For some reason, PHP is not just a language, it's a spirit of writing bad software. A few weeks back I needed to port some crypto from Laravel to Go. I did not

For some reason, PHP is not just a language, it's a spirit of writing bad software. A few weeks back I needed to port some crypto from Laravel to Go. I did not have too much trouble – apart the strange usage of Rijndael-256 that Laravel had until one version or two ago. When I looked at the way they were using keys to encrypt data, I realized that they were directly using "application private key". Is that bad? It shouldn't, but Laravel makes sure all the keys it generates are ASCII, for copy/pasting convenience. What happens if you're using a 256-bit key that can be represented with ASCII? The key space is 10^20 times smaller (the entropy of a byte in the key goes from 256 to 62!). That's been a thing in the most "modern framework" in PHP for more than three years. I'm far from being a security professional, but spending one hour on one file was enough to find a basic security issue. Let's just say we're not writing code with Laravel anymore. I must mention that Taylor Otwell (the author) was extremely fast for fixing the problem. He is probably among the best open source project maintainers I know, and desserves to live off this work on Laravel. Here is the commit: https://github.com/laravel/framework/commit/370ae34d41362c3adb61bc5304068fb68e626586 https://github.com/laravel/framework/commit/370ae34d41362c3a...