4 ms·

... for a quite generous definition of "worked". In comparison, writing web applications with SWI-Prolog is quite safe also thanks to the powerful quasi-quotat

by zmonx 9y ago

... for a quite generous definition of "worked". In comparison, writing web applications with SWI-Prolog is quite safe also thanks to the powerful quasi-quotation mechanism.

nickpsecurity 9y ago
"... for a quite generous definition of "worked"." Barely. All kinds of people learned it quickly. They built web applications. It became a dominant web, application language. The momentum led to many improvements in its ecosystem and deficiencies. Prolog failed to do... any of that at PHP's scale.
- zmonx 9y ago
  A language like PHP greatly increases the chance of security problems. There is ample evidence of such issues in practice. This is one consequence of the quite low-level way to reason about the available data, and a class of problems that does not arise so easily in Prolog. This is just one of many instances where barely working solutions are used, partly stemming from a lack of alternatives at that time. Robust web frameworks are only now becoming gradually available in Prolog!
  - nickpsecurity 9y ago
    PHP wasn't designed for secure web applications. Most of its users don't care about that. It thrives anyway. So, this isn't a failure of PHP. On contrary, the author cranking it out quickly might have been a reason for success. Now, someone wanting secure apps might not want PHP. They traditionally went with "safe" languages such as C# or Java whose runtimes were full of 0-days. They might find Ada, Component Pascal, or Rust with a web framework helpful. Even enterprise sector hasn't been writing most web pages is Ada, though. ;)
    - zmonx 9y ago
      Why are you downvoting what I wrote? You are arguing against statements I did not make. PHP worked for many people in what I can only consider a quite generous definition of "worked", in tandem with countless security problems that arise almost necessarily from its low-level data representation. I am not arguing that this has impeded its adoption, that most users care about this, or that it does not "thrive". These are not signs that it works in the way I prefer software and languages to work. In particular, for writing secure web applications, I cannot recommend PHP. In the future, I expect to see more and more Prolog web applications. The necessary frameworks are now becoming available, with much better safety properties.
      - nickpsecurity 9y ago
        You just repeated the statement Im arguing against: "generous definition of worked." The goal of PHP was to help people, esp non-experts, quickly build web sites. People off all skill levels managed to build web sites that did what they intended in the intended use case. As in, PHP worked for the exact thing it was designed for. It also went beyond that by getting massive adoption by people cranking out too many sites go count. Its success at its goal is legendary in a good or bad way depending on who you ask. Next, you talk about the preference for secure, web apps. Being a high-assurance, security engineer, I'd expect you to immediately start talking about Ada, Opa w/ modified back end, SWIFT on SIF, Ur/Web, Haskell with secure framework... languages that are systematically dedigned to either make classes of vulnerabilities impossible or reduce them greatly. Also, esp Ada or SPARK whose low-level libraries are written in same language for as much safety as possible. Instead, you counter insecurity of PHP use by recommending a Prolog not designed for security with low-level components probably written in C or C++ since most Prologs are. It's probably gotten almist no pentesting to knock out low-hanging fruit either. If those are true, then that's highly hypocritical that you'd smear PHP while recommending something so insecure or uncertain in its security. Far as downvotes, it was because you made a bogus claim about PHP's success with no substantiation. I certainly didnt downvote you cuz Im anti-censorship, voted to eliminate downvotes on Lobsters, and it's impossible to downvote a person replying to you. Check that claim by looking for downvote option next to my name. I instead prefer to counter bullshit with facts in actual comments. Also, with citations when I have time. As is clear by this one.
  - eeZah7Ux 9y ago
    Why the downvotes to the parent? The evidence is there. https://www.cvedetails.com/top-50-vendors.php https://www.cvedetails.com/top-50-vendors.php

by zmonx 9y ago

... for a quite generous definition of "worked". In comparison, writing web applications with SWI-Prolog is quite safe also thanks to the powerful quasi-quotation mechanism.

nickpsecurity 9y ago

"... for a quite generous definition of "worked"." Barely. All kinds of people learned it quickly. They built web applications. It became a dominant web, application language. The momentum led to many improvements in its ecosystem and deficiencies. Prolog failed to do... any of that at PHP's scale.

zmonx 9y ago
A language like PHP greatly increases the chance of security problems. There is ample evidence of such issues in practice. This is one consequence of the quite low-level way to reason about the available data, and a class of problems that does not arise so easily in Prolog. This is just one of many instances where barely working solutions are used, partly stemming from a lack of alternatives at that time. Robust web frameworks are only now becoming gradually available in Prolog!
- nickpsecurity 9y ago
  PHP wasn't designed for secure web applications. Most of its users don't care about that. It thrives anyway. So, this isn't a failure of PHP. On contrary, the author cranking it out quickly might have been a reason for success. Now, someone wanting secure apps might not want PHP. They traditionally went with "safe" languages such as C# or Java whose runtimes were full of 0-days. They might find Ada, Component Pascal, or Rust with a web framework helpful. Even enterprise sector hasn't been writing most web pages is Ada, though. ;)
  - zmonx 9y ago
    Why are you downvoting what I wrote? You are arguing against statements I did not make. PHP worked for many people in what I can only consider a quite generous definition of "worked", in tandem with countless security problems that arise almost necessarily from its low-level data representation. I am not arguing that this has impeded its adoption, that most users care about this, or that it does not "thrive". These are not signs that it works in the way I prefer software and languages to work. In particular, for writing secure web applications, I cannot recommend PHP. In the future, I expect to see more and more Prolog web applications. The necessary frameworks are now becoming available, with much better safety properties.
    - nickpsecurity 9y ago
      You just repeated the statement Im arguing against: "generous definition of worked." The goal of PHP was to help people, esp non-experts, quickly build web sites. People off all skill levels managed to build web sites that did what they intended in the intended use case. As in, PHP worked for the exact thing it was designed for. It also went beyond that by getting massive adoption by people cranking out too many sites go count. Its success at its goal is legendary in a good or bad way depending on who you ask. Next, you talk about the preference for secure, web apps. Being a high-assurance, security engineer, I'd expect you to immediately start talking about Ada, Opa w/ modified back end, SWIFT on SIF, Ur/Web, Haskell with secure framework... languages that are systematically dedigned to either make classes of vulnerabilities impossible or reduce them greatly. Also, esp Ada or SPARK whose low-level libraries are written in same language for as much safety as possible. Instead, you counter insecurity of PHP use by recommending a Prolog not designed for security with low-level components probably written in C or C++ since most Prologs are. It's probably gotten almist no pentesting to knock out low-hanging fruit either. If those are true, then that's highly hypocritical that you'd smear PHP while recommending something so insecure or uncertain in its security. Far as downvotes, it was because you made a bogus claim about PHP's success with no substantiation. I certainly didnt downvote you cuz Im anti-censorship, voted to eliminate downvotes on Lobsters, and it's impossible to downvote a person replying to you. Check that claim by looking for downvote option next to my name. I instead prefer to counter bullshit with facts in actual comments. Also, with citations when I have time. As is clear by this one.
- eeZah7Ux 9y ago
  Why the downvotes to the parent? The evidence is there. https://www.cvedetails.com/top-50-vendors.php https://www.cvedetails.com/top-50-vendors.php