7 ms·

Creator of PHP talks to Digg about performance and security

50 points by ecaron 16y ago

nphase 16y ago
I'd be willing to bet the Digg engineers were bored by this talk. Most of this isn't new and is already PHP best practice (minus the HipHop stuff, I suppose).
- smokinn 16y ago
  I saw him give the talk at the Confoo conference (formerly PHP Quebec that got renamed when Ruby + Python tracks were added) and I was bored as well. You can pretty much boil his talk down to use a profiler and make sure you run as little lines of code as possible. (AKA: Extra indirection always adds extra cost which is why generic web dev frameworks are always slow) The HipHop part of his talk isn't really useful because extremely few sites are resource constrained enough at the web server level for it to make sense to complicate your deployments that massively.
  - jolan 16y ago
    He made a good point about using HipHop for static analysis though. The weird code he found in WordPress via HipHop was a bit disconcerting considering how many copies of it are running. The performance stuff was pretty boring. 30 minutes of talking to go from 9 to 34 reqs/s. My VPS provider can increase my resources by an order of magnitude in 1 minute.
    - code_duck 16y ago
      You don't need to analyze WordPress via HipHop to determine that it is truly dangerous total crap written by morons, and given that, it's been apparent for a long time that it is disturbing how many copies of it are running. If you take a look at any community of designers who consider themselves 'developers', its scary - most of them build on WordPress as a platform. Clearly this is somewhat like putting up a tent on the Deepwater Horizon drilling platform. I can't believe how terrible the innards of wordpress are. That said, the outtards work pretty well, somehow.
jolan 16y ago
I really like his rant that starts at the ~62 minute mark and ends with this: "PHP is just a damn tool. It's just a hammer; it's boring. It's not that interesting. I'm not that interested in it. But I need a working tool to solve problems. I'm really, really interested in problems. The tool itself; if it works great. If it's broken I fix it. But I don't spend my entire life fixing it. PHP is damn ugly. It'll always be ugly because we're not going to spend the time to sit and make it pretty. We're spending our time building actual solutions and fixing problems. And the tool works. You can build really, really fast things with PHP. And yes, it's not pretty. If you're a CS major or if all sort of for the purity of coding; PHP is not for you. But then you're not probably not interested in building things for end users."
- cheald 16y ago
  I'm not much a fan of that sentiment. It's the same sentiment espoused by people who don't have time to design software properly, or test it, or do exception handling. The tool is an important part of solving problems, but having an elegant tool helps keep the tool itself from becoming a problem. There seems to be subtext in that rant which says "prettier languages are inferior because they're written by academic snobs who don't have any experience actually writing real software", which is just patently false.
  - scorpioxy 16y ago
    Seconded. Also, people who usually have that sentiment are not the same people who have to maintain the code. They're usually long gone by then. I have personally suffered many sleepless nights having to maintain projects like that. I think it's healthy to avoid extremes. Neither a "whatever works" nor a "write everything in lisp because it's beautiful" sentiment. It's up to the good programmer to decide when to be a pragmatist and when to be a purist.
  - jolan 16y ago
    My takeaway was that you should use what you're most productive in; even if there happens to be some inconsequential warts.
baddox 16y ago
Regarding his anecdote of the company porting a client's application from PHP to Rails: Maybe the fact that completely rewriting an application in Rails is preferable to maintaining their PHP application is telling.
- pornel 16y ago
  Rewriting is always more fun than maintenance.
chrischen 16y ago
I see php as a lightweight web framework. And it works well for that. I wouldn't use it for general purpose scripting though.
ck2 16y ago
I look forward to one day having real php compilers instead of just opcode caches. If I am not mistaken there are a couple of projects already working on that.
- ahupp 16y ago
  Check out http://wiki.github.com/facebook/hiphop-php/ http://wiki.github.com/facebook/hiphop-php/
  - ck2 16y ago
    For some reason I didn't consider HipHop as a native compiler since it's really converting into another language to get outside of PHP entirely. Also, it's supposedly REALLY difficult to build. I was thinking more like PHC but more evolved.
    - pbiggar 16y ago
      I think it's fair to call HipHop a native compiler, since it can generate native executables. phc generates C code, which is admittedly lower-lever, but it's roughly the same idea. I'm interested in how you'd like phc to be more evolved. I've had lots of ideas (I'm the author) but I'm curious what others would like. Thanks!
thomasfl 16y ago
After 3 minuts Rasmus says this: "I never taken any classes in computer science. I should have taken classes in computer science". So it was never designed to be a state of the art language. Just a tool to get things done. From 1997 to 2001 I really enjoyed solving problems in PHP. But things have changed. I have learned more and now certainly prefer using Ruby.
c00p3r 16y ago
Creator of PHP talks about security it is already funny.. ^_^
- mdg 16y ago
  He drops knowledge quite frequently on the subject.
  - c00p3r 16y ago
    People who are really concerned about security starts from a clear design with security in mind. PHP lacks any kind of design, it was just an rapidly evolved toolchan. ^_^
    - deleted 16y ago
      [deleted]
    - noodle 16y ago
      i guess that means that assembly, C, etc are all terrible languages because they don't have a clear design with system security in mind.
      - kingkilr 16y ago
        From a security perspective, kind of... it's not like for a decade or so every other security hole was a buffer overrun (or underrun, as the case may be) or others of that ilk. That's not to say they don't serve a purpose, but it's pretty easy to see that higher level languages have eliminated an entire class of security concerns in our code (at obvious costs).
        noodle 16y ago
        > (at obvious costs) i suppose thats my point. languages are just tools. some languages are hammers, where you can accidentally hit your thumb. some languages are like an automatic electric hammer where its all safe, but its heavy and you have to keep it plugged into the wall.
davidw 16y ago
Rasmus is a former colleague at Linuxcare, and as far as I'm concerned, is a really cool guy, and very worth talking with. His story is pretty interesting, too. That said, I've encountered too much ugly PHP code to really want much to do with the language these days.
cosmok 16y ago
Wow! I saw some actual code/command that I could use at work. Like PHP itself, his talk was very practical. Thanks for the link!
Lorin 16y ago
Felt like I was watching an old school cracktro with the rainbow effect going on there (a DLP projector issue?). Most of Rasmus's talk is the same as it was for years in regards to optimization. If you've seen one of his older presentations take a look at the slides directly (http://talks.php.net/show/digg/1 http://talks.php.net/show/digg/1) rather than watching the video.

50 points by ecaron 16y ago

I'd be willing to bet the Digg engineers were bored by this talk. Most of this isn't new and is already PHP best practice (minus the HipHop stuff, I suppose).

smokinn 16y ago
I saw him give the talk at the Confoo conference (formerly PHP Quebec that got renamed when Ruby + Python tracks were added) and I was bored as well. You can pretty much boil his talk down to use a profiler and make sure you run as little lines of code as possible. (AKA: Extra indirection always adds extra cost which is why generic web dev frameworks are always slow) The HipHop part of his talk isn't really useful because extremely few sites are resource constrained enough at the web server level for it to make sense to complicate your deployments that massively.
- jolan 16y ago
  He made a good point about using HipHop for static analysis though. The weird code he found in WordPress via HipHop was a bit disconcerting considering how many copies of it are running. The performance stuff was pretty boring. 30 minutes of talking to go from 9 to 34 reqs/s. My VPS provider can increase my resources by an order of magnitude in 1 minute.
  - code_duck 16y ago
    You don't need to analyze WordPress via HipHop to determine that it is truly dangerous total crap written by morons, and given that, it's been apparent for a long time that it is disturbing how many copies of it are running. If you take a look at any community of designers who consider themselves 'developers', its scary - most of them build on WordPress as a platform. Clearly this is somewhat like putting up a tent on the Deepwater Horizon drilling platform. I can't believe how terrible the innards of wordpress are. That said, the outtards work pretty well, somehow.

jolan 16y ago

I really like his rant that starts at the ~62 minute mark and ends with this: "PHP is just a damn tool. It's just a hammer; it's boring. It's not that interesting. I'm not that interested in it. But I need a working tool to solve problems. I'm really, really interested in problems. The tool itself; if it works great. If it's broken I fix it. But I don't spend my entire life fixing it. PHP is damn ugly. It'll always be ugly because we're not going to spend the time to sit and make it pretty. We're spending our time building actual solutions and fixing problems. And the tool works. You can build really, really fast things with PHP. And yes, it's not pretty. If you're a CS major or if all sort of for the purity of coding; PHP is not for you. But then you're not probably not interested in building things for end users."

cheald 16y ago
I'm not much a fan of that sentiment. It's the same sentiment espoused by people who don't have time to design software properly, or test it, or do exception handling. The tool is an important part of solving problems, but having an elegant tool helps keep the tool itself from becoming a problem. There seems to be subtext in that rant which says "prettier languages are inferior because they're written by academic snobs who don't have any experience actually writing real software", which is just patently false.
- scorpioxy 16y ago
  Seconded. Also, people who usually have that sentiment are not the same people who have to maintain the code. They're usually long gone by then. I have personally suffered many sleepless nights having to maintain projects like that. I think it's healthy to avoid extremes. Neither a "whatever works" nor a "write everything in lisp because it's beautiful" sentiment. It's up to the good programmer to decide when to be a pragmatist and when to be a purist.
- jolan 16y ago
  My takeaway was that you should use what you're most productive in; even if there happens to be some inconsequential warts.

baddox 16y ago

Regarding his anecdote of the company porting a client's application from PHP to Rails: Maybe the fact that completely rewriting an application in Rails is preferable to maintaining their PHP application is telling.

pornel 16y ago
Rewriting is always more fun than maintenance.

chrischen 16y ago

I see php as a lightweight web framework. And it works well for that. I wouldn't use it for general purpose scripting though.

ck2 16y ago

I look forward to one day having real php compilers instead of just opcode caches. If I am not mistaken there are a couple of projects already working on that.

ahupp 16y ago
Check out http://wiki.github.com/facebook/hiphop-php/ http://wiki.github.com/facebook/hiphop-php/
- ck2 16y ago
  For some reason I didn't consider HipHop as a native compiler since it's really converting into another language to get outside of PHP entirely. Also, it's supposedly REALLY difficult to build. I was thinking more like PHC but more evolved.
  - pbiggar 16y ago
    I think it's fair to call HipHop a native compiler, since it can generate native executables. phc generates C code, which is admittedly lower-lever, but it's roughly the same idea. I'm interested in how you'd like phc to be more evolved. I've had lots of ideas (I'm the author) but I'm curious what others would like. Thanks!

thomasfl 16y ago

After 3 minuts Rasmus says this: "I never taken any classes in computer science. I should have taken classes in computer science". So it was never designed to be a state of the art language. Just a tool to get things done. From 1997 to 2001 I really enjoyed solving problems in PHP. But things have changed. I have learned more and now certainly prefer using Ruby.

c00p3r 16y ago

Creator of PHP talks about security it is already funny.. ^_^

mdg 16y ago
He drops knowledge quite frequently on the subject.
- c00p3r 16y ago
  People who are really concerned about security starts from a clear design with security in mind. PHP lacks any kind of design, it was just an rapidly evolved toolchan. ^_^
  - deleted 16y ago
    [deleted]
  - noodle 16y ago
    i guess that means that assembly, C, etc are all terrible languages because they don't have a clear design with system security in mind.
    - kingkilr 16y ago
      From a security perspective, kind of... it's not like for a decade or so every other security hole was a buffer overrun (or underrun, as the case may be) or others of that ilk. That's not to say they don't serve a purpose, but it's pretty easy to see that higher level languages have eliminated an entire class of security concerns in our code (at obvious costs).
      - noodle 16y ago
        > (at obvious costs) i suppose thats my point. languages are just tools. some languages are hammers, where you can accidentally hit your thumb. some languages are like an automatic electric hammer where its all safe, but its heavy and you have to keep it plugged into the wall.

davidw 16y ago

Rasmus is a former colleague at Linuxcare, and as far as I'm concerned, is a really cool guy, and very worth talking with. His story is pretty interesting, too. That said, I've encountered too much ugly PHP code to really want much to do with the language these days.

cosmok 16y ago

Wow! I saw some actual code/command that I could use at work. Like PHP itself, his talk was very practical. Thanks for the link!

Lorin 16y ago

Felt like I was watching an old school cracktro with the rainbow effect going on there (a DLP projector issue?). Most of Rasmus's talk is the same as it was for years in regards to optimization. If you've seen one of his older presentations take a look at the slides directly (http://talks.php.net/show/digg/1 http://talks.php.net/show/digg/1) rather than watching the video.