I'm not the biggest fan of PHP (mostly because I learned it on PHP4 and it encouraged bad coding practices back then). However I can't deny how many people use it and how easy it actually is to get started.
Then this happened: https://meta.stackoverflow.com/questions/293930/problematic-...
Stack Exchange websites rank well and they allowed myself and others to provide better answers than they had previously. This leads to more developers being exposed to safer, cleaner ways to solve problems. Which means less terrible code being written from following terrible SO answers and tutorials.
And now things are a lot better. There's still obviously work that needs to be done, but:
- The ecosystem (i.e. tutorials) is improving
- The language is improving drastically
- The community is pushing towards better practices
- Framework developers are taking security seriously
P.S. If you like the direction things are headed, help us make 7.1 even better:
* https://wiki.php.net/rfc/mcrypt-viking-funeral
The Node.js core is particularly bad: It only offers OpenSSL's userspace RNG rather than the operating system's CSPRNG. (That's what window.crypto.getRandomValues() hooks into.) Many of node's deficiencies are tackled by the community, of course. For example: https://www.npmjs.com/package/scrypt-for-humans versus the native PBKDF2 (with no constant-time comparison).
I hear Ruby's SecureRandom still refuses to switch from /dev/random to /dev/urandom as well. Feel free to throw your hat in the ring on that issue.
Historically, C# doesn't have as strong of an open source culture, but if you wanted to make an impact, you could try to nurture it into growing explosively.
But generally: Look at the languages you're already familiar with and see if bad security advice gets more attention from non-experts than from experts. If that's the case, go out of your way to learn how to do things better (if you aren't already well informed) and publish your corrections.
This is a myth. It is adding new features. That does not mean it is improving.
I'm curious what your idea of improving is frankly.
Have you heard the expression, "A chain is only as strong as the weakest link?". So adding strong links after a weak link does not "improve" the strength of the chain.
And that is assuming that these new features added are actually sane. From what I have seen, it is not the case. see here [1]
So you cannot improve php with out making it "not php". And I don't think even if the same people started who are working in the language started from scratch, today, it will be much better than Php. Because they are simply not competent (refer [1]), because if you are competent, and has the vision to see the flaws of the language and the community, you won't go anywhere near it. So I think there is zero chance of Php becoming "sane", let alone nice...
[1] https://np.reddit.com/r/PHP/comments/3j88v4/something_about_...
print 3/2 outputs 1
In Python 3
print(3/2) outputs 1.5
Even a language that is regarded as well designed has unexpected behaviour, it's not necessarily wrong it's just not what the user expects.
They fixed it in 3 but does it's existence in 2 make Python a bad language?
PHP historically did a lot of stuff that a user wouldn't expect but they have started to clean that up, it won't happen overnight but the trend is there, strong and growing.
No such thing as a perfect programming language since everyone has a different definition of perfect.
> it won't happen overnight but the trend is there, strong and growing.
It is just appearance. Just movement, not progress. I just provided you with an example on how new features added follows the same incompetent design, consistant with Php's track record.
>No such thing as a perfect programming language since everyone has a different definition of perfect.
Yea, there is no perfect one, But there is something that is too bad that should not be used. Php is that. It is not going to change.
Can you provide any argued examples? I think not.
I feel this isn't really due to anything inheritely wrong with PHP, but more of it becoming a victim of it's own success. I feel that Node is heading in the same direction too, as more and more people (especially those new to programming) start using it. At least with Node, using third party libraries and frameworks is more common than the 'copy and paste these lines of code' when I learnt PHP 15 years ago :D
Thanks for helping to fix the situation!