[Reason077]

> "This is really weird thing to complain about."

What made you think the OP's post was a complaint? It seems reasonable to defer upgrades if you know they're going to break things and create a lot of extra admin work when you'd rather just be getting your job done.

I feel the same pain myself. Major macOS upgrades typically always break things, either in my dev environment or just by introducing bugs or breaking/removing/changing some random OS feature that I like using.

Its usually only Xcode which forces me to upgrade, since at some point in each release cycle Apple starts requiring the latest macOS for the latest Xcode, which in turn is required if you want to target/deploy to the latest iOS. If it wasn't for that I'd prefer to stick to one major version for 2-3 years.

[Suzuran]

Unacceptable. Deferring updates is always absolutely unacceptable. Security updates must always be given absolute priority over all other concerns. If security isn't breaking your workflow then your security is not extensive enough, and if security isn't your absolute top priority then you are doing security wrong. On the defensive side you are either perfect in your compliance or you are penetrated. This is an invariant. TLDR if security isn't breaking your workflow then your security isn't secure and you are part of the problem. You should be thankful when security stops you from working because that means your security is working.

[Reason077]

We're talking about major version updates, ie: going from Ventura (13.x) to Sonoma (14.x). Those are the ones that have signficant changes and tend to break things.

Apple does release maintenance and security updates for older macOS releases for several years (for example, Monterey 12.7.1 and Ventura 13.6.1 were both released in the past week or so). I always install those right away, as I assume most people do.

[Suzuran]

I apologize; I assumed the over-the-top tone and absurd sentence at the end would be taken as indications of obvious sarcasm.

If your own security (or anything else for that matter) prevents you from working it's clearly not to your benefit.

[xkcd-sucks]

I'm aware of at least one major academic lab, the kind where the PI is a rockstar scientist-cum-entrepreneur and gets a six figure salary from multiple institutions in addition to spinoff startup income, who has had cryptominer malware on their website servers for a few years and doesn't care to go beyond deleting executable every time the website is updated (which naturally comes back immediately afterwords)

Not that this is "acceptable" by any means, just a single calibration point