PHP 6: Pissing in the Wind
philsturgeon.co.uk
philsturgeon.co.uk
"Ah yeah just rewrite the entire code, you are meatheads for not doing that in the first place, you should have done it years ago. Oh yeah I have no programming experience per se, for example I don't know how to program in C and have no idea what the PHP internals look like, but how hard can it be? I mean you just load your C Code into your IDE and then search and replace all the bad code and write in the good code and then press the compile button and there you go. It works that way when I design HTML web sites in Dreamweaver, so it should also work for C, right?" -Archie Bunker 'Armchair Programmer' and 'Technology Bigot'
PHP is from newbies for newbies.
Or Rasmus Lerdorf who releases software that doesn't run all unit tests?
It's a stinking shit crock from end to end. Just because it has a few celebrity developers like Rasmus, doesn't mean it doesn't fuck you in the eyeballs the moment you see it.
Just sit down for a couple of hours with tmux fired up, and vim with bits of ZE source code on the left and on thr right, Python.
You will see. It will make you sick looking at the ZE source code.
Like the "newbies" at Facebook, Yahoo and tons of major sites using Wordpress, huh?
That's not an excuse, thats logic. It's very possible that so few people get involved in core development because there is very little motivation to do so. "I can work really hard on something that I feel really passionate about, then have it totally ignored by a bunch of people who think PHP should just remain a cluster-fuck of inconsistent PHP functions." Yaaaay!
See the issue? It's very easy to say "Well why don't you do more?" but when people see those that try being met with negativity in such a big way it REALLY doesn't make me want to even try to help.
Let's just for the sake of argument say you read a "C for Dummies" book and actually write a few programs. OK now you are a beginner C developer with a small bit of experience under your belt. Now you need to read an Intermediate C book and learn data structures and algorithms that "C for Dummies" didn't teach you. Then you need to read a few Advanced C books to learn how to do system level programming, write your own libraries, hook into interrupts, link to binary libraries written in a different language, and learn how to program C to access operating system internals. After all that, you have to join some smaller level open source C projects, and then move up to medium level, and then finally to large level such as PHP.
Of course at that level, you got people just like you used to be giving you advice on how to do your job, and how to rewrite the program, but you are very busy trying to submit code to the project that is accepted by the maintainers and included in the main branch of code, and you have a few other maintainers telling you how bad your code is, and a few others telling you that your code conflicts with what they wrote. Of course the noobz don't know any of this, but you are frustrated, stressed out, and nobody is paying you any money to do this and you owe a lot of debt on your bills. So you get told "Well why don't you do more?" by a noob, in response to some feature they want you to add to the project, but you know that adding it will cause a lot of problems with the other programmers and maintainers, and also cause them to give you a lot of negative feedback for it.
You consider your options, you could just fork the PHP code into a different open source project, but then who would join you in on it? You could write an open letter to the PHP community about adding this feature and supporting the programmers and maintainers by donating money so they are able to spend extra weeks working on it and quit their jobs and start doing the project full-time. You could just hope that everyone sees it your way and works on adding this feature eventually. You could just give up in frustration and quit, citing family issues. You could talk negatively to the noob and hope he/she quits suggesting these features be added and tell him/her just how hard and complex that would be. You could do something else as well.
I worked at an outfit that hired some utter fuckwits who had been recommended by some more fuckwits for something and they did it in PHP and put it on budget shared hosting.
A week later: SQL injection, CSS, CSRF attacks and someone who had cracked the server was injecting malicious js in the page header.
That day was the day that management finally listened to my doomsaying about security...
It all started with employees who had Irish names like O`Brian, they would cause database errors when trying to insert their name. I found out the data entry clerks didn't know the difference between the "`" apostrophe and "'" single quote character. So I wrote a SQL filter function to double up the single quotes if one is entered. As it turned out some employees where using the single quote for SQL Injection and it foiled their attempts and they filed support tickets for it. I could not replicate the error and then I asked how they were entering the data, and none of them wanted to tell me. So I made a logging code when their user ID is used to access the database and noticed they were trying to use the single quote to gain access to other tables and in some cases entering "1 or 1" and other stuff that just returned all the results in a table. I had to filter out SQL commands, system characters, and other things, even HTML statements because they would stick them in there to deface ASP pages and insert messages.
This was a law firm I worked for, and they had no clue their users were doing this, it was an Intranet site that was not accessible from the Internet. For stopping their 'cracking' of ASP pages, I gained a lot of enemies for that. Some would send denial of service attacks to my Windows PC, some would file fake complaints about me to get rid of me and replace me with someone who didn't sanitize inputs. Eventually I got too sick to work, and was fired for being mentally ill after all the stress I had caused me to develop schizoaffective disorder.
A better example would be Django, most server-side Java frameworks, Ruby frameworks like Sinatra and Padrino, most Erlang code I've seen is solid, Haskell users generally know better, etc.
Meanwhile on planet Earth every popular software package has had some issues. That's natural, security is hard and requires constant vigilance, and people are bound to err or oversee something from time to time.
I warned the local lottery about the security issues they had with their website (I was doing them some side work) but they didn't listen until someone defaced their website and the first thing they did was ask me if I did it.
Sort of like this:
Programmer "Uh you really should use a numerical keypad to the server room, it is more secure than the doorknob lock which is so common anyone can find a key that fits it and rob the server room."
Management "Feh! Forget it, we don't have the budget for it. Besides that doorknob lock was on sale at Lowe's and fit out budget. The clerk there said it was lockpick proof, and that's good enough for us."
Later on someone picks the lock and then steals all the server hardware.
Manager "Someone broke into the server room. Hey programmer was it you, you seem to know a lot about locks and stuff?"
Programmer "No it wasn't me, if you followed my advice with the numerical key pad you wouldn't have had this problem. The lock you used made the server room insecure and allowed a robber to easily pick the lock and rob us all."
Manager "Yeah whatever, I'm pressing charges against you anyway."
And if your prior employment recruited based on connections rather than competence that speaks to a management issue that couldn't possibly be solved by switching languages.
(this isn't really to single out your comment meaty, could be attached to anyone else in this thread)
You _do_ know that some of he largest sites on earth run on Wordpress, right?
They are just fad artists.
Ideally, a blog can be cached to static html (regen pages when owner adds an entry and if comments are self hosted, regen when a comment is added/approved). Even so, it looks like there are too many php processes running compared to mysql connections allowed; lowering the php processes will probably lead to better throughput than ramping up mysql connections.
Most DBs all have their own connection pooling mechanisms that don't work the same way, so we need to look into each to see if it's worth it. Caching though (query as well as HTML), is usually always a good idea.
PHP supported different SQL databases, but they implemented some kind of protection in a non standard way, just because it was supported by MySQL.
If you don't check your configs when moving to a new host, you get what's coming to you.
Slightly longer version - When you stop a AWS instance, the instance is torn down completely and all local state/data (Ephemeral) on the hypervisor is lost. when you then start the instance again a new hypervisor with spare capacity is found and then booted with your chosen base disk image. Restarts do not cause your instance to torn down so you don't lose local state / data. If your instance uses network drives (EBS) then these drives keep state when your server is torn down, and are re-attached when the server is started back up again,
I'm surprised there isn't something like JPHP yet to run PHP on the JVM.
quercus and ibm's ... ack - what was it called? they had a 'freeware' CMS that included their own implementation of PHP in Java.
I think there's another too, but there's quite a lot of oddities and assumptions that make PHP-based code not play well in the JVM.