12 ms·
WordPress on .NET
- andy_ppp 10y agoThis is very clever, what is the performance like compared to PHP?
- sremani 10y agoFrom their benchmarks page (which looks remarkable) http://www.peachpie.io/benchmarks http://www.peachpie.io/benchmarks
- ihsw 10y agoThis page doesn't have memory usage -- large PHP applications tend to chug memory. But the execution time does look very impressive. Next step is to get Symfony, Laraval, et al to run on this.
- arenaninja 10y agoRemarkable, but as bleeding-edge tech I think it's disingenuous to include PHP5.6, which is now only on security support. I know many PHP sites run this version and even older ones, but I think the audience for a project like this are PHP7 developers. That said, I was really impressed by the improvement on require performance. The requests/sec also seem to have big gains. I also wonder what security improvements other are expecting from this? Isn't unsecure code unsecure regardless of language?
- sremani 10y agoCLR imposes lot of requirements for an assembly to run, that would definitely improve security esp. when comparing it to a interpreted language.
- arenaninja 10y agoAh ok. In terms of security I don't tend to think of memory safety, etc. especially since PHP processes die fast. I thought everyone was talking about SQL injections and the like so I was very confused Thanks for clarifying!
- sremani 10y agohttps://www.cvedetails.com/vulnerability-list/vendor_id-74/product_id-128/PHP-PHP.html https://www.cvedetails.com/vulnerability-list/vendor_id-74/p... Wow those are interesting. SQL Injection is still an issue if there are string concats every where and calling the DB, so that is something, that can still happen.
- skc 10y agoThat's quite a blowout.
- benaadams 10y agoTried the TechEmpower plaintext benchmark using Peachpie: Requests/sec: 305,612.35 https://github.com/benaadams/PeachpieBenchmarks https://github.com/benaadams/PeachpieBenchmarks
- oblio 10y agoWell, considering the fact that PHP post v4 is trying to become Java, it made sense that at some point it would be able to run on the JVM or its step-cousin CLR. By the way, does anyone know of a similar project where the JVM is targeted instead?
- 0x0 10y agoQuercus was (is?) an attempt at doing PHP on the JVM, it's been many many years since I last looked into it. http://quercus.caucho.com/ http://quercus.caucho.com/
- mgkimsal 10y ago"project zero" was an effort from ibm to run php on jvm, but it's been several years since anything was done (have to assume it's abandoned). i remember in 2003 wondering if something to allow php to run on jvm would be useful/viable - couldn't convince too many folks in the local user group that the idea had any merit.
- jakubmisek 10y agoj-php - but they don't try to be able to run existing apps
- duke360 10y ago<3 this! any idea on when it will be production-ready?
- hultner 10y agoWhat's the benefit over running a standard PHP-Interpreter? Haven't used PHP or WordPress since 2010 so I might have missed something but to me this looks more like a tech demo then something one would use in a production environment.
- amalag 10y agoI remember from the PHP on Java that there were huge performance benefits. So large PHP hosts should see benefits.
- mtgx 10y agoPHP 7 improved performance by around 3x compared to PHP5, so I wonder how true that still is.
- FraaJad 10y agoThe benchmarks http://www.peachpie.io/benchmarks http://www.peachpie.io/benchmarks show peachpie outperforming PHP7 easily by 100x.
- blowski 10y agoOn Azure, without Opcache enabled. That's not a very good comparison.
- Lievelingsduif 10y agoWhile I do know that Azure is owned by Microsoft I'm not so sure on why it's such a valid argument. In the end it's not like they're actively trying to ruin languages other than C# on their servers? Especially since that would ruin it for a lot of customers?
- egeozcan 10y agoThis seems to be built on an open-souce PHP->CLR compiler called Peachpie[1]. Interesting project. I don't have any PHP codebase that I still maintain but looking forward to trying it with some scripts I've written back in the days. I wonder if it would be faster than PHP 7 - which is already very fast (ok, just found these: http://www.peachpie.io/benchmarks http://www.peachpie.io/benchmarks ). [1]: http://www.peachpie.io/ http://www.peachpie.io/ [edit] If the author is looking, a few nitpicks from the website: - A blank page is shown if browser doesn't load 3rd party scripts by default - After enabling them, the scroll wheel doesn't work - Typo: "free completely to use" -> "completely free to use" - "Run PHP apps on the most secure platform available, Microsoft .NET" -> I also admire the platform but most secure? Comes off a bit too strong.
- j_s 10y agoInteresting. I had heard of https://github.com/DEVSENSE/Phalanger https://github.com/DEVSENSE/Phalanger the predecessor to PeachPie.
- jakubmisek 10y agoJust noticed a similar comment below - the openssl library which PHP is strugling with with every update. Peachpie uses the one in OS through the .NET being updated e.g. by Windows Update. So maybe "most secure" is too strong, but it is definitely more secure.
- JepZ 10y agoNever had any problems with PHP and openssl. Did I miss something or is this specific to the windows platform? (It's been a while since I updated PHP on a Windows system the last time).
- pchp 10y agoThanks for this, will fix asap.
- drzaiusapelord 10y ago>I also admire the platform but most secure? Comes off a bit too strong. There aren't a lot of .NET exploits for a variety of reasons. Its pretty much the Java of the MS world so a lot of issues more liberal languages have, it doesn't, especially in regards to buffer overflows. Its attack surface is also pretty low as it only really inter-operates, by default, with a limited number of MS applications and is frequently the most common setup, while PHP supports anything and everything. Http.sys also seems like a more secure product than openssl. That said, its also the minority platform so it benefits from a lack of effort to target it. I also worry that the closed nature of the platform could lead to someone(s) building up an army of zero days while the more open stuff gets discovered and disclosed faster. I'm not sure how realistic that fear is. At my job we're always scrambling with our FOSS architecture in regards to emergency patching. The MS stuff is more or less 'do monthly patches and forget.'
- nbevans 10y agoRunning PHP and indeed WordPress on the .NET CLR seems like a great way to eliminate a whole tranche of bugs/vulnerabilities in one swoop. Respect.
- jakubmisek 10y agoTrue, I've been noted, for example, about issues with openssl library, which is updated with every update of PHP ... while Peachpie uses the one provided within .NET which might be more frequently updated by Windows Update.
- tannhaeuser 10y agoHow so? A PHP runtime running WP on .NET needs to be bug-for-bug compatible with the real thing (and I've heard early PHP APIs aren't exactly a paragon of API design). Also, why would php-on-net be updated more often than one of the most used runtimes on the web?
- alkonaut 10y agoIf only the .NET version would use proper security (no permissioner to modify files, sandboxed plugins, ....) then yes. But that would be a rewrite. Otherwise the .NET version only remedies vulnerabilities in php and not those in WordPress or its plugins.
- pawadu 10y agoI don't care about performance, show me if security has improved! (which in the case of Wordpress can't be that hard)
- deckiedan 10y agoWordPress security is complex. The core code is OK, security wise. Comparible to similar projects, I guess. The two major issues are that typically PHP runs with permission to modify the WordPress directory, which is useful for automatic upgrades, but means any exploit in any plugin, theme, etc. instantly becomes, "can replace WordPress". The other is that all themes and plugins are completely unsandboxed, and the quality is extremely variable. The permissions thing can be fixed, by running a very stripped down wp-php user with only read access to the code, and only write access to wp-contents/uploads (and a logging dir). Then you do automatic upgrades with wp-cli and (real) cron from a user with write access. The quality of plugins and themes is not easily fixed. The API for writing plugins and themes doesn't help. It's archaic, spaghetti, and doesn't have any kind of coherenc. Global functions like wp_is_home(), the_loop(), get_sitename(), etc. I've come across themes which bundle joomla inside them as they're really joomla themes with a shim.
- stephenr 10y ago> OK, security wise Since when is implementing your own home-grown shitty replacement for parameterised queries "OK"?
- debacle 10y agoSince you need to support versions of PHP that don't support the extensions that have parameterized queries.
- floatboth 10y agoExcept… you don't? > WordPress also works with PHP 5.2.4+ and MySQL 5.0+, but these versions have reached official End Of Life and as such may expose your site to security vulnerabilities > PDO ships with PHP 5.1, and is available as a PECL extension for PHP 5.0 Unless you mean "hosts that disabled PDO"… I think they can safely be ignored.
- algorithmsRcool 10y agoI've been following the peachpie project for a while. The effort they put in is very impressive. They choose to heavily modify the C#/VB compiler (Roslyn) to handle php syntax. Microsoft should be investing time into helping them succeed, it would be great to see the Roslyn compiler platform become more broadly used.
- pchp 10y agoMicrosoft is doing quite a bit of supporting, can't complain there :)
- deleted 10y ago[deleted]
- hokkos 10y agoIt's so smart to do that, Roslyn provides a good design, keeping a rich syntax tree that can help for language tooling (auto-completion), so Language Server for VSCode is for free and all backends too.
- alistproducer2 10y agoI work at a large company and we are starting to branch out into other languages. the problem is most of our infrastructure in .NET. Something like this would be really cool as it would allow us to utilize PHP while not asking too much of infrastructure team. I might put in an OSS approval request for this.
- emodendroket 10y agoI think you might be the first case I've heard of of someone wanting to go from .NET to PHP.
- phkahler 10y agoI laughed at that. As much as I still shun MS platforms, I have never heard anything good about PHP as a language other than "it worked and was available at the time". Why someone would migrate in this direction is beyond me ;-) but that's just my opinion of course.
- jacquesm 10y agoCritical mass, availability of developers, good documentation, free. There are many reasons why people pick one technology over another.
- dyml 10y agoThis is amazing and from the comments I've heard that Microsoft is around supporting the development of this? Is there any MS material mentioning this effort? I'm really impressed by your work
- pchp 10y agoWe made two appearances on the Channel 9 show "On .NET" and one on DotNet Rocks. They also mentioned it a few times on some blogs.
- jakubmisek 10y agothere are links to MS blogs and livecasts http://www.peachpie.io/resources http://www.peachpie.io/resources and of course youtube channel https://www.youtube.com/channel/UC5Hh61n9HFyqYbU4iFkqy4A https://www.youtube.com/channel/UC5Hh61n9HFyqYbU4iFkqy4A
- skrowl 10y agoCool idea. How is the performance vs PHP?
- pchp 10y agoWe haven't benchmarked WordPress yet, as we haven't even started doing any optimization work. It's faster than expected though, but we'll produce a proper benchmark soon.
- rattray 10y agoThey have benchmarks here: http://www.peachpie.io/benchmarks http://www.peachpie.io/benchmarks The last one is probably the most useful and impressive. As mentioned by sibling, not WP-specific, and benchmarks often lie, but better than nothing.
- pchp 10y agoCheck out Ben Adams' benchmarks at https://github.com/benaadams/PeachpieBenchmarks https://github.com/benaadams/PeachpieBenchmarks
- jeresuikkila 10y agoBut why?
- WhitneyLand 10y agoThis is a great way for Microsoft to show the potential of and build awareness for .NET core, I hope they are helping these guys. The nuget thing is inefficient, MS should plot a path to make npm a first class citizen in all ms tools.
- kevin_thibedeau 10y agoThat would require a filesystem that can handle node first.
- mathw 10y agoHow is nuget less efficient than npm?
- amcrouch 10y agoWhy on earth would MS want npm to replace what is one of the better parts of the .Net world?
- amcrouch 10y agoWhy on earth would MS want npm to replace what is one of the better parts of the .Net world?
- douche 10y agoNo, please, no. It'd be nice if somebody would get back to maintaining nuget packages for front-end stuff, the way it was a few years ago, before everyone collectively threw in the towel, shrugged, and said, "I guess npm isn't that painful. You know, compared to having forks shoved in my eyeballs, it's quite nice."
- nvivo 10y agoNPM is already supported by default for quite some time in VisualStudio.
- WhitneyLand 10y ago>NPM is already supported by default for quite some time in VisualStudio I should have been more clear. I mean MS should work with Node/LAMP people to invest in one package manager more than the other. Like they did with TypeScript, they didn't just build a tool that linux people never used, they made useful tooling and also spent a lot of time bringing Google and others into the fold. It makes sense to back npm because (guessing) it's used more than nu-get is used by VS devs. However if nu-get has a stronger ecosystem, stronger user base, etc choose it. Having competition is usually good, but sometimes it just means it's more work to have to learn more/work more to get the same thing done (if you work across environments). Take instant messaging protocols, lots of competition but not even having cooperation has made the result terrible. Incompatibility everywhere, reinventing the wheel, etc. To be sure some things are better not unified. We have multiple, un-unified browser engines and implementations which is critical. It improves competition, innovation and quality while still allowing surface level standardization in html/css/etc. I try to look at each set of competing projects independently and ask: Overall is this helping, or it is mostly just wasting time as clients are forced to learn multiple techs.
- jmcdiesel 10y agoYour developers were so preoccupied with whether or not they could, they didn’t stop to think if they should.
- jacquesm 10y agoThat's an assumption on your part. What a terrible comment.
- freehunter 10y agoHe's quoting Jurassic Park. The idea is that the technology does something that would normally be considered highly unusual or even ridiculous to consider, like running a very complicated code base through a transpiler to make it run on another tech stack. Generally speaking, this kind of comment would be a compliment. Sort of along the lines of "wow, that's absolutely crazy, you did something no one would have thought possible, good work". It's a much more light-hearted comment than you seem to think it is.
- jacquesm 10y agoI don't care what he's quoting and to see this as 'light-hearted' (without any further elaboration on the part of the OP) is extrapolation. FWIW the comment in the movie is also a negative one. > John Hammond: I don't think you're giving us our due credit. Our scientists have done things which nobody's ever done before... > Dr. Ian Malcolm: Yeah, yeah, but your scientists were so preoccupied with whether or not they could that they didn't stop to think if they should. > John Hammond: Condors. Condors are on the verge of extinction... > Dr. Ian Malcolm: [shaking his head] No... > John Hammond: If I was to create a flock of condors on this island, you wouldn't have anything to say. > Dr. Ian Malcolm: No, hold on. This isn't some species that was obliterated by deforestation, or the building of a dam. Dinosaurs had their shot, and nature selected them for extinction. > John Hammond: I simply don't understand this Luddite attitude, especially from a scientist. I mean, how can we stand in the light of discovery, and not act? > Dr. Ian Malcolm: What's so great about discovery? It's a violent, penetrative act that scars what it explores. What you call discovery, I call the rape of the natural world.
- pmlnr 10y agoPHP is about to face Embrace, extend and extinguish?
- recrof 10y agoI'm not sure if your "joke" is relevant. .NET core is open source: https://github.com/dotnet/core https://github.com/dotnet/core
- floatboth 10y agoShared Apache+mod_php+MySQL hosting turns out to be impossible to extinguish…
- tannhaeuser 10y agoYes. I had hoped node.js would fill the role of a cheap generic hosting platform with taste. But while it works well for me on VMs/cloud, managed hosting for node.js is nowhere near PHP in terms of ubiquity.
- bbcbasic 10y agoThings have changed a bit since the J++ days
- yarrel 10y agoNo.
- CiPHPerCoder 10y agoAny chance we can get PHP's HashDoS vulnerability removed if we switch to PeachPie? PHP 7.2 will make libsodium a core extension, so if you use that, you can make use of SipHash-2-4.
- jakubmisek 10y agoInteresting question. Beside that ASP.NET limits request size, Peachpie uses .NET hash function that differs from that used in PHP. Am I close ?
- jesalg 10y agoSeveral years ago I used to run a WordPress blog on IIS 7 using FastCGI. The performance wasn't great but acceptable for a small blog. Wonder how this compares.
- txdv 10y agoIt is faster
- urbanxs 10y ago"Run PHP apps on the most secure platform available, Microsoft .NET." - what?
- mattl 10y agoI can't file an issue on GitHub but the project is missing the license and the WordPress standard copy seems to have been removed.
- pchp 10y agoWe disabled issues for now, but thanks for pointing this out. Just added the license to the peachpie-wordpress repository.