3 ms·

Developers care about cognitive load, and people care about security. Sure, they'll be some guy who's memorised all of PHPs quirks, but for most of us the inco

Developers care about cognitive load, and people care about security. Sure, they'll be some guy who's memorised all of PHPs quirks, but for most of us the inconsistencies make it hell to program, because you're always looking up stuff. As a result, writing secure PHP is possible, but far harder than it should be. IMO the laughable security track record of e.g. Wordpress have damaged PHP's reputation more than anything else.

dsacco 10y ago
As a counterpoint, Facebook, one of the most secure companies in the world, is also the largest single PHP deployment in the world. C is also a language with a frankly horrific security track record; at least an order of magnitude more so than PHP. But C continues to be used because it is a useful and relatively simple language despite its warts and pitfalls.[1] Security is just as much a business process as it is a technical feature. ______________________ 1. Granted, one of the major design goals of Rust is replacing C, but you get the point.
- guitarbill 10y ago
  Or Etsy. I think your comment about C is right, however in many cases mercifully the C code isn't facing the internet :) When it does, it can go very wrong, e.g. OpenSSL. The extra cognitive load doesn't guarantee failure, it just makes it easier to slip up. Even with Python or Rust, you can put insecure code in there (e.g. with Python's subprocess.call(..., shell=True)). Realistically, strict modes and linters are always a good idea and can catch most of these pitfalls.
  - jagger27 10y ago
    Of course C is facing the internet. The entire Linux networking stack is written in C. Damn near every request on the internet touches that code.
    - sebcat 10y ago
      And nginx, and apache, and php, and ...
    - guitarbill 10y ago
      At which point did you decide not to read the comments properly? The gist was that PHP was designed for web use, so it's almost always facing the internet. C on the other hand is very much multi-purpose. Both can be made secure, but maybe it's less effort using something that helps you with security (Hack, Rust, etc.). (BTW, your comment contains a huge fallacy: Just because a majority of packets touches something written in C, that doesn't mean a majority of C code written is exposed to the internet. This is arguably the entire point of e.g. iptables.)

dsacco 10y ago

As a counterpoint, Facebook, one of the most secure companies in the world, is also the largest single PHP deployment in the world. C is also a language with a frankly horrific security track record; at least an order of magnitude more so than PHP. But C continues to be used because it is a useful and relatively simple language despite its warts and pitfalls.[1] Security is just as much a business process as it is a technical feature. ______________________ 1. Granted, one of the major design goals of Rust is replacing C, but you get the point.

guitarbill 10y ago
Or Etsy. I think your comment about C is right, however in many cases mercifully the C code isn't facing the internet :) When it does, it can go very wrong, e.g. OpenSSL. The extra cognitive load doesn't guarantee failure, it just makes it easier to slip up. Even with Python or Rust, you can put insecure code in there (e.g. with Python's subprocess.call(..., shell=True)). Realistically, strict modes and linters are always a good idea and can catch most of these pitfalls.
- jagger27 10y ago
  Of course C is facing the internet. The entire Linux networking stack is written in C. Damn near every request on the internet touches that code.
  - sebcat 10y ago
    And nginx, and apache, and php, and ...
  - guitarbill 10y ago
    At which point did you decide not to read the comments properly? The gist was that PHP was designed for web use, so it's almost always facing the internet. C on the other hand is very much multi-purpose. Both can be made secure, but maybe it's less effort using something that helps you with security (Hack, Rust, etc.). (BTW, your comment contains a huge fallacy: Just because a majority of packets touches something written in C, that doesn't mean a majority of C code written is exposed to the internet. This is arguably the entire point of e.g. iptables.)