@stefano
I think there are FUDs.
"No updates" could cause them (especially security officers) fear whether or not there are vulnerabilities, even if there are actually none by design and "the size of codes".
Maybe announcements "We've reviewed our code finding CVExxx for product A by (3rd party name), resulting no same vulnerabilities exists in our codes. You don't need to worry about updates here." could help? "Updates" are not limited with codes.

@stefano Having software that’s “done,” doesn’t fit into any business plan people can think of. And yet it was always what I aspired to, as well.

@stefano The versions of TeX started with version 3. The next update was 3.1, then 3.14, 3.141, 3.1415, etc. The current version is 3.141592653. Each update adds a digit of pi, with the idea that every update makes it not much larger, but closer and closer to the ideal pi.

@stefano

A really interesting read. Thanks 👍🙂

@stefano

Thank you for sharing. Interesting read

@stefano That's fine if your users don't insist on regular updates to dependencies to fix each day's crop of CVEs.

@stefano Thank you for an amazing piece. Just recently I thought about some examples of "feature-complete" software and how it's actually important.
fluxbox and lilo come to mind.

@stefano but if you have no updates, how can you build a subscription model for your app? 🤔