3 ms·

Nah, the problem is PHP. See: http://blog.codinghorror.com/falling-into-the-pit-of-success/ http://blog.codinghorror.com/falling-into-the-pit-of-success... >

Nah, the problem is PHP. See: http://blog.codinghorror.com/falling-into-the-pit-of-success/ http://blog.codinghorror.com/falling-into-the-pit-of-success... > When you write code in [PHP], you're always circling the pit of despair, just one misstep away from plunging to your doom.

Navarr 12y ago
I'd be willing to say this is true for any language in varying ways.
- BasDirks 12y ago
  And what is gained from doing so? We must remain critical.
- Silhouette 12y ago
  But to widely varying degrees. This kind of problem is a direct consequence of having a relatively weak and dynamic type system (or other semantics that mean you might as well have). Plenty of people have warned about this kind of danger for a very long time. However, there seems to be a significant subset of the web development community that only has experience with languages like JS and PHP and to a lesser extent other dynamic languages like Ruby and Python, who simply fail to realise how many of these bugs should have been entirely prevented by using better tools by now. The usual counter seems to be something about unit tests, at which point anyone following the discussion who actually knows anything about type systems and the wider world of programming languages dies a little inside. It is entirely fair to criticise bad tools for being bad, particularly in specific ways and with clearly identified problems that can result as in this case. It's bad enough that we are stuck with JS for front-end web development these days, but there aren't many good arguments for using something as bad as PHP on the back-end in 2015.
sarciszewski 12y ago
No, the problem is using a shitty function like MD5 for any practical purpose.
- Shish2k 12y ago
  The hash function is completely irrelevant to this bug - whether you use a hash that returns 0 for every input, or invent a hash function that returns a perfectly unique and unpredictable hash for all inputs, PHP will still shoot you in the foot.

Navarr 12y ago

I'd be willing to say this is true for any language in varying ways.

BasDirks 12y ago
And what is gained from doing so? We must remain critical.
Silhouette 12y ago
But to widely varying degrees. This kind of problem is a direct consequence of having a relatively weak and dynamic type system (or other semantics that mean you might as well have). Plenty of people have warned about this kind of danger for a very long time. However, there seems to be a significant subset of the web development community that only has experience with languages like JS and PHP and to a lesser extent other dynamic languages like Ruby and Python, who simply fail to realise how many of these bugs should have been entirely prevented by using better tools by now. The usual counter seems to be something about unit tests, at which point anyone following the discussion who actually knows anything about type systems and the wider world of programming languages dies a little inside. It is entirely fair to criticise bad tools for being bad, particularly in specific ways and with clearly identified problems that can result as in this case. It's bad enough that we are stuck with JS for front-end web development these days, but there aren't many good arguments for using something as bad as PHP on the back-end in 2015.

sarciszewski 12y ago

No, the problem is using a shitty function like MD5 for any practical purpose.

Shish2k 12y ago
The hash function is completely irrelevant to this bug - whether you use a hash that returns 0 for every input, or invent a hash function that returns a perfectly unique and unpredictable hash for all inputs, PHP will still shoot you in the foot.