The issue that makes us resist the idea of simply disabling updates altogether is that very often that will mean never update rather than update at someone’s discretion, and then we’re getting back to some of the problems that got us here in the first place. That’s why we’ve been resisting introducing that global switch, at least for the time being, and instead working with people to mitigate the bad side effects of having automatic updates enabled.
Today we’re already able to schedule the precise window in which the system should update within the day (potentially multiple windows, all with start/end times), and we’re also able to hold minor versions into independent tracks so that major bumps are not delivered automatically. Soon we’ll also start working on health checks, which will allow systems updated to automatically rollback if the system finds itself in a bad place after the update.
So, we understand this is a bit of a departure, but we’re honestly interested in trying to take this pretty unique opportunity to try to mitigate some of the recurring issues we’ve observed in the last so many years.
Given the understanding above, is there anything else we can do to help mitigate the real issues you’ve observed without simply turning updates off entirely?