content: I'm 2nd line at a small SaaS firm, we push updates most days (excluding friday, saturday). We've had two legitimate "oh shit that broke something bad" instances in the last two years, but mostly it's ok as we're not in the critical infrastructure business and we can get a significant number of fixes and feature requests pushed per build.  I'm more on the side of "don't touch my install if it works" but we're a hosted web application and the goalposts (browsers) keep moving so we're perpetually playing catchup. The majority of tickets are "how do I do complicated thing x", in third place are bug reports, which dev roll out promptly and everyone's a winner.  If we ran chernobyl it'd explain chernobyl, but we don't so we can get away without the overheads of change control and people vetting 150+ fixes/features a week for a single non-critical web app. I guess the best option would be letting the customer choose fast ring or slow, and having them worry about it, but there's not much uat they can do without us duplicating their system, which sounds like a monumental ballache for the payoff of "this way I guarantee email won't be broken for 6 hours!" that one time in 2014.