5 ms·

Apologies in advance to the PHPers out there, but... PHP?!

TazeTSchnitzel 13y ago
MagicalTux is a known lunatic who wants to write everything in PHP. Which isn't too bad of an idea, but he, for example, hacked together an SSHd in PHP and immediately put it into production use: http://blog.magicaltux.net/2010/06/27/php-can-do-anything-what-about-some-ssh/ http://blog.magicaltux.net/2010/06/27/php-can-do-anything-wh... Essentially he is a bad programmer and he has Not Invented Here (fixed, thanks jey) syndrome, both of which are terrible attributes for someone coding a Bitcoin exchange.
- deleted 13y ago
  [deleted]
- jey 13y ago
  I think you meant NIH ("Not Invented Here"), not NIMBY ("Not In My Backyard").
  - TazeTSchnitzel 13y ago
    Oops, yes I did indeed mean Not Invented Here syndrome. Thanks.
- stormbrew 13y ago
  .. Well.. at least he didn't write the crypto primitives himself in PHP.
  - brianpgordon 13y ago
    He wrote the DH key exchange himself. I didn't look at the implementation but someone commented before that it's vulnerable.
    - mukyu 13y ago
      I actually wrote that comment back in the day. I was rather snarky and unhelpful it seems. The code for the sshd does not seem to be there anymore, but from memory: it did not check if the number sent by Bob was 0, 1, or any any other groups that would make it easy solve the discrete logarithm problem. I don't think it bothered to check the primes either. [1] I think there was also something wrong with the signature checking (padding not checked maybe?). Altogether it seemed like you could easily MITM connections made to the server, but I don't think I ever tried. It was a perfect example--to me at least--of why you should not spend a trivial amount of time reading about crypto on Wikipedia and then writing crypto code.
olssonm 13y ago
Just for the sake of argument – any reason why not PHP?
- shalmanese 13y ago
  For a bank? I can think of lots of reasons. * You're exposed to any upstream bugs in the language and interpreter * Dynamic typing and silent errors mean you're far more likely to make a mistake and not realize it * It's missing a lot of battle tested libraries and frameworks * It's PHP
  - Gigablah 13y ago
    Maybe someone would like to post a link to the veekun article for the umpteenth time.
    - ColdHawaiian 13y ago
      I'm assuming that you're referring to "PHP: a fractal of bad design"[1]? [1]: http://me.veekun.com/blog/2012/04/09/php-a-fractal-of-bad-design/ http://me.veekun.com/blog/2012/04/09/php-a-fractal-of-bad-de...
  - mappu 13y ago
    > You're exposed to any upstream bugs in the language and interpreter How would you mitigate that, and how is the mitigation process any different for PHP?
    - someone13 13y ago
      Not to say whether PHP is in fact a good idea or not, but at least in a statically-compiled language, once you've got a "working binary", however you accomplish that, it will presumably continue to function that same way indefinitely. Obviously barring OS-level problems, of course :)
  - nodesocket 13y ago
    Would you consider Python and Ruby strongly typed? Because I happen to know two very large payments company using them. However if that is indeed their code, it makes me cry and cringe, even though PHP is my strongest language and I'm proud to admit it.
ing33k 13y ago
no apologies needed , but will be better if you can add more details on why you think using PHP is bad (for Mt.Gox ).
- dschiptsov 13y ago
  Isn't it self-evident?) Having such a bad code in the worst language imaginable that eventually the site has been cracked by Russian punks. This will be a great case study.
krapp 13y ago
Do you believe that Mt.Gox would still have everybody's bitcoins if it had been written in Ruby or Python or Node.js?
- jl2035 13y ago
  If there was the same people (person) behind it.. No.

MagicalTux is a known lunatic who wants to write everything in PHP. Which isn't too bad of an idea, but he, for example, hacked together an SSHd in PHP and immediately put it into production use: http://blog.magicaltux.net/2010/06/27/php-can-do-anything-what-about-some-ssh/ http://blog.magicaltux.net/2010/06/27/php-can-do-anything-wh... Essentially he is a bad programmer and he has Not Invented Here (fixed, thanks jey) syndrome, both of which are terrible attributes for someone coding a Bitcoin exchange.

deleted 13y ago
[deleted]
jey 13y ago
I think you meant NIH ("Not Invented Here"), not NIMBY ("Not In My Backyard").
- TazeTSchnitzel 13y ago
  Oops, yes I did indeed mean Not Invented Here syndrome. Thanks.
stormbrew 13y ago
.. Well.. at least he didn't write the crypto primitives himself in PHP.
- brianpgordon 13y ago
  He wrote the DH key exchange himself. I didn't look at the implementation but someone commented before that it's vulnerable.
  - mukyu 13y ago
    I actually wrote that comment back in the day. I was rather snarky and unhelpful it seems. The code for the sshd does not seem to be there anymore, but from memory: it did not check if the number sent by Bob was 0, 1, or any any other groups that would make it easy solve the discrete logarithm problem. I don't think it bothered to check the primes either. [1] I think there was also something wrong with the signature checking (padding not checked maybe?). Altogether it seemed like you could easily MITM connections made to the server, but I don't think I ever tried. It was a perfect example--to me at least--of why you should not spend a trivial amount of time reading about crypto on Wikipedia and then writing crypto code.

olssonm 13y ago

Just for the sake of argument – any reason why not PHP?

shalmanese 13y ago
For a bank? I can think of lots of reasons. * You're exposed to any upstream bugs in the language and interpreter * Dynamic typing and silent errors mean you're far more likely to make a mistake and not realize it * It's missing a lot of battle tested libraries and frameworks * It's PHP
- Gigablah 13y ago
  Maybe someone would like to post a link to the veekun article for the umpteenth time.
  - ColdHawaiian 13y ago
    I'm assuming that you're referring to "PHP: a fractal of bad design"[1]? [1]: http://me.veekun.com/blog/2012/04/09/php-a-fractal-of-bad-design/ http://me.veekun.com/blog/2012/04/09/php-a-fractal-of-bad-de...
- mappu 13y ago
  > You're exposed to any upstream bugs in the language and interpreter How would you mitigate that, and how is the mitigation process any different for PHP?
  - someone13 13y ago
    Not to say whether PHP is in fact a good idea or not, but at least in a statically-compiled language, once you've got a "working binary", however you accomplish that, it will presumably continue to function that same way indefinitely. Obviously barring OS-level problems, of course :)
- nodesocket 13y ago
  Would you consider Python and Ruby strongly typed? Because I happen to know two very large payments company using them. However if that is indeed their code, it makes me cry and cringe, even though PHP is my strongest language and I'm proud to admit it.

ing33k 13y ago

no apologies needed , but will be better if you can add more details on why you think using PHP is bad (for Mt.Gox ).

dschiptsov 13y ago
Isn't it self-evident?) Having such a bad code in the worst language imaginable that eventually the site has been cracked by Russian punks. This will be a great case study.

krapp 13y ago

Do you believe that Mt.Gox would still have everybody's bitcoins if it had been written in Ruby or Python or Node.js?

jl2035 13y ago
If there was the same people (person) behind it.. No.