Software always needs updating, and delivering it to ships that are often out of contact is harder than it sounds. Get the update channel wrong and you have handed over a master key