91–100 of 174 posts
Earlier quoted context omitted.
> OK, security wise Since when is implementing your own home-grown shitty replacement for parameterised queries "OK"?
Since you need to support versions of PHP that don't support the extensions that have parameterized queries.
Here's a hint: Wordpress since v3.3 needs PHP 5.2+. MySQLi was added in PHP 5.0, PDO in 5.1
WordPress v3.3 was released in 2011.
Earlier quoted context omitted.
I think you might be the first case I've heard of of someone wanting to go from .NET to PHP.
We literally spend millions on licensing Share Point to do what WordPress can do much better and easier. I'm not saying we're going to start writing everything in PHP, but being able to experiment with WP could affect the bottom line in a big way.
This seems to be built on an open-souce PHP->CLR compiler called Peachpie[1]. Interesting project. I don't have any PHP codebase that I still maintain but looking forward to trying it with some scripts I've written back in the days. I wonder if it would be faster than PHP 7 - which is already very fast (ok, just found these: http://www.peachpie.io/benchmarks ). [1]: http://www.peachpie.io/ [edit] If the author is loo…
>I also admire the platform but most secure? Comes off a bit too strong. There aren't a lot of .NET exploits for a variety of reasons. Its pretty much the Java of the MS world so a lot of issues more liberal languages have, it doesn't, especially in regards to buffer overflows. Its attack surface is also pretty low as it only really inter-operates, by default, with a limited number of MS applications and is frequentl…
How is a goddamn HTTP parser in THE KERNEL more secure than a crypto/TLS library?
http.sys is a fundamentally horrendous idea, see CVE-2015-1635 https://technet.microsoft.com/library/security/MS15-034 An exploited HTTP parser shouldn't lead to RCE "in the context of the System account".
Earlier quoted context omitted.
We literally spend millions on licensing Share Point to do what WordPress can do much better and easier. I'm not saying we're going to start writing everything in PHP, but being able to experiment with WP could affect the bottom line in a big way.
I would look at sitecore. It's still .net, but it is closer to wordpress in that you wouldn't necessarily build a sharepoint in it, but you can build pretty much anything else in it. Disclaimer, I work on the UX/UI side of a company that focuses solely on sitecore.
Just the overall replication of Windows desktop for the backend management UI seemed a bit extreme. :)
Earlier quoted context omitted.
This is on .NET Core, so you can actually run this anywhere! I do a lot of Core development on a Mac, but it runs well on AWS/Linux/my toaster. Weird times, huh?
Out of curiosity, why do you use .NET? (Assuming you use Mac/AWS/etc because you like them)
Dapper for data access is also fantastic for the same reasons.
Earlier quoted context omitted.
I don't care what he's quoting and to see this as 'light-hearted' (without any further elaboration on the part of the OP) is extrapolation. FWIW the comment in the movie is also a negative one. > John Hammond: I don't think you're giving us our due credit. Our scientists have done things which nobody's ever done before... > Dr. Ian Malcolm: Yeah, yeah, but your scientists were so preoccupied with whether or not they…
One could argue PHP had its shot.
Wordpress powers a vast chunk of the web[1], whether we like that or not, and frameworks such as Symphony a good bit of the remainder.
For the love that Clojure, Rust etc get on HN their over-representation should not lead you to believe that 'PHP has had it's shot', PHP hasn't had it's shot by a long shot...
Earlier quoted context omitted.
Agreed. It's usually the opposite, especially in enterprise. People on HN get in their bubbles and forget that most large businesses use Windows.
This is on .NET Core, so you can actually run this anywhere! I do a lot of Core development on a Mac, but it runs well on AWS/Linux/my toaster. Weird times, huh?
Earlier quoted context omitted.
>I also admire the platform but most secure? Comes off a bit too strong. There aren't a lot of .NET exploits for a variety of reasons. Its pretty much the Java of the MS world so a lot of issues more liberal languages have, it doesn't, especially in regards to buffer overflows. Its attack surface is also pretty low as it only really inter-operates, by default, with a limited number of MS applications and is frequentl…
> Http.sys also seems like a more secure product than openssl How is a goddamn HTTP parser in THE KERNEL more secure than a crypto/TLS library? http.sys is a fundamentally horrendous idea, see CVE-2015-1635 https://technet.microsoft.com/library/security/MS15-034 An exploited HTTP parser shouldn't lead to RCE "in the context of the System account".
Historically, the schannel infrastructure has been secure, especially as compared to openssl.
>How is a goddamn HTTP parser in THE KERNEL more secure than a crypto/TLS library?
Because, lets face it, openssl is a shit project of legacy code no one wants to fix and https a design by committee standard no one can work well?
Earlier quoted context omitted.
>I also admire the platform but most secure? Comes off a bit too strong. There aren't a lot of .NET exploits for a variety of reasons. Its pretty much the Java of the MS world so a lot of issues more liberal languages have, it doesn't, especially in regards to buffer overflows. Its attack surface is also pretty low as it only really inter-operates, by default, with a limited number of MS applications and is frequentl…
> Http.sys also seems like a more secure product than openssl How is a goddamn HTTP parser in THE KERNEL more secure than a crypto/TLS library? http.sys is a fundamentally horrendous idea, see CVE-2015-1635 https://technet.microsoft.com/library/security/MS15-034 An exploited HTTP parser shouldn't lead to RCE "in the context of the System account".