Comment by CiPHPerCoder | Hacker News Reader

Comment by CiPHPerCoder | Hacker News Reader

Parent Full thread

Up until last year, typing "PHP [anything security- or cryptography-related here]" into any popular search engine would lead you to bad practices.

Then this happened: https://meta.stackoverflow.com/questions/293930/problematic-...

Stack Exchange websites rank well and they allowed myself and others to provide better answers than they had previously. This leads to more developers being exposed to safer, cleaner ways to solve problems. Which means less terrible code being written from following terrible SO answers and tutorials.

And now things are a lot better. There's still obviously work that needs to be done, but:

    - The ecosystem (i.e. tutorials) is improving
    - The language is improving drastically
    - The community is pushing towards better practices
    - Framework developers are taking security seriously

A lot of people don't like how PHP used to be, including most of the people who put time and energy into making it better. You're not alone.

P.S. If you like the direction things are headed, help us make 7.1 even better:

* https://wiki.php.net/rfc/mcrypt-viking-funeral

* https://wiki.php.net/rfc/libsodium

* https://wiki.php.net/rfc/php71-crypto

> [...] would lead you to bad practices

I feel this isn't really due to anything inheritely wrong with PHP, but more of it becoming a victim of it's own success. I feel that Node is heading in the same direction too, as more and more people (especially those new to programming) start using it. At least with Node, using third party libraries and frameworks is more common than the 'copy and paste these lines of code' when I learnt PHP 15 years ago :D

Thanks for helping to fix the situation!

Brilliant. Do other languages need the same cleanup?

Java, C#, and Node.js come to mind immediately as good candidates, but any beginner-friendly language probably need it to some degree.

The Node.js core is particularly bad: It only offers OpenSSL's userspace RNG rather than the operating system's CSPRNG. (That's what window.crypto.getRandomValues() hooks into.) Many of node's deficiencies are tackled by the community, of course. For example: https://www.npmjs.com/package/scrypt-for-humans versus the native PBKDF2 (with no constant-time comparison).

I hear Ruby's SecureRandom still refuses to switch from /dev/random to /dev/urandom as well. Feel free to throw your hat in the ring on that issue.

Historically, C# doesn't have as strong of an open source culture, but if you wanted to make an impact, you could try to nurture it into growing explosively.

But generally: Look at the languages you're already familiar with and see if bad security advice gets more attention from non-experts than from experts. If that's the case, go out of your way to learn how to do things better (if you aren't already well informed) and publish your corrections.

What you've done is fantastic. Is there anything that can be done particularly to help along the mcrypt funeral?

Nice work on SO reviewing q's, great idea.

> The language is improving drastically

This is a myth. It is adding new features. That does not mean it is improving.

They added new sane features, deprecated old stuff with more to come, improved performance by over 100% on many workloads while maintaining backwards compatibility, implemented a proper AST with a JIT to follow.

I'm curious what your idea of improving is frankly.

>They added new sane features..

Have you heard the expression, "A chain is only as strong as the weakest link?". So adding strong links after a weak link does not "improve" the strength of the chain.

And that is assuming that these new features added are actually sane. From what I have seen, it is not the case. see here [1]

So you cannot improve php with out making it "not php". And I don't think even if the same people started who are working in the language started from scratch, today, it will be much better than Php. Because they are simply not competent (refer [1]), because if you are competent, and has the vision to see the flaws of the language and the community, you won't go anywhere near it. So I think there is zero chance of Php becoming "sane", let alone nice...

[1] https://np.reddit.com/r/PHP/comments/3j88v4/something_about_...

In Python 2

print 3/2 outputs 1

In Python 3

print(3/2) outputs 1.5

Even a language that is regarded as well designed has unexpected behaviour, it's not necessarily wrong it's just not what the user expects.

They fixed it in 3 but does it's existence in 2 make Python a bad language?

PHP historically did a lot of stuff that a user wouldn't expect but they have started to clean that up, it won't happen overnight but the trend is there, strong and growing.

No such thing as a perfect programming language since everyone has a different definition of perfect.

I am not sure why you think It is unexpected behavior. And even if it is, it is not even in the same league as the quirks of Php. It would be if 3/2 outputs 1 but 7/2 outputs 3.5, both in Python 2. Then that would be unexpected behavior in the same league as that of Php's.

> it won't happen overnight but the trend is there, strong and growing.

It is just appearance. Just movement, not progress. I just provided you with an example on how new features added follows the same incompetent design, consistant with Php's track record.

>No such thing as a perfect programming language since everyone has a different definition of perfect.

Yea, there is no perfect one, But there is something that is too bad that should not be used. Php is that. It is not going to change.

> Then that would be unexpected behavior in the same league as that of Php's.

Can you provide any argued examples? I think not.

Here you go https://www.reddit.com/r/PHP/comments/41bm7j/new_rfc_allow_s...

Reply on news.ycombinator.com