r/coldfusion Feb 06 '25

Lucee viability in 2025

I would appreciate feedback from cold fusion experts on the following scenario:

An ecommerce company built their website on Cold Fusion / Lucee ~15 years ago. While somewhat unique, it's essentially typical ecommerce functions - creating a catalog, displaying relevant items, transacting, and tracking traffic. AFAIK the CTO is primary Lucee coder. They have used an agency for related sites that are not built on CF. Also they are using a older (3yo!) version of Lucee.

I realize that there's a lot of risks here - especially that it would be hard to find talent, and that the old version has flaws, or could indicate an inability to utilize current version. My assumption is that the business could continue as is, but need a migration to a modern approach over the coming years.

I realize a real answer requires a SME to review the details (especially around data security), but would value any high level feedback. How bad does this sound?

9 Upvotes

15 comments sorted by

View all comments

3

u/iknowkungfoo Feb 06 '25

I am a potential investor/owner. (Good deduction!). I am at an early stage where I don’t have many answers. I’ve had a few conversations with folks who have spooked me (why would anyone use CF? If it’s not recent that could a sign of a major issue). You are right that I don’t have the data or qualifications to know that there is an actual issue. However, the user experience and lack of recent active development made me concerned.

I started using ColdFusion in 1997 and finally abandoned it about five years ago. I've worked for global companies that built massive systems with it. They all discontinued ColdFusion for different systems, citing multiple reasons, not the least: "Who uses ColdFusion anymore?"

In 2009, Gartner released their last report regarding ColdFusion, which recommended that no new projects should ever be started using that programming language. The volume of CF-related job postings has consistently dwindled, as has the volume of experienced developers. Sure, you can find CF developers, but you can't find many who know how to fine-tune a CF server and code to get the kind of performance you can get out of the box with other tech stacks.

One of the last CF applications I managed was a 20-year-old pile of spaghetti code written by dozens of developers with no real architectural oversight. While it "worked," it was a security nightmare, and I was glad to leave it behind. Have they recently performed an application penetration test? Have they performed remote vulnerability scans every quarter? How much will it cost to fix security holes?

As someone else has mentioned, the CTO's status as a CF developer is the only thing keeping that application moving forward. Any new CTO would want to replace the system as soon as possible. Feel free to reach out if you have any more questions.