Nobody demos an upgrade
Keeping old software running is healer work that nobody sees because every instrument we own can only read changes.
There’s no before and after with an upgrade, no short video, nothing that fits on a slide. You get your turn in the demo and say the site still works. Everyone waits for the rest of it.
There isn’t a rest of it. It works the same as it did last week and it’ll still be working in two years. That last part took most of the fall.
Meanwhile the posts that do numbers are the ones you already know. Somebody launched a framework. Somebody rewrote a thing in Rust. Somebody’s got a build tool that’s 40x faster than the build tool that was 40x faster than the one before that.
And I read those. I’ve lost a whole evening to a changelog before. So I’m not above any of it lol.
But nearly all of the software that actually matters to anyone’s life is old. Right now it’s being kept upright by somebody whose name you don’t know. I feel like we’ve built an industry with no instrument that can see that person.
Who set this to 47?
The work is unglamorous in a very specific way. The specifics matter because “maintenance” as a word smuggles in a picture of somebody oiling a hinge.
It’s reading a stack trace down through several layers of framework written by people who left in 2019. It’s finding a config value set to 47, figuring out that nobody currently employed knows why, and then deciding whether you’re brave enough to change it. It’s bumping a patch version and watching half the test suite go red for reasons that have nothing to do with your bump. It’s writing a shim, documenting the shim, and then deleting the shim two years later when the fix finally lands upstream.
None of that photographs. You can’t screenshot it and there’s no diff a client would recognize as work. The best possible outcome of doing all of it perfectly is that nothing happens, which from the outside is identical to having done nothing.
It’s healer work. Nobody says your name for the whole raid. Then somebody dies once and everybody knows it.
Nothing happened, you’re welcome
I keep coming back to this. I don’t think it’s really about ingratitude. It’s more mechanical than that, and a little worse.
Every instrument we own reads changes. Standup is what you did since yesterday. The changelog is what moved. Git blame is a list of differences with names attached.
The paperwork works the same way. A promotion case is a list of things that exist now and didn’t before. An agency case study is a before and an after. An invoice is itemized by thing-done.
Maintenance doesn’t produce a difference. It produces a state that stays the same on purpose. So every one of those instruments points at it, reads zero, and reports honestly that nothing is there.
Nobody in that chain is being unfair to anyone. The ruler just doesn’t have that measurement on it.
For the same reason, nobody buys maintenance until after their first incident. The product is a non-event. A non-event is indistinguishable from not having bought anything, right up until the week that it isn’t.
Legacy is a compliment
I did a whole post about a word last month so I know how this looks. But “legacy” means something handed down. An inheritance. Somebody died and left you a thing they thought was worth having.
And we’ve turned it into a soft insult, a way of saying “this is embarrassing and we should really do something about it,” when 9 times out of 10 it actually means “this is in production and it makes money.”
Software only gets to be legacy by surviving. The stuff that failed never earned the word. It just got deleted, and nobody has ever complained about a legacy system that nobody used.
So I think the label is backwards. It’s the badge for having been useful long enough to become somebody else’s problem. We hand it over like a diagnosis.
Something like 3/4 of the web still has jQuery on it, depending on whose survey you trust. When New Jersey’s unemployment system buckled in the spring of 2020, the state went on television asking for COBOL programmers. I’d bet money that nobody who wrote that system thought of it as a legacy concern. It was just the system. It still is.
And the argument for old software isn’t sentimental. Boring technology is technology whose bugs have already been found by thousands of people who aren’t you. That’s not a consolation prize. It’s the entire value proposition.
It only accrues with time so it can’t be bought or borrowed or hurried. A framework that’s been out in the world for 15 years has had every one of its gotchas filed down by somebody else’s bad night. Yours hasn’t. You’re going to be the one finding them, at 2 am, in prod.
I know, I know
Some old code really is a millstone and I’m not going to pretend otherwise. There are stacks that hold a team hostage, where every small feature costs triple and nobody new can be onboarded without a three-week tour. At some point the honest read is that the thing has to go. Fine. I’d just say two things.
(1) The choice on the table is almost never old thing vs. new thing. It’s old thing vs. 18 months of releasing nothing, followed by a new thing that will itself be legacy by 2032 and maintained by people who weren’t there for any of the arguments.
And (2) base rates. Count the big rewrites you’ve personally watched land on time and do what the pitch said. Then count the ones that quietly became a second system everybody now maintains alongside the first. That ratio isn’t encouraging.
I think it’s more useful to quit arguing about the codebase in general and name the specific thing instead. “The runtime stops getting security patches in 14 months.” “Changes to the ordering flow take three times as long as changes anywhere else and here’s why.”
Those are claims somebody can check, budget for, and say yes to. The first one comes with a date that somebody outside the building already picked. I argued last month that a date like that is most of the reason this kind of work ever gets done. “It’s legacy” is a claim about a vibe.
Nebraska
Everything above is at least a job somebody is being paid for. The version with no invoice attached anywhere is what actually gets to me.
You’ve seen the xkcd: all of modern infrastructure drawn as a tower of blocks, balanced on one small piece that some random person in Nebraska has been thanklessly maintaining since 2003. Funny as a cartoon and not funny at all as a description.
Heartbleed happened and we all found out that OpenSSL, the thing encrypting a serious fraction of the internet, was basically a couple of people and a donations page. Log4Shell was three years ago this week. A lot of us spent that December demanding fixes from volunteers who were doing it after their real jobs, for free, for us.
I’m no closer to a fix for the funding half of the dependency-tree problem than I was years ago. I’ve got a few small things:
- Say thanks in the issue, out loud, where it’s archived and the next person can see it.
- Sponsor a maintainer if you’re employed and they’ve got a link up, even at the $5 tier. The money matters less than a stranger deciding you’re worth $5 a month.
- Write the thankless PR, the docs fix, the flaky test, the dependency bump nobody wants.
And it might be worth reading your comment back for tone before you post it. I’m thinking of the kind that demands a fix, with an edge to it, from a person who has never been paid a cent for any of this and is replying at 11 pm because they feel bad about the delay. I don’t know what we do about that as a culture except be the one who doesn’t do it.
Say it in the standup
I’ve really only changed one small thing about my own behavior. It’s the only actionable thing in this whole post.
In the demo I don’t say the upgrade is done. I say what didn’t happen. “We’re off the version that stops getting security patches in the spring.” “Here are the four things that would have broken when the host moved us on their own schedule, with two weeks’ notice, in the middle of the busiest month of the year.”
It turns out people are perfectly willing to be interested in a non-event as long as you tell them what the event would have been. So when you’re deciding what gets called out in a review, a retro, or an end-of-month note to a client, the upgrade isn’t going to advocate for itself. It’s invisible by design. It has no demo and it won’t come up on its own. Somebody in the room has to name it. It might as well be whoever noticed first.
And the person on a team who does the runtime bumps and reads the deprecation notices and quietly keeps the whole thing from falling over gets none of it because every instrument in this industry is pointed somewhere else 😔 Everybody else builds the fun new thing on a floor that they are holding up. Somebody ought to say so in their standup this week.