PHP 5.5.0 Alpha1 Released | Hacker News Reader

PHP 5.5.0 Alpha1 Released

php.net

36 pointsavirambm52 comments

Open articleView on HN

Ugh, now suhosin is TWO versions behind.

Everyone please donate so he doesn't give up!

http://hardened-php.net/donate.45.html

(also: suhosin github page https://github.com/stefanesser/suhosin/issues )

An igorant question: Do you know why the Suhosin patch was never included in PHP core?

"political" security disagreements between suhosin developer and the php core people.

http://stackoverflow.com/questions/568609/why-isnt-suhosin-p...

See ck2's link, and also the most recent discussion: http://thread.gmane.org/gmane.linux.debian.alioth.pkg-php-ma...

At this point I don't think its smart to wait. It's time to move on and start looking at alternative ways to lock down PHP. I'm running 5.4 and had to make the difficult decision to upgrade my server without it. There can be PHP security without Suhosin. And maybe I have bad information but hasn't there not been a single peep out of the Suhosin project for a seriously long time?

He did make it work with php 5.4.0 when the branch first came out.

That was "only" six months ago so it's not forever.

Unless you do not use any third party code and have your own code audited, it's foolish not to run with suhosin.

I'm still trying to get over the naked feeling of running without magic quotes in 5.4 when using third-party code.

Point taken but I don't understand your aversion to no more magic quotes. Yeah, it's helpful when you run third party code but the benefits outweigh the costs. Anyone running third party code should be testing it first anyway and in the long run magic quotes gave people a false sense of security and promoted a very lax attitude toward security no matter how many times people screamed about not relying on magics quotes.

Thanks to everyone working on PHP for all of their hard work. Looking forward to using that new password hashing API in future production systems in particular, once 5.5 goes final.

You can use it right now: https://packagist.org/packages/ircmaxell/password-compat

Thanks for that!

"We also dropped support for Windows XP and 2003."

Well, that sucks. And everybody was laughing/bitching/both at MS for dropping support for them with VS 2012.

Windows is really a second class citizen in the PHP world, I imagine that there are very few live deployments of PHP on Windows servers.

I doubt that, I know of a few companies running PHP on Azure because they like it and others running PHP on Windows servers because their IT dept refuses to support Linux.

I've never experienced this. I've spent years of my life developing on PHP on Windows (and mostly, but not only, deploying on Linux). I've never got the impression that Windows is 2nd class like it is for Python.

It comes with well working Apache and IIS bindings by default; the Windows package contains a large number of compiled extensions; a fair set of Windows-specific extensions are enabled by default (including support for COM and .NET interfacing, for instance); command-line PHP (for e.g. Composer or Symfony) works just fine; most if not all posix-ish builtin functions have good Windows implementations.

Also, the built-in HTTP server that was added in PHP 5.4 works just fine on Windows. Really, I have no idea what you're talking about.

That said, I've never looked into whether PHP is as performant or secure on Windows.

I suppose it depends on which subset of functions you are using.

I developed a PHP app on Windows which did mailsending, push notifications (APE) and UTF8 encoding. All of these things behaved differently between operating systems.

"behave differently between operating systems" != "Windows is not as well supported"

Mail sending? Hmm, curious. Sure, there's STMP-settings in php.ini vs sendmail, but that can't be a show stopper, right? Also, PEAR::Mail did the rest for me, back in the days. I'm sure there's even better options these days.

I'm also curious how UTF8 was different. After all, since PHP arrays are simply binary arrays, how can it be different?

That may be true for servers, but certainly not for developers, or rather the average PHP user. Think of all the WAMP installations used to setup a Wordpress page.

It strikes me that several of the languages that gained popularity at the turn of the century are having a bit of an identity crisis in the face of their increasing irrelevance. This is especially evident in PHP, but I'm beginning to feel the same about Java in the face of JDK8.

With the new breed of popular languages (Ruby, Python, Scala, Clojure etc.) heavily influenced by functional programming, it seems as if the incumbents are desperate to remain relevant by adding comparable features with little consideration for their impact on the language as a whole.

For me, PHP has become (quite some time ago actually) a "kitchen sink" of a language; if another language has it, it's a fair bet that PHP will try to add it at some point in the future.

> For me, PHP has become (quite some time ago actually) a "kitchen sink" of a language; if another language has it, it's a fair bet that PHP will try to add it at some point in the future.

But is that a problem? I've not seen the fancy new features that PHP added in the last years clash with one another yet.

The only con might be that PHP has become a relatively "big" language. Closures (but weirdly done), references, 2 styles of classes, object literals, namespaces, half-assed reflection with support for magic comments, constants that are slower than variables, some magic functions and methods here and there, half of which have lecacy history. That's a fair lot to take in at once.

But once you've taken it in, it simply allows you to write better PHP code, more productively, than 4 years ago. How can that be bad?

I think it can be bad not for yourself, but when you have to start dealing with other peoples' code. There's little consensus on 'best practices' for some of the newer features, so it's likely you'll end up having to maintain someone else's code who started using new features (closures, for example) without really understanding how they worked, or how they could best be used.

"goto" in PHP is another example of this. I've heard from many people "well, just don't use it!" but... 6 months from now, I'll be handed a codebase that is replete with goto and other stuff that not only do I not use, but the original author didn't really know how to use either.

Adding more features adds more stuff we all have to be aware of, whether or not you use it.

I worked for several years as a C++ developer. Let me tell you that a "kitchen sink" language is a problem. You have to choose a subset to work in, there's lots of corner cases, and moving from one shop to another will turn you quickly into a language lawyer rather than a programmer.

Thank you for this; C++ is exactly the language that I should have referenced. It's a for-bearer for what PHP is to become.

BTW:

5.4.9 final will be tagged next week, November 19th and released on Thursday the 22nd.

Changelog:

https://raw.github.com/php/php-src/PHP-5.4.9/NEWS

Where is the list of deprecated features? At this point PHP really doesn't need new features as much as it needs an internal cleanup of its API's and Libraries and a complete re-write of its "VM"

This is the closest thing, I guess: https://github.com/php/php-src/blob/PHP-5.5/UPGRADING

> THIS IS A DEVELOPMENT PREVIEW - DO NOT USE IT IN PRODUCTION!

Interesting thing to say given that php.net itself runs a development version of PHP.

They're running a patch level update in production, not a development preview.

There are obviously going to be substantially fewer changes between 5.4.8 - 5.4.9 and 5.4.8 - 5.5.0

What's the link to their build server so I can see how many test the latest build has failed?

You mean this one? http://gcov.php.net/viewer.php?version=PHP_5_5

I've never seen one of their builds not report multiple errors!

I spoke too soon:

Build Status: OK Last Build Time: 45 hours

Compile Warnings: 1116 Code Coverage: 70.4% Test Failures: 103 Expected Test Failures: 44 Valgrind Reports: 59

some welcome improvements.

array/string de-referencing will help write less useless lines of code.

Array/string de-referencing was added in php-5.4.

5.4 has function-results dereferencing. array/string is new in 5.5

Why do I have to laugh when I read the new feature list?

Why are people still using this?

One negative aspect of open source is that it prevents failed technologies from disappearing.

> Why do I have to laugh when I read the new feature list?

yeah. Why? What particular items makes you laugh?

Let's start with "support for finally in try/catch blocks". In 2012 this is a new feature?

So far it was argued that by virtue of having no memory management, there will be nothing that needs to be freed and hence no finally clause would be needed.

Of course this was flawed reasoning as there are still many other resources that will require manual freeing, so now the problem has been fixed.

While it was bad that the flawed reasoning existed in the first place. I don't see how fixing bad assumptions made a decade ago is laughable.

Let's not argue here. Obviously he's a cool kid and we should all learn a thing or two from him. Like how to be the very last person here who still thinks its fun to take pot shots at PHP.

So PHP would be better off without adding a missing feature? I don't get your reasoning.

It wasn't reasoning, he's just taking cheap shots at PHP -- effectively ranting rather than making an thoughtful argument.

I'm not PHP's biggest fan, but you have a strange metric for success.

I guess that the reason you don't understand why php is so popular is that you never built anything, you probably just play with the latest cool language building toy projects as a hobby.

There's no need to be a douche just because the parent was. You're making yourself look like a one language pony.

PHP being popular is a fact, that doesn't mean that I use or advise using php only.

And the fact that lots of people that don't understand that syntactic sugar is not the only thing that matter in a language always bash popular languages that are not "cool" is a very common symptom that describes my previous comment very well.

And there is a third fact, that "sensitive" people like you that don't like strong opinions like mine feel the urge to disagree in a way that adds no value to the conversation and ironically call others "douche".

You extrapolated some fantasy and strawmanned the parent, that makes you a douche.

> I guess that the reason you don't understand why php is so popular is that you never built anything.

What.

> you probably just play with the latest cool language building toy projects as a hobby.

Is that meant to be disparaging? It reeks of someone who doesn't know a whole lot beyond the PHP ecosystem. There isn't a dichotomy of PHP and then "cool" languages.

I think PHP is useful in certain scenarios but acting like a zealot (or as you like to call it having "strong opinions") over it is fucking stupid.

> What.

So I guess you also don't understand why PHP is popular.

> It reeks of someone who doesn't know a whole lot beyond the PHP ecosystem.

You are now making some "fantasy" assumptions.

You missed the point from the beginning and now you are trying to take this into mud with all kind of assumptions and insults.

I'm stopping here.

Of course I understand why PHP is popular, I've used it for long enough. My expression of exasperation was at the jumps of logic you were making.

Reply on news.ycombinator.com