———
— SUMMARY TL;DR —
———

On May 22th, 2024, Microsoft announced their plans to deprecate the VBScript engine in future release of Windows Server and other versions.
https://techcommunity.microsoft.com/t5/windows-it-pro-blog/vbscript-deprecation-timelines-and-next-steps/bc-p/4170125

🛑 That will lead to make CLASSIC ASP websites unavailable, too.

That's more than 1,198,964 currently live public websites.
1 Million. Without counting the numerous private intranets used by worldwide companies, factories, and governments agencies.

Microsoft stated that from Windows Server 2025, VBScript will still be available as a "Feature-On-Demand" feature (FOD).
But the company also confirms that they are planning this feature to be purely and completely removed in "later" versions (2027 or 2029 maybe ? Microsoft is not clear enough on this point).

Microsoft must reassess their plans, and keep VBScript + Classic ASP engines available as FOD forever.

 

———
— WEAK MOTIVATIONS —
———

The motivations exposed by Microsoft to this deprecation are not convincing enough, as many applications are already well-protected and used by experienced system administrators and developers. The most basic free antivirus product is able to block malicious VBScripts for ages. So there's no point removing VBScript and Classic ASP.

Not every app can be rewritten. Some must remain functional, so the Microsoft statement that "developers will have enough time to transition" is inadmissible.

Does Microsoft want to improve security? So just disable WScript.exe and CScript.exe by default, and keep vbscript.dll as an FOD forever.

 

———
— A GIGANTIC IMPACT —
———

Classic ASP is used in many critical industries worldwide : banking, transportation, health, government agencies, big e-commerce, and many more.

First tests show that without the VBScript FOD feature installed on Windows, Classic ASP websites are completely broken and unable to remain functional.🚨

This decision would have a predictable huge detrimental impact on big parts of the web ecosystem, putting many small, medium, governments and very large businesses at high risk of failure and bankruptcy, worldwide.

Microsoft must also consider the countless side-effects in real life resulting from this unavailability of VBScript and Classic ASP: all the workflows used by millions of companies, factories, health systems, banks and services provided by countless government agencies will no longer work :

• Economy is at stake.
• Factories too.
• Processes too.
• Transportation Infrastructures too.
• Libraries, culture and media services too.
• Medical and employment files too.
• Thousands of jobs.
• Real human Lives too.
• It is really unimaginable to do without this platform.

🛑 Almost 2% to 5% of the current web ecosystem will be down.

 

 

 

⚙️ Millions of websites, intranets and extranets production-grade applications are written in Classic ASP.
A small part of this huge codebase can be seen at https://trends.builtwith.com/websitelist/Classic-ASP/

The trends of this technology usage are going down, but still very huge, more than (for example) the COBOL that is still used worldwide by the banking industry.

 

———
— INADEQUATE RECOMMENDATIONS —
———

The costs involved to completely rewrite a working Classic ASP web application are unthinkable.
Stopping the usage of Classic ASP is impossible for millions of critical web-apps. .NET never was embraced by the most talented developers: there must be a reason.
Rewriting them is also impossible, as they are tailor-made, highly-customized and, for the majority of them, up and running for numerous years, and still maintained, developed, and used in daily production operations.

When Microsoft recommends developers to "use PowerShell or Javascript", they totally ignore the server-side VBScript: these recommendations only apply to client-side VBScript. Thousands of SysAdmins still rely on VBScript simply because of the overcomplexity of PowerShell.

The number of System Administrators relying on VBScript for their daily tasks is just countless (sorry for not being able to contact all of them to get the real numbers). They use it daily for login screens, workstations configuration across their organization, Active Directory management, software deployment and configuration. Migrate all of these scripts to PowerShell? Pointless: VBScript just works. And far too long. Why not removing and deprecating CMD, too?... seriously!

 

Classic ASP webapps that survived till this day are thoroughly maintained and thoroughly updated. They count hundreds of script files and millions of lines of code for the majority of them. They are intermingled with numerous payment API's, corporate ERP and CRM solutions, and gigantic Microsoft SQL Server databases.

It is quite common that such an system already costed between 30 k - 250 k to the company using it (but can be really more than this amount). Considering their critical role, such customized-apps running in production, are properly hosted and protected against attacks at multiple levels, and just fuels the companies using them.

Without these tools, these companies will purely FAIL. My clients employees count for approximately 5,800 people. Just for MY clients. I'm in relation with dozens of high-level Classic ASP Developers that work for companies whose names can't be quoted here for NDA reasons!

Microsoft have to seriously think about the number of employees whose jobs depends of the Classic ASP webapps made and maintained by all the active Classic ASP developers. And there are more than they think. That can be called an impact. A social one.

I was 18 yo in 2000 : no-one coded in PHP. Everyone was using Classic ASP, because Microsoft made a really good product, and if you were to observe me working during only 1 week, you would be convinced that Classic ASP is reliable, secure, even with all the IA-driven types of attacks, DDOS, networks attacks, and so on.

We just need Microsoft let people choose their tools, especially when they are so widely spread still nowadays : .NET, Classic ASP, Xamarin, PHP, Node.js, or static HTML.

 

———
— OFFICIAL REQUEST TO MICROSOFT TEAM —
———

We are now officially asking the Microsoft team in charge of VBScript and Classic ASP on IIS to reassess their decision, cancel their plans of deprecating and removing the VBScript engine, and commit to make the VBScript + Classic ASP engines still available as Feature-On-Demand, forever even after 2029.

🌱 Microsoft is a responsible company, and we are sure that we can rely on their clarity of mind to reverse this hasty decision.