Hacker News Reader

Comment by dissent | Hacker News Reader

> PHP has the world's simplest deployment model for web applications: copy some files to a directory

And set up a webserver. Perhaps compile mod_php for Apache and configure it, taking care to do it securely. Then configure php too, again taking care to do it securely. Only then you can drop a bunch of files in a docroot and have PHP process them. And put some .htaccess files in so that things that aren't supposed to be directly executed can't be. I think it all just appeared simple, but it wasn't. It was dumb luck and lowest common denominator configurations on shared hosting that made it appear easy.

View on HN

> And set up a webserver. Perhaps compile mod_php for Apache and configure it, taking care to do it securely.

You don't need to do any of this if you use a hosted service, which most people did. In that case you just needed to setup an FTP client. Of course these days hosted services for other stacks like Heroku are about as simple. Just push to a git repository and you're done.

However, presumably you wanted to test locally before deploying, so you needed a local install. Tools like XAMPP to simplify this were as relatively bloated as the modern create-react-app or whatever.

And then you find the software doesn't work because it relied on imagemagick to resize avatars to display the index page and your web host skimped out on the imagemagick module in their PHP deployment to minify resource use or it was just too much effort for them to deploy because it was the 2000s and they were using Slackware on their production servers.

Oh and the web host disabled .htaccess support so you need to turn off the pretty URL support in the config files. Oh and their default config (which you can't override - see .htaccess) is insecure as it means people can execute PHP files from the upload directory. So then you got owned because of that.

Oh and the MySQL configuration or old version used had some weird ideas about character encoding, so good luck with those € signs.

And then you wanted to install a plugin for phpbb or something and the instructions were basically a diff in textual form on a forum post.

> However, presumably you wanted to test locally before deploying, so you needed a local install

I wouldn't necessarily presume that. I mean I would want that now. But for my first forays into web development, I didn't have that. Precisely because it was hard to setup. I would just FTP stuff onto the "live" server (it wasn't exactly a critical site anyway, so if it broke for a while then that didn't matter so much). There were editors which could edit files directly on an FTP which made the dev workflow pretty seamless.

Stuff like imagemagick could indeed be a pain. But you could at least get started without that. In general there were lots of problems, but the on-ramp to some dynamic behaviour was really minimal.

> However, presumably you wanted to test locally before deploying, so you needed a local install.

Or you did it like mentioned on another comment here (https://news.ycombinator.com/item?id=31247426): "copying homepage.php to homepagenew.php, hacking on it until it works, and then renaming homepagenew.php to homepage.php".

The old homepage.php is renamed homepage-2022-03-05.php and either left there indefinitely or deleted after the next backup.

You may even have a script gathering urls for .php files starting with "homepage-" and echo a link for each chronologically (sorted alphabetically)

No need to self host a git server.

PHP is probably the only language that makes it relatively easy for non-technical users to self-install a web application. It is not a quality inherent to PHP but is a consequence of the widespread adoption of PHP among shared hosting providers (no web server setup required).

This is a quote from Jeff Atwood (founder of Stackflow) about PHP (he's not a fan):

Despite the serious problems with PHP, I was forced to consider it. If you want to produce free-as-in-whatever code that runs on virtually every server in the world with zero friction or configuration hassles, PHP is damn near your only option. [1]

When did Atwood say this? 2012.

A decade has passed and hardly anything has changed. Server installation remains needlessly complicated. Current solutions like Docker, Sandstorm, Cloudron, command line scripts etc. are "easy" for developers but not for ordinary users. What is easy for ordinary users? Installing a web app by uploading files to a folder on a server using a GUI FTP app is one example for PHP. (And for some non-technical users, even that might be too complicated).

[1] https://blog.codinghorror.com/the-php-singularity/

Agreed with the Atwood quote (not a fan of PHP myself; not a fan of Atwood, either). But I think you overestimate the approachability of PHP for non-technical users.

> Current solutions like Docker, Sandstorm, Cloudron, command line scripts etc. are "easy" for developers but not for ordinary users.

It sucks that Sandstorm didn't "win". But the implication here is that PHP is easy for "ordinary users". It's not, though. It's easy for a slice of the somewhat technical population at the low end of the technical spectrum. Ordinary people are still left out—and not to mention: susceptible/vulnerable to being lured by the false promises about the "easiness" of the PHP model. Unpatched installs of shoddily written PHP apps (or plugin-laden installs of WordPress) are an undeniable vector for potential security compromises of personal data, spam, and nodes use to coordinate the spread/execution of malware.

But the implication here is that PHP is easy for "ordinary users". It's not, though.

I agree. I've often wondered: why can't web server apps be installed with the same ease-of-use as desktop apps? Simply click through simple screens and installation is complete. All desktop users know how to install desktop apps. Unfortunately, Sandstorm and Cloudron - trying to provide easy app installs - are not widely supported by hosting providers.

> Current solutions like Docker, Sandstorm, Cloudron, command line scripts etc. are "easy" for developers but not for ordinary users. What is easy for ordinary users? Installing a web app by uploading files to a folder on a server using a GUI FTP app is one example for PHP.

Eh? Installing an app on Sandstorm or Cloudron is basically the same UX as installing an app on your phone. Certainly much easier than uploading files to an FTP server.

I agree with your comment with regards to Docker and CLI.

I'm also happy to agree that Sandstorm and Cloudron hosts are much less ubiquitous than PHP hosts, and that's a real blocker to ordinary users... but it seems weird to classify them as developer-oriented on that basis?

(Disclosure: I co-founded Sandstorm.)

That's a very fair point. It was unfair of me to lump Sandstorm and Cloudron togther. Sandstorm and Cloudron setup is carried out by the hosting provider. The trouble is that not many Sandstroms hosts exist, as you acknowledge.

Sandstorm's aim is very commendable and thank you for tackling this important problem of deployment and web app installation.

The other easy part was the markup. Just take your existing HTML page, add some for loops around bits of it and insert placeholders. 14 year old me found it very easy to turn my static HTML (which I was copying and pasting and changing for each article) into a dynamic page.

Of course it had tons of issues (GET and POST variables turning into globals, SQL injection etc.) but the barrier to entry was very low.

Yes, if you have to set up and configure a webserver from scratch, and compile things, deployment in any language is difficult. But for the most common use cases, PHP is still easier.

That assumes you have PHP already installed on the server right? I mean if you already have nodejs on the server, you can also just drop files in

All the really cheap hosts have PHP installed for you.

Not saying they are good, but someone starting out wouldn’t ever start installing things like that.

Shared web hosting is still a big thing outside of our developer bubble. PHP is 99.9% guaranteed to be installed in these types of offerings, or it's a one click install on your control panel page.

In my experience, node.js won't run random files it finds in the current directory, and normally it won't reload them if they change after it starts either. And you have to configure your URL space separately from copying files around; it's not as simple as copying homepage.php to homepagenew.php, hacking on it until it works, and then renaming homepagenew.php to homepage.php.

You can use nodemon for that. PHP Apache similarly requires a process running in the background to handle requests right? My point is, the infrastructure needed to be able to simply drag and drop PHP files onto a PHP server, can be replicated with NodeJS too. There's nothing inherent to PHP about this process, it's just about how you set up you server.

Now it's far more likely to find a hosting provider that already has PHP set up over NodeJS, but as the main article observed, those are in decline. That seems to me as simply a lack of demand. If people want static sites, theres no need for PHP. If people want even a bit of dynamicism, then it's not hard to use a framework, and you get far more scalability. The barrier to entry for these frameworks is so low that it's not worth using barebones PHP and then having to rewrite everything if you start wanting more.

Well, I suppose it's true that you can write command-line programs in the PHP language rather than run them as web pages, but PHP isn't just a language; it's also the software that implements this deployment model on various web servers, with built-in support for things like MySQL.

node.js also implements a deployment model, but it's a different one. (node.js rather than JS is maybe a closer analogue to PHP.) nodemon gets you partway to the PHP model (by restarting your server when something changes) but not all the way; it doesn't start running random files it finds lying around. And people never run it in production.

So, in summary, it is comprehensively not true that if you're already running node.js on the server, you can just drop files in. If you just drop files in, node.js will ignore them.

If you truly wanted to replicate the old PHP style of "drop a new file to handle a new route endpoint", then you would use something like Nodemon + Express. The whole drag and drop functionality is most definitely possible using a nodejs framework, and isn't that far from the popular tools being used today. It's just not common to do it this way, since people don't need it nor want it anymore

I've used Express (a little), and as far as I know, in Express you don't define routes by adding files to a directory, which then get implicitly run; you define routes by running code which calls methods on the app object, like app.get, to register routes. To run that route-registering code, you need to either insert it into your main program, or you need to require() the file it's in from your main program. If anything in this route-registering glob of code has a parse error or tries to require() something that doesn't exist, your server won't start.

There's an enormous difference between claiming that "you can also just drop files on your server" and have a running application, which is what you said in https://news.ycombinator.com/item?id=31246963, and claiming that "[some] people don't need nor want" to just drop files on their server and have a running application, which is what you're saying now.

Now you're bringing up "drag and drop functionality", which is a GUI gesture, totally irrelevant to the things PHP's deployment model enables, which you are correct are things that some people don't want. Here are some examples:

1. You can unzip a zipfile of PHP on your server and have a running app. This is super helpful when you're a novice who doesn't know much about processes and sockets.

2. You can add a new URL by sshing into the server and typing "cp homepage.php homepagenew.php", even using a slow or low-bandwidth connection. Then you can incrementally change the new URL's behavior by editing that new file, while the main site hums along unaffected—at least until you hose the production database. If you want to change the old version, you can type "mv homepagenew.php homepage.php".

3. If you have two PHP apps, like MediaWiki and WordPress, you can unzip them in two different directories on your server and have two apps running on the same server. If one of them is broken, even contains parse errors, it doesn't affect the other one. You can add links in one of them that link to the other.

4. You can temporarily disable a page by typing "chmod 0 upload.php", without breaking any other pages and without slowing down the server.

5. You can host apps belonging to hundreds of mutually untrusting users in the same Apache process, running on different virtual hosts, without the different users being able to screw up each other's "sites".

6. You can break into somebody's website by uploading a file to it with a .php extension in a directory that the webserver is (mis)configured to execute PHP files in.

7. You can make a usable backup of an old version of a page by typing "cp homepage.php homepage.old.4.php". Which you can later restore in a similar way, without affecting other pages, by doing the reverse. Without learning how to use Git.

8. You can load a page in your browser and not have to think about whether possibly the running server has an old version of the page in its memory and that's why your attempted fix has no effect.

Now, PHP has never been my tool of choice; it's optimized by, and written by, people who don't know how to program, and I'd already been making web pages for years when it came out. It has its share of embarrassing bonehead design errors that can now never be fixed, though it did fix a lot of them. I like getting error messages instead of wrong results when I try to run broken code; it's one of the major reasons I switched from Perl to Python for soft stuff, near the turn of the millennium. I already know how to use version control systems, so I don't find it reassuring to have a directory full of "homepage.old.4.php". I want to be able to run the whole site on my laptop, not using the production database, and I want to be able to use a staging server. I don't want to have to worry about whether someone else has edited the files in production and that's why this page, that never should have worked, has always worked, until today. And I especially don't want my site getting popped because the uploads directory treated .php files as plain text but .php4 files as executable PHP. (Oops!)

But the fact is that PHP's deployment model enables beginning programmers to manage a website by putting files in directories, copying files around, making backup copies of files, and so on, without ever taking their entire site down with a parse error at startup, and, as far as I know, there is nothing even vaguely similar for node.js. Nodemon isn't it. Express isn't either.

> There's an enormous difference between claiming that "you can also just drop files on your server" and have a running application

You're definitely right, but the entire lament seems like a lot of special catering for the convenience of an audience that is technical enough to write PHP, but isn't particularly accommodating to, like, the actual masses of people out in the world who are not and will not ever be inclined to wade through the issues inherent to setting up a shared hosting plan with a PHP provider and hashing out their craving to publish by fiddling with templating code.

The author of this piece has a lot to say about SPAs and other client-side fads, which is fair. Lots of what makes up current trends in the "modern" Web is an abomination. But the PHP application/deployment model they advocate for is nothing special wrt the affordances it makes for non-technical folks, nor is it a particularly good implementation of TBL's original vision for the Web—despite the implicit ("explicit"?) claims in the article to the contrary. On both of those fronts, stuff like Zonelets <https://zonelets.net/> has moral superiority (despite its being basically a toy). The essence of Zonelets is also, at a fundamental level, much closer to what we see with SPAs than the "mildly dynamic websites" of yore.

Author here. One thing that occurs to me is that it seems to me that there's a lot of "dark matter" programmers out there, which we don't often interact with. These are not professional programmers but they tinkered with it at some point, possibly out of curiosity, possibly out of necessity. These people maybe wrangled with PHP because they had to to get the website they wanted back then.

These people may drift out of doing any programming as and when it becomes unnecessary. It's similar to the sentiments expressed with GeoCities, where you had web design being done by amateurs who weren't very good at it. Nowadays they probably use some kind of site generator and aren't exposed to HTML at all.

Of course one can say that these these things are better left to professionals, but it's clear I'm not the only one with a clear sense that we've lost something here. Neocities, for example, is a clear reaction to that.

It's similar to how home computers used to boot to a command prompt and now they don't. They essentially invited you to learn how they worked, whereas the modern desktop computing experience tries to seem as magic as possible. Many people of a certain generation probably learnt to program as kids on these old 8-bits because the machines themselves basically invited to. As a professional programmer now I'm genuinely unsure what I would recommend to a child of the same age today.

Thoughts on Zonelets (linked earlier)? It's very much in that GeoCities/Neocities niche, without being PHP or PHP-alike/-adjacent. (See also: <https://ichi.city>.) Once you have something like that, you can do a lot with some way to process basic forms. (On that note: <https://riku.miso.town>.)

The KBFS-backed keybase.pub and the never-officially-launched Keybase Pages also had such huge potential.

These all look interesting and I'm looking forward to exploring them. I've already quite some fun discovering new warrens of the indieweb in the wake of this article. I haven't felt this way browsing the web in, say, 20 years? ;)

You definitely have a point that we are getting further and further abstracted away from the lower level workings. And perhaps we lost something along the way. I just don't think what we lost is the UX, the dynamicity gap that you alluded to in the article. From my experience UX is crucial for beginners, and if PHP truly had a better UX for simply apps and for beginners, it would not have dwindled so much in popularity

Most beginners nowadays are instead using something like Wordpress or Squarespace. I agree that UX is crucial.

What was it that motivated you to program those old 8-bits? For me, it wasn't the command prompt; it was graphics, sound (especially speech synthesis), and games. Based on that, some ideas about what to recommend, based on zero actual experience teaching kids to program:

0. Arduino. You can make colors and sounds that aren't locked in a box and that communicate over infrared. You can drive motors. In some cases, you can repurpose parts from existing consumer electronics. I had the privilege one weekend of helping out with a beginner programming class for artists; in about four hours they went from not knowing what a variable was to being able to program the robots they'd been given to follow a line around a racetrack. (Adults, but evidence suggests Arduino is good enough for kids too.)

1. Minetest. If they like Minecraft, Minetest is a Minecraft clone where they can write mods in Lua. This requires juggling a lot of files, and it can be difficult to figure out why existing mods are doing one thing or another, but you can add new mobs and blocks to the world that affect existing ones in a wide variety of ways. You can play it on your phone, even hosting a server, but there isn't a reasonable way to edit mods on your phone. And if you've spent a few hours playing Minetest the things in the simulated Minetest world can seem very real to you, which makes programming them more appealing.

2. Scratch or, on Squeak, EToys. A lot of kids seem to find Scratch easy to start out with but then want to switch to a textual programming language because they see it as more "grown up". And to be fair Scratch does have some real intrinsic limitations. EToys has maybe a smoother path to full Smalltalk but kids may not be impressed by full Smalltalk if they don't see adults using it.

3. Browser JS. The applicability and deployability is super high, and the barrier to entry here is pretty low if you have a desktop browser: type data:text/html,<a href="javascript:alert('hi')">x into the address bar. Graphics, sound, and multitouch APIs are available. You can easily load in images, including animated GIFs, composite them with alpha, and move them around and stretch them.

For more elaborate graphics there's both a pixel-based <canvas> API and a vector-based SVG API. You can draw SVGs with Inkscape. You can render a fractal in <canvas> in an OG Tweet, though color costs a few more bytes:

    <canvas onclick="c=this.getContext('2d');function d(x,y,k){
    c.fillRect(x,y,1,1);(k/=2)>1&&(d(x,y,k),d(x,y+=k,k),d(x+k,y,k))
    }d(0,0,150)">

By putting your JS into a bookmarklet you can use it on pages you didn't write, including things like Fecebutt. The developer tools in the modern clones of Firebug (browser console, element inspection, CSS editing) are absolutely first class. Unfortunately a lot of this is limited to desktop browsers because vendors have deliberately crippled the browsers on hand computers; those are for consumers, not creators.

Video games are very doable in browser JS, and the situation has improved significantly in the last five, ten, and twenty years. Beginners, especially kids, would probably benefit from a game engine library here because they don't know how to combine constructs to solve problems yet. I wrote http://canonical.org/~kragen/sw/dev3/invaders one day last March, but that's four pages of code full of arcane constructs like row.push((x / barricades.dx / 2 + 12) % 16 < 8). I refactored a game engine ("qj2d") out of it and got http://canonical.org/~kragen/sw/dev3/qvaders, but I haven't tried to teach anyone else to use the game engine, and it has some stumbling blocks and boilerplate.

Chris DeLeon demonstrates coding Pong in Notepad with <canvas> in 5½ minutes in https://youtu.be/KoWqdEACyLI as a teaser for a longer course.

JSFiddle and similar services make it easy to anonymously share your work without signing up for a hosting plan.

4. Micropython, or Adafruit's fork, Circuitpython, as an alternative to the Arduino environment. Circuitpython is focused on getting beginners, especially kids, up and running with a smooth UX. What we were saying above about dropping PHP files in a directory on a server to run them? Well, with Circuitpython you drop Python files in a directory on a USB device to run them. AFAIK they don't run on the AVR that's in the traditional Arduino boards but they do run on another half-dozen types of microcontrollers, mostly ARM.

5. Proce55ing. The Arduino IDE is a fork of the Proce55ing IDE, which is optimized for making mouse-interactive graphics on the CPU, but it can also straightforwardly do sound, integrate with additional sensors and actuators, load GPU shaders, and so on. It's been demonstrated to be very accessible to adult beginners, and I think it works for kids too. You can export the results as Android apps. It normally uses its own Java-like language but there are also JS and Python versions.

6. Shadertoy. There are a lot of graphical effects that are straightforward to achieve on in a shader on the GPU but difficult or impossible to achieve on the CPU, and the Shadertoy website makes it easy to get started with that; you can edit the shader live and see the results in your browser, and save it to a URL. Also maybe check out Patricio Gonzalez Vivo's The Book of Shaders.

7. PyGame, the Python binding for SDL. You can write games in PyGame (solarwolf is in apt, and you can find others with apt-cache rdepends python-pygame) but also it's good for the kind of interactive graphical art Proce55ing is great at. You can get a blue rectangle on the screen as simply as this:

    #!/usr/bin/python
    from pygame import *
    pantalla = display.set_mode((0, 0), FULLSCREEN)
    draw.rect(pantalla, 128, (50, 100, 200, 400))
    display.flip()
    time.delay(2000)

And work up from there. That's https://github.com/kragen/pyconar-talk/blob/master/helloneg1..., which is one of a series of examples I wrote for a talk on this 11 years ago.

8. Godot.

Also more generally Linux is pretty inviting to hack on (though systemd kind of isn't) and the Raspberry Pi is designed to invite that kind of thing too. Even if you don't have a Raspberry Pi at home you can spin up a Linux box for US$5 a month on something like DigitalOcean or Cockbox.

"Technical enough to write PHP" is similar to "technical enough to drive a car," "technical enough to write formulas in Excel," "technical enough to edit Wikipedia," or "technical enough to write a Hypercard stack". Empirically, it's highly accessible to people who don't know how to program, even though it's not a good implementation of TimBL's original vision for the web, or of Ted Nelson's original vision for "hypertext".

> [PHP] is highly accessible to people who don't know how to program

The commitment to this claim is the source of contention.

On "technical enough to write PHP" vs "technical enough to drive a car": there's a much lower barrier to entry for the latter than the former. The latter is about the same as merely operating a computer. Derping around in PHP is def a level above that.

In both cases we're talking about a total training time of a few hours. My experience taking driving lessons and watching intro-to-programming classes make me think it's more like 1 hour to get productive with PHP (or Arduino, or Hypercard, or Excel) and 10 hours to drive a car safely without a driving instructor, but you could be right that it's the other way around.

Regardless of theoretical considerations, it's clearly the case that at least hundreds of thousands of people have used PHP without previous programming experience, and from talking to them (and maintaining their code, eugh, and worse, tweaking their servers—via TeamViewer on one occasion) I think the dirt-simple deployment model is a major enabler of that. They don't have to learn about decentralized version control and build processes to get something running.

You're right that I was simplifying the Express bit (or maybe a lot), but let me try to make that part a bit more clear. You can have a top-level node.js file that uses Express and imports all files in a given folder as routes. Then you can get the "putting files in directories, copying files around, making backup copies of files, and so on". It will take a bit more elbow grease to get the "without ever taking their entire site down with a parse error at startup", but still possible. And if a host like GoDaddy wanted to have this as a preconfiguration on their servers, they could. My point was that the UX that you are describing, is possible in any framework or language, given the right infrastructure pre-installed on the web server (which you have for PHP). So it's less about PHP not being popular, and more about this UX not being as popular anymore. My guess for the reason, is that even beginners find the modern workflows and popular hosting options intuitive and easy to use.

Yes, you could implement PHP in node.js, or indeed in any language on any platform as long as it has files. You could do a better job of it by not botching the programming-language design, too. As far as I know, though, nobody has, and there is a significant difference between software that could hypothetically be written and software that actually exists.

As I said elsewhere I think a lot of beginners are programming instead in Roblox and hosting their sites on Wordpress or something.

The first time I set up and configured a webserver from scratch, in 01994 with EIT's Webmaster Starter Kit (wsk.eit.com), I think it took me about 20 minutes; I just had to fill out an HTML form with some configuration data. I didn't have to compile anything. Later, I would spend many hours getting intimate with the Apache manual, but Apache didn't exist yet.

WSK didn't support PHP, of course.

Nowadays it's not that difficult; you can just run nginx or Apache with Docker, and a few command-line options later you have a server running. If you have IPv6 or can reconfigure your home firewall (and aren't afflicted with CGNAT), it's a globally accessible server. Hosted options are a little trickier but not much.

Plus with package managers you just say “install apache”. There’s now apache helpers that come with that will setup mods and all that stuff. Last time I did this I think you only had to create some symlinks in the config folder to enable a site.

It is work but I mean you’re writing a website then knowing these things is a prerequisite and the docs are good and there’s tutorial after tutorial all over the place.

I was just thinking how long before somebody mentions Docker. Why leave Kubernetes out? Point of article missed completely.

By you, maybe. But I'm contributing things like https://news.ycombinator.com/item?id=31263708 to the discussion while all you're contributing is smug dismissals.

Remember, setting up a web server is done once. Deployment is done more than once. The deployment is still just as simple as scp’ing files to a folder.

when teaching myself web development in high school it was very straightforward to use the "PortableApps Launcher" from my iPod's hard drive over USB to get me Portable XAMPP, Portable Notepad++, and Portable Firefox to develop locally with, and Portable FileZilla (but also the Notepad++ SFTP plugin) to deploy to my paid host. couldn't have been easier.

Yes, if you’re going to build a web application you’re going to have to do the things to build a web application. Even the newest framer knows how to swing a hammer at a nail.

Reply on news.ycombinator.com