3 ms·

Don't know why i'm biting but I will. 1. MtGox could have been written poorly in any other language and it could have been hacked. We find SQL injections in ev

Don't know why i'm biting but I will. 1. MtGox could have been written poorly in any other language and it could have been hacked. We find SQL injections in every language. 2. Facebook started with PHP, still runs a lot of PHP. It's not unsafe.

berkes 5y ago
I've avoided, with care, the statement that PHP is unsafe. I've not even hinted at the statement that it is impossible to write good software in PHP. PHP is not unsafe. You can write magnificent software in PHP. But PHP makes the safe often harder than the unsafe. The community even more so. It direct newbies to write crappy software more than that it guides them to learn about architecture, maintenance, patterns. All the stuff the article we're discussing is promoting. And yes, mtgox could have been hacked even if it was written in pure functions only (well...). What the exact reason is, is unclear. But researchers have pointed out that the sourcecode (leaked by the hackers), contained self-written elliptic curve cryptography, in PHP, which was flawed[1]. Before you comment 'writing your own cryptography is always dumb, has nothing to do with PHP', please note that 1. PHP lacked any libraries for this at that time (it still does?), 2. someone has to write these libs or bindings and 3. in this case it was written, in a language that is -and certainly back then was- unsuited to write such code in. It was not the language itself. But PHP is more than a language, it is an ecosystem. And that ecosystem has brilliant code and magnificent contributors. But is overwhelmed with crappy wordpress hacks and similar WordPress "developers". As well as, apparently, frequented by people who think it is wise to write their own crypto libraries in PHP for a Bitcoin Exchange. [1] https://hackingdistributed.com/2014/03/01/what-did-not-happen-at-mtgox/ https://hackingdistributed.com/2014/03/01/what-did-not-happe...

berkes 5y ago

I've avoided, with care, the statement that PHP is unsafe. I've not even hinted at the statement that it is impossible to write good software in PHP. PHP is not unsafe. You can write magnificent software in PHP. But PHP makes the safe often harder than the unsafe. The community even more so. It direct newbies to write crappy software more than that it guides them to learn about architecture, maintenance, patterns. All the stuff the article we're discussing is promoting. And yes, mtgox could have been hacked even if it was written in pure functions only (well...). What the exact reason is, is unclear. But researchers have pointed out that the sourcecode (leaked by the hackers), contained self-written elliptic curve cryptography, in PHP, which was flawed[1]. Before you comment 'writing your own cryptography is always dumb, has nothing to do with PHP', please note that 1. PHP lacked any libraries for this at that time (it still does?), 2. someone has to write these libs or bindings and 3. in this case it was written, in a language that is -and certainly back then was- unsuited to write such code in. It was not the language itself. But PHP is more than a language, it is an ecosystem. And that ecosystem has brilliant code and magnificent contributors. But is overwhelmed with crappy wordpress hacks and similar WordPress "developers". As well as, apparently, frequented by people who think it is wise to write their own crypto libraries in PHP for a Bitcoin Exchange. [1] https://hackingdistributed.com/2014/03/01/what-did-not-happen-at-mtgox/ https://hackingdistributed.com/2014/03/01/what-did-not-happe...