3 ms·

You write: "Wordpress grew out of b2" That is simply a less direct way of saying what I wrote: "The WordPress team has decided to work with PHP" You phrase

You write: "Wordpress grew out of b2" That is simply a less direct way of saying what I wrote: "The WordPress team has decided to work with PHP" You phrase things in a passive voice so it seems as if no human made a conscious decision to work with PHP. In fact, the history of WordPress, like the history of any software project, is the history of active humans making conscious decisions. You also write: "At the time LAMP was pretty much all there was" I'm not sure what you mean by that. At that time, a loud chorus of people were praising Zope, written in Python. Microsoft had ASP. The most popular blog platform, at that time, was MoveableType, written in Perl. There was a ton of free software available in Perl. And there was a whole of lot of projects happening in the world of Java. There were many choices. You seem to be re-writing history to make it sound as if the WordPress team had no choice but to use PHP. Anyway, even if you were right, would that lessen their responsibility for creating software that is serious about security?

lkrubner 16y ago
Why would someone downvote this? Do you think it is okay for the WordPress team to create insecure software? Do you doubt that there were many other languages, other than PHP, available in 2003?
- drusenko 16y ago
  You are being downvoted because you are blaming PHP for problems created by Wordpress. This has absolutely nothing to do with PHP and everything to do with running untrusted code, which many other people have pointed out.
  - lkrubner 16y ago
    No, you misread me. I say "Some of these problems are inherent to PHP" but I'm pretty clear that the responsibility for WordPress rests with the team that creates WordPress, regardless of what language they chose. If they chose Python or Ruby or Java or ASP, they would still have the same responsibility. I linked to a conversation between Matt Mullenweg and Sam Ruby in which Mullenweg tries to blame certain flaws on PHP. I then quote Sam Ruby's reply, which I like a great deal: "Yes, you can argue that they brought this upon themselves; but it is worth noting that at this point you are along for the ride. When I’m in similar circumstances, I tend to consider the karma implications of cursing the driver." That puts the responsibility where it belongs.
    - enko 16y ago
      > No, you misread me. If one person "misreads" you, it's their problem. If everyone "misreads" you, it's your problem.
      - lkrubner 16y ago
        No, its never my problem if people misread me. This isn't a game. If I said something that was true, and you misread it, then you are the one who is losing something, or missing something. Not me. I still have whatever truth or insight I may (or may not) have started with. Whether you now have it or not is something that effects you, but it does not effect me. All the same, I'm happy to explain myself at greater length, and I've made some attempt to do so in this thread. Still, you raise an interesting issue. It is rare to see anyone on Hacker New write "I'm not sure I understood you, could you please clarify what you wrote?" What is more common is to downvote a comment. A request for clarity might advance the conversation, whereas a downvote tends to bury a conversation. Among friends who trust each other, the more common reaction would be "Could you clarify that?" So downvoting becomes, in some sense, a measure of the distrust on HN, or, at least, a measure of the maximum level of good faith we are willing to extend to one another when reading one another. The thing that surprises me is that the tendency to bury a conversation is so strong, as opposed to the desire to extend a conversation.
Klonoar 16y ago
Woah there, Captain "Death to PHP". I dislike PHP as much as the next guy, but the end of your comment here is a bit out there. Absolutely none of those projects, even the ones written in Perl, were as easy to set up as WordPress was (and still is). ASP, Zope... Java? Part of why WordPress exists is so people don't have to concern themselves with high level frameworks/setups. You can blame all of WordPress's issues on the language it's written in, but that's a bit of a red herring. WordPress is the largest blog engine in terms of overall deployment; MoveableType (and others) have had their own share of security vulnerabilities, but WordPress sees it more due to their massive install base. Most other blog frameworks and engines tend to benefit from "security through obscurity". While PHP is a flawed language, yes, it's certainly not the core issue here. Anything done in this article could be pulled off in another blog engine with relative ease, especially considering this is people who don't really program and are installing/running arbitrary code.
- lkrubner 16y ago
  You write: "Woah there, Captain 'Death to PHP'." I can not imagine what would cause you to write this. I use PHP in almost all of my work. All of my major websites are written in PHP. However, I do try to take security seriously. The small regard that the WordPress team has shown for security is unacceptable. To point out that the WordPress team had language options in no way implies that I disagree with the language they chose, it simply shows that their choice was a conscious choice over which they must take responsibility. I was responding to a comment that implied that the WordPress team had no power to make a choice other than what they made. I am curious, too, that you would criticize what I wrote, yet you offer no criticism of "At the time LAMP was pretty much all there was." The sentence I was responding to was flatly, factually wrong. You write: "Absolutely none of those projects, even the ones written in Perl, were as easy to set up as WordPress was (and still is)." That is one of the problems that arises naturally from the use of PHP - it is easy to set up. As such, you end up with a lot of non-technical people using it. And that is one of the biggest reasons why special attention should be paid to security -- the fact that WordPress is the kind of software that appeals to a crowd that is largely non-technical.
  - 16y ago
singlow 16y ago
I think the availability of PHP in shared hosting plans was the main factor. Perl was almost as ubiquitous, although a lot of Windows based shared hosting plans didn't support it. Any host that had MySQL had PHP.

lkrubner 16y ago

Why would someone downvote this? Do you think it is okay for the WordPress team to create insecure software? Do you doubt that there were many other languages, other than PHP, available in 2003?

drusenko 16y ago
You are being downvoted because you are blaming PHP for problems created by Wordpress. This has absolutely nothing to do with PHP and everything to do with running untrusted code, which many other people have pointed out.
- lkrubner 16y ago
  No, you misread me. I say "Some of these problems are inherent to PHP" but I'm pretty clear that the responsibility for WordPress rests with the team that creates WordPress, regardless of what language they chose. If they chose Python or Ruby or Java or ASP, they would still have the same responsibility. I linked to a conversation between Matt Mullenweg and Sam Ruby in which Mullenweg tries to blame certain flaws on PHP. I then quote Sam Ruby's reply, which I like a great deal: "Yes, you can argue that they brought this upon themselves; but it is worth noting that at this point you are along for the ride. When I’m in similar circumstances, I tend to consider the karma implications of cursing the driver." That puts the responsibility where it belongs.
  - enko 16y ago
    > No, you misread me. If one person "misreads" you, it's their problem. If everyone "misreads" you, it's your problem.
    - lkrubner 16y ago
      No, its never my problem if people misread me. This isn't a game. If I said something that was true, and you misread it, then you are the one who is losing something, or missing something. Not me. I still have whatever truth or insight I may (or may not) have started with. Whether you now have it or not is something that effects you, but it does not effect me. All the same, I'm happy to explain myself at greater length, and I've made some attempt to do so in this thread. Still, you raise an interesting issue. It is rare to see anyone on Hacker New write "I'm not sure I understood you, could you please clarify what you wrote?" What is more common is to downvote a comment. A request for clarity might advance the conversation, whereas a downvote tends to bury a conversation. Among friends who trust each other, the more common reaction would be "Could you clarify that?" So downvoting becomes, in some sense, a measure of the distrust on HN, or, at least, a measure of the maximum level of good faith we are willing to extend to one another when reading one another. The thing that surprises me is that the tendency to bury a conversation is so strong, as opposed to the desire to extend a conversation.

Klonoar 16y ago

Woah there, Captain "Death to PHP". I dislike PHP as much as the next guy, but the end of your comment here is a bit out there. Absolutely none of those projects, even the ones written in Perl, were as easy to set up as WordPress was (and still is). ASP, Zope... Java? Part of why WordPress exists is so people don't have to concern themselves with high level frameworks/setups. You can blame all of WordPress's issues on the language it's written in, but that's a bit of a red herring. WordPress is the largest blog engine in terms of overall deployment; MoveableType (and others) have had their own share of security vulnerabilities, but WordPress sees it more due to their massive install base. Most other blog frameworks and engines tend to benefit from "security through obscurity". While PHP is a flawed language, yes, it's certainly not the core issue here. Anything done in this article could be pulled off in another blog engine with relative ease, especially considering this is people who don't really program and are installing/running arbitrary code.

lkrubner 16y ago
You write: "Woah there, Captain 'Death to PHP'." I can not imagine what would cause you to write this. I use PHP in almost all of my work. All of my major websites are written in PHP. However, I do try to take security seriously. The small regard that the WordPress team has shown for security is unacceptable. To point out that the WordPress team had language options in no way implies that I disagree with the language they chose, it simply shows that their choice was a conscious choice over which they must take responsibility. I was responding to a comment that implied that the WordPress team had no power to make a choice other than what they made. I am curious, too, that you would criticize what I wrote, yet you offer no criticism of "At the time LAMP was pretty much all there was." The sentence I was responding to was flatly, factually wrong. You write: "Absolutely none of those projects, even the ones written in Perl, were as easy to set up as WordPress was (and still is)." That is one of the problems that arises naturally from the use of PHP - it is easy to set up. As such, you end up with a lot of non-technical people using it. And that is one of the biggest reasons why special attention should be paid to security -- the fact that WordPress is the kind of software that appeals to a crowd that is largely non-technical.
- 16y ago

singlow 16y ago

I think the availability of PHP in shared hosting plans was the main factor. Perl was almost as ubiquitous, although a lot of Windows based shared hosting plans didn't support it. Any host that had MySQL had PHP.