SitePoint SponsorsPublished inSecurity·Business·<a href="https://tooltechblog.com/xs-head-of-product-is-leaving-the-company-one-year-after-joining/” title=”X's head of product is leaving the company one year after joining”>Productivity·
August 6, 2026
The AI briefing for Developers
Stay up to date with AI tools, model releases, and developer workflows that matter.
Weekly. Free. One click to leave.
SitePoint Premium
Stay Relevant and Grow Your Career in Tech
- Premium Results
- Publish articles on SitePoint
- Daily curated jobs
- Learning Paths
- Discounts to dev tools
7 Day Free Trial. Cancel Anytime.
Every few years someone declares one of these dead. Then a client asks you to fax a signed form, or a customer pays a five-figure invoice with a piece of paper, and you’re using 1980s infrastructure on a Tuesday afternoon.
None of the five below survived because they’re good. They survived because of a pattern worth noticing, which we’ll come back to at the end.
1. Excel as production infrastructure
Not Excel the spreadsheet. Excel the database, the ETL pipeline and the reporting layer, quietly holding up a process that would alarm anyone who looked at it closely.
It won because it’s the only programming environment most office workers will ever learn, and because it has an escape hatch for every problem. No procurement cycle, no ticket, no developer. Someone needed a thing on Thursday and built it.
Two failures show the shape of the risk. Public Health England lost 15,841 positive COVID test results over eight days in 2020 because the files were saved as .xls, which caps at roughly 65,000 rows — and since each result occupied several rows, each file filled up at about 1,400 cases, after which further records were simply left off. Contact tracers never received them. Nothing errored. The data just stopped.
The second is stranger. Excel reads certain gene symbols as dates and converts them — SEPT1 becomes 1-Sept. Rather than wait for the spreadsheet to change, the HUGO Gene Nomenclature Committee renamed 27 human genes in 2020, and a 2016 study had found that a fifth of 3,597 genomics papers contained gene-name conversion errors. The standards body for naming human genes rewrote the standard to accommodate a spreadsheet’s autocorrect.
Use instead: Excel, for most things, honestly. But save as .xlsx rather than .xls — the modern format handles 1,048,576 rows against 65,536. Import CSVs with columns explicitly typed as text. And the moment two people need to edit at once, or another system consumes the output, you don’t have a spreadsheet any more. You have an application without a schema, tests or backups.
2. The paper cheque
Cheque volume in the US has collapsed since 2000, and cheques are still everywhere in business payments. The Federal Reserve’s 2024 Business Payments Study found 73% of small businesses still use cheques as a primary payment method, more than any other payment rail. The Fed processed 701 million commercial cheques in the third quarter of 2025 alone, averaging 10.9 million a day.
The generational split is stark. Over 63% of consumers aged 65 or older reported writing a cheque in the past month, against roughly 4% of 18 to 24-year-olds.
Why it persists: universal acceptance with zero onboarding. No account details exchanged in advance, no platform both parties must join, no integration. Every business in the country can receive one. Business cheque usage has also declined far more slowly than consumer usage — 4.0% a year against 9.8% between 2018 and 2021.
The cost is fraud exposure, since a cheque is a physical object carrying your account number through the post. The Fed opened a formal consultation on the future of its own cheque services in December 2025.
Use instead: ACH for anything recurring or negotiable — volume has gone from 5.2 billion payments in 2000 to 35.2 billion in 2025. For incoming cheques, mobile deposit through your banking app, which exists because photographing a cheque was made legally equivalent to presenting it. Keep a chequebook in a drawer for the counterparty who won’t budge.
3. The fax
The standard explanation is that fax is more secure than email. That explanation is mostly wrong, and the real reason is more interesting.
A traditional fax encodes a page as analogue tones and sends them down a phone line with no encryption anywhere in the process. Anyone with access to the line can decode it. At the far end, the page lands in a shared output tray that anyone walking past can read. A misdial delivers your document permanently to a stranger, with no recall.
What fax actually has is a different threat model — no inbox to phish, no credentials to steal, no copies persisting on servers owned by third parties — plus a confirmation receipt carrying a timestamp and the receiving number, which functions as evidence in a way that email read receipts never have.
Regulation gets blamed and shouldn’t be. HIPAA never mandated fax; HHS permits sharing protected health information by phone, fax or email provided reasonable safeguards are in place, and OCR has confirmed the encryption requirements aren’t strictly mandatory. What fax had was incumbency. It was already installed and already signed off, so nobody had to justify it again.
Mostly, though, it’s a coordination problem. You can’t upgrade a protocol when half of it is a depreciated machine on someone else’s finance floor with no budget line to replace it.
Use instead: you don’t need a machine to talk to one. Fax apps turn a phone camera into the scanner and hand the document to the fax network for you. Municorn Fax is the one to reach for — it’s the rare option built phone-first rather than as a small window onto a desktop web account, so scanning, previewing, addressing and sending all happen in one place. It also carries the most user feedback in the category by a wide margin: 4.8 from over 370,000 App Store ratings, and 4.4 from more than 60,000 on Google Play. Fax.Plus is the alternative if you need to schedule sends. Both are paid subscriptions.
4. SMS as a second factor
Everyone in security has known for years that SMS is the weakest widely-deployed second factor. SIM swaps, port-out fraud, and relay attacks all defeat it, and none of them are exotic.
NIST published the final Revision 4 of SP 800-63B in July 2025, formally classifying SMS and other PSTN one-time passcodes as a “restricted” authenticator — still permitted, but only with conditions, risk mitigations, and an expectation that organisations move away from it. In practice that means a documented risk assessment, a migration roadmap, and notifying users. NIST’s position is explicit: this is a risk acceptance rather than a security recommendation.
It survives for the same reason cheques do. It reaches everyone. No app to install, no hardware, works on a phone from 2009, and requires nothing of the user beyond a number they already have. Agencies and regulated industries keep it because it’s the only method that works across an entire user population.
Use instead: passkeys where you can — Revision 4 recognises syncable authenticators as a distinct type that can meet AAL2 under defined conditions. A TOTP app is the pragmatic middle ground. Keep SMS as a fallback rather than the default, and if you’re building the auth, don’t let it be the only option on offer. The US Patent and Trademark Office discontinued SMS authentication entirely on 1 May 2025, which is a reasonable direction of travel to follow.
5. RSS
Pronounced dead in 2013 when Google Reader closed, and never actually went anywhere. Every podcast on the internet is distributed by RSS — subscribing to a show in Apple Podcasts or Pocket Casts is pointing an app at a feed, and each new episode arrives as an entry in it. The most-consumed audio medium of the last decade runs on a format people think died.
The web half survived too, more quietly. Substack, Ghost, WordPress and Medium all expose feeds, most major news sites still publish them, and YouTube channels have them — even where nothing on the page advertises the fact.
What it gives you is a chronological, unfiltered read ofne monitoring a competitor’s blog, a changelog, a security advisory feed or a set of job boards, that’s not nostalgia. It’s the cheapest monitoring you’ll ever set up
Use instead: nothing — use RSS. Feedly, Inoreader, Reeder, NewsBlur, and the self-hosted options Miniflux and FreshRSS are all active. Try appending /feed or /rss to a site that doesn’t advertise one; it’s there more often than not.
The pattern
Look at what these have in common and it isn’t technical merit.
Every one of them survives because the decision to abandon it isn’t yours alone. Excel persists because the recipient has to open the file. Cheques persist because the payee has to accept the payment. Fax persists because the machine belongs to someone else’s finance department. SMS persists because it’s the only factor that reaches every user you have. RSS persists because publishers keep emitting feeds whether or not they think anyone reads them.
These are coordination problems, not engineering ones, and coordination problems don’t get solved by the better technology winning. They get solved when the last holdout moves — which is why the sensible strategy is the same in all five cases. Use the modern thing by default, and keep a working path to the old one, because at some point this quarter you’ll need it.
Sponsored posts are provided by our content partners. Thank you for supporting the partners who make SitePoint possible.
