Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PHP 8.1.0

php.net

Post reply on HN
Print view View original

261–270 of 286 posts

Re: PHP 8.1.0

#261

Post by ipaddr »

nicce wrote: post #245
ipaddr wrote: post #159

Earlier quoted context omitted.

What features are used unintentionally leading to serious bugs?

Take a look for https://book.hacktricks.xyz/pentesting/pentesting-web/php-tr... for example. (Note also, that is the only programming language specific list, which is one mile long.)

These are older issues. When you see comments like: This bypass was tried apparently on PHP 5.2.5 and I couldn't make it work on PHP 7.3.15) I'm not sure these apply anymore. The loose == vs strict === exists in many languages. You can make the same mistake in Javascript.

Re: PHP 8.1.0

#262

Post by oblio »

ipaddr wrote: post #108
Gigachad wrote: post #60

Earlier quoted context omitted.

One comment I heard at a programming meetup recently was "I hate how frameworks like laravel have brought PHP back in to popularity when we had the chance to finally kill it off". I do wonder if there really was value in salvaging PHP when we have a wealth of other languages and frameworks that do a perfectly fine job without any of the legacy mistakes sitting around.

There isn't a language that can replace php in 2021. Javascript doesn't have the size of build-in library. Golang is compiled and limited, blank spaces/tabs will kill a Python program. Ruby /rails is slower. All are harder to host. What could you replace php with? The tales of legacy mistakes holding back php are things with no basis in reality. What legacy mistake holds php back? Method names/parameter ordering? Whe…

> blank spaces/tabs will kill a Python program

That's a lousy dig at Python. Stuff you solve with a free text editor and 15 seconds worth of configuration aren't real problems.

Re: PHP 8.1.0

#263

Post by oblio »

jonwinstanley wrote: post #109
Gigachad wrote: post #60

Earlier quoted context omitted.

One comment I heard at a programming meetup recently was "I hate how frameworks like laravel have brought PHP back in to popularity when we had the chance to finally kill it off". I do wonder if there really was value in salvaging PHP when we have a wealth of other languages and frameworks that do a perfectly fine job without any of the legacy mistakes sitting around.

Doubt there was a chance to “kill it off”, doesn’t it run over 50% of all websites?

PHP runs the long tail of the internet. And somewhat accidentally, it also runs Facebook :-D

Re: PHP 8.1.0

#264

Post by rbanffy »

throwaway894345 wrote: post #258
rbanffy wrote: post #218

Earlier quoted context omitted.

Sometimes in that scenario my approach is to ssh into the app container and make the changes in there, moving the fix to version control when it is in a shipable state.

Yeah, that’s not a bad idea. I considered that but it seemed like a lot of work to set up the container to run an SSH daemon and work out the forwarding, but maybe I’m overestimating the work involved?

Usually a docker exec will do the trick. I do a lot of that when exploring an application that's new to me - where it keeps logs that don't trickle up to monitoring and stuff like that.

If you find Emacs in a container, it's probably me ;-)

Re: PHP 8.1.0

#265

Post by ipaddr »

nirui wrote: post #175
ipaddr wrote: post #108

Earlier quoted context omitted.

There isn't a language that can replace php in 2021. Javascript doesn't have the size of build-in library. Golang is compiled and limited, blank spaces/tabs will kill a Python program. Ruby /rails is slower. All are harder to host. What could you replace php with? The tales of legacy mistakes holding back php are things with no basis in reality. What legacy mistake holds php back? Method names/parameter ordering? Whe…

> Javascript doesn't have the size of build-in library. Golang is compiled and limited, blank spaces/tabs will kill a Python program. Ruby /rails is slower. I have once heard an ancient prophecy (I think it's Greek) that says "Debating around PHP online summons the ghost of the dark behind your back" or something like that (I don't speak Greek, sorry). In the Client/Server world now days, the most of the time you onl…

Server-side rendering is what php and these other backend frameworks do when responding to a request. If the output is html a browser will read and display that. Whether it comes from node or php that hello world h1 tag looks the same to your browser.

The problem with swapping out php on the backend for node is now you have to maintain a node server, manage long running processes. If you make a change to a node file you have to restart the server. Where php is running under apache or nginx and files can be dropped in without taking down the site.

That's why everyone is going serverless.. who wants to manage a node server.

Re: PHP 8.1.0

#266

Post by Supermancho »

emodendroket wrote: post #259
Supermancho wrote: post #254

Earlier quoted context omitted.

> The OO stuff is basically like an old version of Java and a bit tedious to write. An IDE is definitely required The OO 'stuff' in PHP is far better. Notably, Traits, Statics and Testing. Java (and JUnit) do not work well with static methods/classes, when it's unironically the most effective way to limit state. In PHP you can create a static class, that has static utility methods. Now you can ensure you have no side…

I'm not sure what about Java is stopping you from making static classes.

> I'm not sure what about Java is stopping you from making static classes.

I didn't imply that you couldn't make a static class in Java. There are lots of ways to make something like a top level static class (nested static, Spring singletons, et al), which works against the explicitly stated purpose of limiting state involvement.

Re: PHP 8.1.0

#268

Post by throwaway894345 »

rbanffy wrote: post #264
throwaway894345 wrote: post #258

Earlier quoted context omitted.

Yeah, that’s not a bad idea. I considered that but it seemed like a lot of work to set up the container to run an SSH daemon and work out the forwarding, but maybe I’m overestimating the work involved?

Usually a docker exec will do the trick. I do a lot of that when exploring an application that's new to me - where it keeps logs that don't trickle up to monitoring and stuff like that. If you find Emacs in a container, it's probably me ;-)

I don’t think that would work because you would need to drop in the new binary and restart the program and as soon as you kill the program it will kill the container and bounce the pod. Moreover, my app is just a static binary with some certs on a scratch image, so I can’t even `kubectl cp` the binary because that depends on a tar binary on your container.

I think I would need to run some sshd program on the binary and use a reverse SSH tunnel from my laptop, but that requires me to expose an SSH port on the pod which isn’t a big concern, but it’s just a grind to get it all working end to end.

Re: PHP 8.1.0

#269

Post by emodendroket »

Supermancho wrote: post #266
emodendroket wrote: post #259

Earlier quoted context omitted.

I'm not sure what about Java is stopping you from making static classes.

> I'm not sure what about Java is stopping you from making static classes. I didn't imply that you couldn't make a static class in Java. There are lots of ways to make something like a top level static class (nested static, Spring singletons, et al), which works against the explicitly stated purpose of limiting state involvement.

Those limitations are a little annoying but I'm not sure how they're preventing you from doing what you want to do, and having top-level statics wouldn't limit someone from just sneaking global state in there either.
Post reply on HN