Nobody demos an upgrade

Nobody demos an upgrade. There’s no before and after, no short video, nothing that fits on a slide. You get your turn, you say the site still works, and then everyone waits for the rest of it. There isn’t a rest of it. It works the same as it worked last week. It’ll still be working in two years, and that last part is what took most of the fall.

Meanwhile the posts that do numbers are the ones you already know. Somebody launched a framework. Somebody rewrote a thing in Rust. Somebody’s got a build tool that’s 40x faster than the build tool that was 40x faster than the one before that. And I read those. I have lost a whole evening to a changelog before. So I’m not above any of it lol

But nearly all of the software that actually matters to anyone’s life is old, and right now it is being kept upright by somebody whose name you don’t know. I can’t help but think we’ve built an industry with no instrument that can see that person.

Who set this to 47?

The work is unglamorous in a very specific way, and the specifics matter, because “maintenance” as a word smuggles in a picture of somebody oiling a hinge.

It’s reading a stack trace down through several layers of framework written by people who left in 2019. It’s finding a config value set to 47, figuring out that nobody currently employed knows why, and then deciding whether you’re brave enough to change it. It’s bumping a patch version and watching half the test suite go red for reasons that have nothing to do with your bump. It’s writing a shim, documenting the shim, and then deleting the shim two years later when the fix finally lands upstream.

None of that photographs. You can’t screenshot it, there’s no diff a client would recognize as work, and the best possible outcome of doing all of it perfectly is that nothing happens, which from the outside is identical to having done nothing.

It’s healer work. Nobody says your name for the whole raid, and then somebody dies once and everybody knows it.

Nothing happened, you’re welcome

I keep coming back to this. I don’t think it’s really about ingratitude. It’s more mechanical than that, and a little worse.

Every instrument we own reads changes. Standup is what you did since yesterday. The changelog is what moved. Git blame is a list of differences with names attached. A promotion case is a list of things that exist now and didn’t before. An agency case study is a before and an after. An invoice is itemized by thing-done.

Maintenance doesn’t produce a difference. It produces a state that stays the same on purpose. So every one of those instruments points at it, reads zero, and reports honestly that nothing is there. Nobody in that chain is being unfair to anyone. The ruler just doesn’t have that measurement on it.

Which is the same reason nobody buys maintenance until after their first incident. The product is a non-event, and a non-event is indistinguishable from not having bought anything, right up until the week that it isn’t.

Legacy is a compliment

I did a whole post about a word last month so I’m aware of how this looks, but “legacy” means something handed down. An inheritance. Somebody died and left you a thing they thought was worth having. And we’ve turned it into a soft insult, a way of saying this is embarrassing and we should really do something about it, when 9 times out of 10 what it actually means is this is in production and it makes money.

Software only gets to be legacy by surviving. The stuff that failed never earned the word, it just got deleted, and nobody has ever complained about a legacy system that nobody used. So the label is backwards. It’s the badge for having been useful long enough to become somebody else’s problem. We hand it over like a diagnosis.

Something like 3/4 of the web still has jQuery on it, depending on whose survey you trust. When New Jersey’s unemployment system buckled in the spring of 2020, the state went on television asking for COBOL programmers. I’d bet money that nobody who wrote that system thought of it as a legacy concern. It was just the system. It still is.

And the argument for old software isn’t sentimental, it’s that boring technology is technology whose bugs have already been found by thousands of people who aren’t you. That’s not a consolation prize. It’s the entire value proposition. It only accrues with time, so it can’t be bought or borrowed or hurried. A framework that’s been out in the world for 15 years has had every one of its gotchas filed down by somebody else’s bad night. Yours hasn’t. You’re going to be the one finding them, at 2 am, in prod.

I know, I know

Some old code really is a millstone and I’m not going to pretend otherwise. There are stacks that hold a team hostage, where every small feature costs triple and nobody new can be onboarded without a three-week tour, and at some point the honest read is that the thing has to go. Fine. I’d just say two things.

(1) The choice on the table is almost never old thing vs. new thing. It’s old thing vs. 18 months of releasing nothing, followed by a new thing that will itself be legacy by 2032, maintained by people who weren’t there for any of the arguments. And (2) base rates. Count the big rewrites you have personally watched land on time and do what the pitch said, then count the ones that quietly became a second system everybody now maintains alongside the first. That ratio is not encouraging.

The more useful move is to quit arguing about the codebase in general and name the specific thing instead. The runtime stops getting security patches in 14 months. Changes to the ordering flow take three times as long as changes anywhere else and here’s why. Those are claims somebody can check, budget for, and say yes to, and the first one comes with a date that somebody outside the building already picked, which last month I argued is most of the reason that kind of work ever gets done. “It’s legacy” is a claim about a vibe.

Nebraska

Everything above is at least a job somebody is being paid for. The version that actually gets to me is the one with no invoice attached anywhere.

You’ve seen the xkcd: all of modern infrastructure drawn as a tower of blocks, balanced on one small piece that some random person in Nebraska has been thanklessly maintaining since 2003. Funny as a cartoon and not funny at all as a description. Heartbleed happened and we all found out that OpenSSL, the thing encrypting a serious fraction of the internet, was basically a couple of people and a donations page. Log4Shell was three years ago this week, and a lot of us spent that December demanding fixes from volunteers who were doing it after their real jobs, for free, for us.

I’m no closer to a fix for the funding half of the dependency-tree problem than I was years ago. I’ve got something small. Say thanks in the issue, out loud, where it’s archived and the next person can see it. Sponsor a maintainer if you’re employed and they’ve got a link up, even the $5 tier, because the money matters less than a stranger deciding you’re worth $5 a month. Write the thankless PR, the docs fix, the flaky test, the dependency bump nobody wants.

And read the tone of your comment back before you post it. The one I mean is somebody demanding a fix, with an edge to it, from a person who has never been paid a cent for any of this and is replying at 11 pm because they feel bad about the delay. I don’t know what we do about that as a culture except be the one who doesn’t do it.

Say it in the standup

The one thing I’ve genuinely changed about my own behavior is small. It’s the only actionable thing in this whole post. In the demo I don’t say the upgrade is done. I say what didn’t happen. We’re off the version that stops getting security patches in the spring. Here are the four things that would have broken when the host moved us on their own schedule, with two weeks’ notice, in the middle of the busiest month of the year. People are perfectly willing to be interested in a non-event, it turns out, as long as you tell them what the event would have been.

So when you’re deciding what gets called out in a review, a retro, an end-of-month note to a client, remember that the upgrade is invisible by design and will not advocate for itself. It has no demo and it will not come up on its own. Somebody in the room has to name it. It might as well be whoever noticed first.

And the person on a team who does the runtime bumps and reads the deprecation notices and quietly keeps the whole thing from falling over gets none of it, because every instrument in this industry is pointed somewhere else 🥲 Everybody else builds the fun new thing on a floor that they are holding up. Somebody ought to say so in their standup this week.