6 ms·

Cool project and write up. An aside - while I love the snark and making fun of these "legacy" systems, it has given me a window into my own maturity as an engi

Cool project and write up. An aside - while I love the snark and making fun of these "legacy" systems, it has given me a window into my own maturity as an engineer. I was absolutely this cavalier and cocky about poorly implemented systems I've been a user or admin of in the past. But having now spent nearly a decade and a half getting paid for this work and seeing a lot of stuff and the evolution of best practices, I have much more empathy for the organizations and authors of these systems. There are very very few programs that ever achieve something like elegance and beauty when they collide with the real world.

ok123456 3y ago
Judging from the javascript, they scraped. The system they were scrapping would have been cutting-edge in 2004-5. Keeping something running that long, duck tape and all, is no small feat.
simonask 3y ago
I totally get what you mean, and I feel kind of the same but in reverse: When I was young, I was totally making systems like this legacy dumpster thermal experience. A lot of this stuff is hacked together by young aspiring programmers just finding their footing, often grossly underpaid, and with very little experience or formal training. Which is great, respect the hustle! But not so super when personal data is being handled. Luckily, it kind of looks like they maybe dodged that bullet in this case? Lesson of the day is: Use different passwords for each thing you log in to. :-)
- bigfatfrock 3y ago
  > A lot of this stuff is hacked together by young aspiring programmers just finding their footing, often grossly underpaid, and with very little experience or formal training. Which is great, respect the hustle! But not so super when personal data is being handled. Luckily, it kind of looks like they maybe dodged that bullet in this case? This is an odd generalization to me - are the massive mainframe COBOL systems handling personal data at banks to this day, "hacked together" by underpaid young programmers? I'm sure they were underpaid... but inexperienced with no formal training?
  - deleted 3y ago
    [deleted]
  - bongodongobob 3y ago
    You went straight to massive fortune 50. Guess what, there are 100s of thousands of businesses in the US. Most aren't fortune 50. Here are some other kinds of business: Freight Logistics Concrete Construction Eyeglasses Lawn care Plumbing Cabinet making Law Office Hair styling These small shops run on bespoke industry specific software with few competitors. They are often buggy and out of date because there is only one game in town a lot of times. There is more to the world than huge businesses headquartered in NYC or SF.
    - whatever1 3y ago
      all of them use QuickBooks!
  - red-iron-pine 3y ago
    > but inexperienced with no formal training? someone doesn't have any experience with offshore programmers, eh?
    - dartos 3y ago
      SAP contractors hurt you too?
      - red-iron-pine 3y ago
        yes, unironically
steinuil 3y ago
Definitely agree. My first few gigs were in consultancy and after seeing how the sausage is made I don't feel much like calling out these kinds of old systems anymore. The budgets and deadlines are tight, the people working on them are often inexperienced and underpaid and have little time to sit down and think things through, and when they have to work on an old system to add some features they have little time and incentives to improve the overall state of things.
dundun 3y ago
There's a ton of dunning-kruger going on, but I think as college kids riding a high of winning a contest and learning a ton, it can be excused.
- rjbwork 3y ago
  Absolutely. I'm not trying to dump on them. It may not have come through with my choice of verbiage, but there's something romantic (in the aesthetic sense) and admirable about what they've done and their attitudes. That kind of unbridled optimism and confidence of youth that can be hard to cultivate as we get older.
- mewpmewp2 3y ago
  Life is full of cringe and certainly I have had more than my fair share of it, who am I to judge anyone. Maybe I am even far more cringe than an average person, or maybe I notice my cringe much more, I hope it is the last, but I can never tell.
limaoscarjuliet 3y ago
Turning 50 this year, writing code for living, and could not agree more. I used to think all must be re-written and refactored. "Old crap must go". "I can do it better". But then one realizes the rewritten system is "crap" to someone else soon. Learning existing system is harder than to create something seemingly equivalent that author understands well. For some time at least.
- leetrout 3y ago
  My measuring stick is how much the team can understand what is happening. When the team at large cannot move through the codebase and effectively make changes then it is time to make changes. If the code is on the back burner and only receiving maintenance then no need to mess with it. But active feature development? Teams need to have a grasp on it and have a way to get a mental model of what is happening.
  - lazyasciiart 3y ago
    A team that can’t understand what the code does now is not going to write a functional replacement any time soon.
    - whstl 3y ago
      In a dysfunctional company where "the code is the documentation"? Yeah. If there are knowledgeable people to lead the process, and the transition is done appropriately: it is 100% possible and I have done multiple times in my career. The burden on rewriting shouldn't lie in developers alone. And before someone quotes Spolsky: not every software is Netscape Navigator.
  - gertlex 3y ago
    Corollary: If the change is going to make it harder to effectively make changes (and figure out changes that need to be made, i.e. manual troubleshooting), it's probably a bad change. (this corollary might be most applicable in robotics?; dealing with the fallout of kubernetes being forced onto robots by cloud-oriented folks)
bigfatfrock 3y ago
100%, I love debugging and digging through legacy systems, personally, yet have only run into co-workers in my career over the years that loathe and fear them! Being able to jump in and put out fires on a building that's already built has served me very well in my career, but in overall satisfaction as well!
paxys 3y ago
I partially agree. While there is nothing wrong with boring "legacy" systems, and the world runs on them, practices like sending plain text passwords over email and all other security failures mentioned in the post are inexcusable. Software like Atrium is a perfect example of companies getting large contracts (usually in the public sector) through connections/corruption and outsourcing development for pennies, with no quality control or other oversight. This stuff should not be romanticized. In fact there is a non-zero chance that the company's response to this blog post will be to file a lawsuit against these students for "hacking" and ruining their lives, as has happened many times in the past in such cases.
- gorjusborg 3y ago
  While I do not like the 'get out of breach free card' that companies like Equifax seem to get, your tone has that exact sort of arrogance that smacks of immaturity. You just can't always apply today's sensibilities to code that has lasted longer than your life so far. I agree that companies need to be held responsible for their decisions not to update security, but that's a different (related) issue than 'legacy'. I am more concerned with legislation and law enforcement. That's the real way to fix things. Rust rewrites wont change business incentives.
  - elondaits 3y ago
    I’m 46 and been working professionally since the late 90s. There was never a time in the history of the web when storing user passwords in plaintext was OK. Encrypted passwords were already well established in UNIX.. although I remember using systems without shadow passwords or salt.
    - gorjusborg 3y ago
      I am similar age, and there is software older than us that is still running.
HeyLaughingBoy 3y ago
> There are very very few programs that ever achieve something like elegance and beauty when they collide with the real world. I write embedded systems. Tell me about it!
zachmu 3y ago
Mocking bad systems like this is all fun and games but it definitely demonstrates your inexperience. Eventually you realize this is just normal, most stuff is as bad as this in one way or another. Mocking it all would be your full time job. And you just get tired of it.
hondo77 3y ago
Yeah, the best thing about hiring people "fresh out of college" (or whatever the equivalent is today) is that they see things with fresh eyes and want to change everything. The worst thing about hiring people fresh out of college is that they see things with fresh eyes and want to change everything. ;-)
- sanderjd 3y ago
  This is a really good insight! The key is to say yes to the good ideas and no to the bad ones.
ipaddr 3y ago
Nothing screams junior dev like the snark of things they don't understand
theideaofcoffee 3y ago
I have a similar length of experience as you, but I'm on the opposite side of the fence and side with the students in this case. If an organization is willfully putting out and maintaining shit products year after year and equivocating about how updating things to be more in-line with modern practices is oh so difficult and oh so expensive, maybe they do deserve to be mocked. If they're making an effort, that's a different story. There's really no excuse to keep insecure and outdated things out in the wild except for organizational laziness. Stand behind and maintain the crap you sell or don't sell it at all. I think as a profession we need more derision and mockery of poorly made, documented and maintained shit and less reverting to robotic response of "you just don't understand, man".
- rjbwork 3y ago
  I don't necessarily disagree. But you get what you pay for. These public institutions typically put out bids for projects and take the lowest one. Incentives matter and these types of organizations are incentivizing the production of cheap and poorly made software.
sanderjd 3y ago
haha I had this same exact thought while reading it. "Oh sweet summer child..." To me it seems like a miracle anyone ever had the budget to create this kind of website to begin with, let alone to "keep up with the times" :)
cortesoft 3y ago
Yeah, once you have gone through a few cycles or your cutting edge approaches becoming standard and then becoming legacy and outdated, you realize the treadmill never stops.
lowercased 3y ago
Within a couple years of working professionally, I went from "who on earth would do X?" to "ah... almost certainly they were forced to do X by ..." some external factors - time/deadline, workaround to another bad system, or management pressure for some weird reason. Sometimes it turned out to be just "really naive dev copy/pasting", but that wasn't a majority of the cases. What still bugs me though is that when poorly done/hacky/broken systems still 'work', the assumption is that everything is 'fine'. When I'm needing to work with those systems, the assumption by others (management, other devs, whoever) is ... "why is this taking so long? just do XYZ and move on!" not understanding that often I'm discovering all the ways the broken system is broken - very hidden things, bad docs, charset issues, speed, incorrect data coming back that other consumers just 'know' to hack around (without it being documented anywhere, etc). It's not frustration at the devs of the other system as much as the pressure you face when others don't realize how much workaround you're needing to do to do something 'simple'. And yeah, it should be simple, if the broken system wasn't broken in the first place.

ok123456 3y ago

Judging from the javascript, they scraped. The system they were scrapping would have been cutting-edge in 2004-5. Keeping something running that long, duck tape and all, is no small feat.

simonask 3y ago

I totally get what you mean, and I feel kind of the same but in reverse: When I was young, I was totally making systems like this legacy dumpster thermal experience. A lot of this stuff is hacked together by young aspiring programmers just finding their footing, often grossly underpaid, and with very little experience or formal training. Which is great, respect the hustle! But not so super when personal data is being handled. Luckily, it kind of looks like they maybe dodged that bullet in this case? Lesson of the day is: Use different passwords for each thing you log in to. :-)

bigfatfrock 3y ago
> A lot of this stuff is hacked together by young aspiring programmers just finding their footing, often grossly underpaid, and with very little experience or formal training. Which is great, respect the hustle! But not so super when personal data is being handled. Luckily, it kind of looks like they maybe dodged that bullet in this case? This is an odd generalization to me - are the massive mainframe COBOL systems handling personal data at banks to this day, "hacked together" by underpaid young programmers? I'm sure they were underpaid... but inexperienced with no formal training?
- deleted 3y ago
  [deleted]
- bongodongobob 3y ago
  You went straight to massive fortune 50. Guess what, there are 100s of thousands of businesses in the US. Most aren't fortune 50. Here are some other kinds of business: Freight Logistics Concrete Construction Eyeglasses Lawn care Plumbing Cabinet making Law Office Hair styling These small shops run on bespoke industry specific software with few competitors. They are often buggy and out of date because there is only one game in town a lot of times. There is more to the world than huge businesses headquartered in NYC or SF.
  - whatever1 3y ago
    all of them use QuickBooks!
- red-iron-pine 3y ago
  > but inexperienced with no formal training? someone doesn't have any experience with offshore programmers, eh?
  - dartos 3y ago
    SAP contractors hurt you too?
    - red-iron-pine 3y ago
      yes, unironically

steinuil 3y ago

Definitely agree. My first few gigs were in consultancy and after seeing how the sausage is made I don't feel much like calling out these kinds of old systems anymore. The budgets and deadlines are tight, the people working on them are often inexperienced and underpaid and have little time to sit down and think things through, and when they have to work on an old system to add some features they have little time and incentives to improve the overall state of things.

dundun 3y ago

There's a ton of dunning-kruger going on, but I think as college kids riding a high of winning a contest and learning a ton, it can be excused.

rjbwork 3y ago
Absolutely. I'm not trying to dump on them. It may not have come through with my choice of verbiage, but there's something romantic (in the aesthetic sense) and admirable about what they've done and their attitudes. That kind of unbridled optimism and confidence of youth that can be hard to cultivate as we get older.
mewpmewp2 3y ago
Life is full of cringe and certainly I have had more than my fair share of it, who am I to judge anyone. Maybe I am even far more cringe than an average person, or maybe I notice my cringe much more, I hope it is the last, but I can never tell.

limaoscarjuliet 3y ago

Turning 50 this year, writing code for living, and could not agree more. I used to think all must be re-written and refactored. "Old crap must go". "I can do it better". But then one realizes the rewritten system is "crap" to someone else soon. Learning existing system is harder than to create something seemingly equivalent that author understands well. For some time at least.

leetrout 3y ago
My measuring stick is how much the team can understand what is happening. When the team at large cannot move through the codebase and effectively make changes then it is time to make changes. If the code is on the back burner and only receiving maintenance then no need to mess with it. But active feature development? Teams need to have a grasp on it and have a way to get a mental model of what is happening.
- lazyasciiart 3y ago
  A team that can’t understand what the code does now is not going to write a functional replacement any time soon.
  - whstl 3y ago
    In a dysfunctional company where "the code is the documentation"? Yeah. If there are knowledgeable people to lead the process, and the transition is done appropriately: it is 100% possible and I have done multiple times in my career. The burden on rewriting shouldn't lie in developers alone. And before someone quotes Spolsky: not every software is Netscape Navigator.
- gertlex 3y ago
  Corollary: If the change is going to make it harder to effectively make changes (and figure out changes that need to be made, i.e. manual troubleshooting), it's probably a bad change. (this corollary might be most applicable in robotics?; dealing with the fallout of kubernetes being forced onto robots by cloud-oriented folks)

bigfatfrock 3y ago

100%, I love debugging and digging through legacy systems, personally, yet have only run into co-workers in my career over the years that loathe and fear them! Being able to jump in and put out fires on a building that's already built has served me very well in my career, but in overall satisfaction as well!

paxys 3y ago

I partially agree. While there is nothing wrong with boring "legacy" systems, and the world runs on them, practices like sending plain text passwords over email and all other security failures mentioned in the post are inexcusable. Software like Atrium is a perfect example of companies getting large contracts (usually in the public sector) through connections/corruption and outsourcing development for pennies, with no quality control or other oversight. This stuff should not be romanticized. In fact there is a non-zero chance that the company's response to this blog post will be to file a lawsuit against these students for "hacking" and ruining their lives, as has happened many times in the past in such cases.

gorjusborg 3y ago
While I do not like the 'get out of breach free card' that companies like Equifax seem to get, your tone has that exact sort of arrogance that smacks of immaturity. You just can't always apply today's sensibilities to code that has lasted longer than your life so far. I agree that companies need to be held responsible for their decisions not to update security, but that's a different (related) issue than 'legacy'. I am more concerned with legislation and law enforcement. That's the real way to fix things. Rust rewrites wont change business incentives.
- elondaits 3y ago
  I’m 46 and been working professionally since the late 90s. There was never a time in the history of the web when storing user passwords in plaintext was OK. Encrypted passwords were already well established in UNIX.. although I remember using systems without shadow passwords or salt.
  - gorjusborg 3y ago
    I am similar age, and there is software older than us that is still running.

HeyLaughingBoy 3y ago

> There are very very few programs that ever achieve something like elegance and beauty when they collide with the real world. I write embedded systems. Tell me about it!

zachmu 3y ago

Mocking bad systems like this is all fun and games but it definitely demonstrates your inexperience. Eventually you realize this is just normal, most stuff is as bad as this in one way or another. Mocking it all would be your full time job. And you just get tired of it.

hondo77 3y ago

Yeah, the best thing about hiring people "fresh out of college" (or whatever the equivalent is today) is that they see things with fresh eyes and want to change everything. The worst thing about hiring people fresh out of college is that they see things with fresh eyes and want to change everything. ;-)

sanderjd 3y ago
This is a really good insight! The key is to say yes to the good ideas and no to the bad ones.

ipaddr 3y ago

Nothing screams junior dev like the snark of things they don't understand

theideaofcoffee 3y ago

I have a similar length of experience as you, but I'm on the opposite side of the fence and side with the students in this case. If an organization is willfully putting out and maintaining shit products year after year and equivocating about how updating things to be more in-line with modern practices is oh so difficult and oh so expensive, maybe they do deserve to be mocked. If they're making an effort, that's a different story. There's really no excuse to keep insecure and outdated things out in the wild except for organizational laziness. Stand behind and maintain the crap you sell or don't sell it at all. I think as a profession we need more derision and mockery of poorly made, documented and maintained shit and less reverting to robotic response of "you just don't understand, man".

rjbwork 3y ago
I don't necessarily disagree. But you get what you pay for. These public institutions typically put out bids for projects and take the lowest one. Incentives matter and these types of organizations are incentivizing the production of cheap and poorly made software.

sanderjd 3y ago

haha I had this same exact thought while reading it. "Oh sweet summer child..." To me it seems like a miracle anyone ever had the budget to create this kind of website to begin with, let alone to "keep up with the times" :)

cortesoft 3y ago

Yeah, once you have gone through a few cycles or your cutting edge approaches becoming standard and then becoming legacy and outdated, you realize the treadmill never stops.

lowercased 3y ago

Within a couple years of working professionally, I went from "who on earth would do X?" to "ah... almost certainly they were forced to do X by ..." some external factors - time/deadline, workaround to another bad system, or management pressure for some weird reason. Sometimes it turned out to be just "really naive dev copy/pasting", but that wasn't a majority of the cases. What still bugs me though is that when poorly done/hacky/broken systems still 'work', the assumption is that everything is 'fine'. When I'm needing to work with those systems, the assumption by others (management, other devs, whoever) is ... "why is this taking so long? just do XYZ and move on!" not understanding that often I'm discovering all the ways the broken system is broken - very hidden things, bad docs, charset issues, speed, incorrect data coming back that other consumers just 'know' to hack around (without it being documented anywhere, etc). It's not frustration at the devs of the other system as much as the pressure you face when others don't realize how much workaround you're needing to do to do something 'simple'. And yeah, it should be simple, if the broken system wasn't broken in the first place.