Live data from Hacker News

PHP Core Security Audit Results

thephp.foundation

51–60 of 72 posts

Re: PHP Core Security Audit Results

#51
post #26

I am genuinely interested why anyone would start a new project in PHP currently. What are the reasons?

It just works out of the box, and request-response model still fits the web better than any other solution out there. And it's still performant enough https://x.com/arvidkahl/status/1775261978006896730

Especially if you use FrankenPHP!

Re: PHP Core Security Audit Results

#52
post #44
post #6

Earlier quoted context omitted.

>>> Last year, it received close to 680K USD, and managed this security audit, sponsored 10 developers, and paid for various expenses. For a language that runs close to 75% of the web, it certainly deserves more funding. Wow, Automattic itself donated more than half of it: Silver Sponsor $387,500 USD Why many donors with more than USD 24K and USD 100K still listed as Silver sponsor? Source: https://opencollective.com…

It feels pretty off that Laravel and Symfony, arguably the two largest benefactories to PHP being in such a good position have donated so little. Those contribution values are lifetime, Laravel hasn't funded it for over 3 years now, meanwhile its a multimillion dollar business with a huge amount of financial backing. I know its all donations and not expected, but them kicking in ~$30k a month would realistically be n…

How's Symfony making money? Aren't they just OSS?

On the other hand Laravel has VC backing and sells services.

Re: PHP Core Security Audit Results

#53
post #50

Earlier quoted context omitted.

TL;DR Your dad's PHP is no longer the current PHP. The language itself has been thoroughly modernized, made more consistent, bug free and performant. There is nothing better than a piece of software that keeps getting improved decade after decade borne out of real developer needs and experience. - Type annotations are integrated and work well with PHP now. This results in a kind of scripty Java OOP that is more succi…

> Your dad's PHP is no longer the current PHP. I am pretty much in the "your dad" category here. Where best to start learning how PHP has changed since I used it? There are things that appeal to be about PHP.

Build something with symfony or laravel. In this space PHP is used in the modern way. Don't look at WordPress, Pimcore, WooCommerce et al. They're pretty much stuck with old PHP.

That said, you can still shoot yourself in the foot with PHP. The dark alleys are all still there.

Re: PHP Core Security Audit Results

#54

I am genuinely interested why anyone would start a new project in PHP currently. What are the reasons?

As mentioned by others, PHP today is not the PHP that is still in most peoples heads. For me one of the big advantages is ease of deployment. No docker, no images, no overhead, scp it to any toaster running apache and you are done!

But how do you install dependencies? Is the "it" you're scping a folder structure that includes them?

Re: PHP Core Security Audit Results

#55

I am genuinely interested why anyone would start a new project in PHP currently. What are the reasons?

Because I‘m good in it. And my clients don‘t depend on me - they can choose to continue working with me not because I‘m the only one who knows how the language works, but because they WANT to.

Re: PHP Core Security Audit Results

#57
post #50

Earlier quoted context omitted.

> Your dad's PHP is no longer the current PHP. I am pretty much in the "your dad" category here. Where best to start learning how PHP has changed since I used it? There are things that appeal to be about PHP.

Build something with symfony or laravel. In this space PHP is used in the modern way. Don't look at WordPress, Pimcore, WooCommerce et al. They're pretty much stuck with old PHP. That said, you can still shoot yourself in the foot with PHP. The dark alleys are all still there.

Thanks. I never want to look at WP again so that suits me :)

I looked at Symfony a few years back and it looked nice. if it has kept up with modern PHP it looks like a nice choice.

Re: PHP Core Security Audit Results

#58
post #49
post #17

Earlier quoted context omitted.

Because it's good enough for almost everything. The vast majority of projects will never have to scale to billions of users, so hyperscalability is not a huge concern. It has a low barrier to entry and great language features - static typing being one of the big ones. It has become a really nice language over the years, great to work in and in no way less satisfying or effective than for example golang. And, of cours…

> The vast majority of projects will never have to scale to billions of users, so hyperscalability is not a huge concern. I would have thought PHP would scale very well. It may not be high performance, but its start each request-response cycle from scratch should scale horizontally very well, surely?

Correct, the real bottleneck is almost always the database.

Re: PHP Core Security Audit Results

#59
post #49
post #17

Earlier quoted context omitted.

Because it's good enough for almost everything. The vast majority of projects will never have to scale to billions of users, so hyperscalability is not a huge concern. It has a low barrier to entry and great language features - static typing being one of the big ones. It has become a really nice language over the years, great to work in and in no way less satisfying or effective than for example golang. And, of cours…

> The vast majority of projects will never have to scale to billions of users, so hyperscalability is not a huge concern. I would have thought PHP would scale very well. It may not be high performance, but its start each request-response cycle from scratch should scale horizontally very well, surely?

It does. But scaling to billions of users (or billions of requests per day) is still not easy and you really need high performance for that. Laravel scales to a certain point, where their design decisions (eloquent, the queuing system etc.) are still working.

That said, with today's PHP it is possible to optimize the hot path pretty well with stuff like FFI.

Re: PHP Core Security Audit Results

#60
post #57

Earlier quoted context omitted.

Build something with symfony or laravel. In this space PHP is used in the modern way. Don't look at WordPress, Pimcore, WooCommerce et al. They're pretty much stuck with old PHP. That said, you can still shoot yourself in the foot with PHP. The dark alleys are all still there.

Thanks. I never want to look at WP again so that suits me :) I looked at Symfony a few years back and it looked nice. if it has kept up with modern PHP it looks like a nice choice.

I would say that symfony is the base of modern PHP. Laravel and others can only be as beautiful as symfony is.
Post reply on HN