FoxDev Studio revives Visual FoxPro, 19 years after Microsoft killed it
A new IDE promises to run decades-old FoxPro projects unchanged, with 64-bit support and a Rust-based runtime.
What to know
- FoxDev Studio claims to run Visual FoxPro projects from 1990s–2007 unchanged, supporting 64-bit file operations and avoiding costly rewrites.
- The project inherits a critical security vulnerability from FoxPro's Database Container design: stored procedures stored as plain text can be trivially modified to execute arbitrary Win32 code.
- Real-world impact: Ohio's voter registration database still runs on VFP with nominal MFA, making it vulnerable to direct file access attacks.
- Developer sentiment is split: nostalgia for FoxPro's superior IDE and rapid development tools versus frustration with architectural limits that forced migrations decades ago.
The dispute Whether FoxDev's superior backward compatibility and revival of lost tools can overcome the platform's fundamental architectural weaknesses and security vulnerabilities that forced the industry to migrate away from FoxPro two decades ago. · positions read across 51 posts and comments
FoxPro's superior IDE and rapid development experience made it exceptional; its tools were never matched by .NET successors.
-
“I loved VFP so much, not for the language but for the tools, the screen designer, the db browser, the sql queries, all that power and user love was dumped in the trash can”
Kuyawa · Hacker News ↗
FoxPro's architectural limitations (network file locking, 2GB table limits, single-user design) made it unsuitable for professional applications and forced migration to proper client/server systems.
-
“The low barrier to entry, high developer productivity… sucks when one of these systems outgrows the capabilities of the underlying platform…Seamless remote access to applications is the exact recipe Visual FoxPro apps fail at.”
EvanAnderson · Hacker News ↗
FoxDev's revival is undermined by inherited security flaws in DBC design that allow trivial code injection and arbitrary execution.
-
“There's a huge security hole in the Database Container (DBC) design. For DBCs to be useful, they must be read/write to all users (there is no permissions scheme)…With a little technical knowledge, one can modify that INSERT trigger to…”
mikestew · Hacker News ↗
boredjohnny FoxDev Studio creatormikestew Security researcher, former FoxPro developerMicrosoft FoxPro publisher (discontinued 2007)
How it unfolded 4 developments, newest first · click a bar or a number to jump articlespostscomments
-
4
Creator commits to adding DBC security hardening
The FoxDev creator (boredjohnny) responded to the security concern by proposing to hash stored procedure text and embed it in the executable to prevent tampering, treating the runtime as the place where the inherited vulnerability can be fixed.
“I would put in a hash of the stored procedure text into the built executable and refuse to run a container whose procs don't match.”
— boredjohnny -
>, Visual FoxPro, Visual Basic, Flash. I used to think one day we will have something that is not only faster, easier and scalable replacement of those.A person's perspective on the older dev tools being "superior" to today's newer tools depends on the things they want to build.I had jobs working on Foxbase/FoxPro for DOS and migrated those apps…
2 more of the top 3 · 41 posts in this stretch
-
Flashback. When I was an adolescent, the dBase and Fox products were my first paid software development, and they were surprisingly accessible to even kids.I was only supposed to help assemble computer furniture, and maybe install networked Unix and PC software, but the retired Marine my mom worked for thought I had potential. "Hey, Kid", he would…
-
Great job with this project, I bet there are VFP apps still running or even DOS FP apps.This takes me back to the first commercial software i ever worked on around 19 years ago, it was an accounting software written in Visual FoxPro. It's a super easy language to get started with programming and the fact that you can drag your widgets on the…
-
-
3
Election security concern: Ohio voter database runs VFP with weak MFA
A commenter disclosed that Ohio's voter registration database is still running on Visual FoxPro and has TOTP-based MFA that can be bypassed by directly opening the underlying database files, illustrating the real-world security implications of the revival.
“One of the "certified" (wrong terminology) Board of Elections voter registration databases for Ohio is written in VFP and has TOTP 'MFA' to comply with a Secretary of State mandate. You can just open the database files directly.”
— EvanAnderson -
Thanks, this is the most useful comment here. FoxDev reads the DBC the same way VFP does, so today it inherits the hole exactly. The runtime is actually the one place it can be fixed. I would put in a hash of the stored procedure text into the built executable and refuse to run a container whose procs don't match. Adding it to the list. Would you…
1 more of the top 2 · 2 posts in this stretch
-
One of the "certified" (wrong terminology) Board of Elections voter registration databases for Ohio is written in VFP and has TOTP 'MFA' to comply with a Secretary of State mandate.You can just open the database files directly.I hang my head.
-
-
2
Security researcher flags DBC stored procedure vulnerability
A commenter identified a critical security design flaw in FoxPro's Database Container (DBC) format: stored procedures are stored as plain text in memo fields and run with full Win32 API access, allowing trivial modification of triggers and code execution. The FoxDev creator acknowledged the issue and committed to adding runtime verification.
“There's a huge security hole in the Database Container (DBC) design…With a little technical knowledge, one can modify that INSERT trigger to whatever you like.”
— mikestew -
I worked with a physician's office in 2006, and the lead physician had cobbled together a system for patient tracking using Visual FoxPro. It was a monstrosity, and using it over a network drive gave all sorts of file locks and issues with multiple people changing the same record (usually the physician and front of house staff when checking the…
2 more of the top 3 · 5 posts in this stretch
-
Here’s my problem with reviving FoxPro in any form: there’s a huge security hole in the Database Container (DBC) design. For DBCs to be useful, they must be read/write to all users (there is no permissions scheme). DBCs have stored procedures that can run any FoxPro code, including Win32 calls made from the FoxPro runtime. The stored procedures…
-
Hey, I got to mention this recently! One of my bizarre claims to fame was writing this little tool[0] a few employers back to convert Visual FoxPro database files to PostgreSQL as part of a migration. For a while we had to run it as a cron job so that people could to data entry in an old VFP app but others could run fast reports on our web app…
-
-
1
Hacker News users debate FoxPro nostalgia and practical concerns
The announcement prompted mixed reactions from former FoxPro developers expressing nostalgia for the language's developer experience while raising concerns about its architectural flaws—network file locking issues, security vulnerabilities in stored procedures, and scalability limitations that pushed many away decades ago.
“FoxDev Studio opens the projects, forms and tables you already have and runs them the way you remember: no rewrite, no conversion, no export step.”
— FoxDev Studio documentation · source -
The low barrier to entry, high developer productivity, and bespoke and "highly conforming to proprietary business processes" nature of resulting applications are all really cool, but man, it sucks when one of these systems outgrows the capabilities of the underlying platform.I shudder at the though of businesses trying to access DBF files on…
2 more of the top 3 · 3 posts in this stretch
-
All these years later, Microsoft Access is still alive and kicking, and just three years ago, the 32bit version got Large Address Aware (LAA) support! Technically my very first software job was writing VBA in Microsoft Access for a few weeks and they're probably still running it (there's no drop in replacement for it or cheap way to migrate away)
-
My father built several projects in FoxPro. I was too young in the ’90s to remember much of it, but I’m sure he’ll be super happy to check this out. The kicker is that we’ll probably need to buy a floppy disk drive and dust off some old boxes to find them.
-
-
background
FoxDev Studio launches as Visual FoxPro revival — FoxDev Studio, a new IDE, is announced at foxscript.org with the promise of running existing Visual FoxPro projects unchanged. The tool reads files directly from disk without conversion, supports 64-bit architecture to overcome original 32-bit limits, and uses a Rust-based runtime compiled to WebAssembly to maintain compatibility with legacy code.
Also covered reported alongside — the timeline has no entry for these yet
-
first by HN Best, 1d ago · also HN Frontpage
What people are saying 15 voices from 1 site · best of 51 · verbatim
- Will the FoxDev creator's proposed DBC hashing solution adequately prevent stored procedure tampering?
- Are there other critical vulnerabilities in the FoxPro design that FoxDev has inherited?
- Yesterday
-
I have been working on a VB6 recreation starting with the IDE. Eventually I want to build the compiler and runtime, but for now being able to open existing projects, load all the images and do all the syntax highlighting is a good first step.I know TwinBasic exists but its closed source and I want to take things further than VB6 ever did. I always…
-
My father in law did database programming for small businesses using FoxPro. It was pretty cool, it created the executable and you could host it on any Windows file server IIRC. I think it also may have had some server functionality built in too. Anyways, it was fast if the database was designed correctly and allowed for easy setup at the clients…
-
My first and only internship was at a mom-and-pop company whose flagship product was a niche CRM written with FoxPro. They didn't have any full-time devs. Instead, their two technicians took a few weeks every year off repairing turnstiles to develop a yearly update. It was a terrible company, but those guys really loved FoxPro.
-
My first ever "paid" consulting job was building a dBASE application."Paid" in quotes because I was about 10 years old at the time and the work was done for my mother in her capacity as a government employee. What she could do, though, was find a surplus shrinkwrapped copy of dBASE III Plus that I was allowed to keep when I was done.
-
It occurred to me recently that with AI/ML, we can basically keep any and all software going, no matter if its original authors retire it .. its getting to the point where an AI can reliably parse the bytes and apply whatever ABI is defined for the platform, and then .. add features, fix bugs, and so on.Are we witnessing the end of the age of…
-
There's been a 64 bit version of FoxPro for years and years [1].No, not the official VFP as released by Microsoft, but a version made by a well known VFP developer.Besides that I do know of some developers actually using this for building their software.No connections here, just know that it exists and is used and well before LLMs became the…
-
> Delphi, Visual FoxPro, Visual Basic, FlashAll these tools are nice for a single developer. But they fail to scale for teams where you want a distributed version system, automated tests and CI/CD pipelines. Also you want to reuse code via package management systems. And a single code base for several target systems (cross compilation , electron)…
-
I haven't used FoxPro but I have had plenty of exposure to tech with a similar 'feel' - Excel and Word documents scripted to the gills with VBA, eventually C#, and mutating into new and kinds of horrors.It always starts simple - you wanna build just a simple CRUD where the entry is a form that goes into the table.Then the complexity grows, and…
-
I know there are still a few niche industry that has an industry standard program written in Visual FoxPro, and I remember as pre COVID 2019 they were still using it. ( Edit: I just called and asked, still using it as of 2026 )Niche but no small business, commodity with over $400M USD annual revenue, the industry together than easily $2B+.If it is…
-
Could the security hole not be closed up?Maybe there's a way to run them more securely with a wrapper.It does make sense to try and move to a sql db of some type, and my immediate thought is if something like Postgres, with a plugin or extension or two couldn't simulate enough of Foxpro.That, or rewriting large parts of the DB engine seem readily…
- Sep 22
-
haha, I used this exact example in sales calls to make the case against app modernization. Sometimes, you just need the stuff to keep working, with $20-and-a-roll-of-duct-tape-level budgets.My proposal was proxy layer sitting in between, running on something like k8s and written mostly by an LLM to provide a safe interface to queries against…
-
I have memories of supporting a Netware network with a custom Foxpro app used by a bunch of telemarketers in the mid 90's.When there was application error the source code would pop up in dialog maybe a some sort of debugger and the end users would just type a bunch of crap in trying to get out of it and hit enter and save the changes and corrupt…
-
Many of the complaints you make apply to SQLite as well?I don't know if dBASE variants support bind variables. That isolation is really required to avoid the "Bobby Tables" effect.https://bobby-tables.com/I'd prefer to see the dBASE language adapted to run on SQLite files, as they are a far more profound standard.
-
My goodness, a blast from the past. Such a glorious time to be a programmer... every single business needed a database to do their simple little daily chores, the coding was insanely easy (just a bunch of CRUD process), and the difference it made to the customers was night/day... hence, you could charge thru the roof.I wrote a simple little CRUD…
-
Oh nostalgia, dbase, clipper, clarion, foxbase, delphi, I loved VFP so much, not for the language but for the tools, the screen designer, the db browser, the sql queries, all that power and user love was dumped in the trash can for the travesti that was .net at the timeI learned VB.net, C# and even F# to see if they surpassed in any sense my…