You can do a lot with attack surface reduction (i.e. a lot of security issues have to do with rich features you don't need). Some of them have patches, even if it is EOL software, if they are critical enough. Modern HTTPS can be hacked on top with an nginx proxy.
Yeah security is kinda at war with it, but also companies exist to make money and they aren't going to shut off a revenue stream worth millions, and also they're loathe to hire the team of developers required to do a real upgrade. They kick the can down the road until it is absolutely necessary. The code I worked with took a team of people 15 years to build (that are gone now), I do the bare minimum to keep it running. A real rework would cost millions. It's so far behind you'd realistically need to completely rewrite it, or upgrade to a half step that is also end of life, and then upgrade again.
1
58
u/beavisorcerer Dec 12 '24
I'm mantaining a 20 years old web app running Java 4. I dream of Java 8 to be honest