5 ms·

Up until last year, typing "PHP [anything security- or cryptography-related here]" into any popular search engine would lead you to bad practices. Then this ha

Up until last year, typing "PHP [anything security- or cryptography-related here]" into any popular search engine would lead you to bad practices. Then this happened: https://meta.stackoverflow.com/questions/293930/problematic-php-cryptography-advice-in-popular-questions https://meta.stackoverflow.com/questions/293930/problematic-... Stack Exchange websites rank well and they allowed myself and others to provide better answers than they had previously. This leads to more developers being exposed to safer, cleaner ways to solve problems. Which means less terrible code being written from following terrible SO answers and tutorials. And now things are a lot better. There's still obviously work that needs to be done, but: - The ecosystem (i.e. tutorials) is improving - The language is improving drastically - The community is pushing towards better practices - Framework developers are taking security seriously A lot of people don't like how PHP used to be, including most of the people who put time and energy into making it better. You're not alone. P.S. If you like the direction things are headed, help us make 7.1 even better: * https://wiki.php.net/rfc/mcrypt-viking-funeral https://wiki.php.net/rfc/mcrypt-viking-funeral * https://wiki.php.net/rfc/libsodium https://wiki.php.net/rfc/libsodium * https://wiki.php.net/rfc/php71-crypto https://wiki.php.net/rfc/php71-crypto

addedlovely 11y ago
Nice work on SO reviewing q's, great idea.
voltagex_ 11y ago
Brilliant. Do other languages need the same cleanup?
- CiPHPerCoder 11y ago
  Java, C#, and Node.js come to mind immediately as good candidates, but any beginner-friendly language probably need it to some degree. The Node.js core is particularly bad: It only offers OpenSSL's userspace RNG rather than the operating system's CSPRNG. (That's what window.crypto.getRandomValues() hooks into.) Many of node's deficiencies are tackled by the community, of course. For example: https://www.npmjs.com/package/scrypt-for-humans https://www.npmjs.com/package/scrypt-for-humans versus the native PBKDF2 (with no constant-time comparison). I hear Ruby's SecureRandom still refuses to switch from /dev/random to /dev/urandom as well. Feel free to throw your hat in the ring on that issue. Historically, C# doesn't have as strong of an open source culture, but if you wanted to make an impact, you could try to nurture it into growing explosively. But generally: Look at the languages you're already familiar with and see if bad security advice gets more attention from non-experts than from experts. If that's the case, go out of your way to learn how to do things better (if you aren't already well informed) and publish your corrections.
mikegioia 11y ago
What you've done is fantastic. Is there anything that can be done particularly to help along the mcrypt funeral?
imakesnowflakes 11y ago
> The language is improving drastically This is a myth. It is adding new features. That does not mean it is improving.
- noir_lord 11y ago
  They added new sane features, deprecated old stuff with more to come, improved performance by over 100% on many workloads while maintaining backwards compatibility, implemented a proper AST with a JIT to follow. I'm curious what your idea of improving is frankly.
  - imakesnowflakes 11y ago
    >They added new sane features.. Have you heard the expression, "A chain is only as strong as the weakest link?". So adding strong links after a weak link does not "improve" the strength of the chain. And that is assuming that these new features added are actually sane. From what I have seen, it is not the case. see here [1] So you cannot improve php with out making it "not php". And I don't think even if the same people started who are working in the language started from scratch, today, it will be much better than Php. Because they are simply not competent (refer [1]), because if you are competent, and has the vision to see the flaws of the language and the community, you won't go anywhere near it. So I think there is zero chance of Php becoming "sane", let alone nice... [1] https://np.reddit.com/r/PHP/comments/3j88v4/something_about_php_7_i_just_saw_in_rlolphp_why/ https://np.reddit.com/r/PHP/comments/3j88v4/something_about_...
    - noir_lord 11y ago
      In Python 2 print 3/2 outputs 1 In Python 3 print(3/2) outputs 1.5 Even a language that is regarded as well designed has unexpected behaviour, it's not necessarily wrong it's just not what the user expects. They fixed it in 3 but does it's existence in 2 make Python a bad language? PHP historically did a lot of stuff that a user wouldn't expect but they have started to clean that up, it won't happen overnight but the trend is there, strong and growing. No such thing as a perfect programming language since everyone has a different definition of perfect.
lucaspiller 11y ago
> [...] would lead you to bad practices I feel this isn't really due to anything inheritely wrong with PHP, but more of it becoming a victim of it's own success. I feel that Node is heading in the same direction too, as more and more people (especially those new to programming) start using it. At least with Node, using third party libraries and frameworks is more common than the 'copy and paste these lines of code' when I learnt PHP 15 years ago :D Thanks for helping to fix the situation!

addedlovely 11y ago

Nice work on SO reviewing q's, great idea.

voltagex_ 11y ago

Brilliant. Do other languages need the same cleanup?

CiPHPerCoder 11y ago
Java, C#, and Node.js come to mind immediately as good candidates, but any beginner-friendly language probably need it to some degree. The Node.js core is particularly bad: It only offers OpenSSL's userspace RNG rather than the operating system's CSPRNG. (That's what window.crypto.getRandomValues() hooks into.) Many of node's deficiencies are tackled by the community, of course. For example: https://www.npmjs.com/package/scrypt-for-humans https://www.npmjs.com/package/scrypt-for-humans versus the native PBKDF2 (with no constant-time comparison). I hear Ruby's SecureRandom still refuses to switch from /dev/random to /dev/urandom as well. Feel free to throw your hat in the ring on that issue. Historically, C# doesn't have as strong of an open source culture, but if you wanted to make an impact, you could try to nurture it into growing explosively. But generally: Look at the languages you're already familiar with and see if bad security advice gets more attention from non-experts than from experts. If that's the case, go out of your way to learn how to do things better (if you aren't already well informed) and publish your corrections.

mikegioia 11y ago

What you've done is fantastic. Is there anything that can be done particularly to help along the mcrypt funeral?

imakesnowflakes 11y ago

> The language is improving drastically This is a myth. It is adding new features. That does not mean it is improving.

noir_lord 11y ago
They added new sane features, deprecated old stuff with more to come, improved performance by over 100% on many workloads while maintaining backwards compatibility, implemented a proper AST with a JIT to follow. I'm curious what your idea of improving is frankly.
- imakesnowflakes 11y ago
  >They added new sane features.. Have you heard the expression, "A chain is only as strong as the weakest link?". So adding strong links after a weak link does not "improve" the strength of the chain. And that is assuming that these new features added are actually sane. From what I have seen, it is not the case. see here [1] So you cannot improve php with out making it "not php". And I don't think even if the same people started who are working in the language started from scratch, today, it will be much better than Php. Because they are simply not competent (refer [1]), because if you are competent, and has the vision to see the flaws of the language and the community, you won't go anywhere near it. So I think there is zero chance of Php becoming "sane", let alone nice... [1] https://np.reddit.com/r/PHP/comments/3j88v4/something_about_php_7_i_just_saw_in_rlolphp_why/ https://np.reddit.com/r/PHP/comments/3j88v4/something_about_...
  - noir_lord 11y ago
    In Python 2 print 3/2 outputs 1 In Python 3 print(3/2) outputs 1.5 Even a language that is regarded as well designed has unexpected behaviour, it's not necessarily wrong it's just not what the user expects. They fixed it in 3 but does it's existence in 2 make Python a bad language? PHP historically did a lot of stuff that a user wouldn't expect but they have started to clean that up, it won't happen overnight but the trend is there, strong and growing. No such thing as a perfect programming language since everyone has a different definition of perfect.

lucaspiller 11y ago

> [...] would lead you to bad practices I feel this isn't really due to anything inheritely wrong with PHP, but more of it becoming a victim of it's own success. I feel that Node is heading in the same direction too, as more and more people (especially those new to programming) start using it. At least with Node, using third party libraries and frameworks is more common than the 'copy and paste these lines of code' when I learnt PHP 15 years ago :D Thanks for helping to fix the situation!