4 ms·

The article claims that "an internal site with old code that has sat there running fine, doing its job for years......costs zero dollars to maintain", versus up

The article claims that "an internal site with old code that has sat there running fine, doing its job for years......costs zero dollars to maintain", versus upgrading to Firefox. But that is not true. Let me tell you what the cost is. Sure, your admins can CYA for a few years, but eventually that old, unmaintained app will implode for some reason (maybe just from hardware failure, at which point you can't buy a machine that runs IE6). When it does, at a completely uncontrolled time with countless business processes dependent on it, the cost will be HUGE: maybe enough to kill the business. So by all means, go on deluding yourself that it costs nothing to keep on using outdated stuff that seems to work just fine. Edit: I'm focusing on the zero cost argument, web apps are just one example. The costs/risks apply to any upgrade or lack of upgrade.

diN0bot 17y ago
Furthermore, there is the opportunity cost of the site users. I had a job where I had to use IE for internal wiki's, whereas I used chrome and firefox for my actual work. There was something seriously demoralizing about switching to IE to use an ugly, neigh unreadable and unusable wiki to document my beautiful work. i don't mean to get into a discussion on how good design and efficiency are coupled with beauty and elegance....suffice to say, i felt like the poor internal sites reflected the companies view of my work, represented our whole philosophical and prideful differences, and i ended that contract asap. edit: ps - i accidently downvoted you when i meant to click reply AND agree with your good points. i know, it makes no sense. eit.
- makecheck 17y ago
  That's an interesting point, that the company's opinion of employees is evident through their (lack of) IT investment. I have personally come to the decision that life is just too short to put up with Windows, and if I look for a job I intend to choose it based on the existence of Mac or Linux.
- pavel_lishin 17y ago
  I probably waste 15 minutes a day on BaseCamp's UI - it's not great, and I've written a few greasemonkey extensions to speed up my process. And that's a 37 signals product, a pretty decent one to boot. I can't imagine how much time (for instance) my friend loses to his stupid internal IE6 app that was probably outsourced to a fourteen yea rold.
gnaritas 17y ago
You can always put IE6 on a machine, even side by side with other versions of IE. Not saying I like IE6 or anything, just that this is a poor excuse.
skolor 17y ago
You seem to be making a large mistake here. The issue in question here isn't "Upgrade a webapp" or "Only use IE6". The issue is "Upgrade a webapp for one user" or "Make that one user use IE6, rather than add another application to the list of applications to watch bug reports/updates/etc for". Yes, the application should upgraded at some point, but just because a user wants to use Firefox is not the reason to be doing it. It is something that needs to be done, sooner rather than later, but this may not be the time, and definitely is not the reason to do it. While I personally use Firefox, and think it would be an improvement if every used it, I would not want to be in an IT department pushing it. A large focus of the article was about limiting choice for users, which is what the complaint was. "Why can't I use XXXXXX, it just takes 5 minutes to install..." does not mean that after 5 minutes of installing it that any service will be done. Updates will need to be run, testing (should be) run to make sure it works in all the necessary cases, integration into whatever imaging/software management system the organization is using... The list goes on. On top of that, each additional application installed in the organization opens up that much more attack space, and puts the entire organization that much more at risk. Yes, it isn't that big of a deal to let one or two users use Firefox. But once you've done that, when the next user wants Adobe Air installed, so they can have their Twitter application installed, its a lot harder to say no. Usually this snowball effect doesn't really apply, but with the ease of automated attacks it does. Take spamming. Most users know not to trust spam. Even more may know not to click on any links. But even with a 1 in 10,000 (or lower) success rate, spamming still turns a huge profit, simply because its trivial to send out a million emails, which would result in ~100 successes. The same applies to applications. Without proper testing and updating, applications are vulnerable, and it is relatively trivial to scan a network searching for a given vulnerability. Even if the IT department is really on top of the game, and is watching the news and finds patches right away for their products, all it takes is one application somewhere to have not taken the patch right, or to be running an older version of the software, for an attacker to gain a foothold into the organization. From there it becomes significantly easier to gain access to anything they want.
- makecheck 17y ago
  I think you're right, but I really just wanted to focus on the zero-cost claim that I quoted from the article. Firefox is just one example of an upgrade, and the logic applies anywhere: it's a trade-off, where "never" assumes too much risk (which is an expense), and "hourly" is also a very risky upgrade schedule. The sweet spot is naturally somewhere in between.
deleted 17y ago
[deleted]
jvdh 17y ago
An internal site with that code running there is probably going to be tested if any browser updates will be performed. Upgrading to Firefox will mean that you will effectively have to perform these checks twice. (No, you are not going to get everyone to use Firefox, it is a different browser, hence "scary" for most users.)
Tichy 17y ago
"When it does, at a completely uncontrolled time with countless business processes dependent on it, the cost will be HUGE" Couldn't that happen with any app, even the new ones? I don't quite get the "risk of legacy" debate. Sure it would be nice to get rid of legacy stuff, but should it always be priority 1? I rather doubt it, especially since new stuff becomes legacy very quickly, too. You'd end up wasting all your resources just trying to keep up with the latest developments.
- skolor 17y ago
  The risk of legacy is fairly simple: when your brand new app crashes, you have most of the team there, ready to fix it. When your 10 year old legacy app has a catastrophic failure, you have a maintenance programmer, one of a long line of maintenance programmers who all added their own code to it. Basically, the older an app is, the less any person knows about it and the more convoluted it has become.
  - billswift 17y ago
    And the more likely you are to have trouble porting it in one jump from ancient to new hardware.

diN0bot 17y ago

Furthermore, there is the opportunity cost of the site users. I had a job where I had to use IE for internal wiki's, whereas I used chrome and firefox for my actual work. There was something seriously demoralizing about switching to IE to use an ugly, neigh unreadable and unusable wiki to document my beautiful work. i don't mean to get into a discussion on how good design and efficiency are coupled with beauty and elegance....suffice to say, i felt like the poor internal sites reflected the companies view of my work, represented our whole philosophical and prideful differences, and i ended that contract asap. edit: ps - i accidently downvoted you when i meant to click reply AND agree with your good points. i know, it makes no sense. eit.

makecheck 17y ago
That's an interesting point, that the company's opinion of employees is evident through their (lack of) IT investment. I have personally come to the decision that life is just too short to put up with Windows, and if I look for a job I intend to choose it based on the existence of Mac or Linux.
pavel_lishin 17y ago
I probably waste 15 minutes a day on BaseCamp's UI - it's not great, and I've written a few greasemonkey extensions to speed up my process. And that's a 37 signals product, a pretty decent one to boot. I can't imagine how much time (for instance) my friend loses to his stupid internal IE6 app that was probably outsourced to a fourteen yea rold.

gnaritas 17y ago

You can always put IE6 on a machine, even side by side with other versions of IE. Not saying I like IE6 or anything, just that this is a poor excuse.

skolor 17y ago

You seem to be making a large mistake here. The issue in question here isn't "Upgrade a webapp" or "Only use IE6". The issue is "Upgrade a webapp for one user" or "Make that one user use IE6, rather than add another application to the list of applications to watch bug reports/updates/etc for". Yes, the application should upgraded at some point, but just because a user wants to use Firefox is not the reason to be doing it. It is something that needs to be done, sooner rather than later, but this may not be the time, and definitely is not the reason to do it. While I personally use Firefox, and think it would be an improvement if every used it, I would not want to be in an IT department pushing it. A large focus of the article was about limiting choice for users, which is what the complaint was. "Why can't I use XXXXXX, it just takes 5 minutes to install..." does not mean that after 5 minutes of installing it that any service will be done. Updates will need to be run, testing (should be) run to make sure it works in all the necessary cases, integration into whatever imaging/software management system the organization is using... The list goes on. On top of that, each additional application installed in the organization opens up that much more attack space, and puts the entire organization that much more at risk. Yes, it isn't that big of a deal to let one or two users use Firefox. But once you've done that, when the next user wants Adobe Air installed, so they can have their Twitter application installed, its a lot harder to say no. Usually this snowball effect doesn't really apply, but with the ease of automated attacks it does. Take spamming. Most users know not to trust spam. Even more may know not to click on any links. But even with a 1 in 10,000 (or lower) success rate, spamming still turns a huge profit, simply because its trivial to send out a million emails, which would result in ~100 successes. The same applies to applications. Without proper testing and updating, applications are vulnerable, and it is relatively trivial to scan a network searching for a given vulnerability. Even if the IT department is really on top of the game, and is watching the news and finds patches right away for their products, all it takes is one application somewhere to have not taken the patch right, or to be running an older version of the software, for an attacker to gain a foothold into the organization. From there it becomes significantly easier to gain access to anything they want.

makecheck 17y ago
I think you're right, but I really just wanted to focus on the zero-cost claim that I quoted from the article. Firefox is just one example of an upgrade, and the logic applies anywhere: it's a trade-off, where "never" assumes too much risk (which is an expense), and "hourly" is also a very risky upgrade schedule. The sweet spot is naturally somewhere in between.

deleted 17y ago

[deleted]

jvdh 17y ago

An internal site with that code running there is probably going to be tested if any browser updates will be performed. Upgrading to Firefox will mean that you will effectively have to perform these checks twice. (No, you are not going to get everyone to use Firefox, it is a different browser, hence "scary" for most users.)

Tichy 17y ago

"When it does, at a completely uncontrolled time with countless business processes dependent on it, the cost will be HUGE" Couldn't that happen with any app, even the new ones? I don't quite get the "risk of legacy" debate. Sure it would be nice to get rid of legacy stuff, but should it always be priority 1? I rather doubt it, especially since new stuff becomes legacy very quickly, too. You'd end up wasting all your resources just trying to keep up with the latest developments.

skolor 17y ago
The risk of legacy is fairly simple: when your brand new app crashes, you have most of the team there, ready to fix it. When your 10 year old legacy app has a catastrophic failure, you have a maintenance programmer, one of a long line of maintenance programmers who all added their own code to it. Basically, the older an app is, the less any person knows about it and the more convoluted it has become.
- billswift 17y ago
  And the more likely you are to have trouble porting it in one jump from ancient to new hardware.