I have the exact same problem, i'm pretty curious about what solution will be proposed.
From my experience it is really case dependant. I went throught several "legacy" codebases, and everything depends on the willingness of change in the company. I think my 3 last experiences are revelant of different situations :
1 - Peoples want to change
A few years ago I went to a company with some code from 5+years, with poor quality. It was quite easy to explain peoples we were facing troubles maintaining the codebase in descent state, since it was a small company with people involved in dev process/ selling the product.
2 - Clueless people
After that i moved to a company with terrible codebase. I put everything on git and set a dev environment on my first week. It was in 2017. The legacy was unmaintainable, and by speaking with the ceo/cto, we managed to explain the risks for the company. It took month, but they understood the urge of refactoring, rewriting, etc. They just were not able to find a solution by themselves and our help to rationalise the problem and find effective solution was sufficent to give them understanding of the problem and willingness on moving forward.
3 - Conservative peoples
I moved a few month ago in a really conservative company with totaly insane codebase. For the moment I have no clue on what to do to make people understand at what point the code is in a sinistred state. Tech people understand it but not the rest of the company. Company is economicaly wealthy and it's really hard to make people understand that it does hide terrible technical reality.
I personally think the most important point are :
- Explain to your boss what are the most dangerous problems (unencrypted passwords in DB, that kind of things)
- Explain what is tech debt
- Explain that current techs are solutions to those problems
- Speak about the costs
Everything is easier if you are in a small company, wether ir not peoples around you does have thech background or not.
It's easier too if you can prove what you're saying: with examples of dangerous things understandable by non tech people, and with POC.
For the moment i just does not figure out how to push the need of purging tech debt when company is wealthy. People feel that everything goes well and you're just too much of a geek/perfectionnist