Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PHP 5 and 7.0 end of life

hackertarget.com

Post reply on HN
Print view View original

91–100 of 122 posts

Re: PHP 5 and 7.0 end of life

#91

Post by kijin »

tomxor wrote: post #73
kijin wrote: post #21

Earlier quoted context omitted.

Exactly. These EOL dates aren't really helpful in a world where most people just use a handful of distros. WordPress keeps sending the same unhelpful message and I hate it. Just the other day, a somewhat technical client of mine called me to ask if his PHP 7.0 installation has gaping security holes. I said no, you're using Ubuntu 16.04 LTS, you'll be fine until April 2021. If you force an upgrade now, you might run o…

> My go-to version for production right now is PHP 7.2. I'm going to ignore all warnings about its EOL until 2028, when support for Ubuntu 18.04 runs out. I'm not sure you can just hide behind the LTS assurance of the OS, they can't guarantee every single package in their repos will remain safe. Plenty of packages in Ubuntu LTS releases reach EoL far far before OS EoL.

True, but PHP tends to be looked after fairly well given its importance to the web ecosystem.

Ubuntu for example has a pretty good track record of backporting PHP security fixes. PHP 7.0 in Ubuntu 16.04 has been getting updates every few weeks despite the EOL last winter, and I remember observing the same with PHP 5.5 in 14.04 until the OS itself reached EOL earlier this year.

The fact that both Red Hat and Canonical are committed to supporting PHP 7.2 for the next decade probably means that there will be more eyes on that particular version, and more hands to patch it, for the foreseeable future. It's a nice coincidence for people who want a bit of stability now that PHP has begun to change rather quickly.

Re: PHP 5 and 7.0 end of life

#92

Post by Spivak »

tomxor wrote: post #73
kijin wrote: post #21

Earlier quoted context omitted.

Exactly. These EOL dates aren't really helpful in a world where most people just use a handful of distros. WordPress keeps sending the same unhelpful message and I hate it. Just the other day, a somewhat technical client of mine called me to ask if his PHP 7.0 installation has gaping security holes. I said no, you're using Ubuntu 16.04 LTS, you'll be fine until April 2021. If you force an upgrade now, you might run o…

> My go-to version for production right now is PHP 7.2. I'm going to ignore all warnings about its EOL until 2028, when support for Ubuntu 18.04 runs out. I'm not sure you can just hide behind the LTS assurance of the OS, they can't guarantee every single package in their repos will remain safe. Plenty of packages in Ubuntu LTS releases reach EoL far far before OS EoL.

I mean 'guarantee' is a pretty strong word in the world of security. Better phrasing might be "is committed to backporting security fixes for the lifetime of the OS."

Re: PHP 5 and 7.0 end of life

#93

Post by clairity »

smt88 wrote: post #86
lunchables wrote: post #43

Earlier quoted context omitted.

I miss ColdFusion. I really liked the idea of a tag based server side language. It will never have the power or expressiveness of other languages but for raw productivity of producing very simple dynamic apps with an incredibly low bar to entry for new/non-programmers, nothing else was even close.

> nothing else was even close Well, I'd argue that PHP and Python were roughly equally easy, although they didn't "blend" into the HTML as well (which is good or bad, depending on your viewpoint). ASP was supposed to be just as easy, but I remember some of those code bases being pretty woolly. Nowadays, I think we actually have it easier. I haven't used many of the other front-end frameworks, but you can design/gener…

> "Nowadays, I think we actually have it easier...."

no, it's not even close. you'd have to learn a whole javscript framework, read the open api spec, grok backend vs frontend, and really understand the modern web before you could even get started, not to mention the fomo induced by the hundreds of other options you'd have to discard in the process. for the average human, that's a non-starter.

with tag-based coldfusion, it felt like you were learning an extension to html, rather than an entirely different (programming) language. while php/asp were somewhat easy to learn, coldfusion was extra-super-duper-easy (i taught classes back in the day). people with no prior experience could create a dynamic web page in an hour or two and feel that sense of accomplishment that drove them deeper into it.

Re: PHP 5 and 7.0 end of life

#94

Post by johnchristopher »

userbinator wrote: post #34
johnchristopher wrote: post #6

Yeah, yeah. Go tell that to my 10x php self-taught guy who's still running php 5.4 on a windows server 2003 in a wamp installation. He upgraded the bundled mysql with mariadb last year by dropping the executable in the folder (edit: just checked out, and the drop-in has been reverted back to mysql 5.0 because the upgrade path is impossible because apache 2.2). And of course this in-house guru for anything that happen…

Besides the "doesn't bother updating the passwords" point, this sort of "it's old so let's change it" attitude is unfortunately so pervasive in the software industry and I find it massively irritating because it's the same reason why a lot of software has gotten increasingly unstable over time. Instead of making only fixes and bringing a platform towards maturity they do the exact opposite, adding plenty of new bugs…

I agree with you, don't fix what ain't broken, etc.

I won't get into details but the thing isn't stable and the last hack brought down some part of an emergency infrastructure for a whole region of a small country.

So, yeah... not stable, not safe.

Re: PHP 5 and 7.0 end of life

#95

Post by parliament32 »

onion2k wrote: post #44
userbinator wrote: post #34

Earlier quoted context omitted.

Besides the "doesn't bother updating the passwords" point, this sort of "it's old so let's change it" attitude is unfortunately so pervasive in the software industry and I find it massively irritating because it's the same reason why a lot of software has gotten increasingly unstable over time. Instead of making only fixes and bringing a platform towards maturity they do the exact opposite, adding plenty of new bugs…

"it's old so let's change it" That's very rarely the thought process in the real world when you're dealing with a production system though. Most developers who have the seniority and experience to make the call to upgrade something aren't just upgrading for the fun of it. It's more like... "it's old and hundreds of security patches and performance improvements have been released in versions that have come along since…

But that sounds exactly what GP is doing, "I am in the process of dockerizing almost everything in sight."

Why do you need Docker to run a WAMP server?

Re: PHP 5 and 7.0 end of life

#96

Post by johnchristopher »

k__ wrote: post #67
johnchristopher wrote: post #6

Yeah, yeah. Go tell that to my 10x php self-taught guy who's still running php 5.4 on a windows server 2003 in a wamp installation. He upgraded the bundled mysql with mariadb last year by dropping the executable in the folder (edit: just checked out, and the drop-in has been reverted back to mysql 5.0 because the upgrade path is impossible because apache 2.2). And of course this in-house guru for anything that happen…

lol, you had me until "dockerizing".

What do you mean ?

Re: PHP 5 and 7.0 end of life

#98

Post by soulclap »

perfunctory wrote: post #29

For a second, after reading the title, I thought PHP as a whole was end of life. That'd be fun. Which also made me think - does anybody know an example of a widely used programming language that voluntarily discontinued?

How is this fun?

Thanks for changing the title, whoever did it. This definitely sounded like PHP as a whole is dead. There's more than enough FUD surrounding PHP out there really.

Re: PHP 5 and 7.0 end of life

#99

Post by wishinghand »

userbinator wrote: post #34
johnchristopher wrote: post #6

Yeah, yeah. Go tell that to my 10x php self-taught guy who's still running php 5.4 on a windows server 2003 in a wamp installation. He upgraded the bundled mysql with mariadb last year by dropping the executable in the folder (edit: just checked out, and the drop-in has been reverted back to mysql 5.0 because the upgrade path is impossible because apache 2.2). And of course this in-house guru for anything that happen…

Besides the "doesn't bother updating the passwords" point, this sort of "it's old so let's change it" attitude is unfortunately so pervasive in the software industry and I find it massively irritating because it's the same reason why a lot of software has gotten increasingly unstable over time. Instead of making only fixes and bringing a platform towards maturity they do the exact opposite, adding plenty of new bugs…

Just going to gloss over using PHP 5.4?

Re: PHP 5 and 7.0 end of life

#100

Post by Someone »

perfunctory wrote: post #29

For a second, after reading the title, I thought PHP as a whole was end of life. That'd be fun. Which also made me think - does anybody know an example of a widely used programming language that voluntarily discontinued?

Sort of: Python 2.7, in 2020 (https://www.python.org/dev/peps/pep-0373/)

There likely are many, many proprietary languages that were officially discontinued at some time.

Post reply on HN