The Goldilocks zone of software stability

Not too new, not too old. The post The Goldilocks zone of software stability appeared first on The Old New Thing.

Apr 8, 2025 - 18:30

I’ve learned that the enterprise product support folks talk about the “Goldilocks zone” of software stability. Sometimes, their enterprise customers are running software (particularly anti-malware software) that hasn’t been updated in years. That’s too old. Sometimes, their software was updated just a few days ago. That’s too new. In between is the Goldilocks zone, where the software is old enough to be stable, but not so old that it’s obsolete.

The name “Goldilocks zone” is a reference to the English fairy tale of Goldilocks and the Three Bears. In the most common version of the story, a young girl stumbles into an unoccupied home and finds various items in sets of three. The first item in each set is bad in some way (too hot, too soft), the second item is bad in the opposite way (too cold, too hard), and the third item is just right.

Anti-malware software in particular is prone to the Goldilocks effect because they often do sketchy unsupported things with the operating system, so the longer it’s been since you updated it, the more likely that changes to the operating system have invalidated or at least partially invalidated the assumptions under which they were written. Furthermore, anti-malware software is under enormous time pressure to respond to new threats, so the changes may have been rushed out without broad enough testing.

On the other hand, all software is at risk of running into problems immediately upon release because it’s hard to test against every possible end user configuration.¹ As the saying goes, no plan survives first contact with the enemy.

¹ Another possibility is that the change didn’t have enough bake time.

The post The Goldilocks zone of software stability appeared first on The Old New Thing.