Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PHP: The Right Way

phptherightway.com

Post reply on HN
Print view View original

161–170 of 233 posts

Re: PHP: The Right Way

#161

Post by aw3c2 »

mcantor wrote: post #157
dsl wrote: post #137

Earlier quoted context omitted.

You really can't tell the difference between blindly executing input from an insecure HTTP connection, and installing packages with a tool that verifies cryptographic signatures against known good keys shipped with your distro? Mr. Cantor, I have added to the list of people to never hire I keep in my notebook.

So? Who says the verified package isn't malicious? My point isn't about cryptography, it's about complexity. Unless you personally read through every line of code, how do you really know that there isn't something in there waiting to screw you over?

I trust my system's package maintainers and the signing makes sure that it is them.

I do not trust a random website that could easily be MITMd.

Re: PHP: The Right Way

#162

Post by ainsomni »

wvenable wrote: post #139
dlitz wrote: post #126

Earlier quoted context omitted.

Javascript is just Scheme with a C-like syntax and a limited number of bad design decisions (like automatic semicolon insertion and the == operator). PHP is a never-ending fountain of bad design decisions, because its core devs continue to make new ones.

What bad design decisions have been made in PHP in the last 5 years?

Using '\' as a namespace seperator? Just off the top of my head, there are probably loads more.

Re: PHP: The Right Way

#163

Post by etherealG »

lotyrin wrote: post #107
ObnoxiousJul wrote: post #79

Right way to write PHP indeed. Sometimes I wish PHP itself was written this way. Oh! The guide does not mention the case: if a class contains only one static method, please, use a function. It does not look as educated, but it's obviously a function. Not PHP specific, I admit.

Oh god yes. I ran into an extreme case of this recently. 200 something lines of class definition, class variables and internal private methods that end up chaining 5-deep, with a single public method. Refactoring to a single function took it down to under 20 lines. I wish I knew what motivated people to do things like this.

pretty sure it's the same thing every time: coming from working on really big systems that need that much depth of abstraction to something simple that can be done in 20 lines and forgetting, or not understanding how to scale down. most common with c# or java coders doing client libs for php for their application.

Re: PHP: The Right Way

#164

Post by soc88 »

huhtenberg wrote: post #145
dsl wrote: post #137

Earlier quoted context omitted.

You really can't tell the difference between blindly executing input from an insecure HTTP connection, and installing packages with a tool that verifies cryptographic signatures against known good keys shipped with your distro? Mr. Cantor, I have added to the list of people to never hire I keep in my notebook.

The risk of picking up malicious executable from the legit server is far higher than that of picking up a malicious executable from an impersonating server. Practically speaking.

So what? The package manager will not install it. So it is still thousand times better than downloading random things from the net.

Re: PHP: The Right Way

#166

Post by soc88 »

smsm42 wrote: post #127
gbog wrote: post #78

PHP with these guidelines looks like JAVA to me, but without the relatively sane foundations. It is fun how much a very old moralist sentence by Confucius applies well to PHP. He said 其本亂而末治者否矣 which can be translated, in software language development context, as "Build a nice, reliable language on shitty definition? Bullshit!". (The word-by-word translation is "your - root - messy - and/but - leaves/result - governe…

This illustrates very common problem with people trying to criticize PHP. First you demand some "foundations". But if you look on virtually all existing popular languages, none of them were designed exactly in the form they are now. Java had tons of changes and additions, Python had object model change and now has new version that changed so much that it's not even backwards compatible, etc. etc. Does it mean they la…

This old and tired “but but but ... other languages aren't perfect too” is adding nothing to the debate.

The problem is that PHP is light-years behind any sanely -not necessarily perfect - designed and implemented language.

There is a large difference between “not perfect” and “PHP-style broken” which PHP denialists prefer to ignore.

Re: PHP: The Right Way

#167

Post by walrus »

dsl wrote: post #137
mcantor wrote: post #130

Earlier quoted context omitted.

Yeah... only idiots "sudo aptitude install" without reading and building from source first!

You really can't tell the difference between blindly executing input from an insecure HTTP connection, and installing packages with a tool that verifies cryptographic signatures against known good keys shipped with your distro? Mr. Cantor, I have added to the list of people to never hire I keep in my notebook.

You can explain the difference without attacking the person you're replying to.

Re: PHP: The Right Way

#169

Post by VMG »

aw3c2 wrote: post #161
mcantor wrote: post #157

Earlier quoted context omitted.

So? Who says the verified package isn't malicious? My point isn't about cryptography, it's about complexity. Unless you personally read through every line of code, how do you really know that there isn't something in there waiting to screw you over?

I trust my system's package maintainers and the signing makes sure that it is them. I do not trust a random website that could easily be MITMd.

So you'd be fine with https?

Re: PHP: The Right Way

#170

Post by sneak »

drivebyacct2 wrote: post #99
LnxPrgr3 wrote: post #59

Earlier quoted context omitted.

C lets you define variables with block scope: int main(int argc, char *argv[]) { for(int i=0;i The last line fails to compile—'i' is no longer defined after exiting the loop. Java: public static void main(String[] args) { for(int i=0;i That also won't compile. Coming from a language that supports variables with block scope, PHP's behavior is very surprising indeed. If the first mention of $object is in the loop, I ca…

I'm just upset that you don't have braces around the inner body of your `for` statements. I want to edit the DOM just to fix it.

His indent level is set enough that it's likely not an issue.

(Yes, the "what if you add another statement line later?!" trope has been registered.)

Post reply on HN