How do I convince my boss to use an up to date version of software to develop a new SaaS

Question

So I've been tasked to develop a SaaS. Originally it was to be an internal tool, but during the design phase I was asked to make it multitenant capable (for external companies to use).

The problem

The system was asked to be built using an older codebase (ruby/rails). The language version on the server I am allowed to deploy on is already 1 year out of LTS (Long Term Support) and the framework version two years out of LTS. This is before development even started.

I asked about building using the latest versions or at least one that wasn't out of LTS, but was told this is the only server we can put it on so the versions were set. As an internal tool, I begrudgingly accepted that it is what it is.

Now after being told to add multitenant functionality, I approached it again. I was told this is the codebase and version I need to build it on.

I start diving into the existing codebase that I am to build upon. It is a simple setup with a few unwanted bits but it includes an email f2p setup and IP restriction features. The code itself is a mess. I asked the original developer and I was told this felt more like a "learn the framework, learn the language" project when it was originally created. (last update to the codebase is also 2 years ago).

note: the company has money, but I am not in a position to know any details so I can only accept it if they say "we don't have the money". -- though it would be highly suspect

The question

I need to make a convincing case to my boss why we have to use a newer version of the language/framework and preferably rebuild from scratch, regardless of my boss stating that the server mentioned is the only place we can host it.

What I have so far

• The system is employing additional security (2fa, ip restriction), so security is of concern
  • using software out of LTS opens the SaaS to both known and unknown security holes that will not be patched (more impactful if I find specific examples of existing and unpatched security holes)
  • our company supposedly is compliant with a number of security certifications (I cannot fathom using out of LTS frameworks as being compliant)
• the existing codebase is small enough it would be less costly to rebuild it than to spend the time refactoring
  • cleaning up coding from someone learning the language/framework as they built it
  • handling the differences in design between the purpose of the original code base and the current SaaS product being built
  • not having to handle the learning curve of figuring out the existing code (leading to refactoring needs or perpetuating poor coding practices)
• using an old version at the start adds considerable technical debt to a product that has barely left the design stage and will only get worse before it is released (save a little now only to spend a considerable sum later)

Are there any other points (in addition or new) that I can use to make my case?

---

Additional aside

I am actively looking for a new job and have been interviewing. If I'm lucky I will find a good job before I get too far down this rabbit hole and I won't have to deal with these issues immediately. Though in web services this is an unfortunate and common problem, so I feel it is still worth finding an answer because I am certain this same problem will crop up sooner than later again.

(so please don't suggest "quitting" ;))

Answer 1

The language of your manager is "money", not "outdated" or "newest". So take the version already on the server and the newest, compare them side by side, make a list of the important differences. Features updated, features added, security problems fixed. Explain what will NOT be available in the SaaS product if using the outdated software.

If the info is available, show what happened with other companies which used the same outdated version. The more expensive the damage, the better.

However, at the end of the day, it is the job of the management to make decisions, and our job as employees to follow them. Or to find another job :)

---

[EDIT]

You mentioned "Japan" in a comment. Please remember that the Japanese government is still using floppy disks - and just started making efforts to phase them out. So using stuff which is too old might be the way of living in those parts of the world.

Answer 2

You can try to collect some coherent "business" arguments to convince the powers at be. Examples could be

1. There is considerable legal exposure. If there is a vulnerability in the old framework and a customer gets hacked, you maybe found "grossly negligent" by starting the development on a out of date unsupported platform
2. Continuing the "hacked" use case: It would be very difficult and expensive to fix any vulnerability since you have to do it all yourself inside a potentially huge and complicated code base.
3. The product might hard to sell. These days it would be VERY hard to sell software that runs on Windows 10 and NOT not Windows 11
4. The product might be not be competitive. Competitive products may offer features that customers expect, but that would be difficult, costly or even impossible to implement on the old framework.
5. Difficult to future proof. Even if you have feature parity right now, the new frameworks will evolve and so will features and customer expectations. It will be costly to keep up.

Technical debt costs real money. Starting a new project with a huge technical debt from day 1 doesn't make business sense.

Answer 3

Explaining to non-tech managers can be painful. The key is not to try to teach them or expect to learn the tech. If you reach into the "Business World" logic it isn't usually difficult to get a reasonable person to agree with you.

Business reponses must address:

• How does it increase sales
• How does it reduce cost
• How does it reduce risk

"It is a good idea" is not on the list.

Frame the logic in business verbiage.

• The greater security of using "In Life" tools will make this product more saleable (increase sales).
• Using tools that are "In Life / Currently Supported" will reduce our support costs.
• Starting with "Tech Debt" will likely increase costs and decrease pool of future available coders
• Unable to be SOC Compliant (or other security certification)

Make your points in this style to have business impact.

Answer 4

Does your company have a competent CISO? If yes, he/she would be the one to define polices regarding the use of outdated/unsupported development tools and libraries. If there are such policies, check whether they support your case. If yes, you have a very good argument to present to your manager. Otherwise, this might be an opportunity to suggest changes in the security policy to deal with this situation.

Answer 5

Security should match with the level of possible damage

The first and most important question to ask in these scenarios is how much damage would there be if a security breach happens and the system is totally compromised? The cost to mitigate should not exceed the cost of damages. Think of it like spending $1,000 on security measures to protect a piece of jewelry worth $10.

For your scenario does the possible damage of a compromise exceed the cost of a new server and several years of software development effort?

If yes then:

Make the problem your boss' problem

People are much more likely to care about a problem if said problem impacts them directly. An apocryphal story that has been passed down:

There was a meeting where a new internal timekeeping software for the company was being demoed to executives. The executives were impressed and want it to be pushed out company wide as soon as possible. One engineer protested this stating that it had security vulnerabilities that needed to be addressed. The executive in charge was dismissive to the concerns, so the engineer went over to where the new timekeeping site was being demoed. They then proceeded to use an exploit to log in as the executive in charge of the meeting showing the executive's timesheet to everyone in the meeting.

Suddenly the executive had a change of heart and demanded that the security vulnerabilities be fixed as soon as possible and that this would not be allowed to go out until it had been fixed.

I cannot recommend the kind of action above since that can easily backfire or at the very least be a career limiting move. However, if you can frame or show this issue in a way where it is no longer just a security problem, but something that will directly cause harm to those in charge, then they will be more likely to act upon it.

Though be warned sometimes how leadership deals with problems is to get rid of the person reporting the problem rather than addressing the problem.

Answer 6

I think you're missing the point.

The real problem is that the hierarchy does not trust you. If they did, you'd get a free hand to build from the bottom up. You could build a webserver in a couple of days or less. Or chuck a virtual machine into an existing server. You have asked twice and pointed out importance etc,. and both times been fobbed off with no leverage to get your way.

Asking a third time isn't going to increase their trust levels. You're already job hunting, just keep at it. Another option is just to go ahead and build it however you want it. What are they going to do?

The time to hit back was the first time you were denied.