I wasn't specifically talking about security bugs, but bug is bug, so this applies anyways: Where do you think it's more likely a bug is found and fixed: In one

I wasn't specifically talking about security bugs, but bug is bug, so this applies anyways: Where do you think it's more likely a bug is found and fixed: In one of dozens of unofficial implementations or in the one official implementation? "bloat" is not always bad (well. bloat is. but a big library isn't necessarily what I'd call bloated). If you want to talk about bad parts in PHP, I could name a ton, but a huge base library isn't one of them. Bad parts are: - too much focus in backwards compatibility. A py3k like cut between php 4 and 5 would have done wonders and would not have made the adoption much slower (which was still very slow despite the more or less given backwards compatibility). - wordy, inflexible syntax - trying too hard to be like java while not being like java. - inconsistencies in the base library (parameter order) - very, very WTFy type conversion (IMHO the worst part of PHP) But having a big base library is not what I would ever be disgusted with.