Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PHP 5 and 7.0 end of life

hackertarget.com

Post reply on HN
Print view View original

81–90 of 122 posts

Re: PHP 5 and 7.0 end of life

#81

Post by cultus »

InvaderFizz wrote: post #76
cultus wrote: post #36

Earlier quoted context omitted.

"If it ain't broke don't fix it" is always good advice. But some ancient duct-taped WAMP situation with insecure passwords needs to just be set on fire. Jesus christ, running Windows Server 2003 alone is something he should be fired for if its connected to the internet.

> Jesus christ, running Windows Server 2003 alone is something he should be fired for if its connected to the internet. Never look under the hood at any of the companies involved in silicon development then. Server 2003 would be an upgrade for many, many tester machines. To get to the "why dont they update" question: 1. Proprietary hardware with a custom driver. 2. Barely functional proprietary software, good luck ge…

Yikes. I get that there's situations where you can't get newer compatible hardware, etc. But if it's that important, you'd think security would be important enough to go through the trouble of air-gapping it.

Re: PHP 5 and 7.0 end of life

#82

Post by fabriceleal »

snowwrestler wrote: post #75
fabriceleal wrote: post #59

Earlier quoted context omitted.

So the issue is not breaking backwards compability in the "standard library" between versions?

If that's an issue with PHP, it's certainly not unique to PHP.

> If

Is it not?

> certainly not unique to PHP

Doesn't stop it from being an issue in my book, one that prevents updating to newer versions of the interpreter without breaking production.

Re: PHP 5 and 7.0 end of life

#83

Post by ryacko »

InvaderFizz wrote: post #76
cultus wrote: post #36

Earlier quoted context omitted.

"If it ain't broke don't fix it" is always good advice. But some ancient duct-taped WAMP situation with insecure passwords needs to just be set on fire. Jesus christ, running Windows Server 2003 alone is something he should be fired for if its connected to the internet.

> Jesus christ, running Windows Server 2003 alone is something he should be fired for if its connected to the internet. Never look under the hood at any of the companies involved in silicon development then. Server 2003 would be an upgrade for many, many tester machines. To get to the "why dont they update" question: 1. Proprietary hardware with a custom driver. 2. Barely functional proprietary software, good luck ge…

At $500k wouldn’t be cheaper to reverse engineer it, or even start a clean room reverse engineering project and open source it?

Re: PHP 5 and 7.0 end of life

#85

Post by davesmith1983 »

hnarn wrote: post #12
ajsalminen wrote: post #5

Note that multiple Linux distributions will still be supporting it, in some cases for a very long time after.

RHEL 7 provides Apache 2.4 and PHP version 5.4, and RHEL/CentOS 7 is going to be around for a while.

I am running CentOS 7 and that is still using 5.4. I am only running a forum, IRC and some other things and I don't really want to bother with third party packages.

Re: PHP 5 and 7.0 end of life

#86

Post by smt88 »

lunchables wrote: post #43
ceejayoz wrote: post #39

Earlier quoted context omitted.

ColdFusion's still around. https://www.adobe.com/products/coldfusion-family.html

I miss ColdFusion. I really liked the idea of a tag based server side language. It will never have the power or expressiveness of other languages but for raw productivity of producing very simple dynamic apps with an incredibly low bar to entry for new/non-programmers, nothing else was even close.

> nothing else was even close

Well, I'd argue that PHP and Python were roughly equally easy, although they didn't "blend" into the HTML as well (which is good or bad, depending on your viewpoint). ASP was supposed to be just as easy, but I remember some of those code bases being pretty woolly.

Nowadays, I think we actually have it easier. I haven't used many of the other front-end frameworks, but you can design/generate a back-end in a few minutes using Open API Spec, add a persistence layer in a few more minutes, and wire it up to a Vue front-end very quickly. And the kicker is that it's modular and maintainable, which a lot of CF/PHP/ASP projects certainly were not.

Re: PHP 5 and 7.0 end of life

#87

Post by InvaderFizz »

ryacko wrote: post #83
InvaderFizz wrote: post #76

Earlier quoted context omitted.

> Jesus christ, running Windows Server 2003 alone is something he should be fired for if its connected to the internet. Never look under the hood at any of the companies involved in silicon development then. Server 2003 would be an upgrade for many, many tester machines. To get to the "why dont they update" question: 1. Proprietary hardware with a custom driver. 2. Barely functional proprietary software, good luck ge…

At $500k wouldn’t be cheaper to reverse engineer it, or even start a clean room reverse engineering project and open source it?

There is a cost-benefit-analysis at play, and even if one makes the security argument, that is "what if" talk, not concrete numbers that are coming out this year.

A $500k tester's depreciation is based on a 10+ year service life. The ones that make it past that point turn into security nightmares and profit centers at the same time.

These are large and complex machines, with hundreds or thousands of moving parts. A competent reverse engineer and driver developer likely could solve many of the driver interface issues and move things to newer platforms, but why invest hundreds of thousands per year in maybe updating something that still works? Who is going to pay for that? Oh, you want to raise your rates to pay for it? I guess they'll move all of their testing development to the competitor in Asia.

This isnt some big name you have heard of, but this is one of the places that all the big names go to to test their silicon during development.

Re: PHP 5 and 7.0 end of life

#88

Post by pritambaral »

ryacko wrote: post #83
InvaderFizz wrote: post #76

Earlier quoted context omitted.

> Jesus christ, running Windows Server 2003 alone is something he should be fired for if its connected to the internet. Never look under the hood at any of the companies involved in silicon development then. Server 2003 would be an upgrade for many, many tester machines. To get to the "why dont they update" question: 1. Proprietary hardware with a custom driver. 2. Barely functional proprietary software, good luck ge…

At $500k wouldn’t be cheaper to reverse engineer it, or even start a clean room reverse engineering project and open source it?

I guess the idea there is that it will always be cheaper to just not touch anything.

Re: PHP 5 and 7.0 end of life

#89

Post by InvaderFizz »

cultus wrote: post #81
InvaderFizz wrote: post #76

Earlier quoted context omitted.

> Jesus christ, running Windows Server 2003 alone is something he should be fired for if its connected to the internet. Never look under the hood at any of the companies involved in silicon development then. Server 2003 would be an upgrade for many, many tester machines. To get to the "why dont they update" question: 1. Proprietary hardware with a custom driver. 2. Barely functional proprietary software, good luck ge…

Yikes. I get that there's situations where you can't get newer compatible hardware, etc. But if it's that important, you'd think security would be important enough to go through the trouble of air-gapping it.

It is worse than that, customers run their own workload on these testers using one of two methods:

1. In person.

2. Using VNC/telnet over a SSH gateway that dumps them onto the single broadcast network with all these testers.

Did I mention that changing the IP address on many of the testers is not possible without triggering a $10k+ licensing event because a change in the IP address invalidates the license file?

Re: PHP 5 and 7.0 end of life

#90

Post by coldacid »

mtnGoat wrote: post #77
onion2k wrote: post #44

Earlier quoted context omitted.

"it's old so let's change it" That's very rarely the thought process in the real world when you're dealing with a production system though. Most developers who have the seniority and experience to make the call to upgrade something aren't just upgrading for the fun of it. It's more like... "it's old and hundreds of security patches and performance improvements have been released in versions that have come along since…

"That's very rarely the thought process in the real world when you're dealing with a production system though. Most developers who have the seniority and experience to make the call to upgrade something aren't just upgrading for the fun of it." you and i's experience varies greatly, Ive worked at a number of firms that update things based solely on age(and boredom) and nothing else... thats what happens when non-tech…

Well there's your problem. Stop working for morons. :D
Post reply on HN