maintained.   
      
   >> For vendors, maintaining ABIs and to a lesser extent APIs becomes   
   >> increasingly costly, difficult, and problematic, and less useful  given   
   >> the apps themselves are increasingly being continuously  rebuilt.   
   >   
   > It's not actually that hard, but the understanding of how to do it   
   > right seems to be very rare.   
      
   Oh, it gets much harder when the API or ABI no longer reflects current   
   reality, and you're left to break ABIs or downgrade operations.   
      
   >> DEC sought to provide a degree of ABI and API stability, which _   
   >> *looks around* _ clearly wasn't a particularly viable business  model.   
   >> Not for funding competitive product development work, and  not for   
   >> maintaining and growing the customer base.   
   >   
   > OTOH, the Linux kernel maintains its ABIs and API very thoroughly, with   
   > the objective that changes within the kernel can't break applications.   
      
   That's a goal of many platforms. OpenVMS has an extensive ABI and API   
   test suite. (One or two things slipped by it over the years too, such   
   as the BACKUP ABI.)   
      
   >> LTS is a hard problem, and that in various dimensions.   
   >   
   > Notably, it involves risks that can't be predicted.   
      
   And some future changes that just can't be (or weren't) predicted, too.   
      
      
   --   
   Pure Personal Opinion | HoffmanLabs LLC   
      
   --- SoupGate-Win32 v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)