Hacker News Reader

Comment by postfuturist | Hacker News Reader

A quick glance at Appleseed's SVN repo and I see the code base is PHP, like GNU social. It's maybe not a terrible decision, but it deters me (as a developer who sometimes deals with PHP at my day job) from any interest in looking any closer or wanting to risk installing it on my server.

View on HN

It pays off to be 'language agnostic', in other words, to realize that programming is more about the programmer than it is about the language.

I've seen BASIC used to power million dollar companies.

To throw out some project simply because it is built in a language you don't like is counter-productive. I know PHP is the language to hate around here but you could do a lot worse in a web environment.

PHP really is the new 'BASIC', it has a very low barrier to get started and that's why plenty of people associate it with crummy code but you don't have to write crummy code in any language.

Then give me open protocols and endpoints so that I can write C# code to talk to it.

There is one, it is called http or https. I agree that more direct interfaces would be nice, but there are currently methods of controlling and passing data to a PHP server from any language you can open a port in.

It takes a lot more that just http. I'd need to know the URL schema if you're restful, or the method names if you're SOAPy. Then there's the format of the data (SOAP, JSON, XML ..) and the expected data fields in the data sent and received, etc.

I don't think it's fully implemented yet, but here's the protocol Appleseed is using:

http://svn.appleseedproject.org/trunk/_documentation/quickso...

From the source, it looks like they're building abstracted PHP libraries, too. And it's an event/hook architecture, so you can pop this protocol out and put another one in, theoretically.

I don't know if this is a placeholder protocol while they build the software, or if this is what they plan on using and evolving.

If their goal is a distributed social network, then going with PHP makes sense since it's the best for normal people that will want to host the project somewhere.

A lot of the biggest sites on the web are coded in PHP, including Facebook, Wikipedia, and Digg.

We know and so what?

Not only is it in a language that many hackers dislike, but it's a supposedly decentralized social app in a centralized (and, in this context, archaic) SVN repo.

That has to be the most ridiculous criticism I've ever heard of any project ever.

I strongly and completely disagree. For a supposed next-generation, distributed open source application, language and version control choices are important. There are arguably valid reasons for using PHP, none of which you provided in either of your comments, but there is no excuse for using SVN. SVN has its place, and that place isn't in a project like this.

I'm completely down with the idea the SVN isn't a great choice, but I don't see what that has to do with the decentralized nature of the app whose source it's hosting. It seems like saying you should use XWindows to develop all network-related software because it uses sockets.

No. If your differentiating feature is a principle, then you can't ignore that principle.

Today, DVCS is essentially the foundation of developer social networks, both formally (github, bitbucket) and informally. How are you going to make a supposedly decentralized open source social network when the foundation isn't decentralized? Mom doesn't care right now whether a social network is decentralized and open source, developers do.

Judging by the amount of open source PHP code out there, some of it powering major websites, I'm not sure at all it's "a language many hackers dislike".

It's pretty universally acknowledged, even among PHP developers, that the language is a mess. There are reasons to use it despite this, but don't try to pretend it's something it isn't.

If you look at the most popular open source server software, a very large proportion of it is written in PHP (popular by install base) with applications such as Wordpress, PHPBB, PHPAds, Drupal, Gallery, Zencart, Joomla, SugarCRM, MediaWiki, PhpNuke, BuddyPresss, Moodle, ezPublish etc. etc.

Look at the list of apps that simplescripts supports[1], most of them are PHP (and simplescript in-turn is supported by a lot of hosts).

Look at OpenSourceCRM - most of the applications there are PHP[2]. The most popular open source CRM applications are also written in PHP[3]

PHP makes up a significant portion of self-install web apps because it is so widely supported[4] (LAMP), it easy to setup and a lot of sysadmins and designers understand how the apps work.

I commented when Diaspora was announced that for these reasons, and because of the target market, PHP would have been a better choice. They could have slipstreamed the install on top of the already large install base of these other applications without admins and potential users having to purchase or setup additional servers (ie. if you already have Wordpress installed somewhere, installing a PHP Diaspora would be a cinch. It could even read and setup using WP or other config files).

You may not like PHP (I don't know anybody who likes it from a design perspective), but you would be a fool to ignore it.

[1] http://www.simplescripts.com/script_list

[2] http://php.opensourcecms.com/scripts/search.php

[3] http://www.insidecrm.com/features/top-open-source-solutions-...

[4] http://php.net/usage.php

>risk installing it on my server

What risk do you perceive?

The same risk as installing any not-well-vetted server software. Except, from experience, I trust PHP code much less. Every PHP code base I have ever seen has been full of vulnerabilities. I don't like reading PHP code, so I don't feel like looking over it myself.

PHP had some poor defaults early on, but that was fixed long ago. Any decent PHP framework deals with SQL injection or XSS in the same way decent Ruby/Python/etc framework does. Judging from the fact they already released code and have experienced devs, I'd tend to trust Appleseed's PHP more than Diaspora Ruby. (Personally I prefer working in Ruby)

At the end of the day, the hip new app with the latest fashionable framework might still send your plaintext password over HTTP.

I hope you know that Facebook is also coded in php... Do you use it?

He was talking as a developer wanting to hack on the code, not a user.

He also mentioned he didn't want to 'risk' installing it on his server, as if PHP programs are inherently insecure.

Reply on news.ycombinator.com