For a project that's going to live/used/maintained by the developer for a very long time (ex: 20-50 year); Is custom (self made) framework better than (open source) popular frameworks? Basically my highest priority requirement is security and very long term lifetime.
My current situation is having to maintain 15 year-ish old web application written in PHP5 (at the time, it was a cutting edge application since PHP5 released at July 2004. The application used custom, closed-source framework (since I imagine at that time there's yet any popular or mature frameworks yet)
The application have served the organization for long time, and it's rather business critical. I'm trying to make a new mobile friendly version of it (to run alongside the old one). Should I use the same framework, or should I use newer frameworks like symfony or laravel?
[A] When I read the source code of the old framework, I realized that there's a lot of demerit:
- a lot of it didn't follow some of OWASP best practices (I can't say which ones);
- no automated test, no documentation (every time we need to change something, we're reverse engineering it and hope things didn't break);
- a lot of bad PHP programming practice in general (variable name upper\lower-casing, drowning in warnings, gigantic monolith, no null safety, very loosely typed, no error logging, not using abstraction layer, basically going against every PSR that exist out there)
- basically a very huge technical debt
[B] Even so, the consideration of keep using our old, custom, closed-source framework is that:
- it's more secure
- security through obscurity (only us know the source code, unlike open source frameworks which their code are basically 'leaked' through the internet),
- AND security through very strict network firewall rules,
- AND security through enforced legal and organizational law);
- more understandable by the team (us);
- PHP5 will still run on servers;
- it's lifetime is forever (since the team: us; still maintain it and patch security vulnerabilities), - it will never get deprecated, never get breaking changes; I know that symfony provide LTS release that receive maintenance for 4 years. But it's still very-very short in term of the application's lifetime (our team expect 20-50 year);
- it's receiving very huge amount of request every day, no framework (less footprint/resource usage); even if I try to change to new framework and follow every best practice out there, it'll be bad practices again after 20-50 year
- our requirements doesn't mind if the app appears old (in html/css presentation); that's not where our customer find us
My question is:
- should I propose for a change of framework and design?
- is there any of my point in [A] or [B] that is wrong or misguided?
Related question (but quite different): https://stackoverflow.com/questions/1836351/thoughts-on-abandoning-proprietary-framework-for-a-larger-open-source-project (my question is more on security and long lifecycle)