3 ms·

One of the main benefits of PHP for web serving, is the "shared nothing" architecture. By operating as a non-threaded application, entire categories of bugs an

One of the main benefits of PHP for web serving, is the "shared nothing" architecture. By operating as a non-threaded application, entire categories of bugs and security holes are avoided. Are there situations where threads could genuinely help? Sure, there is always an exception to any rule, but for the vast majority of projects where PHP is used, I don't believe threading would achieve much in terms of performance gains.

ragnese 7y ago
Yeah, but if you're worried about bugs and security holes, I'm not sure PHP can possibly help more than it hurts. E.g., type juggling: https://www.netsparker.com/blog/web-security/php-type-juggling-vulnerabilities/ https://www.netsparker.com/blog/web-security/php-type-juggli...
- stephenr 7y ago
  There are very few places where PHP cannot do strict comparisons. The first example in that article even highlights that `in_array` has a `$strict` parameter. I'd bet a months salary it's easier to teach developers to use strict comparisons (either through arguments to be passed, or strict operators to be used) than it is to teach developers how to avoid thread-safety bugs.
  - ragnese 7y ago
    Yeah, you're probably right about that. Though, it might take longer to train them to spot every place where they could/should be using some stricter version of the defaults. That's the problem with opt-in safety. On the other hand, there are languages that make thread-safety bugs much less likely. Some day those ecosystems will catch up to the languages that have been around "forever" and we'll get our cake and eat it, too.
    - stephenr 7y ago
      There really aren't that many places to remember, and there is copious amounts of developer tooling available to identify, and in some cases even fix the issues automatically. I don't recall ever seeing any kind of dev tooling that can just automatically fix thread safety issues.

ragnese 7y ago

Yeah, but if you're worried about bugs and security holes, I'm not sure PHP can possibly help more than it hurts. E.g., type juggling: https://www.netsparker.com/blog/web-security/php-type-juggling-vulnerabilities/ https://www.netsparker.com/blog/web-security/php-type-juggli...

stephenr 7y ago
There are very few places where PHP cannot do strict comparisons. The first example in that article even highlights that `in_array` has a `$strict` parameter. I'd bet a months salary it's easier to teach developers to use strict comparisons (either through arguments to be passed, or strict operators to be used) than it is to teach developers how to avoid thread-safety bugs.
- ragnese 7y ago
  Yeah, you're probably right about that. Though, it might take longer to train them to spot every place where they could/should be using some stricter version of the defaults. That's the problem with opt-in safety. On the other hand, there are languages that make thread-safety bugs much less likely. Some day those ecosystems will catch up to the languages that have been around "forever" and we'll get our cake and eat it, too.
  - stephenr 7y ago
    There really aren't that many places to remember, and there is copious amounts of developer tooling available to identify, and in some cases even fix the issues automatically. I don't recall ever seeing any kind of dev tooling that can just automatically fix thread safety issues.