8 ms·
PHP 6: Pissing in the Wind
- 0x0 14y agoI don't get why a string object would be so concerned about UTF encoding. What's the difference between a "UTF-8 string" and a "UTF-16 string"? The encoding only matters as you serialize the string to a set of bytes. Very confusing article.
- pestaa 14y agoMost PHP developers I've worked with had no idea of different encodings, serializations, etc. They just wanted to echo $_GET['input'] and be done with it.
- 0x0 14y agoHello, XSS :)
- meaty 14y agoWelcome to PHP. This is the norm. I worked at an outfit that hired some utter fuckwits who had been recommended by some more fuckwits for something and they did it in PHP and put it on budget shared hosting. A week later: SQL injection, CSS, CSRF attacks and someone who had cracked the server was injecting malicious js in the page header. That day was the day that management finally listened to my doomsaying about security...
- Firehed 14y agoThat's a developer incompetence problem, not a PHP problem. If python or ruby was as trivially easy to get running (read: preinstalled everywhere), then they would be the lowest barrier to entry and have the exact same problems.
- meaty 14y agoActually no. PHP has many fundamental flaws which do not exist in Python or Ruby.
- stesch 14y agoI wonder when the Wordpress installations will blow up that were set up against my recommendation.
- migueld 14y agoAgainst your recommendation, because obviously you are so knowledgeable about security and all, right?Judging from your insightful "avoid PHP because it's for newbs"comment above... You _do_ know that some of he largest sites on earth run on Wordpress, right?
- stesch 14y agoThose large sites sure have a whole team attending them. And can update it 24/7.
- fatalerrorx3 14y agoAnd those sites became large because people could get them up and running quickly which is what made PHP a popular language. Hobbyist programmers made it what it is, and many of those hobbyist programmers went on to build big companies... Mark Zuckerberg, Matt Mullenweg, just to name a few.
- meaty 14y agoBig value companies - yes. Big companies - no. They are just fad artists.
- leviathan 14y agoYou're lucky they didn't think it was you. I warned the local lottery about the security issues they had with their website (I was doing them some side work) but they didn't listen until someone defaced their website and the first thing they did was ask me if I did it.
- orionblastar 14y agoYes that usually is the case. You warn the administrators and managers about security issues and then when some script-kiddie runs a script and cracks the security and downloads the database, they blame you for it. Sort of like this: Programmer "Uh you really should use a numerical keypad to the server room, it is more secure than the doorknob lock which is so common anyone can find a key that fits it and rob the server room." Management "Feh! Forget it, we don't have the budget for it. Besides that doorknob lock was on sale at Lowe's and fit out budget. The clerk there said it was lockpick proof, and that's good enough for us." Later on someone picks the lock and then steals all the server hardware. Manager "Someone broke into the server room. Hey programmer was it you, you seem to know a lot about locks and stuff?" Programmer "No it wasn't me, if you followed my advice with the numerical key pad you wouldn't have had this problem. The lock you used made the server room insecure and allowed a robber to easily pick the lock and rob us all." Manager "Yeah whatever, I'm pressing charges against you anyway."
- meaty 14y agoI've worked for an asshole company that did that. We reached a stalemate after I managed to use my code ownership clause against them - basically "fuck off or I'll open source all your code".
- orionblastar 14y agoI'll have to remember that should I find myself in another position to be hired or contracted by another asshole company to include a 'code ownership' clause and a 'right to open source the code" clause in case of any problems or difficulties.
- guycook 14y agoI would hardly call this 'the norm', may as well say the all C software inevitably segfaults and is thus unreliable since that happens at least once to everyone who's ever learnt the language. PHP newbies just have the unfortunate side effect of being a bit more exposed to the 'outside elements' while learning. And if your prior employment recruited based on connections rather than competence that speaks to a management issue that couldn't possibly be solved by switching languages. (this isn't really to single out your comment meaty, could be attached to anyone else in this thread)
- smsm42 14y agoAnd we all know such vulnerabilities never happen to respectable frameworks written by real programmers using real languages (read: not PHP), only to people that lack basic clues and are utter fuckwits... oh wait, https://www.pcworld.com/article/251259/user_hacks_github_to_showcase_vulnerability_after_rails_developers_dismiss_his_report.html https://www.pcworld.com/article/251259/user_hacks_github_to_... https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/dUaiOOGWL1k https://groups.google.com/forum/?fromgroups=#!topic/rubyonra...
- codewright 14y agoI wouldn't really let Rails slide here or call them an exemplar in the subject at hand. They were lazy and paid dearly for it. A better example would be Django, most server-side Java frameworks, Ruby frameworks like Sinatra and Padrino, most Erlang code I've seen is solid, Haskell users generally know better, etc.
- smsm42 14y agoYou mean neither of those ever had or will have security issues, because only stupid incompetent developers ever have those? That was pretty much the point of the parent comment. Meanwhile on planet Earth every popular software package has had some issues. That's natural, security is hard and requires constant vigilance, and people are bound to err or oversee something from time to time.
- meaty 14y agoI'm not suggesting that the other people aren't fuckwits either. TBH Rails is just as bad - it's the same culture of incompetence.
- orionblastar 14y agoYeah I found this out the hard way back in 1997 writing ASP pages using SQL Server. I learned to sanitize my data inputs. It all started with employees who had Irish names like O`Brian, they would cause database errors when trying to insert their name. I found out the data entry clerks didn't know the difference between the "`" apostrophe and "'" single quote character. So I wrote a SQL filter function to double up the single quotes if one is entered. As it turned out some employees where using the single quote for SQL Injection and it foiled their attempts and they filed support tickets for it. I could not replicate the error and then I asked how they were entering the data, and none of them wanted to tell me. So I made a logging code when their user ID is used to access the database and noticed they were trying to use the single quote to gain access to other tables and in some cases entering "1 or 1" and other stuff that just returned all the results in a table. I had to filter out SQL commands, system characters, and other things, even HTML statements because they would stick them in there to deface ASP pages and insert messages. This was a law firm I worked for, and they had no clue their users were doing this, it was an Intranet site that was not accessible from the Internet. For stopping their 'cracking' of ASP pages, I gained a lot of enemies for that. Some would send denial of service attacks to my Windows PC, some would file fake complaints about me to get rid of me and replace me with someone who didn't sanitize inputs. Eventually I got too sick to work, and was fired for being mentally ill after all the stress I had caused me to develop schizoaffective disorder.
- mokash 14y agoWebsite is down but I really like the error page. http://i.imgur.com/f20igSW.png http://i.imgur.com/f20igSW.png
- timothya 14y agoThis is a standard CodeIgniter error message.
- WA 14y agoThis is a poorly configured webserver/CodeIgniter framework. It's an info leak that should be avoided.
- grakic 14y agoPersistent connection pools are not popular in the PHP world :)
- sandfox 14y agoOr generally possible directly with web requests. Pretty much everything is torn down at the end of each request. (Yeah PHP-FPM slightly muddies the waters)
- eksith 14y agoWith MySQL it's not necessarily always a good thing to persist connections. If your script dies, you lost that connection as a resource until it's killed for being idle. Most DBs all have their own connection pooling mechanisms that don't work the same way, so we need to look into each to see if it's worth it. Caching though (query as well as HTML), is usually always a good idea.
- toast0 14y agoThe error is that there are too many connections, not that it took too long to establish them. MySQL is generally pretty quick about establishing connections (although you can have issues w/ reverse DNS taking forever; it's best to turn that off and do access control by ips). Ideally, a blog can be cached to static html (regen pages when owner adds an entry and if comments are self hosted, regen when a comment is added/approved). Even so, it looks like there are too many php processes running compared to mysql connections allowed; lowering the php processes will probably lead to better throughput than ramping up mysql connections.
- pestaa 14y agoI can't tell you much I'd love to see smarter scalars in PHP, but then for a business what's the difference between upgrading to PHP 6 or upgrading to, say, Python?
- kodablah 14y agoThe PHP world is mired in legacy codebases. I have seen many code bases that are on very old, unsupported PHP versions. Although PHP strives to maintain backwards compatibility, it doesn't always work. And many of the backwards incompatible changes are only apparent at runtime and are incredibly difficult discover due to the dynamism of the language and the abuses that are present in most legacy PHP code.
- 0x0 14y ago"PHP strives to maintain backwards compatibility", I'll have to say I've seen enough evidence to the contrary. Even basic object-oriented metaprogramming have been radically changed in minor point/patch releases. Stuff like "get_class_vars()" changing from returning private vars, to not returning private vars, etc. (edit: between PHP v5.2.6 and v5.2.7 if I remember correctly)
- kodablah 14y agoAlthough true, I would say that's kind of an "abuse". I find many PHP functions have changed over versions to give more predictable output and validate expected input more stringently. If backwards compatibility wasn't a concern, they would attempt to standardize the lib in obvious incompatible ways.
- 0x0 14y agoWell, backwards compability is kind of a binary thing, isn't it. Either you're aiming for backwards compability and you can be sure your legacy code will keep running, or you don't. In fact it would be more helpful to throw fatal errors because a method signature changed, than start returning different and unexpected values which can break data integrity in subtle ways.
- nowarninglabel 14y agoWhile I agree with the overall point, I don't think the "I don't know C" hand-waving is very useful (both from the author and various commenters). If you want something done, then one should not be afraid to dive in and learn some C to figure it out. I don't know a lot of C though I learned on it, but I knew enough to open up the PHP source code and figure out what was going on with a multibyte encoding issue to file an accepted bug report and a follow-up feature request. Why don't I do that for parameter ordering in functions? Because, like the author stipulated, I'm not one of the people who cares enough to want to. But, those who do care enough to want it should stop making excuses for themselves about not knowing C and go learn it. Move on from there to writing documentation for the Zend stuff if it sucks in the places you want it to shine.
- smsm42 14y agoIt's a recurring theme - "we need to rewrite PHP and I know exactly how to do it and PHP maintainers are idiots for not doing it years ago. Oh, btw, I don't know C and have no idea how PHP internals look like, but how hard could it be?" Happens all the time.
- stesch 14y agoThe people who are good programmers and know C well enough aren't the ones who stick with PHP. They moved on. PHP is from newbies for newbies.
- ch0wn 14y agoDoesn't seem to be cached by Google, yet. Does someone have a copy?
- fatalerrorx3 14y agoThe HN effect is enough to take down even the mightiest of servers lol, avoid shared hosting if you plan to make the front page, I'm curious what the article reads like but I can't get to it...the suspense is killing me
- fatalerrorx3 14y agoAlthough it looks like the DNS is pointing to AWS...how did it go down?
- jtreminio 14y ago> @philsturgeon: When you click Terminate instead of Reboot bad things happen.
- fatalerrorx3 14y agoAha, just checked his twitter feed
- fatalerrorx3 14y agoSo if you terminate an instance on AWS you automatically lose your data? How does that work? I've never used AWS, I usually self host or use 1and1 VPS
- sandfox 14y agodepends, TL;DR, local disk drives (Ephemeral) do not persist anything that wasn't part of the base image if you power down the machine (doesn't include restarts - data is persisted in this situation). network based drives (EBS) persist all their data across machine shutdown. Slightly longer version - When you stop a AWS instance, the instance is torn down completely and all local state/data (Ephemeral) on the hypervisor is lost. when you then start the instance again a new hypervisor with spare capacity is found and then booted with your chosen base disk image. Restarts do not cause your instance to torn down so you don't lose local state / data. If your instance uses network drives (EBS) then these drives keep state when your server is torn down, and are re-attached when the server is started back up again,
- eksith 14y agoS̶l̶a̶s̶h̶d̶o̶t̶Hacker News: News for nerds
- smsm42 14y agoNow it's 404.
- jiggy2011 14y agoI can't view that article because it's down, but I assume this is some sort of "PHP internals suck" rant. I'm surprised there isn't something like JPHP yet to run PHP on the JVM.
- mgkimsal 14y agothere are a few options: quercus and ibm's ... ack - what was it called? they had a 'freeware' CMS that included their own implementation of PHP in Java. I think there's another too, but there's quite a lot of oddities and assumptions that make PHP-based code not play well in the JVM.
- lsmith77 14y agoibm thingi was called "project zero" btw i hear facebook is also looking to move to the jvm to ease some troubles with their hiphop approach
- eitland 14y agoDon't think it solves this problem but Caucho Resin (Java EE server) should be able to run php as well.
- janLo 14y agoFacebook is doing this as successor of their php-c++ translator
- Osiris 14y agoI didn't realize that the Property Accessors Syntax RFC was voted down, 34 (yea) to 20 (nay). I'm curious to know why people objected to it. Magic methods are a horrible way to do get/set and writing separate getProperty/setProperty methods is pretty annoying also.
- meaty 14y agoSeriously - just find another language. The people upstairs are crack smokers.
- tomschlick 14y agoMirror of the article as phil has been having some trouble on his aws rds box dealing with the traffic. https://gist.github.com/raw/4645323/2e581d48609effb553dd9ce0fa2d0bba72cb81fd/gistfile1.txt https://gist.github.com/raw/4645323/2e581d48609effb553dd9ce0...