Hacker News Reader

Comment by tptacek | Hacker News Reader

Wordpress has had a catastrophic history of insecure code, based on a number of basic design flaws:

* Reliance on ad-hoc hand-coded SQL.

* A system that registers psuedonymous Internet commenters in the same user table as Wordpress administrators.

* Mishandling of internationalization.

Yes, Wordpress is also the most popular blogging platform, and yes, it's also much more dynamic than its competitors, but phpBB and vBulletin seem to have had better track records than Wordpress have. It's just not very secure.

View on HN

Basically, Wordpress is written in PHP and this is the root of all evil.

Let's look at the roots of PHP: it was never designed as a programming language, it was a tiny script language used to create Rasmus Lerdorf's website. Thus, it has a lot of oddities like the === operaor.

Do you know why it it is there? Because they wrote a broken instr() wrapper and messed up the error handling. And instead of doing one thing right, they added another obfuscation layer. Great design.

Then, PHP was traditionally used by webdesigners, not programmers. This lead to tons of bad code and bad practices. It is not that you cannot write elegant code in PHP, but there is so much more bad code around that it is hard to find the good code.

So, why do wonder about this?

Don't get me wrong, I like using Python. But I prefer small compromises addressing prior mistakes, allowing for backwards compatibility, over a full rewrite.

I think we're a few years past the arguments you make against PHP. If you want to be trendy, you should rail against the people running Internals (namespace separator).

Waiting a few years doesn't make his arguments wrong.

By "past" I meant that they've been adequately addressed.

Can we stop this argument already?

Real hackers can appreciate every damn language out there. If it weren't for Basic in the early 80s, I wouldn't be programming now.

PHP is a wonderful gateway language for a generation of web programmers. It is installed on every webserver and is always ready to rock-n-roll. No other language has achieved that level of ubiquity.

No. We can have a productive discussion about whether a language and its frameworks are conducive to secure coding without it devolving into a language war. We're adults here, and there are more than just stylistic differences between PHP and its competitors.

Despite the qualms I have with PHP, you can't blame the language for design flaws in the software.

Sure you can. People do it all the time with C.

Hah! Fair enough, but my point was that those claims aren't legitimate. Especially those claims about C

phpBB has an atrocious security record as well.

I'd deploy phpBB in its default configuration before I'd deploy default Wordpress. (Our blog is Wordpress).

phpBB has an atrocious security record. It's gotten much better since version 3.

I think I could credibly dispute the record here, but I think we can also probably just agree that today, phpBB is hobbled by fewer design errors and better hygiene than Wordpress. Wordpress is just a scary glob of PHP code.

Isn't the basic design flaw being programmed in PHP?

There are PHP programs with decent track records. PHP doesn't make it easy to write secure web apps, but it's not a lead weight either.

Reply on news.ycombinator.com