Dependable and boring
Upgrades nobody live-tweets, and the weird insult we have made of the word legacy.
There’s a particular kind of post that does numbers and you know exactly the one. Somebody launched a framework. Somebody rewrote a thing in Rust. Somebody’s got a build tool that’s 40x faster than the build tool that was 40x faster than the one before it. And look, I read those posts. I have genuinely lost an evening to a changelog before, I’m not above any of this.
But the posts that never do numbers are the ones where somebody spent five months getting a nine-year-old app onto a supported runtime without breaking anybody’s Tuesday. Nobody writes “we upgraded” as a launch. There’s no demo video for the outage that didn’t happen. And I think that’s kinda backwards, because as far as I can tell almost all of the software that actually matters to people’s lives is old, and it is being kept alive right now by someone whose name you don’t know.
Mostly it’s archaeology
The work itself is deeply unsexy, which I suspect is most of the problem. It’s reading a stack trace down through four layers of abstraction written by people who left the company in 2019. It’s figuring out why a config value is set to 47, concluding that nobody alive knows, and then deciding whether you’re brave enough to change it. It’s bumping a minor version and watching 340 tests go red for reasons that have nothing to do with your change. It’s writing a shim, documenting the shim, and then deleting the shim two years later when upstream finally lands the fix.
None of that photographs well. You can’t screenshot it. And the best possible outcome of doing it perfectly is that nothing happens, which unfortunately looks completely identical to doing nothing.
The best possible outcome of maintenance is that nothing happens, which looks completely identical to doing nothing.
It’s goalkeeper work. 90 minutes of standing around in the cold and the only way anyone learns your name is if you screw it up. So the incentives are just straightforwardly bad: you get promoted for the thing you shipped, not for the seven incidents that never got written up because you did the migration properly in March.
Legacy is a weird word for it
I keep getting stuck on this one. “Legacy” means something handed down to you. Inheritance. Somebody died and left you something of value. And we’ve somehow turned it into an insult, a way of saying “this is embarrassing and we should really do something about it,” when nine times out of ten what it actually means is “this is in production and it makes money.”
Something like three quarters of the web still has jQuery on it, depending on whose numbers you trust. When New Jersey’s unemployment system buckled in 2020 the state went on television asking for COBOL programmers, and I promise you nobody involved in writing that system in the seventies thought of it as a legacy concern. It was just the system. It still is.
The thing is that boring technology is technology whose bugs have already been found by ten thousand people who aren’t you. That’s not a consolation prize, that’s the entire value proposition, and it’s a value that only accrues with time and can’t be bought or shortcut. A framework that’s been in the wild for 15 years has had every one of its sharp edges filed down by someone else’s bad night. Your brand new one hasn’t, and you’re going to be the one finding them, at 2 am, in prod.
I know the counter here and it’s a fair one. Some old code really is a millstone. There are stacks that hold a team hostage, where every feature costs triple and nobody can onboard, and at some point the honest read is that the thing has to go. Sure. I’d just say two things. First, the choice on the table is almost never “old thing vs. new thing,” it’s “old thing vs. 18 months of shipping nothing, followed by a new thing that will itself be legacy by 2032.” Second, base rates. Think about how many big rewrites you’ve watched land on time and deliver what the pitch promised, versus how many quietly became the second system everyone’s now maintaining alongside the first. That ratio is not encouraging.
The part where nobody’s getting paid
The version of this that actually keeps me up is the open source one.
Everyone’s seen the xkcd about modern infrastructure being a tower of blocks balanced on one tiny piece some random person in Nebraska has been thanklessly maintaining since 2003. It’s funny because it’s a cartoon and not funny at all because it’s just true. Heartbleed happened and we all found out that OpenSSL, the thing encrypting a serious fraction of the internet, was essentially one guy and a donations page. Log4Shell happened and the internet spent a frantic December demanding fixes from volunteers who were doing this after their actual jobs, for free, for us.
And then there are the issue threads. You’ve read them. Someone demanding a fix, in a tone, from a person who has never been paid a cent for any of it and is answering at 11 pm because they feel bad. I don’t really know what we do about that culturally except notice it, and be the person who doesn’t do it.
So the small stuff, I guess. Say thanks in the issue, out loud, where it’s archived. Sponsor a maintainer if you’re employed and they’ve got a link up, even the five dollar tier, because the money matters less than a human being deciding you’re worth five dollars a month. Write the boring PR: the docs fix, the flaky test, the dependency bump nobody wants. And at work, when you’re deciding what gets called out in a review or a standup, remember that the upgrade is invisible by design and will not advocate for itself. Somebody has to say it.
If you’re the one on your team who does the runtime bumps and reads the deprecation notices and quietly keeps the thing from falling over: I know that mostly feels like nothing, because the whole reward structure of this industry is pointed somewhere else 🥲. But the reason everyone else gets to build the shiny thing is that you’re holding the floor up underneath them. That’s not maintenance work sitting below the real work. That is the real work, and the new stuff is a rounding error on top of it.
I’ve shipped plenty of things I then abandoned for somebody else to inherit, so I’m hardly clean here. But go thank a maintainer this week. It’s free.