Hacker News Reader

Comment by mastazi | Hacker News Reader

> Cons:

> Written in old PHP and there is work underway to do a complete rewrite in Golang

I will never understand "the big rewrite" philosophy, no matter how many times I hear it.

Are some languages better than others in some aspects? Yes, but:

1. if you think that changing language is the only way to make a codebase secure, then there is something wrong with your security practices.

2. if you think that rewriting in another language is the only way to improve code quality, then there is something wrong with your software development practices.

3. chasing "the hot new thing" is a never ending cycle.

Choosing something like a calendar client based on what language it's written in, instead of its merits as a client, is such a ludicrous concept.

View on HN

I wish them luck with the rewrite, but those sorts of rewrites are usually just replications of Apple's Copland. I suspect these sorts of rewrites are attempts at capturing the zeitgeist of younger developers.

OP is going to be in for a world of hurt trying to find a solution, there's a reason why all these libraries are in 'old PHP'. Most of the big companies have 'Appified' their APIs with calendars, and the old .ical etc formats are there for legacy support. So you need to create an app, delegate it permissions and then you've got a REST API to play with. If you've got the skill to do this, you'll have the skill to write a syncing script.

For most languages I would agree with you. But I worked on a project that migrated away from PHP, and it was definitely worth it. Before the migration, a pretty big portion of bugs were because of weird unexpected things PHP did, afterwards, not so much. All languages have quirks, but PHP is on a different level than most popular languages.

And perhaps more importantly, a lot of developers hated working in PHP, and switching languages increased developer satisfaction.

Yes, it is possible to make secure, quality software in PHP, but it is more difficult than in many other languages. If making your app secure and higher quality requires substantial refactoring, or the marginal cost of maintaining security and quality in a PHP app is sufficiently high, switching to a different language could very well be worth it.

I'm going out on a limb and guess that either it wasn't a particularly large codebase and/or it didn't have many dependencies and/or you had more than enough resources so you could do the rewrite while at the same time providing support for the current version.

In the case of Nextcloud, my educated guess is that none of the above conditions is true.

It was a pretty large codebase, but we did have enough resources to do the rewrite while maintaining the current version. Sort of. It was migrated incrementally, and basically whenever we needed to fix a bug or add a feature to something that was still in the PHP part, we would migrate that specific functionality over to the new language. It did take several years, but since it was done incrementally, we got value from it along the way.

How exactly is it more difficult to write secure and quality software in PHP compared to other languages?

Lots of legacy gotchas that aren’t as secure as you would expect because fixing the implementation to make them secure would break someone’s production code.

Any examples of these gotchas?

how long do you expect the underlying older PHP basis to be supported as a module in apache, or run viably through whatever nginx does? what guarantees of backporting CVE security issues is there?

This wasn't just hatred of PHP (its a C like syntax. low barrier to entry) -It was about OLD php. Depending, formally (it may work on new PHP but it isn't clear. it might use deprecated language features or side-effects which dont work that way any more in newer language platform) on the old language spec can be a nightmare.

Plus, if its in a language you don't "like" then local mods are harder.

Would you e.g. run a Rust binary, if every other dependency you had was in GO? Or, APL, if nothing else you ran was in APL? Some choices about language make sense, if you consider the full ecology of running a service on a host.

Except it's not old PHP? Nextcloud stable officially runs on PHP7.4 and that is still officially supported for a little while yet. I personally run it on PHP8 with no issues

https://www.php.net/supported-versions.php

Edit: Also the docker image is updated to PHP8 for NC22: https://github.com/nextcloud/docker/pull/1563

> how long do you expect the underlying older PHP basis to be supported

You can keep software up to date without rewriting in another language, which is what Nextcloud did by the way, as it runs perfectly on my box with PHP 7.3.

Yes, I get the specific instance isn't a good example. I'm working in a space with code which was written to very old Perl with CPAN, and we've emerged into a state where the CPAN dependencies actually can't be made exactly the same, and the old perl is not workable on the new platform.

You're arguing the specific, I'm arguing the generic: it is possible to wind up in a place where your old code won't re-compile, or run.

GoLang isn’t exactly a “hot new thing”. It’s battle tested. Maybe the maintainers feel that it’ll be easier to work with in the long run?

Yes I agree about GoLang. I mentioned "hot new thing" to describe a general mindset and not specific to Go.

Reply on news.ycombinator.com