As someone who just retired a fairly interesting piece of software that had been running for 20 years (not immortal, but not too bad), I have a few thoughts: 1

As someone who just retired a fairly interesting piece of software that had been running for 20 years (not immortal, but not too bad), I have a few thoughts: 1) Have standards that don't change appreciably. I first wrote the system in the early days of the Web and put it into full production at or about 1997. The fact that HTTP, CGI and SQL didn't change much and continued to be supported helped immeasurably. 2) Use a platform that you can manage effectively. We started with SGI IRIX, then moved it to Linux, where it spent most of its life. That let us move it from machine to machine and finally a datacenter. This would have been more difficult on an OS with a commercial pressure to upgrade. 3) Be lucky with your language choice. I used Perl 5, which had just come out at the time. I started on Perl 4, but the OOP features of 5 were very attractive (was heavily influenced by articles I read about SmallTalk at the time). Because Perl 6 never really happened (for me), I avoided the Python 2.x/3.x problem. 4) Make it documentable. Every code object in the system could be easily documented (the editor included a comment field for everything, which could be automatically extracted to provide developer help). Not everyone who worked on the system used it, but I did, which made it easier to figure out what was going on years after I had been doing other things. 5) Make it straightforward. Not sure that's the best way to put it, but after I left the company, the system suffered a good chunk of updates and rewrites by people who knew more or less what they were doing, but because they had to remain compatible with the original, fairly simple architecture, I was always able to pick up the thread when I did contract maintenance on it. 6) Security is a process. At the time I wrote it, it was... let's say "fairly" secure. Some of the updates/rewrites badly degraded the capability-based security it had (the maintainers didn't understand it and thought it was decreasing performance (which, to be fair, it was), so my original security thinking was rolled under the pressure of customer requests and deadlines. Hope that helps!