Hacker News Reader

Comment by shocks | Hacker News Reader

> forget about it for a few years

No version upgrade required. :D

Haha yeah I can say, with the same sincerity, that I get occasional calls about fixing PHP apps that I built 2007-2013. They've been running (without upgrades) on some forgotten server in a multinational corporation.

I tell them that they should let their compliance department know, that the version of PHP isn't even supported, and I list some of the thousand security fixes that they aren't using.

I usually end up VPN/FTP:ing into a forgotten era to add the fixes and I definitely don't want to go back.

I had this happen about a year and a half ago with an application I wrote in 2009. Finally got them to allow me to rewrite everything in C#, allowing me to keep up to date on security vulnerabilities and performance improvements, without having to do much but run through a series of tests when a NuGet package or .NET version upgrade is released. NuGet with current .NET is a far different beast now, than when you used .NET Framework and plenty of XML assembly binding.

At the time we were reluctant to update even our linux servers. We had only critical security fix repos enabled and checked them once a week.

No, we didn't update PHP unless strictly needed.

If you piss on security sure but then every language is "easy" if you just need to deploy once and forget about the server for forever

Reply on news.ycombinator.com